{"text_format":"3","workbook":"xlsx","n_sheets":14,"sheets":["Guidance","Overview","Scoping","Assessment","Evaluation","AttestationReport","AssessmentReport","DetailedReport","Reporting","ActionPlans","©","RepoData","tech","source"],"not_rendered":{"charts":11,"images":6,"comments":1},"read":"whole","date_system":"1900"}

{"sheet":"Guidance","index":0,"n_rows":212,"n_cols":12,"rows_kept":212,"merged":[[1,1,1,11],[3,1,3,11],[5,1,5,11],[7,2,7,11],[11,4,11,5],[11,6,11,11],[12,4,12,5],[12,6,12,11],[13,4,13,5],[13,6,13,11],[14,4,14,5],[14,6,14,11],[15,4,15,5],[15,6,15,11],[19,4,19,5],[19,6,19,11],[20,4,20,5],[20,6,20,11],[21,4,21,5],[21,6,21,11],[35,1,35,11],[37,1,37,11],[38,1,38,11],[39,1,39,11],[40,3,40,11],[42,3,42,11],[44,3,44,4],[44,5,44,6],[44,7,44,11],[45,3,45,4],[45,5,45,6],[45,7,45,11],[46,3,46,4],[46,5,46,6],[46,7,46,11],[47,3,47,4],[47,5,47,6],[47,7,47,11],[49,2,49,11],[51,4,51,11],[53,4,53,11],[66,2,66,11],[67,2,67,11],[68,4,68,11],[70,4,70,11],[71,4,71,11],[73,1,73,11],[75,1,75,11],[77,2,77,11],[79,2,79,11],[81,3,81,11],[83,3,83,11],[84,3,84,11],[85,3,85,11],[86,3,86,11],[88,3,88,11],[90,3,90,11],[91,3,91,11],[93,2,93,11],[95,2,95,11],[97,3,97,11],[99,3,99,11],[101,3,101,11],[103,3,103,11],[105,3,105,11],[107,3,107,11],[108,1,108,11],[110,1,110,11],[111,1,111,11],[113,2,113,11],[115,4,115,11],[116,4,116,11],[117,2,117,11],[118,4,118,11],[119,2,119,11],[120,2,120,11],[121,4,121,11],[122,4,122,11],[124,4,124,11],[125,4,125,11],[127,4,127,11],[128,4,128,11],[132,4,132,11],[134,1,134,11],[136,1,136,11],[137,1,137,11],[139,2,139,11],[141,4,141,11],[142,4,142,11],[143,4,143,11],[145,4,145,11],[161,1,161,11],[163,1,163,11],[164,1,164,11],[165,2,165,11],[167,4,167,11],[169,4,169,11],[171,4,171,11],[172,4,172,11],[174,4,174,11],[176,4,176,11],[177,4,177,11],[179,4,179,11],[181,4,181,11],[182,4,182,11],[184,1,184,11],[188,2,188,11],[190,4,190,11],[191,4,191,11],[203,4,203,11],[204,4,204,11],[205,4,205,5],[205,6,205,11],[206,4,206,5],[206,6,206,11],[207,4,207,5],[207,6,207,11],[208,4,208,5],[208,6,208,11],[209,4,209,5],[209,6,209,11],[210,4,210,5],[210,6,210,11],[211,4,211,5],[211,6,211,11]]}
[]
[null,"PKI Maturity tool guidance"]
[]
[null,"Use-case overview"]
[]
[null,"Initial phase of assessment process is focused on the use-case to be assessed. Fill the Overview sheet with required information which will be used for definition of the assessed case and for reporting."]
[]
[null,null,"Introduce your use-case on “PKI Maturity Tool” sheet"]
[]
[null,null,"1.",null,"Fill in information about the use-case to be evaluated."]
[]
[{"$nulls":4},"Use-case name",null,"Type in the use-case name, which will identify this specific use-case among the others."]
[{"$nulls":4},"Company",null,"Type in the name of company owning the use-case."]
[{"$nulls":4},"Starting date",null,"Type in the date when the assessment starts."]
[{"$nulls":4},"Target date",null,"Type in the date of required or estimated ending of the assessment."]
[{"$nulls":4},"Finish date",null,"Type in the date of required or estimated ending of the assessment."]
[]
[null,null,"2.",null,"Fill in information about the Assessor"]
[]
[{"$nulls":4},"Assessor’s position",null,"Choose if the use-case is assessed by Internal or External assessor."]
[{"$nulls":4},"Company",null,"Type in the name of company of the assessor.\nIn case of internal assessor the company will be the same as company owning the use-case."]
[{"$nulls":4},"Assessor’s name",null,"Type in the assessor's name."]
[]
[null,null,"3.",null,"Provide detail information about the use-case"]
[]
[{"$nulls":4},"Use-case description"]
[{"$nulls":4},"List of all components that are involved in the use-case"]
[{"$nulls":4},"Specification of out-of-scope considerations"]
[]
[null,null,"4. ",null,"Provide detail information about the PKI environment"]
[]
[{"$nulls":4},"Description of high-level design of the PKI environment"]
[{"$nulls":4},"Specification points of interaction between parties involved in the use-cases"]
[]
[]
[null,"Scoping"]
[]
[null,"The Scoping sheet provides user with complete list of requirements for PKI Maturity Level evaluation. Individual requirements are grouped into categories, which are further grouped into modules. "]
[null,"For each category, there is a brief description and list of inputs that are evaluated in the category and any evidence that need to be documented as proof of the fulfillment of the requirements."]
[null,"The only active controls on this sheet are the cells in the Scope columns. There are two of them - one relates to a category, the other relates to a requirement.\nBy changing the value in the cell is being set applicability of appropriate category or requirement. There are two values to choose:"]
[{"$nulls":3},"IN --> Requirement or category is included in the scope and affects the result of evaluation\nOUT OF --> Requirement or category is excluded from the scope and does not affect the result of evaluation"]
[]
[{"$nulls":3},"Possible scenarios"]
[]
[{"$nulls":3},"Category",null,"Requirements",null,"Impact description"]
[{"$nulls":3},"IN",null,"all IN",null,"Category is Applicable and each it's requirement will affect result of PKI Maturity evaluation."]
[{"$nulls":3},"IN",null,"at least one\nOUT OF",null,"Category is Partially Applicable and only it's applicable requirements will affect result of PKI Maturity evaluation."]
[{"$nulls":3},"OUT OF",null,"does not matter",null,"Category is non-applicable and any of it's requirements will not affect result of PKI Maturity evaluation, regardless the values filled in the requirements scope cells."]
[]
[null,null,"Define scoping of assessment"]
[]
[null,null,"5.",null,"Decide which categories are in the scope – column F (Scope)"]
[]
[null,null,"6.",null,"For categories in scope, decide which requirements are in the scope – column K (Scope)"]
[]
[{"$nulls":5},"F",{"$nulls":5},"K"]
{"$rows_empty":12}
[null,null,"7.",null,"For requirements and/or categories out of scope describe the reason of the decision – column L (Reason)"]
[]
[{"$nulls":4},"If the category or even just one of its requirements is marked as Out of scope, please fill in the Reason column with the justification for removing the requirement/s from the scope."]
[{"$nulls":4},"This justification can further serve as a basis for compiling the resulting report."]
[]
[null,"Assessment"]
[]
[null,"The following chapter describes the methodology how is the maturity assessment done based on the PKI Maturity Model."]
[]
[null,null,"Assessment methods"]
[]
[null,null,"The assessment methods consist of:\n- Self-assessment questionnaires\n- Face-to-face interviews and workshops"]
[]
[{"$nulls":3},"Self-assessment questionnaire (SAQ)"]
[]
[{"$nulls":3},"Questionnaires are initially the tool to perform and collect all relevant data about the capabilities and performance of the PKI."]
[{"$nulls":3},"The SAQ contains a set of questions with deterministic answers (list of possible answers), which are answered by the entity operating the PKI."]
[{"$nulls":3},"SAQ is defined for each of the assessed categories and carefully tailored to provide valuable information leading to measure maturity level of the category. Each question gives an output in the form of the partial assessed level and all ratings are finally combined to provide category maturity level or rating."]
[{"$nulls":3},"The category maturity level is calculated as average of all partial levels produced by the SAQ in the category."]
[]
[{"$nulls":3},"F2F interview/workshop"]
[]
[{"$nulls":3},"The interview or workshop has the same basis as for the SAQ and the main purpose of this phase is to help entity understand the maturity assessment question and to provide correct answer. This will be mainly provided to entities which are not fully PKI-aware or does not have enough resources and skilled personnel, but would like to understand the process."]
[{"$nulls":3},"During the interview/workshop the main focus is on moderating the discussion with relevant parties working for entity and filling the SAQs accordingly to achieve the consistent maturity assessment across all categories."]
[]
[null,null,"Assessment types"]
[]
[null,null,"(TBD) The following assessment types will be provided:\n- Self-assessment\n- Third-party assessment\n- Certified assessment"]
[]
[{"$nulls":3},"Self-assessment"]
[]
[{"$nulls":3},"Collecting all information to provide answers for SAQs by internal members or personnel of the entity."]
[]
[{"$nulls":3},"Third-party assessment"]
[]
[{"$nulls":3},"Using independent 3rd party to collect information and provide answers for SAQs, this will be used mainly by entities which do not have enough skilled resources to perform the self-assessment or would like to have independent view on the maturity of the PKI. (if such scenario can happen…)"]
[]
[{"$nulls":3},"Certified assessment"]
[]
[{"$nulls":3},"Provided by us as PKI maturity assessment practitioners. Purpose of the certified assessment is to give consistent, reliable output of the PKI maturity rating across all entities. Certificate can be issued to prove the maturity level to other entities or create a badge on the website providing assurance for the customers and relying parties."]
[null,"Assessment"]
[]
[null,"The \"Assessment\" sheet contains all requirements with detail guidance what and how to evaluate them. Requirements are grouped to the categories and categories are further grouped to the modules."]
[null,"Requirements marked on \"Scoping\" sheet as non-applicable are inactive and grey."]
[]
[null,null,"Perform assessment"]
[]
[null,null,"8.",null,"Evaluate each applicable requirement – column I (Maturity level)"]
[{"$nulls":4},"To achieve a comprehensive assessment of PKI Maturity, it is necessary to evaluate all applicable requirements. Evaluating a request means assigning one of the following values to the request:"]
[null,null,"Initial --> Basic --> Advanced --> Managed --> Optimized"]
[{"$nulls":4},"If the requirement is applicable and has not been assigned any of the values, it is marked as not evaluated in the evaluation and the evaluation is thus incomplete."]
[]
[]
[null,null,"9.",null,"Make notes if needed – column J (Notes)"]
[{"$nulls":4},"Any comments related to the request, ideas for improvement, persons or departments that could contribute to the evaluation of the request, etc."]
[]
[null,null,"10.",null,"Add references on relevant evidence – column L (Evidence)"]
[{"$nulls":4},"A description or, ideally, a link to a repository or knowledge base containing evidence demonstrating the level of fulfillment of the requirement."]
[]
[null,null,"11.",null,"Watch the continuously achieved level"]
[{"$nulls":4},"The continuously achieved level of PKI Maturity can be monitored directly on the Assessment sheet in the progress bar in the upper right part of the sheet."]
[]
[]
[]
[{"$nulls":4},"The achieved level is highlighted in blue. The percentage figure given for the next higher level indicates the score so far leading to the achievement of that level."]
[]
[null,"Evaluation"]
[]
[null,"The \"Evaluation\" sheet provides results of the assessment and information about reached maturity level of the whole use-case, individual modules and all categories."]
[null,"Last item on the sheet gives you possibility to display list of requirements filtered by maturity level or list of non-applicable requirements."]
[]
[null,null,"Review the results of assessment"]
[]
[null,null,"12.",null,"Check the achieved maturity level and statistics"]
[{"$nulls":4},"The achieved level of use-case is supplemented with a brief description of the level."]
[{"$nulls":4},"For all levels of detail - use-case, modules, categories - are the statistics available, showing number of requirements in each maturity level, total number of applicable requirements and also non-applicable requirements."]
[]
[null,null,"13.",null,"View a list of requirements by maturity level or non-applicable requirements"]
{"$rows_empty":15}
[null,"Report"]
[]
[null,"PKI Maturity assessment report plays a crucial role to achieve the consistency of the results and comparable outputs."]
[null,"Also, the possibility of reporting the maturity levels and progress is very important for continuous improvements and tracking of the PKI maturity in time."]
[null,null,"Choose your report"]
[]
[null,null,"14.",null,"Select required detail of the report"]
[]
[{"$nulls":4},"Assessment report"]
[]
[{"$nulls":4},"The purpose of this report is to provide enough information in a presentable format for management, in order to support the PKI strategy and improvement."]
[{"$nulls":4},"The assessment report should contain the following information:\n- Overall maturity level with the description of the achieved level\n- Simple overall rating with description\n- Chart with the maturity levels in each of the category\n- Recommendation to move to next maturity level (if applicable) (to improve) (table with the current snapshot and where it should be moved)\n- Chart as comparison with similar companies"]
[]
[{"$nulls":4},"Attestation"]
[]
[{"$nulls":4},"This is a short report that can be presented to customers and relying parties to prove the compliance and maturity level of the PKI implementation."]
[{"$nulls":4},"The attestation should contain:\n- Overall maturity level achieved\n- Date of the assessment\n- Identification of the assessor (internal / external)"]
[]
[{"$nulls":4},"Detailed report"]
[]
[{"$nulls":4},"The purpose of the detailed report is to have all the information regarding the assessment and maturity model in one place. The end users of the detailed report are internal people managing the PKI."]
[{"$nulls":4},"The detailed assessment report should contain the following:\n- Overall rating of the assessment with description of achieved maturity level\n- Detailed report about each of the category and its maturity level together with explanation why the level has such rating\n- Chart with all categories\n- Chart with industry ratings (similar organizations)\n- Recommendation for progress with explanation how to achieve the next level (if applicable)\n- Model explanation"]
[]
[null,"Action plans"]
[]
[]
[]
[null,null,"Define your action plans"]
[]
[null,null,"15.",null,"Identify categories to be improved and desired maturity level"]
[{"$nulls":4},"Select required maturity level for each category you want to define action plan for."]
{"$rows_empty":11}
[null,null,"16.",null,"Fill in the Action plan form(s)"]
[{"$nulls":4},"The action plan forms are now visible for each category with selected desired maturity level. Fill in the following items of the form:"]
[{"$nulls":4},"Objectives",null,"describing the purpose of the action plan and what we want to achieve"]
[{"$nulls":4},"Responsibility",null,"who is responsible for the action plan to be executed and implemented"]
[{"$nulls":4},"Schedule",null,"when the implementation of the action plan needs to be completed"]
[{"$nulls":4},"Resources",null,"what resources are required to implement the action plan, including dependencies"]
[{"$nulls":4},"Outputs",null,"what are the expected outputs of the action plan"]
[{"$nulls":4},"Tasks",null,"breakdown of individual tasks that are required to be done to implement the action plan"]
[{"$nulls":4},"Comments",null,"any additional comments that are relevant to the action plan"]

{"sheet":"Overview","index":1,"n_rows":104,"n_cols":12,"rows_kept":104,"merged":[[1,1,1,14],[3,1,3,7],[3,9,3,14],[4,1,4,2],[4,3,4,7],[4,9,4,10],[4,11,4,14],[5,1,5,2],[5,3,5,7],[5,9,5,10],[5,11,5,14],[6,1,6,2],[6,3,6,7],[6,9,6,10],[6,11,6,14],[7,1,7,2],[7,3,7,7],[7,9,7,10],[7,11,7,14],[8,1,8,2],[8,3,8,4],[8,5,8,7],[8,9,8,10],[8,11,8,14],[11,1,11,7],[13,1,13,8],[15,1,15,14],[17,1,17,8],[19,1,19,14],[21,1,21,8],[23,1,23,14],[25,1,25,8],[28,1,28,8],[30,1,30,14],[32,1,32,8],[34,1,34,14],[38,1,38,7],[40,1,40,14],[42,1,42,7],[44,1,44,14],[45,1,45,14],[47,1,47,7],[49,1,49,14],[50,1,50,14],[52,2,52,3],[52,4,52,13],[53,2,53,3],[53,4,53,13],[54,2,54,3],[54,4,54,13],[55,2,55,3],[55,4,55,13],[56,2,56,3],[56,4,56,13],[57,2,57,3],[57,4,57,13],[59,1,59,7],[61,1,61,14],[63,2,63,3],[63,4,63,13],[64,2,64,3],[64,4,64,13],[65,2,65,3],[65,4,65,13],[66,2,66,3],[66,4,66,13],[67,2,67,3],[67,4,67,13],[69,1,69,7],[71,1,71,14],[73,3,73,5],[73,6,73,10],[73,11,73,12],[74,3,77,5],[74,6,74,10],[74,11,74,12],[75,6,75,10],[75,11,75,12],[76,6,76,10],[76,11,76,12],[77,6,77,10],[77,11,77,12],[78,3,81,5],[78,6,78,10],[78,11,78,12],[79,6,79,10],[79,11,79,12],[80,6,80,10],[80,11,80,12],[81,6,81,10],[81,11,81,12],[82,3,85,5],[82,6,82,10],[82,11,82,12],[83,6,83,10],[83,11,83,12],[84,6,84,10],[84,11,84,12],[85,6,85,10],[85,11,85,12],[86,3,88,5],[86,6,86,10],[86,11,86,12],[87,6,87,10],[87,11,87,12],[88,6,88,10],[88,11,88,12],[90,1,90,6],[90,7,90,10],[91,1,91,14],[93,1,93,7],[95,1,95,14],[96,1,96,14],[98,2,98,3],[98,4,98,10],[98,11,98,13],[99,2,99,3],[99,4,99,10],[99,11,99,13],[100,2,100,3],[100,4,100,10],[100,11,100,13],[101,2,101,3],[101,4,101,10],[101,11,101,13],[102,2,102,3],[102,4,102,10],[102,11,102,13],[103,2,103,3],[103,4,103,10],[103,11,103,13],[104,4,104,10],[104,11,104,13],[105,4,105,10],[105,11,105,13],[106,4,106,10],[106,11,106,13],[107,4,107,10],[107,11,107,13],[108,4,108,10],[108,11,108,13],[109,4,109,10],[109,11,109,13],[110,4,110,10],[110,11,110,13],[111,4,111,10],[111,11,111,13],[112,4,112,10],[112,11,112,13],[113,4,113,10],[113,11,113,13],[114,4,114,10],[114,11,114,13]]}
[]
[null,"PKI Maturity Level evaluation overview"]
[]
[null,"Evaluated Use-case information",{"$nulls":7},"Assessor information"]
[null,"Use-case name",null,"Cool PKI",{"$nulls":5},"Assessor's position",null,"Internal"]
[null,"Company",null,"3Key Company",{"$nulls":5},"Company",null,"3Key Company"]
[null,"Starting date",null,"2023-05-02",{"$nulls":5},"Assessor's name",null,"Franta Hrábě"]
[null,"Target date",null,"2023-06-26"]
[null,"Finish date",null,"2023-07-01",null,{"$f":"IF(D9=\"\",\"\",_xlfn.CONCAT(ABS(D8-D9),\" \",IF(ABS(D8-D9)=1,tech!B134,tech!B135),\" \",IF(D8>D9,tech!A134,tech!A135)))","v":"5 days late"}]
[]
[]
[null,"Use-case description"]
[]
[null,"Describe the use-case to be assessed:"]
[]
[]
[]
[null,"List all components that are involved in the use-case"]
[]
[]
[]
[null,"Specify out-of-scope considerations"]
[]
[]
[]
[null,"Description of the PKI environment"]
[null,"The PKI environment description should include the following information:"]
[]
[null,"High-level design of the PKI environment"]
[]
[]
[]
[null,"Points of interaction between parties involved in the use-cases"]
[]
[]
[]
[]
[]
[null,"PKI Maturity Model"]
[]
[null,"The objective of this document is to provide a definition of the PKI maturity model and what is the maturity assessment process and procedures in order to rate the current maturity level according the model and track progress."]
[]
[null,"Maturity Model"]
[]
[null,"The maturity model is based on the Capability Maturity Model Integration (CMMI) developed by Carnegie Mellon University. It should provide the following:"]
[null,"- Quickly understand the current level of capabilities and performance of the PKI\n- Support comparison of PKI maturity with similar organizations based on size or industry (anonymized)\n- Action plans on how to improve the capabilities of the current PKI\n- Improve overall PKI performance"]
[]
[null,"Maturity Levels"]
[]
[null,"The maturity model consists of several categories which are directly associated with the PKI and covers all aspects and activities (people, processes, technology). Based on the maturity model parts, the overall maturity level is determined as a single value representing the current state of capabilities and performance."]
[null,"Each category can be separately assessed for its maturity level. Maturity levels are generally defined as follows:"]
[]
[null,null,"Maturity level",null,"Short description (general)"]
[null,null,"Initial",null,"Unpredictable process with poor control and always reactive"]
[null,null,"Basic",null,"Process is characterized by each particular case or project and controls are often reactive"]
[null,null,"Advanced",null,"Process is characterized by organizational standards and controls are proactive"]
[null,null,"Managed",null,"Processes are measured and controlled, proactive approach"]
[null,null,"Optimized",null,"Continuous improvement of the processes and procedures, proactive approach for future technology improvement"]
[]
[null,"Modules"]
[]
[null,"There are 4 modules defined for the maturity model. Each of the module is focused on the specific parts of the PKI."]
[]
[null,null,"Module",null,"Description"]
[null,null,"Governance",null,"Consist of the leadership, overall structures, and processes to enable organization using the PKI in a sustainable way. In also consists of having strategy and objectives and proper decision making"]
[null,null,"Management",null,"Translates the governance into actions that support the PKI, management of the resources to maintain the required level of trust"]
[null,null,"Operations",null,"Includes day to day business as usual activities that lead to secure and future-proof PKI in accordance with the organization goals"]
[null,null,"Resources",null,"Ensures that the activities related to the PKI are performed with a proper knowledge and experience, with enough capacities, and that it provides complete and accurate information to relying parties"]
[]
[null,"Categories and weights"]
[]
[null,"Each module consists of specific categories related to them.\nThe following categories of the PKI maturity model are defined with the appropriate weight based on the applicability and importance:"]
[]
[{"$nulls":3},"Module",null,null,"Category",{"$nulls":4},"Weight"]
[{"$nulls":3},"Governance",null,null,"Strategy and vision",{"$nulls":4},5]
[{"$nulls":6},"Policies and documentation",{"$nulls":4},4]
[{"$nulls":6},"Compliance",{"$nulls":4},2]
[{"$nulls":6},"Processes and procedures",{"$nulls":4},3]
[{"$nulls":3},"Management",null,null,"Key Management",{"$nulls":4},4]
[{"$nulls":6},"Certificate Management",{"$nulls":4},4]
[{"$nulls":6},"Infrastructure Management",{"$nulls":4},2]
[{"$nulls":6},"Change Management and Agility",{"$nulls":4},3]
[{"$nulls":3},"Operations",null,null,"Resilience",{"$nulls":4},4]
[{"$nulls":6},"Automation",{"$nulls":4},2]
[{"$nulls":6},"Interoperability",{"$nulls":4},2]
[{"$nulls":6},"Monitoring and Auditing",{"$nulls":4},2]
[{"$nulls":3},"Resources",null,null,"Sourcing",{"$nulls":4},4]
[{"$nulls":6},"Knowledge and Training",{"$nulls":4},3]
[{"$nulls":6},"Awareness",{"$nulls":4},3]
[]
[null,"For more information on categories, please refer to the",{"$nulls":5},"Categories Maturity Evaluation"]
[null,"The weights of the categories are used to calculate the overall maturity level of the PKI."]
[]
[null,"Overall maturity level"]
[]
[null,"Based on the nature of PKI part, these maturity levels are described accordingly. Overall maturity level is calculated as weighted average of maturity level of PKI categories."]
[null,"There are defined the following overall maturity levels for the PKI Maturity Model:"]
[]
[null,null,"Maturity level",null,"Indicators",{"$nulls":6},"Associated risks"]
[null,null,"1 - Initial",null,"- PKI is ad-hoc managed, reactive\n- There are minimum processes and procedures, which are typically not followed\n- There is no approach how to address certificate related issues\n- PKI does not take into account any industry standards or regulations\n- Insufficient resources and knowledge",{"$nulls":6},"- High probability of compromise\n- High probability of operational issues\n- No trust"]
[null,null,"2 - Basic",null,"- PKI is ad-hoc managed, often reactive\n- There are defined processes and procedures which are followed\n- PKI is not managed according industry standards and regulations\n- Insufficient knowledge",{"$nulls":6},"- High probability of operational issues\n- Medium probability of compromise\n- No trust"]
[null,null,"3 - Advanced",null,"- Certificate services are not consistent\n- Procedures are defined and followed\n- CP and CPS partially exist\n- partially available resources and knowledge",{"$nulls":6},"- Medium probability of operational issues\n- Low probability of compromise"]
[null,null,"4 - Managed",null,"- PKI is consistently managed\n- Well defined CP and CPS for provided services\n- Available skilled resources\n- Documented processes and procedures to manage certificates and related keys\n- Inconsistent approach to certificate related activities",{"$nulls":6},"- Low probability of operational issues\n- Low probability of compromise\n- Low probability of loosing trust"]
[null,null,"5 - Optimized",null,"- Well defined CP and CPS\n- Effective procedures for certificate management exist\n- Resources with knowledge and experience available\n- Consistent PKI with alignment to current practice and regulation\n- Future proof",{"$nulls":6},"- Minimal probability of operational issues\n- Minimal probability of compromise\n- Minimal probability of loosing trust"]

{"sheet":"Scoping","index":2,"n_rows":95,"n_cols":12,"rows_kept":95,"merged":[[1,1,4,2],[1,3,3,4],[2,9,2,11],[3,9,3,11],[4,9,4,11],[7,2,7,6],[7,8,7,10],[9,1,32,1],[9,2,14,2],[9,3,14,3],[9,4,14,4],[9,5,14,5],[9,6,14,6],[9,11,14,11],[15,2,20,2],[15,3,20,3],[15,4,20,4],[15,5,20,5],[15,6,20,6],[15,11,20,11],[21,2,26,2],[21,3,26,3],[21,4,26,4],[21,5,26,5],[21,6,26,6],[21,11,26,11],[27,2,32,2],[27,3,32,3],[27,4,32,4],[27,5,32,5],[27,6,32,6],[27,11,32,11],[33,1,57,1],[33,2,38,2],[33,3,38,3],[33,4,38,4],[33,5,38,5],[33,6,38,6],[33,11,38,11],[39,2,45,2],[39,3,45,3],[39,4,45,4],[39,5,45,5],[39,6,45,6],[39,11,45,11],[46,2,51,2],[46,3,51,3],[46,4,51,4],[46,5,51,5],[46,6,51,6],[46,11,51,11],[52,2,57,2],[52,3,57,3],[52,4,57,4],[52,5,57,5],[52,6,57,6],[52,11,57,11],[58,1,81,1],[58,2,63,2],[58,3,63,3],[58,4,63,4],[58,5,63,5],[58,6,63,6],[58,11,63,11],[64,2,69,2],[64,3,69,3],[64,4,69,4],[64,5,69,5],[64,6,69,6],[64,11,69,11],[70,2,75,2],[70,3,75,3],[70,4,75,4],[70,5,75,5],[70,6,75,6],[70,11,75,11],[76,2,81,2],[76,3,81,3],[76,4,81,4],[76,5,81,5],[76,6,81,6],[76,11,81,11],[82,1,94,1],[82,2,85,2],[82,3,85,3],[82,4,85,4],[82,5,85,5],[82,6,85,6],[82,11,85,11],[86,2,90,2],[86,3,90,3],[86,4,90,4],[86,5,90,5],[86,6,90,6],[86,11,90,11],[91,2,94,2],[91,3,94,3],[91,4,94,4],[91,5,94,5],[91,6,94,6],[91,11,94,11]]}
[]
[null,"Scoping",null,{"$f":"Overview!D5","v":"Cool PKI"}]
[{"$nulls":9},{"$f":"_xlfn.CONCAT(\"Duration of the assessment: \",TODAY()-Overview!D7,\" days     \")","v":"Duration of the assessment: 321 days     "}]
[{"$nulls":9},{"$f":"IF(Overview!D9<>\"\",\"The assessment has been finished     \",IF(Overview!D8>=TODAY(),_xlfn.CONCAT(\"Remaining time to the target date: \",Overview!D8-TODAY(),\" days     \"),_xlfn.CONCAT(\"Overrunning the target date by: \",TODAY()-Overview!D8,\" days     \")))","v":"The assessment has been finished     "}]
[{"$nulls":4},{"$f":"Overview!D6","v":"3Key Company"},{"$nulls":4},{"$f":"_xlfn.CONCAT(\"Name of responsible assessor: \",Overview!L7,\"     \")","v":"Name of responsible assessor: Franta Hrábě     "}]
[]
[]
[null,null,"Categories",{"$nulls":5},"Requirements"]
[null,"Module","Category","Description","Inputs and evidence","Scope","Aplicability",null,"#","Requirements","Scope","Reason"]
[null,{"$f":"Assessment!C8","v":"1. Governance"},{"$f":"Assessment!C12","v":"1.1. Strategy and vision"},{"$f":"VLOOKUP(LEFT(C10,4),source!$CV$4:$CW$23,2,0)","v":"Responsible for the PKI management and strategy. Includes alignment with organizational goals and requirements, risk management, and policy decisions."},"• Responsibility matrix\n• Formal assignment for the responsibilities\n• Documented PKI purpose and strategy","IN",{"$f":"IF(F10=tech!$A$5,tech!$A$9,IF(COUNTIF(H10:H15,0)>0,tech!$A$10,tech!$A$8))","v":"Applicable"},{"$f":"IF(OR(F$10=tech!$A$5,K10=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C16","v":"1.1.1."},{"$f":"Assessment!D16","v":"Organizational sponsor and support"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$10=tech!$A$5,K11=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C17","v":"1.1.2."},{"$f":"Assessment!D17","v":"Formal assignment of responsible leadership"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$10=tech!$A$5,K12=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C18","v":"1.1.3."},{"$f":"Assessment!D18","v":"Scope and business drivers for PKI"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$10=tech!$A$5,K13=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C19","v":"1.1.4."},{"$f":"Assessment!D19","v":"Architecture and design of the PKI"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$10=tech!$A$5,K14=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C20","v":"1.1.5."},{"$f":"Assessment!D20","v":""},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$10=tech!$A$5,K15=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C21","v":"1.1.6."},{"$f":"Assessment!D21","v":""},"IN"]
[null,null,{"$f":"Assessment!C23","v":"1.2. Policies and documentation"},{"$f":"VLOOKUP(LEFT(C16,4),source!$CV$4:$CW$23,2,0)","v":"Formal policies and practice statements for supported PKI services and use-cases. Formal management of agreements between parties involved in the PKI."},"• Documented certification policies and practice statements\n• Documented PKI disclosure statement\n• Availability and maintenance of policies","IN",{"$f":"IF(F16=tech!$A$5,tech!$A$9,IF(COUNTIF(H16:H21,0)>0,tech!$A$10,tech!$A$8))","v":"Applicable"},{"$f":"IF(OR(F$16=tech!$A$5,K16=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C27","v":"1.2.1."},{"$f":"Assessment!D27","v":"The scope of policies is defined and documented"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$16=tech!$A$5,K17=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C28","v":"1.2.2."},{"$f":"Assessment!D28","v":"Certificate Policy is documented and published"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$16=tech!$A$5,K18=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C29","v":"1.2.3."},{"$f":"Assessment!D29","v":"Certification Practice Statement is documented and published"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$16=tech!$A$5,K19=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C30","v":"1.2.4."},{"$f":"Assessment!D30","v":"Disclosure statement is documented and published"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$16=tech!$A$5,K20=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C31","v":"1.2.5."},{"$f":"Assessment!D31","v":"Policies are periodically reviewed and updated"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$16=tech!$A$5,K21=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C32","v":"1.2.6."},{"$f":"Assessment!D32","v":""},"IN"]
[null,null,{"$f":"Assessment!C34","v":"1.3. Compliance"},{"$f":"VLOOKUP(LEFT(C22,4),source!$CV$4:$CW$23,2,0)","v":"Adherence to standards and applicable regulations and requirements for the PKI and trust services. Standards and regulations may be internal or external, country specific or purpose specific."},"• List of standards and regulations that PKI must comply with\n• Responsibility for the compliance management","IN",{"$f":"IF(F22=tech!$A$5,tech!$A$9,IF(COUNTIF(H22:H27,0)>0,tech!$A$10,tech!$A$8))","v":"Applicable"},{"$f":"IF(OR(F$22=tech!$A$5,K22=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C38","v":"1.3.1."},{"$f":"Assessment!D38","v":"Compliance policies are defined, implemented, and communicated"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$22=tech!$A$5,K23=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C39","v":"1.3.2."},{"$f":"Assessment!D39","v":"A program to monitor compliance with the policies is established"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$22=tech!$A$5,K24=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C40","v":"1.3.3."},{"$f":"Assessment!D40","v":"Responsibilities for the compliance are formally defined and assigned"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$22=tech!$A$5,K25=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C41","v":"1.3.4."},{"$f":"Assessment!D41","v":"List of relevant laws, regulations, and standards, exist and is maintained"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$22=tech!$A$5,K26=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C42","v":"1.3.5."},{"$f":"Assessment!D42","v":""},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$22=tech!$A$5,K27=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C43","v":"1.3.6."},{"$f":"Assessment!D43","v":""},"IN"]
[null,null,{"$f":"Assessment!C45","v":"1.4. Processes and procedures"},{"$f":"VLOOKUP(LEFT(C28,4),source!$CV$4:$CW$23,2,0)","v":"Processes and procedures related to PKI management tasks and operational activities. This includes also the supply chain procedures and processes that includes acceptance or receipt of the HW and SW related to the PKI."},"• Documented processes and procedures\n• Description of the supply chain\nValidation of the integrity","IN",{"$f":"IF(F28=tech!$A$5,tech!$A$9,IF(COUNTIF(H28:H33,0)>0,tech!$A$10,tech!$A$8))","v":"Applicable"},{"$f":"IF(OR(F$28=tech!$A$5,K28=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C49","v":"1.4.1."},{"$f":"Assessment!D49","v":"Scope of processes and procedure is aligned with policies"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$28=tech!$A$5,K29=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C50","v":"1.4.2."},{"$f":"Assessment!D50","v":"Processes and procedures are formally documented and followed"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$28=tech!$A$5,K30=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C51","v":"1.4.3."},{"$f":"Assessment!D51","v":"Recurring activities are executed on time"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$28=tech!$A$5,K31=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C52","v":"1.4.4."},{"$f":"Assessment!D52","v":"Evidence from procedures is collected and maintained"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$28=tech!$A$5,K32=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C53","v":"1.4.5."},{"$f":"Assessment!D53","v":"Processes and procedures are reviewed and updated"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$28=tech!$A$5,K33=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C54","v":"1.4.6."},{"$f":"Assessment!D54","v":""},"IN"]
[null,{"$f":"Assessment!C57","v":"2. Management"},{"$f":"Assessment!C61","v":"2.1. Key Management"},{"$f":"VLOOKUP(LEFT(C34,4),source!$CV$4:$CW$23,2,0)","v":"Key management policy and procedures related to PKI cryptographic keys and its lifecycle. Inventory of cryptographic keys. Secure and trusted key ceremonies. Key escrow and key recovery if applicable."},"• Documented key management policy and procedures\n• Inventory of cryptographic keys","IN",{"$f":"IF(F34=tech!$A$5,tech!$A$9,IF(COUNTIF(H34:H39,0)>0,tech!$A$10,tech!$A$8))","v":"Applicable"},{"$f":"IF(OR(F$34=tech!$A$5,K34=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C65","v":"2.1.1."},{"$f":"Assessment!D65","v":"Key management roles and responsibilities are documented and formally assigned"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$34=tech!$A$5,K35=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C66","v":"2.1.2."},{"$f":"Assessment!D66","v":"Inventory of cryptographic keys is documented and maintained"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$34=tech!$A$5,K36=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C67","v":"2.1.3."},{"$f":"Assessment!D67","v":"Inventory of cryptographic devices is documented and maintained"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$34=tech!$A$5,K37=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C68","v":"2.1.4."},{"$f":"Assessment!D68","v":"Each cryptographic key is defined and has documented lifecycle procedures"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$34=tech!$A$5,K38=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C69","v":"2.1.5."},{"$f":"Assessment!D69","v":"Cryptographic cipher suites and protocols are documented and maintained"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$34=tech!$A$5,K39=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C70","v":"2.1.6."},{"$f":"Assessment!D70","v":"Key management is periodically reviewed and updated"},"IN"]
[null,null,{"$f":"Assessment!C72","v":"2.2. Certificate Management"},{"$f":"VLOOKUP(LEFT(C40,4),source!$CV$4:$CW$23,2,0)","v":"Certificate management policy and lifecycle. Inventory of certificates. Definition of the certificate profiles and supported states of the certificate including the transitions between the states. Proper validation fo the certificates."},"• Documented certificate profiles and lifecycle\n• Inventory of certificates","IN",{"$f":"IF(F40=tech!$A$5,tech!$A$9,IF(COUNTIF(H40:H46,0)>0,tech!$A$10,tech!$A$8))","v":"Applicable"},{"$f":"IF(OR(F$40=tech!$A$5,K40=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C76","v":"2.2.1."},{"$f":"Assessment!D76","v":"Certificate profiles are documented"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$40=tech!$A$5,K41=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C77","v":"2.2.2."},{"$f":"Assessment!D77","v":"Certificate cipher suites are documented"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$40=tech!$A$5,K42=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C78","v":"2.2.3."},{"$f":"Assessment!D78","v":"Certificate lifecycle management is documented"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$40=tech!$A$5,K43=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C79","v":"2.2.4."},{"$f":"Assessment!D79","v":"Inventory of issued certificates is documented"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$40=tech!$A$5,K44=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C80","v":"2.2.5."},{"$f":"Assessment!D80","v":"Certificate discovery process is documented"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$40=tech!$A$5,K45=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C81","v":"2.2.6."},{"$f":"Assessment!D81","v":"Certificate management is periodically reviewed and updated"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$40=tech!$A$5,K46=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C82","v":"2.2.7."},{"$f":"Assessment!D82","v":"Organizational PKI governance"},"IN"]
[null,null,{"$f":"Assessment!C84","v":"2.3. Infrastructure Management"},{"$f":"VLOOKUP(LEFT(C47,4),source!$CV$4:$CW$23,2,0)","v":"Availability of the PKI services, infrastructure setup to achieve availability goals. PKI continuity testing and infrastructure recovery. Infrastructure security controls."},"• Description of the availability requirements\n• High availability and failover design\n• Recovery procedures\n• Network segmentation","IN",{"$f":"IF(F47=tech!$A$5,tech!$A$9,IF(COUNTIF(H47:H52,0)>0,tech!$A$10,tech!$A$8))","v":"Applicable"},{"$f":"IF(OR(F$47=tech!$A$5,K47=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C88","v":"2.3.1."},{"$f":"Assessment!D88","v":"Network and deployment infrastructure is documented"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$47=tech!$A$5,K48=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C89","v":"2.3.2."},{"$f":"Assessment!D89","v":"Separation and segmentation principles are applied"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$47=tech!$A$5,K49=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C90","v":"2.3.3."},{"$f":"Assessment!D90","v":"Network vulnerability management is implemented and maintained"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$47=tech!$A$5,K50=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C91","v":"2.3.4."},{"$f":"Assessment!D91","v":"Infrastructure recovery objectives controls"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$47=tech!$A$5,K51=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C92","v":"2.3.5."},{"$f":"Assessment!D92","v":"Infrastructure activities are periodically reviewed"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$47=tech!$A$5,K52=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C93","v":"2.3.6."},{"$f":"Assessment!D93","v":""},"IN"]
[null,null,{"$f":"Assessment!C95","v":"2.4. Change Management and Agility"},{"$f":"VLOOKUP(LEFT(C53,4),source!$CV$4:$CW$23,2,0)","v":"Secure and controlled process for the change management. Formal process to request changes in the PKI, approval, staging, roll-back."},"• Documented change management process\n• Sample change requests","IN",{"$f":"IF(F53=tech!$A$5,tech!$A$9,IF(COUNTIF(H53:H58,0)>0,tech!$A$10,tech!$A$8))","v":"Applicable"},{"$f":"IF(OR(F$53=tech!$A$5,K53=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C99","v":"2.4.1."},{"$f":"Assessment!D99","v":"The policy for change management and agility is documented"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$53=tech!$A$5,K54=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C100","v":"2.4.2."},{"$f":"Assessment!D100","v":"Request for change structure is documented and followed"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$53=tech!$A$5,K55=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C101","v":"2.4.3."},{"$f":"Assessment!D101","v":"The change management process is documented and implemented"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$53=tech!$A$5,K56=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C102","v":"2.4.4."},{"$f":"Assessment!D102","v":"Requirements for agility are identified"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$53=tech!$A$5,K57=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C103","v":"2.4.5."},{"$f":"Assessment!D103","v":"Change management and agility is periodically reviewed"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$53=tech!$A$5,K58=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C104","v":"2.4.6."},{"$f":"Assessment!D104","v":""},"IN"]
[null,{"$f":"Assessment!C107","v":"3. Operations"},{"$f":"Assessment!C111","v":"3.1. Resilience"},{"$f":"VLOOKUP(LEFT(C59,4),source!$CV$4:$CW$23,2,0)","v":"Quickly respond to potential attack and unavailability of the PKI services or other related resources."},"• Vulnerability management\n• Business continuity plans\n• Future proofing","IN",{"$f":"IF(F59=tech!$A$5,tech!$A$9,IF(COUNTIF(H59:H64,0)>0,tech!$A$10,tech!$A$8))","v":"Applicable"},{"$f":"IF(OR(F$59=tech!$A$5,K59=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C115","v":"3.1.1."},{"$f":"Assessment!D115","v":"Risk assessment and business impact analysis"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$59=tech!$A$5,K60=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C116","v":"3.1.2."},{"$f":"Assessment!D116","v":"Cyber-security management and incident planning"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$59=tech!$A$5,K61=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C117","v":"3.1.3."},{"$f":"Assessment!D117","v":"Business continuity planning and disaster recovery"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$59=tech!$A$5,K62=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C118","v":"3.1.4."},{"$f":"Assessment!D118","v":"Technology future proofing"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$59=tech!$A$5,K63=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C119","v":"3.1.5."},{"$f":"Assessment!D119","v":"Competence and information sharing"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$59=tech!$A$5,K64=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C120","v":"3.1.6."},{"$f":"Assessment!D120","v":"Continual review and improvement"},"IN"]
[null,null,{"$f":"Assessment!C122","v":"3.2. Interoperability"},{"$f":"VLOOKUP(LEFT(C65,4),source!$CV$4:$CW$23,2,0)","v":"Interoperability between applications, implementations, and technologies. Application of interoperable protocols and standards. Transparency and vendor lock avoidance strategy."},"• Integration guidance\n• Supported protocols and priorities in usage of protocols\n• Requirements for the vendor lock avoidance","IN",{"$f":"IF(F65=tech!$A$5,tech!$A$9,IF(COUNTIF(H65:H70,0)>0,tech!$A$10,tech!$A$8))","v":"Applicable"},{"$f":"IF(OR(F$65=tech!$A$5,K65=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C126","v":"3.2.1."},{"$f":"Assessment!D126","v":"Maintain PKI interoperability strategy"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$65=tech!$A$5,K66=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C127","v":"3.2.2."},{"$f":"Assessment!D127","v":"Documented integration guidance"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$65=tech!$A$5,K67=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C128","v":"3.2.3."},{"$f":"Assessment!D128","v":"Adoption and application of open standards"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$65=tech!$A$5,K68=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C129","v":"3.2.4."},{"$f":"Assessment!D129","v":""},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$65=tech!$A$5,K69=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C130","v":"3.2.5."},{"$f":"Assessment!D130","v":""},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$65=tech!$A$5,K70=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C131","v":"3.2.6."},{"$f":"Assessment!D131","v":""},"IN"]
[null,null,{"$f":"Assessment!C133","v":"3.3. Monitoring and Auditing"},{"$f":"VLOOKUP(LEFT(C71,4),source!$CV$4:$CW$23,2,0)","v":"Measurement of the PKI metrics, collecting evidence, monitoring and alerting of relevant issues, including references to incident response management."},"• Description of metrics\n• Collecting of logs and records\n• Incident response plans","IN",{"$f":"IF(F71=tech!$A$5,tech!$A$9,IF(COUNTIF(H71:H76,0)>0,tech!$A$10,tech!$A$8))","v":"Applicable"},{"$f":"IF(OR(F$71=tech!$A$5,K71=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C137","v":"3.3.1."},{"$f":"Assessment!D137","v":"Monitoring events and logging requirements are defined and documented"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$71=tech!$A$5,K72=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C138","v":"3.3.2."},{"$f":"Assessment!D138","v":"Event logs from systems are collected"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$71=tech!$A$5,K73=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C139","v":"3.3.3."},{"$f":"Assessment!D139","v":"Audit trail can be reconstructed from audit logs"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$71=tech!$A$5,K74=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C140","v":"3.3.4."},{"$f":"Assessment!D140","v":"Monitoring of operational and security events is implemented"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$71=tech!$A$5,K75=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C141","v":"3.3.5."},{"$f":"Assessment!D141","v":"Critical events are immediately alerted and resolved according to incident response plans"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$71=tech!$A$5,K76=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C142","v":"3.3.6."},{"$f":"Assessment!D142","v":"Review of events and logs is periodically performed"},"IN"]
[null,null,{"$f":"Assessment!C144","v":"3.4. Automation"},{"$f":"VLOOKUP(LEFT(C77,4),source!$CV$4:$CW$23,2,0)","v":"Automation of certificate lifecycle management. Technology and tools for the automation. Monitoring of automated certificate operations."},"• Automation needs\n• Tooling\n• Automation monitoring","IN",{"$f":"IF(F77=tech!$A$5,tech!$A$9,IF(COUNTIF(H77:H82,0)>0,tech!$A$10,tech!$A$8))","v":"Applicable"},{"$f":"IF(OR(F$77=tech!$A$5,K77=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C148","v":"3.4.1."},{"$f":"Assessment!D148","v":"Process automation description"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$77=tech!$A$5,K78=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C149","v":"3.4.2."},{"$f":"Assessment!D149","v":"Monitoring and auditing of automated process"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$77=tech!$A$5,K79=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C150","v":"3.4.3."},{"$f":"Assessment!D150","v":"Incidents and exceptions handling"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$77=tech!$A$5,K80=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C151","v":"3.4.4."},{"$f":"Assessment!D151","v":""},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$77=tech!$A$5,K81=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C152","v":"3.4.5."},{"$f":"Assessment!D152","v":""},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$77=tech!$A$5,K82=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C153","v":"3.4.6."},{"$f":"Assessment!D153","v":""},"IN"]
[null,{"$f":"Assessment!C156","v":"4. Resources"},{"$f":"Assessment!C160","v":"4.1. Sourcing"},{"$f":"VLOOKUP(LEFT(C83,4),source!$CV$4:$CW$23,2,0)","v":"Availability of skilled resources to manage PKI. Processes and procedures to maintain the required resources in time, monitoring of the skills."},"• Roles and responsibilities to operate PKI\n• Requirements for the skills\n• Regular monitoring of the resource availability","IN",{"$f":"IF(F83=tech!$A$5,tech!$A$9,IF(COUNTIF(H83:H86,0)>0,tech!$A$10,tech!$A$8))","v":"Applicable"},{"$f":"IF(OR(F$83=tech!$A$5,K83=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C164","v":"4.1.1."},{"$f":"Assessment!D164","v":"Resources are identified and documented"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$83=tech!$A$5,K84=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C165","v":"4.1.2."},{"$f":"Assessment!D165","v":"Resources are clearly defined"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$83=tech!$A$5,K85=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C166","v":"4.1.3."},{"$f":"Assessment!D166","v":"Availability of resources"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$83=tech!$A$5,K86=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C167","v":"4.1.4."},{"$f":"Assessment!D167","v":"Resources are periodically reviewed"},"IN"]
[null,null,{"$f":"Assessment!C169","v":"4.2. Knowledge and Training"},{"$f":"VLOOKUP(LEFT(C87,4),source!$CV$4:$CW$23,2,0)","v":"Education of people and continuously gathering required knowledge and skills to manage PKI. Training plans and improvement."},"• Training plan\n• Continuous education of the personnel","IN",{"$f":"IF(F87=tech!$A$5,tech!$A$9,IF(COUNTIF(H87:H91,0)>0,tech!$A$10,tech!$A$8))","v":"Applicable"},{"$f":"IF(OR(F$87=tech!$A$5,K87=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C173","v":"4.2.1."},{"$f":"Assessment!D173","v":"Establish training plan"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$87=tech!$A$5,K88=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C174","v":"4.2.2."},{"$f":"Assessment!D174","v":"Responsible personnel receive training"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$87=tech!$A$5,K89=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C175","v":"4.2.3."},{"$f":"Assessment!D175","v":"Perform security awareness training"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$87=tech!$A$5,K90=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C176","v":"4.2.4."},{"$f":"Assessment!D176","v":"Establish education plan"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$87=tech!$A$5,K91=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C177","v":"4.2.5."},{"$f":"Assessment!D177","v":"Periodically review knowledge"},"IN"]
[null,null,{"$f":"Assessment!C179","v":"4.3. Awareness"},{"$f":"VLOOKUP(LEFT(C92,4),source!$CV$4:$CW$23,2,0)","v":"Providing awareness about the PKI in the organization and its purpose. Awareness how to apply the PKI in a trusted and secure way."},"• Awareness plan\n• Awareness programQ&A","IN",{"$f":"IF(F92=tech!$A$5,tech!$A$9,IF(COUNTIF(H92:H95,0)>0,tech!$A$10,tech!$A$8))","v":"Applicable"},{"$f":"IF(OR(F$92=tech!$A$5,K92=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C183","v":"4.3.1."},{"$f":"Assessment!D183","v":"Establish and maintain awareness plan"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$92=tech!$A$5,K93=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C184","v":"4.3.2."},{"$f":"Assessment!D184","v":"Disclose PKI information"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$92=tech!$A$5,K94=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C185","v":"4.3.3."},{"$f":"Assessment!D185","v":"Establish single point of contact"},"IN"]
[{"$nulls":7},{"$f":"IF(OR(F$92=tech!$A$5,K95=tech!$A$5),0,1)","v":1},{"$f":"Assessment!C186","v":"4.3.4."},{"$f":"Assessment!D186","v":"Timely communication of important information"},"IN"]

{"sheet":"Assessment","index":3,"n_rows":186,"n_cols":15,"rows_kept":186,"merged":[[1,3,4,3],[1,6,3,6],[1,8,2,12],[7,2,9,4],[7,5,9,12],[11,2,12,3],[11,5,12,12],[13,2,13,12],[14,9,14,10],[14,11,14,12],[15,9,15,10],[15,11,15,12],[16,9,16,10],[16,11,16,12],[17,9,17,10],[17,11,17,12],[18,9,18,10],[18,11,18,12],[19,9,19,10],[19,11,19,12],[20,9,20,10],[20,11,20,12],[22,2,23,3],[22,5,23,12],[24,2,24,12],[25,9,25,10],[25,11,25,12],[26,9,26,10],[26,11,26,12],[27,9,27,10],[27,11,27,12],[28,9,28,10],[28,11,28,12],[29,9,29,10],[29,11,29,12],[30,9,30,10],[30,11,30,12],[31,9,31,10],[31,11,31,12],[33,2,34,3],[33,5,34,12],[35,2,35,12],[36,9,36,10],[36,11,36,12],[37,9,37,10],[37,11,37,12],[38,9,38,10],[38,11,38,12],[39,9,39,10],[39,11,39,12],[40,9,40,10],[40,11,40,12],[41,9,41,10],[41,11,41,12],[42,9,42,10],[42,11,42,12],[44,2,45,3],[44,5,45,12],[46,2,46,12],[47,9,47,10],[47,11,47,12],[48,9,48,10],[48,11,48,12],[49,9,49,10],[49,11,49,12],[50,9,50,10],[50,11,50,12],[51,9,51,10],[51,11,51,12],[52,9,52,10],[52,11,52,12],[53,9,53,10],[53,11,53,12],[56,2,58,4],[56,5,58,12],[60,2,61,3],[60,5,61,12],[62,2,62,12],[63,9,63,10],[63,11,63,12],[64,9,64,10],[64,11,64,12],[65,9,65,10],[65,11,65,12],[66,9,66,10],[66,11,66,12],[67,9,67,10],[67,11,67,12],[68,9,68,10],[68,11,68,12],[69,9,69,10],[69,11,69,12],[71,2,72,3],[71,5,72,12],[73,2,73,12],[74,9,74,10],[74,11,74,12],[75,9,75,10],[75,11,75,12],[76,9,76,10],[76,11,76,12],[77,9,77,10],[77,11,77,12],[78,9,78,10],[78,11,78,12],[79,9,79,10],[79,11,79,12],[80,9,80,10],[80,11,80,12],[81,9,81,10],[81,11,81,12],[83,2,84,3],[83,5,84,12],[85,2,85,12],[86,9,86,10],[86,11,86,12],[87,9,87,10],[87,11,87,12],[88,9,88,10],[88,11,88,12],[89,9,89,10],[89,11,89,12],[90,9,90,10],[90,11,90,12],[91,9,91,10],[91,11,91,12],[92,9,92,10],[92,11,92,12],[94,2,95,3],[94,5,95,12],[96,2,96,12],[97,9,97,10],[97,11,97,12],[98,9,98,10],[98,11,98,12],[99,9,99,10],[99,11,99,12],[100,9,100,10],[100,11,100,12],[101,9,101,10],[101,11,101,12],[102,9,102,10],[102,11,102,12],[103,9,103,10],[103,11,103,12],[106,2,108,4],[106,5,108,12],[110,2,111,3],[110,5,111,12],[112,2,112,12],[113,9,113,10],[113,11,113,12],[114,9,114,10],[114,11,114,12],[115,9,115,10],[115,11,115,12],[116,9,116,10],[116,11,116,12],[117,9,117,10],[117,11,117,12],[118,9,118,10],[118,11,118,12],[119,9,119,10],[119,11,119,12],[121,2,122,3],[121,5,122,12],[123,2,123,12],[124,9,124,10],[124,11,124,12],[125,9,125,10],[125,11,125,12],[126,9,126,10],[126,11,126,12],[127,9,127,10],[127,11,127,12],[128,9,128,10],[128,11,128,12],[129,9,129,10],[129,11,129,12],[130,9,130,10],[130,11,130,12],[132,2,133,3],[132,5,133,12],[134,2,134,12],[135,9,135,10],[135,11,135,12],[136,9,136,10],[136,11,136,12],[137,9,137,10],[137,11,137,12],[138,9,138,10],[138,11,138,12],[139,9,139,10],[139,11,139,12],[140,9,140,10],[140,11,140,12],[141,9,141,10],[141,11,141,12],[143,2,144,3],[143,5,144,12],[145,2,145,12],[146,9,146,10],[146,11,146,12],[147,9,147,10],[147,11,147,12],[148,9,148,10],[148,11,148,12],[149,9,149,10],[149,11,149,12],[150,9,150,10],[150,11,150,12],[151,9,151,10],[151,11,151,12],[152,9,152,10],[152,11,152,12],[155,2,157,4],[155,5,157,12],[159,2,160,3],[159,5,160,12],[161,2,161,12],[162,9,162,10],[162,11,162,12],[163,9,163,10],[163,11,163,12],[164,9,164,10],[164,11,164,12],[165,9,165,10],[165,11,165,12],[166,9,166,10],[166,11,166,12],[168,2,169,3],[168,5,169,12],[170,2,170,12],[171,9,171,10],[171,11,171,12],[172,9,172,10],[172,11,172,12],[173,9,173,10],[173,11,173,12],[174,9,174,10],[174,11,174,12],[175,9,175,10],[175,11,175,12],[176,9,176,10],[176,11,176,12],[178,2,179,3],[178,5,179,12],[180,2,180,12],[181,9,181,10],[181,11,181,12],[182,9,182,10],[182,11,182,12],[183,9,183,10],[183,11,183,12],[184,9,184,10],[184,11,184,12],[185,9,185,10],[185,11,185,12]]}
[]
[{"$nulls":3},"Assessment",null,null,{"$f":"Overview!D5","v":"Cool PKI"},null,"Reached PKI Maturity Level"]
[{"$nulls":7},{"$f":"_xlfn.CONCAT(\"Duration of the assessment: \",TODAY()-Overview!D7,\" days     \")","v":"Duration of the assessment: 321 days     "}]
[{"$nulls":7},{"$f":"IF(Overview!D9<>\"\",\"The assessment has been finished     \",IF(Overview!D8>=TODAY(),_xlfn.CONCAT(\"Remaining time to the target date: \",Overview!D8-TODAY(),\" days     \"),_xlfn.CONCAT(\"Overrunning the target date by: \",TODAY()-Overview!D8,\" days     \")))","v":"The assessment has been finished     "},"Initial","Basic","Advanced","Managed","Optimized"]
[{"$nulls":6},{"$f":"Overview!D6","v":"3Key Company"},{"$f":"_xlfn.CONCAT(\"Name of responsible assessor: \",Overview!L7,\"     \")","v":"Name of responsible assessor: Franta Hrábě     "},{"$f":"IF($N$6=0,$N$7-$N$6,IF($N$6>0,1,0))","v":{"v":1,"d":"100%"}},{"$f":"IF($N$6=1,$N$7-$N$6,IF($N$6>1,1,0))","v":{"v":1,"d":"100%"}},{"$f":"IF($N$6=2,$N$7-$N$6,IF($N$6>2,1,0))","v":{"v":0.8627883755793642,"d":"86%"}},{"$f":"IF($N$6=3,$N$7-$N$6,IF($N$6>3,1,0))","v":{"v":0,"d":"0%"}},{"$f":"IF($N$6=4,$N$7-$N$6,IF($N$6>4,1,0))","v":{"v":0,"d":"0%"}}]
[null,null,"#","Requirement","Weight","N/A","Guidance","Assessment","Maturity level","Notes",null,"Evidence",null,{"$f":"TRUNC(N7,0)","v":2},{"$f":"VLOOKUP(N6,tech!$A$21:$B$26,2,0)","v":"Basic"}]
[{"$nulls":13},{"$f":"(SUM(E13,E24,E35,E46)*N10+SUM(E62,E73,E85,E96)*N59+SUM(E112,E123,E134,E145)*N109+SUM(E161,E170,E180)*N158)/SUM(E13,E24,E35,E46,E62,E73,E85,E96,E112,E123,E134,E145,E161,E170,E180)","v":2.862788375579364}]
[null,null,"1. Governance",null,null,{"$f":"IF(AND(B13=0,B24=0,B35=0,B46=0),tech!$A$9,\"\")","v":""}]
[{"$nulls":13},{"$f":"IF(SUM(E13,E24,E35,E46)=0,0,TRUNC((IF(B13=0,0,SUM(N16:N21)/SUM(E16:E21)*E13)+IF(B24=0,0,SUM(N27:N32)/SUM(E27:E32)*E24)+IF(B35=0,0,SUM(N38:N43)/SUM(E38:E43)*E35)+IF(B46=0,0,SUM(N49:N54)/SUM(E49:E54)*E46))/SUM(E13,E24,E35,E46),0))","v":2}]
[{"$nulls":13},{"$f":"IF(SUM(E13,E24,E35,E46)=0,0,(IF(B13=0,0,SUM(N16:N21)/SUM(E16:E21)*E13)+IF(B24=0,0,SUM(N27:N32)/SUM(E27:E32)*E24)+IF(B35=0,0,SUM(N38:N43)/SUM(E38:E43)*E35)+IF(B46=0,0,SUM(N49:N54)/SUM(E49:E54)*E46))/SUM(E13,E24,E35,E46))","v":2.008403361344538}]
[]
[null,null,{"$f":"tech!A117","v":"1.1. Strategy and vision"},null,"Weight",{"$f":"IF(B13=0,tech!$A$9,\"\")","v":""}]
[null,{"$f":"IF(Scoping!F10=tech!$A$5,0,1)","v":1},null,null,{"$f":"VLOOKUP(C12,tech!$A$117:$B$131,2,0)*B13","v":5},{"$nulls":8},{"$f":"IF(SUM(B16:B21)=0,0,TRUNC(SUM(N16:N21)/SUM(E16:E21),0))","v":1}]
[]
[null,null,"#","Requirement","Weight","N/A","Guidance","Assessment","Maturity level","Notes",null,"Evidence"]
[null,{"$f":"IF(B$13=0,0,IF(F16=tech!$B$9,0,1))","v":1},"1.1.1.",{"$f":"IFERROR(VLOOKUP(C16,source!$J$4:$L$13,3,0),\"\")","v":"Organizational sponsor and support"},{"$f":"IFERROR(VLOOKUP(C16,source!$J$4:$L$13,2,0),0)*B16","v":3},{"$f":"IF(Scoping!K10=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$M$15:$M$300,source!$L$15:$L$300=_xlfn.CONCAT($C16,LEFT(G$15,1),\"Y\"),\"\"))","v":"The success of the PKI implementation highly depends on the organization top management support. Top management typically also acts as a sponsor of the PKI, meaning that they allocate and approve budget needed to build and maintain the PKI.\n\nThe basic assumption is that the established digital trust is going to be maintained and developed for years, and therefore it is important to have a long-term vision and strategy for the PKI. The strategy and vision should be aligned with the overall organizational goals and approach."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$M$15:$M$300,source!$L$15:$L$300=_xlfn.CONCAT($C16,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• Interview with the top management\n• Documented strategy and vision\n• Documented organizational goals and approach\n• Understanding of why the PKI is needed and what is the value for the organization\n• Support and sponsorship of the top management"},"Initial",{"$nulls":4},{"$f":"IF(I16=\"\",0,VLOOKUP(I16,tech!$A$13:$B$17,2,0))*E16","v":3},{"$f":"IF(D16=\"\",\"\",IF(B16=0,tech!$B$9,IF(AND(B16=1,N16=0),tech!$B$21,I16)))","v":"Initial"}]
[null,{"$f":"IF(B$13=0,0,IF(F17=tech!$B$9,0,1))","v":1},"1.1.2.",{"$f":"IFERROR(VLOOKUP(C17,source!$J$4:$L$13,3,0),\"\")","v":"Formal assignment of responsible leadership"},{"$f":"IFERROR(VLOOKUP(C17,source!$J$4:$L$13,2,0),0)*B17","v":2},{"$f":"IF(Scoping!K11=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$M$15:$M$300,source!$L$15:$L$300=_xlfn.CONCAT($C17,LEFT(G$15,1),\"Y\"),\"\"))","v":"Proper leadership and responsible person should be assigned by the management to fulfil the role for the establishment, maintenance, and development of the PKI according to the strategy and vision. The responsible person should be able to make decisions and take actions to ensure the PKI is aligned with the organizational goals and needs."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$M$15:$M$300,source!$L$15:$L$300=_xlfn.CONCAT($C17,LEFT(H$15,1),\"Y\"),\"\"))","v":"The formal assignment of the responsible person should be documented and approved by the management. Formal document should contains identification of the person and understanding of the role and responsibilities.\nInterview with the responsible person should confirm the understanding of the role and responsibilities, driving the PKI implementation according to the organizational strategy."},"Initial",{"$nulls":4},{"$f":"IF(I17=\"\",0,VLOOKUP(I17,tech!$A$13:$B$17,2,0))*E17","v":2},{"$f":"IF(D17=\"\",\"\",IF(B17=0,tech!$B$9,IF(AND(B17=1,N17=0),tech!$B$21,I17)))","v":"Initial"}]
[null,{"$f":"IF(B$13=0,0,IF(F18=tech!$B$9,0,1))","v":1},"1.1.3.",{"$f":"IFERROR(VLOOKUP(C18,source!$J$4:$L$13,3,0),\"\")","v":"Scope and business drivers for PKI"},{"$f":"IFERROR(VLOOKUP(C18,source!$J$4:$L$13,2,0),0)*B18","v":2},{"$f":"IF(Scoping!K12=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$M$15:$M$300,source!$L$15:$L$300=_xlfn.CONCAT($C18,LEFT(G$15,1),\"Y\"),\"\"))","v":"The scope of the PKI should be clearly defined and documented. The scope should be defined in terms of the use-cases that the PKI is going to support. Each use-case can have a different requirements and therefore different strategy. The use-cases should be defined in terms of the business drivers that are going to be supported by the PKI. Business drivers helps to document alignment with the overall organizational goals.\n\nThe scope and business drivers can be considered as a formal high-level overview of the PKI strategy and vision.\nIts purpose is also to create a common understanding of the organizational PKI and to provide direction for the detailed design and implementation.\nThe target audience consists typically of architects, experts, advisors, management, and sponsors."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$M$15:$M$300,source!$L$15:$L$300=_xlfn.CONCAT($C18,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• Documented scope of the PKI\n• Documented business drivers\n• Documented use-cases\n• Documented alignment with the organizational goals"},"Initial",{"$nulls":4},{"$f":"IF(I18=\"\",0,VLOOKUP(I18,tech!$A$13:$B$17,2,0))*E18","v":2},{"$f":"IF(D18=\"\",\"\",IF(B18=0,tech!$B$9,IF(AND(B18=1,N18=0),tech!$B$21,I18)))","v":"Initial"}]
[null,{"$f":"IF(B$13=0,0,IF(F19=tech!$B$9,0,1))","v":1},"1.1.4.",{"$f":"IFERROR(VLOOKUP(C19,source!$J$4:$L$13,3,0),\"\")","v":"Architecture and design of the PKI"},{"$f":"IFERROR(VLOOKUP(C19,source!$J$4:$L$13,2,0),0)*B19","v":1},{"$f":"IF(Scoping!K13=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$M$15:$M$300,source!$L$15:$L$300=_xlfn.CONCAT($C19,LEFT(G$15,1),\"Y\"),\"\"))","v":"The architecture and design of the PKI should be documented to provide a clear understanding of the implementation and technologies that are involved. The architecture and design should be aligned with the scope and business drivers for the PKI and should be reviewed and updated regularly.\n\nThe architecture and design typically consists of the following:\n• Functional and technical design description\n• description of logical components\n• Network infrastructure design\n• Technology involved\n• Integration requirements and interfaces (APIs)\n• Support systems (such as IAM, logging, monitoring, etc.)\n• operational requirements\n• Security requirements\n• Deployment options\n• Staging and testing\n\nThe architecture and design are further used for the implementation of the PKI and serves as an input for the PKI team. It can be also used for the procurement of the PKI components and services that are needed for the implementation."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$M$15:$M$300,source!$L$15:$L$300=_xlfn.CONCAT($C19,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• Documented architecture and design\n• alignment with the scope and business drivers\n• Interview with the PKI team to confirm the Understanding of the architecture and design"},"Initial",{"$nulls":4},{"$f":"IF(I19=\"\",0,VLOOKUP(I19,tech!$A$13:$B$17,2,0))*E19","v":1},{"$f":"IF(D19=\"\",\"\",IF(B19=0,tech!$B$9,IF(AND(B19=1,N19=0),tech!$B$21,I19)))","v":"Initial"}]
[null,{"$f":"IF(B$13=0,0,IF(F20=tech!$B$9,0,1))","v":1},"1.1.5.",{"$f":"IFERROR(VLOOKUP(C20,source!$J$4:$L$13,3,0),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(C20,source!$J$4:$L$13,2,0),0)*B20","v":0},{"$f":"IF(Scoping!K14=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$M$15:$M$300,source!$L$15:$L$300=_xlfn.CONCAT($C20,LEFT(G$15,1),\"Y\"),\"\"))","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$M$15:$M$300,source!$L$15:$L$300=_xlfn.CONCAT($C20,LEFT(H$15,1),\"Y\"),\"\"))","v":""},{"$nulls":5},{"$f":"IF(I20=\"\",0,VLOOKUP(I20,tech!$A$13:$B$17,2,0))*E20","v":0},{"$f":"IF(D20=\"\",\"\",IF(B20=0,tech!$B$9,IF(AND(B20=1,N20=0),tech!$B$21,I20)))","v":""}]
[null,{"$f":"IF(B$13=0,0,IF(F21=tech!$B$9,0,1))","v":1},"1.1.6.",{"$f":"IFERROR(VLOOKUP(C21,source!$J$4:$L$13,3,0),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(C21,source!$J$4:$L$13,2,0),0)*B21","v":0},{"$f":"IF(Scoping!K15=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$M$15:$M$300,source!$L$15:$L$300=_xlfn.CONCAT($C21,LEFT(G$15,1),\"Y\"),\"\"))","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$M$15:$M$300,source!$L$15:$L$300=_xlfn.CONCAT($C21,LEFT(H$15,1),\"Y\"),\"\"))","v":""},{"$nulls":5},{"$f":"IF(I21=\"\",0,VLOOKUP(I21,tech!$A$13:$B$17,2,0))*E21","v":0},{"$f":"IF(D21=\"\",\"\",IF(B21=0,tech!$B$9,IF(AND(B21=1,N21=0),tech!$B$21,I21)))","v":""}]
[]
[null,null,{"$f":"tech!A118","v":"1.2. Policies and documentation"},null,"Weight",{"$f":"IF(B24=0,tech!$A$9,\"\")","v":""}]
[null,{"$f":"IF(Scoping!F16=tech!$A$5,0,1)","v":1},null,null,{"$f":"VLOOKUP(C23,tech!$A$117:$B$131,2,0)*B24","v":4},{"$nulls":8},{"$f":"IF(SUM(B27:B32)=0,0,TRUNC(SUM(N27:N32)/SUM(E27:E32),0))","v":2}]
[]
[null,null,"#","Requirement","Weight","N/A","Guidance","Assessment","Maturity level","Notes","Notes","Evidence","Evidence"]
[null,{"$f":"IF(B$24=0,0,IF(F27=tech!$B$9,0,1))","v":1},"1.2.1.",{"$f":"IFERROR(VLOOKUP(C27,source!$P$4:$R$13,3,0),\"\")","v":"The scope of policies is defined and documented"},{"$f":"IFERROR(VLOOKUP(C27,source!$P$4:$R$13,2,0),0)*B27","v":2},{"$f":"IF(Scoping!K16=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$S$15:$S$300,source!$R$15:$R$300=_xlfn.CONCAT($C27,LEFT(G$15,1),\"Y\"),\"\"))","v":"Each PKI implementation and use case is different, therefore it requires different care. The scope of policies that are applicable for the implementation should be defined and documented. When the proper description of the policies scope is provided, it helps all parties involved to understand the purpose of the policies and their applicability.\n\nThe scope can include the following:\n• Identification of the policies required for the implementation\n• Reasoning why the policies are required or not required\n• Structure of policies and documentation\n• List of policies with references, versions, etc.\n• any other relevant information"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$S$15:$S$300,source!$R$15:$R$300=_xlfn.CONCAT($C27,LEFT(H$15,1),\"Y\"),\"\"))","v":"• the scope of policies is defined and Documented\n• the scope of policies is complete\n• Interview with the management and PKI responsible personnel to confirm the scope"},"Basic",{"$nulls":4},{"$f":"IF(I27=\"\",0,VLOOKUP(I27,tech!$A$13:$B$17,2,0))*E27","v":4},{"$f":"IF(D27=\"\",\"\",IF(B27=0,tech!$B$9,IF(AND(B27=1,N27=0),tech!$B$21,I27)))","v":"Basic"}]
[null,{"$f":"IF(B$24=0,0,IF(F28=tech!$B$9,0,1))","v":1},"1.2.2.",{"$f":"IFERROR(VLOOKUP(C28,source!$P$4:$R$13,3,0),\"\")","v":"Certificate Policy is documented and published"},{"$f":"IFERROR(VLOOKUP(C28,source!$P$4:$R$13,2,0),0)*B28","v":5},{"$f":"IF(Scoping!K17=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$S$15:$S$300,source!$R$15:$R$300=_xlfn.CONCAT($C28,LEFT(G$15,1),\"Y\"),\"\"))","v":"Certificate Policy (CP) is used to establish the controls of the issuing party and the roles and responsibilities of its entities for the specific PKI implementation and use case. It's used to provide assurance to partners and show the trustworthiness by the use of standards. It can be considered as a high level contract between the parties involved in the PKI and therefore should be published and available to all parties involved.\n\nCPs are described in a document form where the content may differ. Multiple policies can be part of a single document for different use cases. A CP contains a set of rules that indicates the applicability of a certificate to a particular community and/or class of applications with common security requirements or level of security (for instance certificates for the purpose of: persons, domains, organizations, authenticity and confidentiality, services). To uniquely identify the purpose of the certificates the CP contains unique numbers (Object Identifier, OID) which needs to be registered.\n\nIn general a CP addresses the following items:\n• types of certificates\n• Document name and Identification\n• PKI participants\n• certificate usage\n• policy administration\n• Definitions\n• Publication and repository responsibilities\n• Identification and authentication\n• certificate life-cycle operational requirements\n• Facility management and operational controls\n• technical Security controls\n• Certificate, CRL, and OCSP profiles\n• compliance audit and other assessments\n• other business and legal matters"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$S$15:$S$300,source!$R$15:$R$300=_xlfn.CONCAT($C28,LEFT(H$15,1),\"Y\"),\"\"))","v":"• the CP is properly Documented in its full scope\n• The CP clearly defines the scope of the policy, such as the purpose of the security and assurance levels, the type and use of its certificates and parties involved\n• the legal rights and responsibilities of parties are described in the CP\n• CP has listed correct object identifiers for the purpose it's used for\n• Verify that the CP is published and available to all parties involved\n• Interview with the management and PKI responsible personnel to confirm the CP is accurate and followed"},"Basic",{"$nulls":4},{"$f":"IF(I28=\"\",0,VLOOKUP(I28,tech!$A$13:$B$17,2,0))*E28","v":10},{"$f":"IF(D28=\"\",\"\",IF(B28=0,tech!$B$9,IF(AND(B28=1,N28=0),tech!$B$21,I28)))","v":"Basic"}]
[null,{"$f":"IF(B$24=0,0,IF(F29=tech!$B$9,0,1))","v":1},"1.2.3.",{"$f":"IFERROR(VLOOKUP(C29,source!$P$4:$R$13,3,0),\"\")","v":"Certification Practice Statement is documented and published"},{"$f":"IFERROR(VLOOKUP(C29,source!$P$4:$R$13,2,0),0)*B29","v":5},{"$f":"IF(Scoping!K18=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$S$15:$S$300,source!$R$15:$R$300=_xlfn.CONCAT($C29,LEFT(G$15,1),\"Y\"),\"\"))","v":"In addition to a CP, there is typically a Certification Practice Statement (CPS). While a CP is more at a strategic level, detailed information about how things should be carried out is part of a CPS (tactical level). The CP and CPS can be combined into a single managed document, however they are typically split for most of the PKI implementations for better orientation.\n\nThe CPS covers the same items as the CP, but includes technical detail of how the CP is implemented. All parties involved in the PKI should be aware of the CPS and follow it. The CPS is a living document that is continuously updated and changed as technologies, security, and compliance requirements change."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$S$15:$S$300,source!$R$15:$R$300=_xlfn.CONCAT($C29,LEFT(H$15,1),\"Y\"),\"\"))","v":"• the CPS is properly Documented in its full scope\n• CPS is published and available to all parties involved\n• Interview with the management and PKI responsible personnel to confirm the CPS is accurate and followed\n• confirm that the information in the CPS is Consistent with the information in the CP"},"Basic",{"$nulls":4},{"$f":"IF(I29=\"\",0,VLOOKUP(I29,tech!$A$13:$B$17,2,0))*E29","v":10},{"$f":"IF(D29=\"\",\"\",IF(B29=0,tech!$B$9,IF(AND(B29=1,N29=0),tech!$B$21,I29)))","v":"Basic"}]
[null,{"$f":"IF(B$24=0,0,IF(F30=tech!$B$9,0,1))","v":1},"1.2.4.",{"$f":"IFERROR(VLOOKUP(C30,source!$P$4:$R$13,3,0),\"\")","v":"Disclosure statement is documented and published"},{"$f":"IFERROR(VLOOKUP(C30,source!$P$4:$R$13,2,0),0)*B30","v":4},{"$f":"IF(Scoping!K19=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$S$15:$S$300,source!$R$15:$R$300=_xlfn.CONCAT($C30,LEFT(G$15,1),\"Y\"),\"\"))","v":"The disclosure statement (DS) is a document that describes the PKI and its services. It refers to a document that discloses the relevant information about the CA and its services to the relying parties.\n\nIt typically includes information like:\n• CA's identity, legal status, and contact information\n• Certificate types, verification procedures and compliance with standards\n• Reliance limits\n• Obligations of the CA and the relying parties\n• Warranty and liability limitations\n• Agreement, CP and CPS\n• Privacy policy\n• Refund policy and claims\n• information on audit and compliance\n\nThe purpose of a DS is to provide transparency to relying parties, allowing them to assess the trustworthiness and reliability of the CA before relying on its certificates."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$S$15:$S$300,source!$R$15:$R$300=_xlfn.CONCAT($C30,LEFT(H$15,1),\"Y\"),\"\"))","v":"• the DS is properly Documented in its full scope\n• DS is published and available to all parties involved\n• Interview with the management and PKI responsible personnel to confirm the DS is accurate\n• confirm that the information in the DS is Consistent with the information in the CP and CPS"},"Basic",{"$nulls":4},{"$f":"IF(I30=\"\",0,VLOOKUP(I30,tech!$A$13:$B$17,2,0))*E30","v":8},{"$f":"IF(D30=\"\",\"\",IF(B30=0,tech!$B$9,IF(AND(B30=1,N30=0),tech!$B$21,I30)))","v":"Basic"}]
[null,{"$f":"IF(B$24=0,0,IF(F31=tech!$B$9,0,1))","v":1},"1.2.5.",{"$f":"IFERROR(VLOOKUP(C31,source!$P$4:$R$13,3,0),\"\")","v":"Policies are periodically reviewed and updated"},{"$f":"IFERROR(VLOOKUP(C31,source!$P$4:$R$13,2,0),0)*B31","v":3},{"$f":"IF(Scoping!K20=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$S$15:$S$300,source!$R$15:$R$300=_xlfn.CONCAT($C31,LEFT(G$15,1),\"Y\"),\"\"))","v":"Policies are living documents that are continuously updated and changed as technologies, security, and compliance requirements change. The policies should be reviewed and updated periodically. The frequency of review should be determined by the organization. Good practice is to review policies at least annually or when there are significant changes in the PKI or its environment."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$S$15:$S$300,source!$R$15:$R$300=_xlfn.CONCAT($C31,LEFT(H$15,1),\"Y\"),\"\"))","v":"• the policies are reviewed and updated periodically\n• Check the last review date of the policies\n• implementation of review process\n• Validation of documentation and reviews\n• Interview with the management and PKI responsible personnel to confirm the policies are reviewed and updated periodically"},"Basic",{"$nulls":4},{"$f":"IF(I31=\"\",0,VLOOKUP(I31,tech!$A$13:$B$17,2,0))*E31","v":6},{"$f":"IF(D31=\"\",\"\",IF(B31=0,tech!$B$9,IF(AND(B31=1,N31=0),tech!$B$21,I31)))","v":"Basic"}]
[null,{"$f":"IF(B$24=0,0,IF(F32=tech!$B$9,0,1))","v":1},"1.2.6.",{"$f":"IFERROR(VLOOKUP(C32,source!$P$4:$R$13,3,0),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(C32,source!$P$4:$R$13,2,0),0)*B32","v":0},{"$f":"IF(Scoping!K21=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$S$15:$S$300,source!$R$15:$R$300=_xlfn.CONCAT($C32,LEFT(G$15,1),\"Y\"),\"\"))","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$S$15:$S$300,source!$R$15:$R$300=_xlfn.CONCAT($C32,LEFT(H$15,1),\"Y\"),\"\"))","v":""},"Basic",{"$nulls":4},{"$f":"IF(I32=\"\",0,VLOOKUP(I32,tech!$A$13:$B$17,2,0))*E32","v":0},{"$f":"IF(D32=\"\",\"\",IF(B32=0,tech!$B$9,IF(AND(B32=1,N32=0),tech!$B$21,I32)))","v":""}]
[]
[null,null,{"$f":"tech!A119","v":"1.3. Compliance"},null,"Weight",{"$f":"IF(B35=0,tech!$A$9,\"\")","v":""}]
[null,{"$f":"IF(Scoping!F22=tech!$A$5,0,1)","v":1},null,null,{"$f":"VLOOKUP(C34,tech!$A$117:$B$131,2,0)*B35","v":2},{"$nulls":8},{"$f":"IF(SUM(B38:B43)=0,0,TRUNC(SUM(N38:N43)/SUM(E38:E43),0))","v":2}]
[]
[null,null,"#","Requirement","Weight","N/A","Guidance","Assessment","Maturity level","Notes","Notes","Evidence","Evidence"]
[null,{"$f":"IF(B$35=0,0,IF(F38=tech!$B$9,0,1))","v":1},"1.3.1.",{"$f":"IFERROR(VLOOKUP(C38,source!$V$4:$X$13,3,0),\"\")","v":"Compliance policies are defined, implemented, and communicated"},{"$f":"IFERROR(VLOOKUP(C38,source!$V$4:$X$13,2,0),0)*B38","v":3},{"$f":"IF(Scoping!K22=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$Y$15:$Y$300,source!$X$15:$X$300=_xlfn.CONCAT($C38,LEFT(G$15,1),\"Y\"),\"\"))","v":"Compliance policies are a critical component of an organization’s risk management strategy to help ensure that the PKI system is secure, reliable, trustworthy, and meets any applicable regulatory requirements.\n\nBy defining appropriate policies and related procedures and communicating these to all stakeholders who rely on the PKI, the organization can ensure that administrators, operators, and users are properly authenticated and authorized to access the system and that appropriate controls are in place to prevent unauthorized access or misuse of the PKI.\n\nHaving a sound set of compliance policies defined, implemented, and communicated can help to demonstrate that the organization took reasonable steps to protect the PKI and may result in reduced legal liability in the event of a breach due to improper or malicious use of the PKI.\n\nThe compliance policies typically include:\n• Laws, industry regulations and government legislation that apply to the organization business and PKI\n• Roles and responsibilities\n• Compliance program management requirements\n• Reporting and auditing requirements\n• References to relevant documents (anti-trust, anti-fraud, anti-bribery, anti-money laundering, due diligence, etc.)\n• Any other relevant information that rule Compliance"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$Y$15:$Y$300,source!$X$15:$X$300=_xlfn.CONCAT($C38,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Documented audit and accountability policies\n• Documented communication plan for informing stakeholders of the policies\n• Formalized process for stakeholder acknowledgement upon receipt of the policies"},"Basic",{"$nulls":4},{"$f":"IF(I38=\"\",0,VLOOKUP(I38,tech!$A$13:$B$17,2,0))*E38","v":6},{"$f":"IF(D38=\"\",\"\",IF(B38=0,tech!$B$9,IF(AND(B38=1,N38=0),tech!$B$21,I38)))","v":"Basic"}]
[null,{"$f":"IF(B$35=0,0,IF(F39=tech!$B$9,0,1))","v":1},"1.3.2.",{"$f":"IFERROR(VLOOKUP(C39,source!$V$4:$X$13,3,0),\"\")","v":"A program to monitor compliance with the policies is established"},{"$f":"IFERROR(VLOOKUP(C39,source!$V$4:$X$13,2,0),0)*B39","v":4},{"$f":"IF(Scoping!K23=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$Y$15:$Y$300,source!$X$15:$X$300=_xlfn.CONCAT($C39,LEFT(G$15,1),\"Y\"),\"\"))","v":"A PKI compliance monitoring program typically involves ongoing monitoring and testing of the controls and procedures to detect potential compliance violations associated with rules and regulations that govern the issuance, update, or revocation of certificates.\n\nThese programs often include a risk assessment to identify and assess potential risks that could lead to non-compliance, including regulatory changes, operational changes, or employee turnover.\n\nThe monitoring process may include reviewing documentation, conducting interviews with key stakeholders, and reporting any issues or compliance violations.  Reporting from compliance monitoring should be communicated to those stakeholders who committed the violation(s) and those stakeholders who are empowered to take corrective action to address the violations observed."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$Y$15:$Y$300,source!$X$15:$X$300=_xlfn.CONCAT($C39,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Documented practices regarding periodic and aperiodic compliance assessments\n• Documented practices for regularly review and reporting of security issues\n• Documented and implemented processes for investigation and response to suspicious activities"},"Basic",{"$nulls":4},{"$f":"IF(I39=\"\",0,VLOOKUP(I39,tech!$A$13:$B$17,2,0))*E39","v":8},{"$f":"IF(D39=\"\",\"\",IF(B39=0,tech!$B$9,IF(AND(B39=1,N39=0),tech!$B$21,I39)))","v":"Basic"}]
[null,{"$f":"IF(B$35=0,0,IF(F40=tech!$B$9,0,1))","v":1},"1.3.3.",{"$f":"IFERROR(VLOOKUP(C40,source!$V$4:$X$13,3,0),\"\")","v":"Responsibilities for the compliance are formally defined and assigned"},{"$f":"IFERROR(VLOOKUP(C40,source!$V$4:$X$13,2,0),0)*B40","v":3},{"$f":"IF(Scoping!K24=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$Y$15:$Y$300,source!$X$15:$X$300=_xlfn.CONCAT($C40,LEFT(G$15,1),\"Y\"),\"\"))","v":"Within the organization, there should exist clear and well documented guidelines outlining which individual, group or team is responsible for ensuring that PKI policies are being followed. This applies to governance and oversight in addition to operational policies and procedures.\n\nDocumenting specifically \"who\" shall be responsible for ensuring PKI policies are being enforced enhances accountability and trustworthiness of the PKI by enforcing the mentality that \"someone is watching\".  This will help to mitigate risks associated with improper or malicious acts."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$Y$15:$Y$300,source!$X$15:$X$300=_xlfn.CONCAT($C40,LEFT(H$15,1),\"Y\"),\"\"))","v":"• For each defined procedure, a specific individual or team is identified and assigned to perform the tasks associated with the procedure\n• Interview with the personnel to confirm understanding of the role and responsibilities"},"Basic",{"$nulls":4},{"$f":"IF(I40=\"\",0,VLOOKUP(I40,tech!$A$13:$B$17,2,0))*E40","v":6},{"$f":"IF(D40=\"\",\"\",IF(B40=0,tech!$B$9,IF(AND(B40=1,N40=0),tech!$B$21,I40)))","v":"Basic"}]
[null,{"$f":"IF(B$35=0,0,IF(F41=tech!$B$9,0,1))","v":1},"1.3.4.",{"$f":"IFERROR(VLOOKUP(C41,source!$V$4:$X$13,3,0),\"\")","v":"List of relevant laws, regulations, and standards, exist and is maintained"},{"$f":"IFERROR(VLOOKUP(C41,source!$V$4:$X$13,2,0),0)*B41","v":5},{"$f":"IF(Scoping!K25=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$Y$15:$Y$300,source!$X$15:$X$300=_xlfn.CONCAT($C41,LEFT(G$15,1),\"Y\"),\"\"))","v":"To better understand the relevance to PKI, one should understand the differences between laws, regulations, and standards.\n\nLaws are legal rules that are enacted by a governing body, such as a federal, state or local government.  They are binding and enforceable by the legal system within the jurisdiction of the governing body that enacted them.  Violating law can lead to legal consequences, such as fines or imprisonment.\n\nRegulations are derived from laws and are often meant to supplement and clarify the broader provisions outlined in the laws.  Compliance with regulations is mandatory and non-compliance can result in penalties or other legal consequences.\n\nStandards are voluntary guidelines or specifications typically established by a particular industry group or standards organization.  Standards usually define best practices, technical specifications, quality benchmarks, and other criteria and are meant as a means of ensuring consistency, interoperability, and quality.  Typically, compliance with standards is not legally required, however, lack of conformance to standards can lead to diminished interoperability and reduced trust.\n\nWith respect to PKI, it is very important to understand what laws, regulations and standards are relevant to the PKI and its ancillary systems.  For example, given that PKI involves cryptography, one must be certain to adhere to government laws regarding use and deployment of cryptographic products and solutions.\n\nAnd, many times, a PKI will make use of hardware cryptographic modules for key generation and storage.  Therefore, it’s critical to ensure that the hardware cryptographic modules comply with the relevant standards. There are many laws, regulations and standards that apply to PKI.  As such, it is necessary to maintain a list of the ones that are relevant to your organization to help ensure that none are being overlooked."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$Y$15:$Y$300,source!$X$15:$X$300=_xlfn.CONCAT($C41,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Documented list of applicable laws, regulations and standards is maintained\n• Procedures established for periodic review of the laws, regulations and standards\n• Procedures established to remediate Any deficiencies or non-Compliance issues identified\n• Procedures established to communicate results of the periodic reviews"},"Basic",{"$nulls":4},{"$f":"IF(I41=\"\",0,VLOOKUP(I41,tech!$A$13:$B$17,2,0))*E41","v":10},{"$f":"IF(D41=\"\",\"\",IF(B41=0,tech!$B$9,IF(AND(B41=1,N41=0),tech!$B$21,I41)))","v":"Basic"}]
[null,{"$f":"IF(B$35=0,0,IF(F42=tech!$B$9,0,1))","v":1},"1.3.5.",{"$f":"IFERROR(VLOOKUP(C42,source!$V$4:$X$13,3,0),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(C42,source!$V$4:$X$13,2,0),0)*B42","v":0},{"$f":"IF(Scoping!K26=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$Y$15:$Y$300,source!$X$15:$X$300=_xlfn.CONCAT($C42,LEFT(G$15,1),\"Y\"),\"\"))","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$Y$15:$Y$300,source!$X$15:$X$300=_xlfn.CONCAT($C42,LEFT(H$15,1),\"Y\"),\"\"))","v":""},"Basic",{"$nulls":4},{"$f":"IF(I42=\"\",0,VLOOKUP(I42,tech!$A$13:$B$17,2,0))*E42","v":0},{"$f":"IF(D42=\"\",\"\",IF(B42=0,tech!$B$9,IF(AND(B42=1,N42=0),tech!$B$21,I42)))","v":""}]
[null,{"$f":"IF(B$35=0,0,IF(F43=tech!$B$9,0,1))","v":1},"1.3.6.",{"$f":"IFERROR(VLOOKUP(C43,source!$V$4:$X$13,3,0),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(C43,source!$V$4:$X$13,2,0),0)*B43","v":0},{"$f":"IF(Scoping!K27=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$Y$15:$Y$300,source!$X$15:$X$300=_xlfn.CONCAT($C43,LEFT(G$15,1),\"Y\"),\"\"))","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$Y$15:$Y$300,source!$X$15:$X$300=_xlfn.CONCAT($C43,LEFT(H$15,1),\"Y\"),\"\"))","v":""},"Basic",{"$nulls":4},{"$f":"IF(I43=\"\",0,VLOOKUP(I43,tech!$A$13:$B$17,2,0))*E43","v":0},{"$f":"IF(D43=\"\",\"\",IF(B43=0,tech!$B$9,IF(AND(B43=1,N43=0),tech!$B$21,I43)))","v":""}]
[]
[null,null,{"$f":"tech!A120","v":"1.4. Processes and procedures"},null,"Weight",{"$f":"IF(B46=0,tech!$A$9,\"\")","v":""}]
[null,{"$f":"IF(Scoping!F28=tech!$A$5,0,1)","v":1},null,null,{"$f":"VLOOKUP(C45,tech!$A$117:$B$131,2,0)*B46","v":3},{"$nulls":8},{"$f":"IF(SUM(B49:B54)=0,0,TRUNC(SUM(N49:N54)/SUM(E49:E54),0))","v":3}]
[]
[null,null,"#","Requirement","Weight","N/A","Guidance","Assessment","Maturity level","Notes","Notes","Evidence","Evidence"]
[null,{"$f":"IF(B$46=0,0,IF(F49=tech!$B$9,0,1))","v":1},"1.4.1.",{"$f":"IFERROR(VLOOKUP(C49,source!$AB$4:$AD$13,3,0),\"\")","v":"Scope of processes and procedure is aligned with policies"},{"$f":"IFERROR(VLOOKUP(C49,source!$AB$4:$AD$13,2,0),0)*B49","v":4},{"$f":"IF(Scoping!K28=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AE$15:$AE$300,source!$AD$15:$AD$300=_xlfn.CONCAT($C49,LEFT(G$15,1),\"Y\"),\"\"))","v":"The scope of the processes and procedures should be aligned with the policies and statements. Each implementation and use case can have different scope, but the scope should be defined and documented, with all applicable processes, procedures, and eventually instructions.\n\nThe alignment with the policies helps to ensure that the processes and procedures are aligned with the PKI implementation goals and needs, and can be effectively trusted over the time. A simple matrix can be used to ensure that all applicable policies and statements are covered by the processes and procedures.\n\nThe completeness of the processes and procedures can be evaluated by the risk assessment, audit, or by the feedback from the users."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AE$15:$AE$300,source!$AD$15:$AD$300=_xlfn.CONCAT($C49,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is a sample evidence and information that can be collected during the assessment:\n• Documented scope of the processes and procedures\n• alignment with the PKI policies and statements\n• Interview with the PKI management"},"Advanced",{"$nulls":4},{"$f":"IF(I49=\"\",0,VLOOKUP(I49,tech!$A$13:$B$17,2,0))*E49","v":12},{"$f":"IF(D49=\"\",\"\",IF(B49=0,tech!$B$9,IF(AND(B49=1,N49=0),tech!$B$21,I49)))","v":"Advanced"}]
[null,{"$f":"IF(B$46=0,0,IF(F50=tech!$B$9,0,1))","v":1},"1.4.2.",{"$f":"IFERROR(VLOOKUP(C50,source!$AB$4:$AD$13,3,0),\"\")","v":"Processes and procedures are formally documented and followed"},{"$f":"IFERROR(VLOOKUP(C50,source!$AB$4:$AD$13,2,0),0)*B50","v":3},{"$f":"IF(Scoping!K29=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AE$15:$AE$300,source!$AD$15:$AD$300=_xlfn.CONCAT($C50,LEFT(G$15,1),\"Y\"),\"\"))","v":"Identified processes and procedures needs to be properly designed and documented with all relevant information like scope, purpose, inputs, outputs, roles and responsibilities, and other. The processes and procedures should be also reviewed and approved by the management.\n\nOnce the processes and procedures are published, appropriate training is required to ensure they are followed by the PKI management and staff. Without following the processes and procedures, the PKI can be exposed to the risks and threats, and eventually lose any established trust."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AE$15:$AE$300,source!$AD$15:$AD$300=_xlfn.CONCAT($C50,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence and information that can be collected during the assessment:\n• Documented processes and procedures\n• Completeness of the processes and procedures documentation\n• Evidence of the processes and procedures usage\n• Interview with the PKI management and staff\n• Training materials covering the processes and procedures"},"Advanced",{"$nulls":4},{"$f":"IF(I50=\"\",0,VLOOKUP(I50,tech!$A$13:$B$17,2,0))*E50","v":9},{"$f":"IF(D50=\"\",\"\",IF(B50=0,tech!$B$9,IF(AND(B50=1,N50=0),tech!$B$21,I50)))","v":"Advanced"}]
[null,{"$f":"IF(B$46=0,0,IF(F51=tech!$B$9,0,1))","v":1},"1.4.3.",{"$f":"IFERROR(VLOOKUP(C51,source!$AB$4:$AD$13,3,0),\"\")","v":"Recurring activities are executed on time"},{"$f":"IFERROR(VLOOKUP(C51,source!$AB$4:$AD$13,2,0),0)*B51","v":5},{"$f":"IF(Scoping!K30=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AE$15:$AE$300,source!$AD$15:$AD$300=_xlfn.CONCAT($C51,LEFT(G$15,1),\"Y\"),\"\"))","v":"Recurring activities are the activities that are performed on a regular basis, such as certificate management operations, backup procedures, security reviews, risk assessment, reviews of logs and security events, and other.\n\nEach activity should be tracked and have a frequency defined, for example, some activities may be performed daily, weekly, monthly, quarterly, or yearly. The activities should be performed on time, and any delays should be properly tracked and reported.\n\nRecurring activities needs to be incorporated into the processes and procedures to support the PKI implementation."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AE$15:$AE$300,source!$AD$15:$AD$300=_xlfn.CONCAT($C51,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence and information that can be collected during the assessment:\n• Documented business as usual activities\n• Evidence of the business as usual activities execution\n• business as usual activities tracking and Reporting\n• Calendar of activities\n• Interview with the PKI management and staff"},"Optimized",{"$nulls":4},{"$f":"IF(I51=\"\",0,VLOOKUP(I51,tech!$A$13:$B$17,2,0))*E51","v":25},{"$f":"IF(D51=\"\",\"\",IF(B51=0,tech!$B$9,IF(AND(B51=1,N51=0),tech!$B$21,I51)))","v":"Optimized"}]
[null,{"$f":"IF(B$46=0,0,IF(F52=tech!$B$9,0,1))","v":1},"1.4.4.",{"$f":"IFERROR(VLOOKUP(C52,source!$AB$4:$AD$13,3,0),\"\")","v":"Evidence from procedures is collected and maintained"},{"$f":"IFERROR(VLOOKUP(C52,source!$AB$4:$AD$13,2,0),0)*B52","v":3},{"$f":"IF(Scoping!K31=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AE$15:$AE$300,source!$AD$15:$AD$300=_xlfn.CONCAT($C52,LEFT(G$15,1),\"Y\"),\"\"))","v":"Each process, procedure, instruction, or activity would not be effective without evidence confirming that it was performed. The evidence should be descriptive with all relevant information, such as date and time, who performed the activity, what was the result, and other information, if needed. \n\nThe evidence can be collected and maintained in various forms, such as logs, reports, notes, screenshots, etc. The evidence should be collected and maintained for the defined period of time, and should be available for the audit or other purposes."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AE$15:$AE$300,source!$AD$15:$AD$300=_xlfn.CONCAT($C52,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence and information that can be collected during the assessment:\n• Evidence of the execution of the processes and procedures\n• Interview with the PKI management and staff\n• Logs, reports, notes, screenshots, and other evidence"},"Advanced",{"$nulls":4},{"$f":"IF(I52=\"\",0,VLOOKUP(I52,tech!$A$13:$B$17,2,0))*E52","v":9},{"$f":"IF(D52=\"\",\"\",IF(B52=0,tech!$B$9,IF(AND(B52=1,N52=0),tech!$B$21,I52)))","v":"Advanced"}]
[null,{"$f":"IF(B$46=0,0,IF(F53=tech!$B$9,0,1))","v":1},"1.4.5.",{"$f":"IFERROR(VLOOKUP(C53,source!$AB$4:$AD$13,3,0),\"\")","v":"Processes and procedures are reviewed and updated"},{"$f":"IFERROR(VLOOKUP(C53,source!$AB$4:$AD$13,2,0),0)*B53","v":2},{"$f":"IF(Scoping!K32=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AE$15:$AE$300,source!$AD$15:$AD$300=_xlfn.CONCAT($C53,LEFT(G$15,1),\"Y\"),\"\"))","v":"The processes and procedures should be reviewed and updated on a regular basis, based on the feedback, risk assessment, audit, or other. The review should be performed by the management, and the updates should be approved by the management.\n\nThe review and update of the processes and procedures helps to keep the PKI implementation up to date, and helps to ensure that the processes and procedures are effective and efficient."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AE$15:$AE$300,source!$AD$15:$AD$300=_xlfn.CONCAT($C53,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence and information that can be collected during the assessment:\n• Documented review and update process\n• Evidence of the review and update of the processes and procedures\n• Interview with the PKI management and staff"},"Managed",{"$nulls":4},{"$f":"IF(I53=\"\",0,VLOOKUP(I53,tech!$A$13:$B$17,2,0))*E53","v":8},{"$f":"IF(D53=\"\",\"\",IF(B53=0,tech!$B$9,IF(AND(B53=1,N53=0),tech!$B$21,I53)))","v":"Managed"}]
[null,{"$f":"IF(B$46=0,0,IF(F54=tech!$B$9,0,1))","v":1},"1.4.6.",{"$f":"IFERROR(VLOOKUP(C54,source!$AB$4:$AD$13,3,0),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(C54,source!$AB$4:$AD$13,2,0),0)*B54","v":0},{"$f":"IF(Scoping!K33=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AE$15:$AE$300,source!$AD$15:$AD$300=_xlfn.CONCAT($C54,LEFT(G$15,1),\"Y\"),\"\"))","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AE$15:$AE$300,source!$AD$15:$AD$300=_xlfn.CONCAT($C54,LEFT(H$15,1),\"Y\"),\"\"))","v":""},{"$nulls":5},{"$f":"IF(I54=\"\",0,VLOOKUP(I54,tech!$A$13:$B$17,2,0))*E54","v":0},{"$f":"IF(D54=\"\",\"\",IF(B54=0,tech!$B$9,IF(AND(B54=1,N54=0),tech!$B$21,I54)))","v":""}]
[]
[]
[null,null,"2. Management",null,null,{"$f":"IF(AND(B62=0,B73=0,B85=0,B96=0),tech!$A$9,\"\")","v":""}]
[{"$nulls":13},{"$f":"IF(SUM(E62,E73,E85,E96)=0,0,TRUNC((IF(B62=0,0,SUM(N65:N70)/SUM(E65:E70)*E62)+IF(B73=0,0,SUM(N76:N82)/SUM(E76:E82)*E73)+IF(B85=0,0,SUM(N88:N93)/SUM(E88:E93)*E85)+IF(B96=0,0,SUM(N99:N104)/SUM(E99:E104)*E96))/SUM(E62,E73,E85,E96),0))","v":2}]
[{"$nulls":13},{"$f":"IF(SUM(E62,E73,E85,E96)=0,0,(IF(B62=0,0,SUM(N65:N70)/SUM(E65:E70)*E62)+IF(B73=0,0,SUM(N76:N82)/SUM(E76:E82)*E73)+IF(B85=0,0,SUM(N88:N93)/SUM(E88:E93)*E85)+IF(B96=0,0,SUM(N99:N104)/SUM(E99:E104)*E96))/SUM(E62,E73,E85,E96))","v":2.9057199211045366}]
[]
[null,null,{"$f":"tech!A121","v":"2.1. Key Management"},null,"Weight",{"$f":"IF(B62=0,tech!$A$9,\"\")","v":""}]
[null,{"$f":"IF(Scoping!F34=tech!$A$5,0,1)","v":1},null,null,{"$f":"VLOOKUP(C61,tech!$A$117:$B$131,2,0)*B62","v":4},{"$nulls":8},{"$f":"IF(SUM(B65:B70)=0,0,TRUNC(SUM(N65:N70)/SUM(E65:E70),0))","v":3}]
[]
[null,null,"#","Requirement","Weight","N/A","Guidance","Assessment","Maturity level","Notes",null,"Evidence"]
[null,{"$f":"IF(B$62=0,0,IF(F65=tech!$B$9,0,1))","v":1},"2.1.1.",{"$f":"IFERROR(VLOOKUP(C65,source!$AH$4:$AJ$13,3,0),\"\")","v":"Key management roles and responsibilities are documented and formally assigned"},{"$f":"IFERROR(VLOOKUP(C65,source!$AH$4:$AJ$13,2,0),0)*B65","v":2},{"$f":"IF(Scoping!K34=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AK$15:$AK$300,source!$AJ$15:$AJ$300=_xlfn.CONCAT($C65,LEFT(G$15,1),\"Y\"),\"\"))","v":"Proper definition of roles and responsibilities for key management operations establishes a good basis for accountability and auditing. The roles and responsibilities should follow key management policy, principles, and boundaries.\n\nPersonnel should be formally assigned to the role based on appropriate skills, and background check to ensure that there are no external risks associated that can cause potential compromise of key management.\n\nNaming or assignment records should contain relevant information such as:\n• Identification of personnel\n• Role to be assigned\n• Date of appointment\n• Confirmation of required skills\n• Acknowledgment of responsibilities"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AK$15:$AK$300,source!$AJ$15:$AJ$300=_xlfn.CONCAT($C65,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Documented roles and responsibilities\n• Signed naming protocol of personnel to Role(s)\n• Roles and responsibilities matrix (that may be used to cross-check if there are any conflicting roles)\n• Validation of required knowledge and skills\n• Review according to the key management policy"},"Advanced",{"$nulls":4},{"$f":"IF(I65=\"\",0,VLOOKUP(I65,tech!$A$13:$B$17,2,0))*E65","v":6},{"$f":"IF(D65=\"\",\"\",IF(B65=0,tech!$B$9,IF(AND(B65=1,N65=0),tech!$B$21,I65)))","v":"Advanced"}]
[null,{"$f":"IF(B$62=0,0,IF(F66=tech!$B$9,0,1))","v":1},"2.1.2.",{"$f":"IFERROR(VLOOKUP(C66,source!$AH$4:$AJ$13,3,0),\"\")","v":"Inventory of cryptographic keys is documented and maintained"},{"$f":"IFERROR(VLOOKUP(C66,source!$AH$4:$AJ$13,2,0),0)*B66","v":2},{"$f":"IF(Scoping!K35=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AK$15:$AK$300,source!$AJ$15:$AJ$300=_xlfn.CONCAT($C66,LEFT(G$15,1),\"Y\"),\"\"))","v":"Inventory of cryptographic keys is important and a strategic database for organizations to:\n• Monitor cryptographic key status and compliance\n• Quickly react to changes and incidents (deprecation of algorithms, compromise, new attacks and vulnerabilities)\n• Understand impact of lifecycle changes, migration and use of keys\n\nAlthough the cryptographic key inventory may be implemented and maintained using various tools and approaches, it should serve the purpose of having a consistent and accurate map of all cryptographic keys deployed in the organization with details like algorithm, key length, usage, storage, location, generation and distribution method, backup and recovery, key check value, fingerprint, number of share or components, owner or responsible person, uniqueness, crypto-periods, or any other applicable attributes and properties of the key.\n\nInventory should follow procedures and business as usual activities to keep it accurate and updated in time."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AK$15:$AK$300,source!$AJ$15:$AJ$300=_xlfn.CONCAT($C66,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Documented inventory of cryptographic keys\n• Accuracy and consistency\n• Completeness of inventory\n• Validation of cryptographic key records"},"Basic",{"$nulls":4},{"$f":"IF(I66=\"\",0,VLOOKUP(I66,tech!$A$13:$B$17,2,0))*E66","v":4},{"$f":"IF(D66=\"\",\"\",IF(B66=0,tech!$B$9,IF(AND(B66=1,N66=0),tech!$B$21,I66)))","v":"Basic"}]
[null,{"$f":"IF(B$62=0,0,IF(F67=tech!$B$9,0,1))","v":1},"2.1.3.",{"$f":"IFERROR(VLOOKUP(C67,source!$AH$4:$AJ$13,3,0),\"\")","v":"Inventory of cryptographic devices is documented and maintained"},{"$f":"IFERROR(VLOOKUP(C67,source!$AH$4:$AJ$13,2,0),0)*B67","v":1},{"$f":"IF(Scoping!K36=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AK$15:$AK$300,source!$AJ$15:$AJ$300=_xlfn.CONCAT($C67,LEFT(G$15,1),\"Y\"),\"\"))","v":"Sensitive cryptographic keys are protected by hardware security modules that can have various forms and comply with security standards such as FIPS 140-3 or Common Criteria Protection Profiles. The keys may be in some case software-protected when there is no high risk associated with its compromise.\n\nThe approved ways of protecting cryptographic keys should have defined rules, which can be specified by the key management policy and followed using the key management procedures. Cryptographic devices that protect keys may be quickly identified using the inventory of cryptographic keys with reference to an inventory of cryptographic devices.\n\nThe inventory of cryptographic devices should contain relevant information such as:\n• Vendor and device model Identification\n• Serial numbers\n• Hardware / firmware / software versions\n• Security certification and expiration dates\n• Locations"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AK$15:$AK$300,source!$AJ$15:$AJ$300=_xlfn.CONCAT($C67,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Documented requirements for cryptographic devices\n• Documented inventory of cryptographic devices\n• Completeness, accuracy, and consistency of inventory\n• Validation of records"},"Managed",{"$nulls":4},{"$f":"IF(I67=\"\",0,VLOOKUP(I67,tech!$A$13:$B$17,2,0))*E67","v":4},{"$f":"IF(D67=\"\",\"\",IF(B67=0,tech!$B$9,IF(AND(B67=1,N67=0),tech!$B$21,I67)))","v":"Managed"}]
[null,{"$f":"IF(B$62=0,0,IF(F68=tech!$B$9,0,1))","v":1},"2.1.4.",{"$f":"IFERROR(VLOOKUP(C68,source!$AH$4:$AJ$13,3,0),\"\")","v":"Each cryptographic key is defined and has documented lifecycle procedures"},{"$f":"IFERROR(VLOOKUP(C68,source!$AH$4:$AJ$13,2,0),0)*B68","v":2},{"$f":"IF(Scoping!K37=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AK$15:$AK$300,source!$AJ$15:$AJ$300=_xlfn.CONCAT($C68,LEFT(G$15,1),\"Y\"),\"\"))","v":"Each cryptographic key type that is defined and used for specific use-case should have a complete description of its lifecycle. Each lifecycle phase has a proper description of the process and is backed up with the procedure that is executed when needed.\n\nThe key can have various lifecycle phases, such as generation, registration, initialization, distribution, loading, storage, archiving, backup, recovery, revocation, removal, destruction, or others applicable for the key.\n\nThe lifecycle phases contains appropriate description of the procedure such as:\n• Prerequisites for execution\n• required roles and permissions\n• Procedure and records"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AK$15:$AK$300,source!$AJ$15:$AJ$300=_xlfn.CONCAT($C68,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Examine the definition of cryptographic key\n• Documented key lifecycle phases\n• Documented procedures and related records for the key lifecycle\n• lifecycle is integrated and followed in the organization"},"Managed",{"$nulls":4},{"$f":"IF(I68=\"\",0,VLOOKUP(I68,tech!$A$13:$B$17,2,0))*E68","v":8},{"$f":"IF(D68=\"\",\"\",IF(B68=0,tech!$B$9,IF(AND(B68=1,N68=0),tech!$B$21,I68)))","v":"Managed"}]
[null,{"$f":"IF(B$62=0,0,IF(F69=tech!$B$9,0,1))","v":1},"2.1.5.",{"$f":"IFERROR(VLOOKUP(C69,source!$AH$4:$AJ$13,3,0),\"\")","v":"Cryptographic cipher suites and protocols are documented and maintained"},{"$f":"IFERROR(VLOOKUP(C69,source!$AH$4:$AJ$13,2,0),0)*B69","v":2},{"$f":"IF(Scoping!K38=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AK$15:$AK$300,source!$AJ$15:$AJ$300=_xlfn.CONCAT($C69,LEFT(G$15,1),\"Y\"),\"\"))","v":"Protocols and encryption strengths may quickly change or be deprecated due to identification of vulnerabilities or design flaws. In order to support current and future data security needs, the organization should know where cryptography is used and understand how they would be able to respond rapidly to changes impacting the strength of their cryptographic implementations.\n\nSpecific rules and boundaries to be applied for cryptographic cipher suites and protocols should be documented in encryption management policy that reflect the current status of cryptography practice.\n\nCipher suites and protocols should be regularly checked against the implemented technology and configuration. Any deviation from the documented and allowed protocols should be fixed."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AK$15:$AK$300,source!$AJ$15:$AJ$300=_xlfn.CONCAT($C69,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Documented encryption management policy\n• Validation of implementation and used protocols against what is Documented\n• Accuracy of the description\n• Security and vulnerabilities of applicable cipher suites and protocols"},"Basic",{"$nulls":4},{"$f":"IF(I69=\"\",0,VLOOKUP(I69,tech!$A$13:$B$17,2,0))*E69","v":4},{"$f":"IF(D69=\"\",\"\",IF(B69=0,tech!$B$9,IF(AND(B69=1,N69=0),tech!$B$21,I69)))","v":"Basic"}]
[null,{"$f":"IF(B$62=0,0,IF(F70=tech!$B$9,0,1))","v":1},"2.1.6.",{"$f":"IFERROR(VLOOKUP(C70,source!$AH$4:$AJ$13,3,0),\"\")","v":"Key management is periodically reviewed and updated"},{"$f":"IFERROR(VLOOKUP(C70,source!$AH$4:$AJ$13,2,0),0)*B70","v":3},{"$f":"IF(Scoping!K39=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AK$15:$AK$300,source!$AJ$15:$AJ$300=_xlfn.CONCAT($C70,LEFT(G$15,1),\"Y\"),\"\"))","v":"Key management policy, processes and procedures related to cryptographic keys, inventory and lifecycle should be periodically reviewed, updated and approved. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends.\n\nPeriodical review helps to keep the key management accurate and helps to maintain required skills and knowledge.\nIt provides assurance that the expected controls are active and working as intended."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AK$15:$AK$300,source!$AJ$15:$AJ$300=_xlfn.CONCAT($C70,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Risk management and Review frequency\n• implementation of Review process\n• Validation of documentation and reviews"},"Managed",{"$nulls":4},{"$f":"IF(I70=\"\",0,VLOOKUP(I70,tech!$A$13:$B$17,2,0))*E70","v":12},{"$f":"IF(D70=\"\",\"\",IF(B70=0,tech!$B$9,IF(AND(B70=1,N70=0),tech!$B$21,I70)))","v":"Managed"}]
[]
[null,null,{"$f":"tech!A122","v":"2.2. Certificate Management"},null,"Weight",{"$f":"IF(B73=0,tech!$A$9,\"\")","v":""}]
[null,{"$f":"IF(Scoping!F40=tech!$A$5,0,1)","v":1},null,null,{"$f":"VLOOKUP(C72,tech!$A$117:$B$131,2,0)*B73","v":4},{"$nulls":8},{"$f":"IF(SUM(B76:B82)=0,0,TRUNC(SUM(N76:N82)/SUM(E76:E82),0))","v":2}]
[]
[null,null,"#","Requirement","Weight","N/A","Guidance","Assessment","Maturity level","Notes",null,"Evidence"]
[null,{"$f":"IF(B$73=0,0,IF(F76=tech!$B$9,0,1))","v":1},"2.2.1.",{"$f":"IFERROR(VLOOKUP(C76,source!$AN$4:$AP$13,3,0),\"\")","v":"Certificate profiles are documented"},{"$f":"IFERROR(VLOOKUP(C76,source!$AN$4:$AP$13,2,0),0)*B76","v":2},{"$f":"IF(Scoping!K40=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AQ$15:$AQ$300,source!$AP$15:$AP$300=_xlfn.CONCAT($C76,LEFT(G$15,1),\"Y\"),\"\"))","v":"Certificate profiles specify the contents of certificates for one or more use cases. It defines things such as:\n* Certificate use case(s) for certificates covered by specific profiles\n* Naming standards for subject distinguished name and subject alternative names, which are allowed and mandatory fields.\n* Certificate validity periods\n* Certificate extensions, mandatory and allowed extensions, their criticality and possible values\n* Allowed key types and signature algorithms\n* Revocation profiles, i.e. CRL and/or OCSP"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AQ$15:$AQ$300,source!$AP$15:$AP$300=_xlfn.CONCAT($C76,LEFT(H$15,1),\"Y\"),\"\"))","v":"* Documented scope of applicability\n* Documented and approved certificate profiles\n* Content of the profiles is complete and unambiguous\n* Certificate profiles are implemented in certificattion authority\n* Certificate profiles are enforced by certification authority\n* Certificate profiles are compatible with RFC5280, or deviations are well documented\n* Profiles for CRLs and/or OCSP usage, i.e. validity periods, issuance intervals, max revocation time delay, etc"},"Managed",{"$nulls":4},{"$f":"IF(I76=\"\",0,VLOOKUP(I76,tech!$A$13:$B$17,2,0))*E76","v":8},{"$f":"IF(D76=\"\",\"\",IF(B76=0,tech!$B$9,IF(AND(B76=1,N76=0),tech!$B$21,I76)))","v":"Managed"}]
[null,{"$f":"IF(B$73=0,0,IF(F77=tech!$B$9,0,1))","v":1},"2.2.2.",{"$f":"IFERROR(VLOOKUP(C77,source!$AN$4:$AP$13,3,0),\"\")","v":"Certificate cipher suites are documented"},{"$f":"IFERROR(VLOOKUP(C77,source!$AN$4:$AP$13,2,0),0)*B77","v":3},{"$f":"IF(Scoping!K41=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AQ$15:$AQ$300,source!$AP$15:$AP$300=_xlfn.CONCAT($C77,LEFT(G$15,1),\"Y\"),\"\"))","v":"Cipher suites, for certificates specifically defining key algorithms, key security levels and signature algorithms are important to be crypto agile. For example, the change of the cipher suites can be required when the cryptographic algorithm becomes broken, or deprecated. An organization should have a clear rationale to the usage of specific algorithms, and how long they will be valid and what may replace them in the future."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AQ$15:$AQ$300,source!$AP$15:$AP$300=_xlfn.CONCAT($C77,LEFT(H$15,1),\"Y\"),\"\"))","v":"* Determine the scope of applicability\n* Documented and approved cipher suites with rationale for inclusion of algorithms\n* Documented agile path for migration to other algorithms when needed\n* Cipher suites are enforced by certification authority"},"Optimized",{"$nulls":4},{"$f":"IF(I77=\"\",0,VLOOKUP(I77,tech!$A$13:$B$17,2,0))*E77","v":15},{"$f":"IF(D77=\"\",\"\",IF(B77=0,tech!$B$9,IF(AND(B77=1,N77=0),tech!$B$21,I77)))","v":"Optimized"}]
[null,{"$f":"IF(B$73=0,0,IF(F78=tech!$B$9,0,1))","v":1},"2.2.3.",{"$f":"IFERROR(VLOOKUP(C78,source!$AN$4:$AP$13,3,0),\"\")","v":"Certificate lifecycle management is documented"},{"$f":"IFERROR(VLOOKUP(C78,source!$AN$4:$AP$13,2,0),0)*B78","v":4},{"$f":"IF(Scoping!K42=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AQ$15:$AQ$300,source!$AP$15:$AP$300=_xlfn.CONCAT($C78,LEFT(G$15,1),\"Y\"),\"\"))","v":"Issuance of certificates follow specific procedures, be it manual processes or automated processes using standard or non-standard PKI protocol. An organization should be clear about the full life cycle management of certificates:\n1. Certificate Application and the validation procedures used, by RAs and CAs\n2. Certificate Issuance and protocols used for enrollment, on-line and off-line\n3. Certificate Renewal, Re-key and Modification, upon expiration or other causes\n   * Process of monitoring certificates for expiration and timely renewal processes prevent common issues\n4. Certificate Revocation\n   * When certificates need to be revoked it is important to have a well-defined certificate revocation process:\n     * How subjects can request a certificate be revoked\n     * How to report misuse of certificates\n     * Expected time for revocation to be completed after a revocation request\n5. Certificate status dissemination\n   * How revocation information is disseminated to relying parties\n6. Key escrow and recovery\n7. Trust anchor management\n   * Trust anchors on machines and devices are a key point of trust management in the organization. Unmanaged trust stores can cause both outages and security issues."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AQ$15:$AQ$300,source!$AP$15:$AP$300=_xlfn.CONCAT($C78,LEFT(H$15,1),\"Y\"),\"\"))","v":"* Documented application and validation rules\n* Documented process for issuing certificates\n  * configuration of protocols\n* Documented Certificate Acceptance and certificate subject installation procedures\n* Documented renewal criteria, where re-key is nessecary and which certificate modifications are allowed\n  * Documented criticality of expiration for different use cases\n  * Automated monitoring and alerting of expiration for critical systems\n  * Automated certificate renewal\n* Documented revocation process\n  * Documented revocation procedures, both for subjects and administrators\n  * If suspension is used the process to lift (or remove) suspension\n  * Documented contact points for reports in the organizations or from relying parties\n  * List of relying parties that depend on updated revocation information\n* Documented Certificate status service\n  * OCSP and/or CRLs\n  * Documentation how relying parties get access to revocation information\n* Documented process for key escrow and recovery when encryption keys need to be stored centrally\n* Documented trust anchor management\n  * Distribution of new and updated trust anchors (Root CA certificates)"},"Basic",{"$nulls":4},{"$f":"IF(I78=\"\",0,VLOOKUP(I78,tech!$A$13:$B$17,2,0))*E78","v":8},{"$f":"IF(D78=\"\",\"\",IF(B78=0,tech!$B$9,IF(AND(B78=1,N78=0),tech!$B$21,I78)))","v":"Basic"}]
[null,{"$f":"IF(B$73=0,0,IF(F79=tech!$B$9,0,1))","v":1},"2.2.4.",{"$f":"IFERROR(VLOOKUP(C79,source!$AN$4:$AP$13,3,0),\"\")","v":"Inventory of issued certificates is documented"},{"$f":"IFERROR(VLOOKUP(C79,source!$AN$4:$AP$13,2,0),0)*B79","v":3},{"$f":"IF(Scoping!K43=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AQ$15:$AQ$300,source!$AP$15:$AP$300=_xlfn.CONCAT($C79,LEFT(G$15,1),\"Y\"),\"\"))","v":"Certificate inventory consists of all known certificates and provides an overview of known certificates in the organization. Certificates in inventory are subject to certificate lifecycle management. The certificate inventory is important for the organization because:\n• it provides immediate access to the current status of certificates\n• provides possibility to react on certificate-related events (compromise, change, expiration, etc.)\n• Understand impact of lifecycle changes\n• it gives information on all Locations of certificates\n• can enforce and maintain ownership of certificates\n\nThe certificate inventory therefore consists of information related to certificate like certificate attributes, validity and validation information, fingerprint and serial number, trust chain, owner, public key, signature algorithm, certificate type, compliance information, certificate locations, change history, or any other attributes and properties of the certificates that is required."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AQ$15:$AQ$300,source!$AP$15:$AP$300=_xlfn.CONCAT($C79,LEFT(H$15,1),\"Y\"),\"\"))","v":"* Documented inventory\n  * How inventory is maintained across the organization\n* Documented certificate inventory management\n* Validation of certificate inventory records\n* Effectiveness of the certificate inventory implementation"},"Initial",{"$nulls":4},{"$f":"IF(I79=\"\",0,VLOOKUP(I79,tech!$A$13:$B$17,2,0))*E79","v":3},{"$f":"IF(D79=\"\",\"\",IF(B79=0,tech!$B$9,IF(AND(B79=1,N79=0),tech!$B$21,I79)))","v":"Initial"}]
[null,{"$f":"IF(B$73=0,0,IF(F80=tech!$B$9,0,1))","v":1},"2.2.5.",{"$f":"IFERROR(VLOOKUP(C80,source!$AN$4:$AP$13,3,0),\"\")","v":"Certificate discovery process is documented"},{"$f":"IFERROR(VLOOKUP(C80,source!$AN$4:$AP$13,2,0),0)*B80","v":2},{"$f":"IF(Scoping!K44=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AQ$15:$AQ$300,source!$AP$15:$AP$300=_xlfn.CONCAT($C80,LEFT(G$15,1),\"Y\"),\"\"))","v":"Certificate discovery process protects an organization from unknown certificates that may be deployed in the infrastructure. Unknown certificates may be further issued by unauthorized certification authorities and mislead users of services. Certificate discovery helps to maintain current inventory of certificates, but does not depend on the inventory and is not nessecary to maintain an inventory. Certificate discovery process should be implemented based on supported certificates and use-cases, for example:\n• to scan the network for certificates used on known protocols and ports to discover certificates that can potentially cause service outage or breach\n• search for the certificates on file system to discover unauthorized or unsecured certificates\n\nDiscovery process should be run frequently on the specified locations and the certificate inventory should be updated based on the results of the certificate discovery to keep it current."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AQ$15:$AQ$300,source!$AP$15:$AP$300=_xlfn.CONCAT($C80,LEFT(H$15,1),\"Y\"),\"\"))","v":"* Documented certificate discovery requirements\n* Documented certificate discovery process and frequency\n* The supporting tools for the certificate discovery\n* Certificate inventory is updated with discovered certificates"},"Basic",{"$nulls":4},{"$f":"IF(I80=\"\",0,VLOOKUP(I80,tech!$A$13:$B$17,2,0))*E80","v":4},{"$f":"IF(D80=\"\",\"\",IF(B80=0,tech!$B$9,IF(AND(B80=1,N80=0),tech!$B$21,I80)))","v":"Basic"}]
[null,{"$f":"IF(B$73=0,0,IF(F81=tech!$B$9,0,1))","v":1},"2.2.6.",{"$f":"IFERROR(VLOOKUP(C81,source!$AN$4:$AP$13,3,0),\"\")","v":"Certificate management is periodically reviewed and updated"},{"$f":"IFERROR(VLOOKUP(C81,source!$AN$4:$AP$13,2,0),0)*B81","v":4},null,{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AQ$15:$AQ$300,source!$AP$15:$AP$300=_xlfn.CONCAT($C81,LEFT(G$15,1),\"Y\"),\"\"))","v":"No certificate issuance and management system works over long periods of time without changes to use-cases, processes, protocols and algorithms. It is important that the certificate management is periodically reviewed and updated to avoid gaps. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends.\n\nPeriodical review helps to keep the certificate management accurate and helps to maintain required skills and knowledge.\nIt provides assurance that the expected controls are active and working as intended."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AQ$15:$AQ$300,source!$AP$15:$AP$300=_xlfn.CONCAT($C81,LEFT(H$15,1),\"Y\"),\"\"))","v":"* Documented process for reviewing the certificate management process and systems\n* Ability to implement updates to certificate management system\n* Document management system and validation of review"},"Advanced",{"$nulls":4},{"$f":"IF(I81=\"\",0,VLOOKUP(I81,tech!$A$13:$B$17,2,0))*E81","v":12},{"$f":"IF(D81=\"\",\"\",IF(B81=0,tech!$B$9,IF(AND(B81=1,N81=0),tech!$B$21,I81)))","v":"Advanced"}]
[null,{"$f":"IF(B$73=0,0,IF(F82=tech!$B$9,0,1))","v":1},"2.2.7.",{"$f":"IFERROR(VLOOKUP(C82,source!$AN$4:$AP$13,3,0),\"\")","v":"Organizational PKI governance"},{"$f":"IFERROR(VLOOKUP(C82,source!$AN$4:$AP$13,2,0),0)*B82","v":2},{"$f":"IF(Scoping!K46=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AQ$15:$AQ$300,source!$AP$15:$AP$300=_xlfn.CONCAT($C82,LEFT(G$15,1),\"Y\"),\"\"))","v":"Large organizations commonly have several PKI systems spread out in the organization. Some can be consolidated, but in many cases different PKI silos exists for good reasons. Having a central governance of PKIs across the organization will help to maintain best practices, ensure secure PKI operations, re-use PKI knowledge in the organization, ensure consistent profiles and avoid unnecessary duplication of effort."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AQ$15:$AQ$300,source!$AP$15:$AP$300=_xlfn.CONCAT($C82,LEFT(H$15,1),\"Y\"),\"\"))","v":"* Documented PKIs used in the organization\n  * Different PKI technologies used\n  * Installed PKI instances\n* Documented PKI best practices\n  * Installation procedures to avoid re-learning the same issues in different parts of the organization\n  * Configuration to ensure consistent and interoperable certificates where applicable\n  * Security to maintain a security base line across the whole organization"},"Basic",{"$nulls":4},{"$f":"IF(I82=\"\",0,VLOOKUP(I82,tech!$A$13:$B$17,2,0))*E82","v":4},{"$f":"IF(D82=\"\",\"\",IF(B82=0,tech!$B$9,IF(AND(B82=1,N82=0),tech!$B$21,I82)))","v":"Basic"}]
[]
[null,null,{"$f":"tech!A123","v":"2.3. Infrastructure Management"},null,"Weight",{"$f":"IF(B85=0,tech!$A$9,\"\")","v":""}]
[null,{"$f":"IF(Scoping!F47=tech!$A$5,0,1)","v":1},null,null,{"$f":"VLOOKUP(C84,tech!$A$117:$B$131,2,0)*B85","v":2},{"$nulls":8},{"$f":"IF(SUM(B88:B93)=0,0,TRUNC(SUM(N88:N93)/SUM(E88:E93),0))","v":3}]
[]
[null,null,"#","Requirement","Weight","N/A","Guidance","Assessment","Maturity level","Notes",null,"Evidence"]
[null,{"$f":"IF(B$85=0,0,IF(F88=tech!$B$9,0,1))","v":1},"2.3.1.",{"$f":"IFERROR(VLOOKUP(C88,source!$AT$4:$AV$13,3,0),\"\")","v":"Network and deployment infrastructure is documented"},{"$f":"IFERROR(VLOOKUP(C88,source!$AT$4:$AV$13,2,0),0)*B88","v":4},{"$f":"IF(Scoping!K52=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AW$15:$AW$300,source!$AV$15:$AV$300=_xlfn.CONCAT($C88,LEFT(G$15,1),\"Y\"),\"\"))","v":"The network and deployment documentation of the infrastructure should be aligned with the architecture and design of the PKI. In other terms, it provides details about how the implementation is done in the real environment.\n\nThe network and deployment infrastructure should be properly documented and maintained. The documentation should include the following:\n• PKI components and their dependencies\n• Facilities and equipment\n• Deployment infrastructure description\n• Clustering and load balancing\n• network topology and diagram\n• Communication and open ports requirements\n• Supporting cloud providers and services\n• Supporting systems and services (identity management, access control, logging, monitoring, etc.)"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AW$15:$AW$300,source!$AV$15:$AV$300=_xlfn.CONCAT($C88,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• network topology and diagram\n• Deployment documentation\n• Sample configuration of network to compare with the documentation\n• Integration with Supporting and other systems\n• Interview with the network administrators"},"Managed",{"$nulls":4},{"$f":"IF(I88=\"\",0,VLOOKUP(I88,tech!$A$13:$B$17,2,0))*E88","v":16},{"$f":"IF(D88=\"\",\"\",IF(B88=0,tech!$B$9,IF(AND(B88=1,N88=0),tech!$B$21,I88)))","v":"Managed"}]
[null,{"$f":"IF(B$85=0,0,IF(F89=tech!$B$9,0,1))","v":1},"2.3.2.",{"$f":"IFERROR(VLOOKUP(C89,source!$AT$4:$AV$13,3,0),\"\")","v":"Separation and segmentation principles are applied"},{"$f":"IFERROR(VLOOKUP(C89,source!$AT$4:$AV$13,2,0),0)*B89","v":3},{"$f":"IF(Scoping!K48=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AW$15:$AW$300,source!$AV$15:$AV$300=_xlfn.CONCAT($C89,LEFT(G$15,1),\"Y\"),\"\"))","v":"The PKI environment should be properly separated and segmented from other environments and systems. The separation and segmentation should be applied on all levels, including network, infrastructure, and application. The separation and segmentation should be applied based on the security requirements and risk assessment.\n\nSegmentation isolates the PKI environment from the remaining environment and reduces the risk of unauthorized access and data leakage. It also helps to reduce the impact of a potential compromise of the PKI environment from other systems and environments. Segmentation can be achieved using a number of physical or logical methods, such as:\n• Properly configured internal network Security controls\n• Routers with strong access control lists\n• other technologies that restrict access to a particular segment of a network\n\nFor the proper maintenance of the infrastructure and deployed PKI components, the staging/testing environment should be available in the same configuration as the production environment. If needed, development environments can be used for testing and development purposes.\nProduction, staging, and development environments should be logically separated and isolated from each other, including the data that is used in the environments."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AW$15:$AW$300,source!$AV$15:$AV$300=_xlfn.CONCAT($C89,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• network topology and diagram\n• implementation of network isolation\n• Separation of production and testing environments\n• Sample data\n• Interview with the network administrators"},"Basic",{"$nulls":4},{"$f":"IF(I89=\"\",0,VLOOKUP(I89,tech!$A$13:$B$17,2,0))*E89","v":6},{"$f":"IF(D89=\"\",\"\",IF(B89=0,tech!$B$9,IF(AND(B89=1,N89=0),tech!$B$21,I89)))","v":"Basic"}]
[null,{"$f":"IF(B$85=0,0,IF(F90=tech!$B$9,0,1))","v":1},"2.3.3.",{"$f":"IFERROR(VLOOKUP(C90,source!$AT$4:$AV$13,3,0),\"\")","v":"Network vulnerability management is implemented and maintained"},{"$f":"IFERROR(VLOOKUP(C90,source!$AT$4:$AV$13,2,0),0)*B90","v":3},{"$f":"IF(Scoping!K49=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AW$15:$AW$300,source!$AV$15:$AV$300=_xlfn.CONCAT($C90,LEFT(G$15,1),\"Y\"),\"\"))","v":"The network vulnerability management is a process that is used to identify, classify, remediate, and mitigate vulnerabilities in the network infrastructure and protects PKI implementation from potential attacks. The process should be implemented and maintained in order to ensure that the network infrastructure is properly secured and protected from potential attacks.\n\nThe network vulnerability management should include the following:\n• Included in the overall vulnerability management process\n• Periodical scanning of the network infrastructure\n• Identification of vulnerabilities\n• Categorization and prioritization of vulnerabilities and remediation\n• Updating and patching requirements"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AW$15:$AW$300,source!$AV$15:$AV$300=_xlfn.CONCAT($C90,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• network vulnerability management process\n• Results from last network vulnerability scan\n• remediation plan\n• Interview with the network administrators"},"Advanced",{"$nulls":4},{"$f":"IF(I90=\"\",0,VLOOKUP(I90,tech!$A$13:$B$17,2,0))*E90","v":9},{"$f":"IF(D90=\"\",\"\",IF(B90=0,tech!$B$9,IF(AND(B90=1,N90=0),tech!$B$21,I90)))","v":"Advanced"}]
[null,{"$f":"IF(B$85=0,0,IF(F91=tech!$B$9,0,1))","v":1},"2.3.4.",{"$f":"IFERROR(VLOOKUP(C91,source!$AT$4:$AV$13,3,0),\"\")","v":"Infrastructure recovery objectives controls"},{"$f":"IFERROR(VLOOKUP(C91,source!$AT$4:$AV$13,2,0),0)*B91","v":1},{"$f":"IF(Scoping!K50=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AW$15:$AW$300,source!$AV$15:$AV$300=_xlfn.CONCAT($C91,LEFT(G$15,1),\"Y\"),\"\"))","v":"In case of issues with the infrastructure, it should be possible to quickly identify the root cause and recover the infrastructure to the operational state. The recovery objectives should be defined and aligned with the overall business continuity and disaster recovery strategy of the organization.\n\nThe infrastructure should be frequently backed up and the backups should be stored in a secure location. The backups should be tested and validated on a regular basis. Infrastructure managed as code may help to reduce complexity and increase the speed of recovery."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AW$15:$AW$300,source!$AV$15:$AV$300=_xlfn.CONCAT($C91,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• infrastructure recovery objectives\n• Backup and recovery plan\n• infrastructure configuration as a code\n• Interview with the infrastructure administrators"},"Basic",{"$nulls":4},{"$f":"IF(I91=\"\",0,VLOOKUP(I91,tech!$A$13:$B$17,2,0))*E91","v":2},{"$f":"IF(D91=\"\",\"\",IF(B91=0,tech!$B$9,IF(AND(B91=1,N91=0),tech!$B$21,I91)))","v":"Basic"}]
[null,{"$f":"IF(B$85=0,0,IF(F92=tech!$B$9,0,1))","v":1},"2.3.5.",{"$f":"IFERROR(VLOOKUP(C92,source!$AT$4:$AV$13,3,0),\"\")","v":"Infrastructure activities are periodically reviewed"},{"$f":"IFERROR(VLOOKUP(C92,source!$AT$4:$AV$13,2,0),0)*B92","v":2},{"$f":"IF(Scoping!K51=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AW$15:$AW$300,source!$AV$15:$AV$300=_xlfn.CONCAT($C92,LEFT(G$15,1),\"Y\"),\"\"))","v":"Infrastructure management related activities should be periodically reviewed, updated and approved. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends.\n\nPeriodical review helps to keep the infrastructure management accurate and helps to maintain required skills and knowledge.\nIt provides assurance that the expected controls are active and working as intended.\n\nThe review can include the following:\n• changes made to the infrastructure\n• Regular checks of firewall rules\n• Review of the network topology\n• Review of the network segmentation\n• Regular checks of access control lists\n• vulnerability reports and timely remediation\n• Review and correlation of logs\n• and other activities related to the infrastructure management"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AW$15:$AW$300,source!$AV$15:$AV$300=_xlfn.CONCAT($C92,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• infrastructure management activities Review frequency\n• Organizational implementation of Review process\n• Validation of documentation, reports, records, and reviews"},"Managed",{"$nulls":4},{"$f":"IF(I92=\"\",0,VLOOKUP(I92,tech!$A$13:$B$17,2,0))*E92","v":8},{"$f":"IF(D92=\"\",\"\",IF(B92=0,tech!$B$9,IF(AND(B92=1,N92=0),tech!$B$21,I92)))","v":"Managed"}]
[null,{"$f":"IF(B$85=0,0,IF(F93=tech!$B$9,0,1))","v":1},"2.3.6.",{"$f":"IFERROR(VLOOKUP(C93,source!$AT$4:$AV$13,3,0),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(C93,source!$AT$4:$AV$13,2,0),0)*B93","v":0},{"$f":"IF(Scoping!K52=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AW$15:$AW$300,source!$AV$15:$AV$300=_xlfn.CONCAT($C93,LEFT(G$15,1),\"Y\"),\"\"))","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$AW$15:$AW$300,source!$AV$15:$AV$300=_xlfn.CONCAT($C93,LEFT(H$15,1),\"Y\"),\"\"))","v":""},{"$nulls":5},{"$f":"IF(I93=\"\",0,VLOOKUP(I93,tech!$A$13:$B$17,2,0))*E93","v":0},{"$f":"IF(D93=\"\",\"\",IF(B93=0,tech!$B$9,IF(AND(B93=1,N93=0),tech!$B$21,I93)))","v":""}]
[]
[null,null,{"$f":"tech!A124","v":"2.4. Change Management and Agility"},null,"Weight",{"$f":"IF(B96=0,tech!$A$9,\"\")","v":""}]
[null,{"$f":"IF(Scoping!F53=tech!$A$5,0,1)","v":1},null,null,{"$f":"VLOOKUP(C95,tech!$A$117:$B$131,2,0)*B96","v":3},{"$nulls":8},{"$f":"IF(SUM(B99:B104)=0,0,TRUNC(SUM(N99:N104)/SUM(E99:E104),0))","v":2}]
[]
[null,null,"#","Requirement","Weight","N/A","Guidance","Assessment","Maturity level","Notes",null,"Evidence"]
[null,{"$f":"IF(B$96=0,0,IF(F99=tech!$B$9,0,1))","v":1},"2.4.1.",{"$f":"IFERROR(VLOOKUP(C99,source!$AZ$4:$BB$13,3,0),\"\")","v":"The policy for change management and agility is documented"},{"$f":"IFERROR(VLOOKUP(C99,source!$AZ$4:$BB$13,2,0),0)*B99","v":4},{"$f":"IF(Scoping!K58=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BC$15:$BC$300,source!$BB$15:$BB$300=_xlfn.CONCAT($C99,LEFT(G$15,1),\"Y\"),\"\"))","v":"The policy for change management and agility should be documented and approved by the management. The policy contains principles and boundaries for the implementation of the change management and agility requirements. Typically, it can be documented on the organizational level and applied to all systems and services, including the PKI implementation.\n\nThe PKI may have specific requirements for change management and agility, and therefore it may be recommended to have a separate policy for the PKI implementation. The policy should be aligned with organizational policy and should be approved by the responsible personnel for the PKI.\n\nThe policy contains the following information:\n• Approach to change management and agility\n• Principles and boundaries for change management and agility\n• roles and responsibilities\n• requirements for change management and agility\n• Tools and technologies used for change management\n• and other relevant information"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BC$15:$BC$300,source!$BB$15:$BB$300=_xlfn.CONCAT($C99,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• Documented policy for change management and agility\n• Alignment with Organizational policy\n• Approval by the management\n• Understanding of the policy by the PKI personnel\n• and other relevant evidence"},"Basic",{"$nulls":4},{"$f":"IF(I99=\"\",0,VLOOKUP(I99,tech!$A$13:$B$17,2,0))*E99","v":8},{"$f":"IF(D99=\"\",\"\",IF(B99=0,tech!$B$9,IF(AND(B99=1,N99=0),tech!$B$21,I99)))","v":"Basic"}]
[null,{"$f":"IF(B$96=0,0,IF(F100=tech!$B$9,0,1))","v":1},"2.4.2.",{"$f":"IFERROR(VLOOKUP(C100,source!$AZ$4:$BB$13,3,0),\"\")","v":"Request for change structure is documented and followed"},{"$f":"IFERROR(VLOOKUP(C100,source!$AZ$4:$BB$13,2,0),0)*B100","v":3},{"$f":"IF(Scoping!K54=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BC$15:$BC$300,source!$BB$15:$BB$300=_xlfn.CONCAT($C100,LEFT(G$15,1),\"Y\"),\"\"))","v":"The request for change structure is the basic stone of each change management process. It provides information about a change, its scope, and other relevant data. The request for change structure should be formally documented and followed by all stakeholders involved.\n\nRequest for change can contain any change that can affect the PKI implementation, including:\n• PKI upgrades, updates, and patches\n• New components or functionalities\n• changes in the configuration of the PKI\n• changes in the algorithms and protocols\n\nRequest for change structure should cover the following information:\n• description of the change\n• Scope of the change\n• Category of the change\n• Impacted systems and services\n• Back-out Procedure in case of failure\n• testing requirements\n• and other relevant information"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BC$15:$BC$300,source!$BB$15:$BB$300=_xlfn.CONCAT($C100,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• Documented request for change structure\n• Sample of change request\n• Review implemented changes and compare with the request for change"},"Managed",{"$nulls":4},{"$f":"IF(I100=\"\",0,VLOOKUP(I100,tech!$A$13:$B$17,2,0))*E100","v":12},{"$f":"IF(D100=\"\",\"\",IF(B100=0,tech!$B$9,IF(AND(B100=1,N100=0),tech!$B$21,I100)))","v":"Managed"}]
[null,{"$f":"IF(B$96=0,0,IF(F101=tech!$B$9,0,1))","v":1},"2.4.3.",{"$f":"IFERROR(VLOOKUP(C101,source!$AZ$4:$BB$13,3,0),\"\")","v":"The change management process is documented and implemented"},{"$f":"IFERROR(VLOOKUP(C101,source!$AZ$4:$BB$13,2,0),0)*B101","v":4},{"$f":"IF(Scoping!K55=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BC$15:$BC$300,source!$BB$15:$BB$300=_xlfn.CONCAT($C101,LEFT(G$15,1),\"Y\"),\"\"))","v":"The change management process is the core of the change management and agile systems. It provides a robust and reliable process to ensure that every change is properly assessed, approved, implemented, and eventually reviewed.\n\nThe change management process should be documented, communicated, and integrated into the organization. The process states how a request for change can be submitted and how it is processed, which includes assessment and approval of the change, implementation of the change, functional testing after the change, and review of the change."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BC$15:$BC$300,source!$BB$15:$BB$300=_xlfn.CONCAT($C101,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• Documented change management process\n• Sample of change request\n• Steps involved in the change management process\n• Interview with the responsible personnel"},"Basic",{"$nulls":4},{"$f":"IF(I101=\"\",0,VLOOKUP(I101,tech!$A$13:$B$17,2,0))*E101","v":8},{"$f":"IF(D101=\"\",\"\",IF(B101=0,tech!$B$9,IF(AND(B101=1,N101=0),tech!$B$21,I101)))","v":"Basic"}]
[null,{"$f":"IF(B$96=0,0,IF(F102=tech!$B$9,0,1))","v":1},"2.4.4.",{"$f":"IFERROR(VLOOKUP(C102,source!$AZ$4:$BB$13,3,0),\"\")","v":"Requirements for agility are identified"},{"$f":"IFERROR(VLOOKUP(C102,source!$AZ$4:$BB$13,2,0),0)*B102","v":2},{"$f":"IF(Scoping!K56=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BC$15:$BC$300,source!$BB$15:$BB$300=_xlfn.CONCAT($C102,LEFT(G$15,1),\"Y\"),\"\"))","v":"Agility provides the ability to adapt to changes quickly and efficiently. Agility and change management are closely related and should be considered together. The future-proof PKI implementation should be able to identify the requirements for agility and implement them in a timely manner.\n\nAgility can be considered on operational and technical levels. Operational agility means that the PKI is able to adapt to changes in the operational environment, including any changes to the organizational structure, processes, and other operational aspects. Technical agility means that the PKI is able to adapt to changes in the technologies, algorithms, protocols, and other technical aspects.\n\nIdentification of requirements where agility is needed is important to ensure changes are implemented when needed."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BC$15:$BC$300,source!$BB$15:$BB$300=_xlfn.CONCAT($C102,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• agility requirements of the PKI implementation\n• configuration changes\n• changes in the operational environment\n• changes in the technologies\n• and other relevant evidence"},"Advanced",{"$nulls":4},{"$f":"IF(I102=\"\",0,VLOOKUP(I102,tech!$A$13:$B$17,2,0))*E102","v":6},{"$f":"IF(D102=\"\",\"\",IF(B102=0,tech!$B$9,IF(AND(B102=1,N102=0),tech!$B$21,I102)))","v":"Advanced"}]
[null,{"$f":"IF(B$96=0,0,IF(F103=tech!$B$9,0,1))","v":1},"2.4.5.",{"$f":"IFERROR(VLOOKUP(C103,source!$AZ$4:$BB$13,3,0),\"\")","v":"Change management and agility is periodically reviewed"},{"$f":"IFERROR(VLOOKUP(C103,source!$AZ$4:$BB$13,2,0),0)*B103","v":2},{"$f":"IF(Scoping!K57=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BC$15:$BC$300,source!$BB$15:$BB$300=_xlfn.CONCAT($C103,LEFT(G$15,1),\"Y\"),\"\"))","v":"The change management and agility requirements should be periodically reviewed to ensure that they are still valid and relevant. The review should be performed by the responsible personnel and should be documented. A good practice is to review the change management and agility requirements at least once a year, however, the frequency of the review can be different depending on the PKI implementation."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BC$15:$BC$300,source!$BB$15:$BB$300=_xlfn.CONCAT($C103,LEFT(H$15,1),\"Y\"),\"\"))","v":"• change management Review frequency\n• implementation of Review process and documentation\n• Interview with the responsible personnel"},"Advanced",{"$nulls":4},{"$f":"IF(I103=\"\",0,VLOOKUP(I103,tech!$A$13:$B$17,2,0))*E103","v":6},{"$f":"IF(D103=\"\",\"\",IF(B103=0,tech!$B$9,IF(AND(B103=1,N103=0),tech!$B$21,I103)))","v":"Advanced"}]
[null,{"$f":"IF(B$96=0,0,IF(F104=tech!$B$9,0,1))","v":1},"2.4.6.",{"$f":"IFERROR(VLOOKUP(C104,source!$AZ$4:$BB$13,3,0),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(C104,source!$AZ$4:$BB$13,2,0),0)*B104","v":0},{"$f":"IF(Scoping!K58=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BC$15:$BC$300,source!$BB$15:$BB$300=_xlfn.CONCAT($C104,LEFT(G$15,1),\"Y\"),\"\"))","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BC$15:$BC$300,source!$BB$15:$BB$300=_xlfn.CONCAT($C104,LEFT(H$15,1),\"Y\"),\"\"))","v":""},{"$nulls":5},{"$f":"IF(I104=\"\",0,VLOOKUP(I104,tech!$A$13:$B$17,2,0))*E104","v":0},{"$f":"IF(D104=\"\",\"\",IF(B104=0,tech!$B$9,IF(AND(B104=1,N104=0),tech!$B$21,I104)))","v":""}]
[]
[]
[null,null,"3. Operations",null,null,{"$f":"IF(AND(B112=0,B123=0,B134=0,B145=0),tech!$A$9,\"\")","v":""}]
[{"$nulls":13},{"$f":"IF(SUM(E112,E123,E134,E145)=0,0,TRUNC((IF(B112=0,0,SUM(N115:N120)/SUM(E115:E120)*E112)+IF(B123=0,0,SUM(N126:N131)/SUM(E126:E131)*E123)+IF(B134=0,0,SUM(N137:N142)/SUM(E137:E142)*E134)+IF(B145=0,0,SUM(N148:N153)/SUM(E148:E153)*E145))/SUM(E112,E123,E134,E145),0))","v":3}]
[{"$nulls":13},{"$f":"IF(SUM(E112,E123,E134,E145)=0,0,(IF(B112=0,0,SUM(N115:N120)/SUM(E115:E120)*E112)+IF(B123=0,0,SUM(N126:N131)/SUM(E126:E131)*E123)+IF(B134=0,0,SUM(N137:N142)/SUM(E137:E142)*E134)+IF(B145=0,0,SUM(N148:N153)/SUM(E148:E153)*E145))/SUM(E112,E123,E134,E145))","v":3.1897142857142855}]
[]
[null,null,{"$f":"tech!A125","v":"3.1. Resilience"},null,"Weight",{"$f":"IF(B112=0,tech!$A$9,\"\")","v":""}]
[null,{"$f":"IF(Scoping!F59=tech!$A$5,0,1)","v":1},null,null,{"$f":"VLOOKUP(C111,tech!$A$117:$B$131,2,0)*B112","v":4},{"$nulls":8},{"$f":"IF(SUM(B115:B120)=0,0,TRUNC(SUM(N115:N120)/SUM(E115:E120),0))","v":3}]
[null,null,"Resilience is the key for any organization wanting to thrive in an ever-changing world, which is obviously very important factor for any PKI implementation. The PKI is planned to be trusted for multiple years, if not decades. Therefore, the ability to absorb and adapt to the unpredictability, while continuing to deliver on the objectives is becoming mandatory.\nRobust resilience framework helps organizations future-proof their PKI oriented business, detailing key principles, attributes and activities that are followed to ensure that the PKI implementation will be trusted, secure, and effective all the time."]
[null,null,"#","Requirement","Weight","N/A","Guidance","Assessment","Maturity level","Notes",null,"Evidence"]
[null,{"$f":"IF(B$112=0,0,IF(F115=tech!$B$9,0,1))","v":1},"3.1.1.",{"$f":"IFERROR(VLOOKUP(C115,source!$BF$4:$BH$13,3,0),\"\")","v":"Risk assessment and business impact analysis"},{"$f":"IFERROR(VLOOKUP(C115,source!$BF$4:$BH$13,2,0),0)*B115","v":6},{"$f":"IF(Scoping!K69=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BI$15:$BI$300,source!$BH$15:$BH$300=_xlfn.CONCAT($C115,LEFT(G$15,1),\"Y\"),\"\"))","v":"Proper risk assessment provides robust understanding about the risks and their impact on the business and organization PKI. The risk assessment results (for example potential loss scenarios) are documented and serves as input for the business impact analysis to identify the critical PKI-related business processes and their dependencies.\n\nDocumented results of the business impact analysis are used to develop recovery strategies for the PKI implementation with required resources and availability."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BI$15:$BI$300,source!$BH$15:$BH$300=_xlfn.CONCAT($C115,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• Risk management and assessment process\n• Documented Risk assessment Results\n• Documented business impact analysis Results\n• Documented recovery strategies\n• Understanding of the resilience and Approval of the Results\n• Interview with the PKI management"},"Optimized",{"$nulls":4},{"$f":"IF(I115=\"\",0,VLOOKUP(I115,tech!$A$13:$B$17,2,0))*E115","v":30},{"$f":"IF(D115=\"\",\"\",IF(B115=0,tech!$B$9,IF(AND(B115=1,N115=0),tech!$B$21,I115)))","v":"Optimized"}]
[null,{"$f":"IF(B$112=0,0,IF(F116=tech!$B$9,0,1))","v":1},"3.1.2.",{"$f":"IFERROR(VLOOKUP(C116,source!$BF$4:$BH$13,3,0),\"\")","v":"Cyber-security management and incident planning"},{"$f":"IFERROR(VLOOKUP(C116,source!$BF$4:$BH$13,2,0),0)*B116","v":4},{"$f":"IF(Scoping!K70=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BI$15:$BI$300,source!$BH$15:$BH$300=_xlfn.CONCAT($C116,LEFT(G$15,1),\"Y\"),\"\"))","v":"Cyber-security management covers activities to ensure that the PKI is protected against known and zero-day vulnerabilities, cyberattacks and other threats. The operational procedures and technologies are evolving and the PKI needs to be able to adapt to the changes. Without knowing the threats and vulnerabilities, it is not possible to plan for the resilience and properly plan for incident response.\n\nIncident response planning helps to ensure that the organization is able to respond to the suspected incidents. Incident response plans should be documented and tested regularly. The result of executed incident response plans should be documented and used to improve the plan, even if it was a false alarm.\n\nCyber-security management and incident planning covers important aspects such as vulnerability management and security operations center (SOC) identification and response to potential incidents."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BI$15:$BI$300,source!$BH$15:$BH$300=_xlfn.CONCAT($C116,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• Documented vulnerability management\n• vulnerability scanning Results\n• Documented incident response plans\n• Documented incident response test Results\n• Monitoring of cyber-Security threats\n• Interview with the Security operations team"},"Advanced",{"$nulls":4},{"$f":"IF(I116=\"\",0,VLOOKUP(I116,tech!$A$13:$B$17,2,0))*E116","v":12},{"$f":"IF(D116=\"\",\"\",IF(B116=0,tech!$B$9,IF(AND(B116=1,N116=0),tech!$B$21,I116)))","v":"Advanced"}]
[null,{"$f":"IF(B$112=0,0,IF(F117=tech!$B$9,0,1))","v":1},"3.1.3.",{"$f":"IFERROR(VLOOKUP(C117,source!$BF$4:$BH$13,3,0),\"\")","v":"Business continuity planning and disaster recovery"},{"$f":"IFERROR(VLOOKUP(C117,source!$BF$4:$BH$13,2,0),0)*B117","v":5},{"$f":"IF(Scoping!K71=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BI$15:$BI$300,source!$BH$15:$BH$300=_xlfn.CONCAT($C117,LEFT(G$15,1),\"Y\"),\"\"))","v":"The business continuity planning and disaster recovery are the key activities to ensure availability of the PKI operations. The business continuity planning is used to define the recovery time objectives (RTO) and recovery point objectives (RPO) for the PKI. The RTO and RPO are used to define the required resources and their availability.\n\nRequirements for the business continuity and disaster recovery should be properly defined. It contains backups of the PKI resources, such as hardware security modules (HSM), databases, configuration files, etc. The availability of backups should be tested regularly to ensure that the backups are available when needed, especially during the disaster.\n\nProper measures are applied to identify the disaster and a communication matrix is maintained to ensure that the right people are informed about the disaster on time and the recovery process can be started.\n\nThe following parts are typically covered:\n• Scope of the business continuity and disaster recovery\n• roles and responsibilities\n• Activation of disaster recovery\n• Physical Locations\n• Communication matrix\n• other requirements and information needed"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BI$15:$BI$300,source!$BH$15:$BH$300=_xlfn.CONCAT($C117,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• Documented business continuity and disaster recovery plans\n• Documented recovery time objectives (RTO) and recovery point objectives (RPO)\n• Documented Backup and recovery procedures\n• Communication matrix and contact information\n• Availability of backups and other requirements to execute the disaster recovery Procedure\n• Periodically tested effectiveness of the disaster recovery"},"Managed",{"$nulls":4},{"$f":"IF(I117=\"\",0,VLOOKUP(I117,tech!$A$13:$B$17,2,0))*E117","v":20},{"$f":"IF(D117=\"\",\"\",IF(B117=0,tech!$B$9,IF(AND(B117=1,N117=0),tech!$B$21,I117)))","v":"Managed"}]
[null,{"$f":"IF(B$112=0,0,IF(F118=tech!$B$9,0,1))","v":1},"3.1.4.",{"$f":"IFERROR(VLOOKUP(C118,source!$BF$4:$BH$13,3,0),\"\")","v":"Technology future proofing"},{"$f":"IFERROR(VLOOKUP(C118,source!$BF$4:$BH$13,2,0),0)*B118","v":3},{"$f":"IF(Scoping!K72=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BI$15:$BI$300,source!$BH$15:$BH$300=_xlfn.CONCAT($C118,LEFT(G$15,1),\"Y\"),\"\"))","v":"Applicable technology should always be future proofed to ensure that the PKI is able to adapt to changes, and will support the organization PKI in the future when new standards, algorithms, and approach will be developed.\n\nWhen deciding to apply new technologies, or evaluating if the current technology is still suitable and support the goals of the PKI implementation, the following should be considered:\n• Technology is supported by the Vendor\n• Industry standards are applied for interoperability and Security\n• Review and references on the Vendor and Technology\n• Applicability of the Technology for long-term use\n• vulnerabilities and Security reports of the Technology\n• Integration capabilities and customizations needed\n• open source vs. proprietary Technology"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BI$15:$BI$300,source!$BH$15:$BH$300=_xlfn.CONCAT($C118,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• Interview with the CTO or CIO\n• documentation of the Technology future proofing\n• RFI and RFP documents\n• Vendor and Technology check"},"Managed",{"$nulls":4},{"$f":"IF(I118=\"\",0,VLOOKUP(I118,tech!$A$13:$B$17,2,0))*E118","v":12},{"$f":"IF(D118=\"\",\"\",IF(B118=0,tech!$B$9,IF(AND(B118=1,N118=0),tech!$B$21,I118)))","v":"Managed"}]
[null,{"$f":"IF(B$112=0,0,IF(F119=tech!$B$9,0,1))","v":1},"3.1.5.",{"$f":"IFERROR(VLOOKUP(C119,source!$BF$4:$BH$13,3,0),\"\")","v":"Competence and information sharing"},{"$f":"IFERROR(VLOOKUP(C119,source!$BF$4:$BH$13,2,0),0)*B119","v":3},{"$f":"IF(Scoping!K73=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BI$15:$BI$300,source!$BH$15:$BH$300=_xlfn.CONCAT($C119,LEFT(G$15,1),\"Y\"),\"\"))","v":"Organization environments may change over time. The impact of changes can be in various forms, for example:\n• personnel can rotate in their positions, new people can be hired, or people can leave the organization\n• technologies are changing, therefore required skills and knowledge may change\n• procedures and eventually management of the PKI will be adjusted\n\nThe organization needs to ensure that the competence of the personnel is maintained and the information is shared to not lose the knowledge introduced by changes within known and unknown variables. The organization should have a plan to ensure that the competence is maintained for the most critical parts of the PKI.\n\nThe competence and information sharing is an important part to achieve the resilience of the PKI implementation by having relevant information and competencies ready when needed."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BI$15:$BI$300,source!$BH$15:$BH$300=_xlfn.CONCAT($C119,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• documentation and collaboration\n• Onboarding and offboarding procedures\n• Building competence and knowledge sharing"},"Initial",{"$nulls":4},{"$f":"IF(I119=\"\",0,VLOOKUP(I119,tech!$A$13:$B$17,2,0))*E119","v":3},{"$f":"IF(D119=\"\",\"\",IF(B119=0,tech!$B$9,IF(AND(B119=1,N119=0),tech!$B$21,I119)))","v":"Initial"}]
[null,{"$f":"IF(B$112=0,0,IF(F120=tech!$B$9,0,1))","v":1},"3.1.6.",{"$f":"IFERROR(VLOOKUP(C120,source!$BF$4:$BH$13,3,0),\"\")","v":"Continual review and improvement"},{"$f":"IFERROR(VLOOKUP(C120,source!$BF$4:$BH$13,2,0),0)*B120","v":4},{"$f":"IF(Scoping!K74=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BI$15:$BI$300,source!$BH$15:$BH$300=_xlfn.CONCAT($C120,LEFT(G$15,1),\"Y\"),\"\"))","v":"The resilience of the PKI implementation should be reviewed and improved regularly. The review and improvement process should be documented and the results should be used to improve the resilience of the PKI implementation. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BI$15:$BI$300,source!$BH$15:$BH$300=_xlfn.CONCAT($C120,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• resilience effectiveness Review frequency\n• implementation of Review process\n• Validation of documentation and reviews\n• Training records"},"Advanced",{"$nulls":4},{"$f":"IF(I120=\"\",0,VLOOKUP(I120,tech!$A$13:$B$17,2,0))*E120","v":12},{"$f":"IF(D120=\"\",\"\",IF(B120=0,tech!$B$9,IF(AND(B120=1,N120=0),tech!$B$21,I120)))","v":"Advanced"}]
[]
[null,null,{"$f":"tech!A126","v":"3.2. Interoperability"},null,"Weight",{"$f":"IF(B123=0,tech!$A$9,\"\")","v":""}]
[null,{"$f":"IF(Scoping!F65=tech!$A$5,0,1)","v":1},null,null,{"$f":"VLOOKUP(C122,tech!$A$117:$B$131,2,0)*B123","v":2},{"$nulls":8},{"$f":"IF(SUM(B126:B131)=0,0,TRUNC(SUM(N126:N131)/SUM(E126:E131),0))","v":3}]
[]
[null,null,"#","Requirement","Weight","N/A","Guidance","Assessment","Maturity level","Notes",null,"Evidence"]
[null,{"$f":"IF(B$123=0,0,IF(F126=tech!$B$9,0,1))","v":1},"3.2.1.",{"$f":"IFERROR(VLOOKUP(C126,source!$BL$4:$BN$13,3,0),\"\")","v":"Maintain PKI interoperability strategy"},{"$f":"IFERROR(VLOOKUP(C126,source!$BL$4:$BN$13,2,0),0)*B126","v":3},{"$f":"IF(Scoping!K80=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BO$15:$BO$300,source!$BN$15:$BN$300=_xlfn.CONCAT($C126,LEFT(G$15,1),\"Y\"),\"\"))","v":"The interoperability strategy defines the interoperability requirements and the approach to achieve interoperability between the PKI components to ensure the PKI implementation is able to adopt new technologies and standards in the future, and will not be locked-in to a specific vendor.\n\nPKI interoperability strategy should be maintained, documented, and integrated in the organization. It should cover at least the following information:\n• Application of interoperability\n• Using open standards and protocols\n• Conditions for PKI components to be interoperable\n• Restrictions on the use of proprietary interfaces\n• interoperability testing\n• requirements for migration to New technologies\n• requirements for vendors\n• other relevant information"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BO$15:$BO$300,source!$BN$15:$BN$300=_xlfn.CONCAT($C126,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following evidence should be available for the assessment of the requirement:\n• Documented and approved interoperability strategy\n• interoperability strategy is integrated in the organization\n• Interview with the responsible person(s) to verify Understanding of the interoperability strategy\n• Review documentation for PKI components to verify the requirements for interoperability"},"Advanced",{"$nulls":4},{"$f":"IF(I126=\"\",0,VLOOKUP(I126,tech!$A$13:$B$17,2,0))*E126","v":9},{"$f":"IF(D126=\"\",\"\",IF(B126=0,tech!$B$9,IF(AND(B126=1,N126=0),tech!$B$21,I126)))","v":"Advanced"}]
[null,{"$f":"IF(B$123=0,0,IF(F127=tech!$B$9,0,1))","v":1},"3.2.2.",{"$f":"IFERROR(VLOOKUP(C127,source!$BL$4:$BN$13,3,0),\"\")","v":"Documented integration guidance"},{"$f":"IFERROR(VLOOKUP(C127,source!$BL$4:$BN$13,2,0),0)*B127","v":1},{"$f":"IF(Scoping!K81=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BO$15:$BO$300,source!$BN$15:$BN$300=_xlfn.CONCAT($C127,LEFT(G$15,1),\"Y\"),\"\"))","v":"To have effective interoperability between PKI components, it is important to have a proper integration in place that serves the purpose and does not expose any potential risks. Available and documented integration guidance for the developers and administrators should be maintained and updated regularly.\n\nThe integration guidance should be available for all critical PKI components and should cover at least the following information:\n• Integration requirements and Prerequisites\n• applicable standards and protocols\n• Integration architecture\n• Integration testing"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BO$15:$BO$300,source!$BN$15:$BN$300=_xlfn.CONCAT($C127,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following evidence should be available for the assessment of the requirement:\n• Documented Integration guidance for all critical PKI components\n• Interview with the system administrators and developers\n• Review of the Integration guidance\n• system configuration Review"},"Advanced",{"$nulls":4},{"$f":"IF(I127=\"\",0,VLOOKUP(I127,tech!$A$13:$B$17,2,0))*E127","v":3},{"$f":"IF(D127=\"\",\"\",IF(B127=0,tech!$B$9,IF(AND(B127=1,N127=0),tech!$B$21,I127)))","v":"Advanced"}]
[null,{"$f":"IF(B$123=0,0,IF(F128=tech!$B$9,0,1))","v":1},"3.2.3.",{"$f":"IFERROR(VLOOKUP(C128,source!$BL$4:$BN$13,3,0),\"\")","v":"Adoption and application of open standards"},{"$f":"IFERROR(VLOOKUP(C128,source!$BL$4:$BN$13,2,0),0)*B128","v":3},{"$f":"IF(Scoping!K82=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BO$15:$BO$300,source!$BN$15:$BN$300=_xlfn.CONCAT($C128,LEFT(G$15,1),\"Y\"),\"\"))","v":"Open standards are publicly available standards that are developed and maintained by communities or standardization bodies. Open standards are developed through a consensus-based process and are available to everyone without any restrictions. Open standards are usually free to use and implement.\n\nThe open standards are important for interoperability as they are typically technology-agnostic and are supported by technologies and solutions. Open standards are applicable for interfaces, communication protocols, cryptographic algorithms, data formats, automation and orchestration, and other aspects of the PKI.\n\nThe adoption of open standards significant increase interoperability and reduce the risk of vendor lock-in."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BO$15:$BO$300,source!$BN$15:$BN$300=_xlfn.CONCAT($C128,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following evidence should be available for the assessment of the requirement:\n• Documented list of open standards used by the PKI\n• Policies requiring the use of open standards\n• Interview with the responsible person to verify Understanding of the open standards\n• Review of Training materials"},"Managed",{"$nulls":4},{"$f":"IF(I128=\"\",0,VLOOKUP(I128,tech!$A$13:$B$17,2,0))*E128","v":12},{"$f":"IF(D128=\"\",\"\",IF(B128=0,tech!$B$9,IF(AND(B128=1,N128=0),tech!$B$21,I128)))","v":"Managed"}]
[null,{"$f":"IF(B$123=0,0,IF(F129=tech!$B$9,0,1))","v":1},"3.2.4.",{"$f":"IFERROR(VLOOKUP(C129,source!$BL$4:$BN$13,3,0),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(C129,source!$BL$4:$BN$13,2,0),0)*B129","v":0},{"$f":"IF(Scoping!K83=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BO$15:$BO$300,source!$BN$15:$BN$300=_xlfn.CONCAT($C129,LEFT(G$15,1),\"Y\"),\"\"))","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BO$15:$BO$300,source!$BN$15:$BN$300=_xlfn.CONCAT($C129,LEFT(H$15,1),\"Y\"),\"\"))","v":""},{"$nulls":5},{"$f":"IF(I129=\"\",0,VLOOKUP(I129,tech!$A$13:$B$17,2,0))*E129","v":0},{"$f":"IF(D129=\"\",\"\",IF(B129=0,tech!$B$9,IF(AND(B129=1,N129=0),tech!$B$21,I129)))","v":""}]
[null,{"$f":"IF(B$123=0,0,IF(F130=tech!$B$9,0,1))","v":1},"3.2.5.",{"$f":"IFERROR(VLOOKUP(C130,source!$BL$4:$BN$13,3,0),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(C130,source!$BL$4:$BN$13,2,0),0)*B130","v":0},{"$f":"IF(Scoping!K84=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BO$15:$BO$300,source!$BN$15:$BN$300=_xlfn.CONCAT($C130,LEFT(G$15,1),\"Y\"),\"\"))","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BO$15:$BO$300,source!$BN$15:$BN$300=_xlfn.CONCAT($C130,LEFT(H$15,1),\"Y\"),\"\"))","v":""},{"$nulls":5},{"$f":"IF(I130=\"\",0,VLOOKUP(I130,tech!$A$13:$B$17,2,0))*E130","v":0},{"$f":"IF(D130=\"\",\"\",IF(B130=0,tech!$B$9,IF(AND(B130=1,N130=0),tech!$B$21,I130)))","v":""}]
[null,{"$f":"IF(B$123=0,0,IF(F131=tech!$B$9,0,1))","v":1},"3.2.6.",{"$f":"IFERROR(VLOOKUP(C131,source!$BL$4:$BN$13,3,0),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(C131,source!$BL$4:$BN$13,2,0),0)*B131","v":0},{"$f":"IF(Scoping!K85=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BO$15:$BO$300,source!$BN$15:$BN$300=_xlfn.CONCAT($C131,LEFT(G$15,1),\"Y\"),\"\"))","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BO$15:$BO$300,source!$BN$15:$BN$300=_xlfn.CONCAT($C131,LEFT(H$15,1),\"Y\"),\"\"))","v":""},{"$nulls":5},{"$f":"IF(I131=\"\",0,VLOOKUP(I131,tech!$A$13:$B$17,2,0))*E131","v":0},{"$f":"IF(D131=\"\",\"\",IF(B131=0,tech!$B$9,IF(AND(B131=1,N131=0),tech!$B$21,I131)))","v":""}]
[]
[null,null,{"$f":"tech!A127","v":"3.3. Monitoring and Auditing"},null,"Weight",{"$f":"IF(B134=0,tech!$A$9,\"\")","v":""}]
[null,{"$f":"IF(Scoping!F71=tech!$A$5,0,1)","v":1},null,null,{"$f":"VLOOKUP(C133,tech!$A$117:$B$131,2,0)*B134","v":2},{"$nulls":8},{"$f":"IF(SUM(B137:B142)=0,0,TRUNC(SUM(N137:N142)/SUM(E137:E142),0))","v":3}]
[]
[null,null,"#","Requirement","Weight","N/A","Guidance","Assessment","Maturity level","Notes",null,"Evidence"]
[null,{"$f":"IF(B$134=0,0,IF(F137=tech!$B$9,0,1))","v":1},"3.3.1.",{"$f":"IFERROR(VLOOKUP(C137,source!$BR$4:$BT$13,3,0),\"\")","v":"Monitoring events and logging requirements are defined and documented"},{"$f":"IFERROR(VLOOKUP(C137,source!$BR$4:$BT$13,2,0),0)*B137","v":4},{"$f":"IF(Scoping!K91=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BU$15:$BU$300,source!$BT$15:$BT$300=_xlfn.CONCAT($C137,LEFT(G$15,1),\"Y\"),\"\"))","v":"The monitoring and logging requirements should be defined and documented in the CP, CPS, or other relevant documents. The requirements should be aligned with the overall PKI policies and statements, and should be based on the risk assessment and management activities.\n\nThe requirements can typically include:\n• events to be monitored\n• frequency of Monitoring\n• logs to be collected\n• Retention period for logs\n• Audit trail requirements\n• Audit log protection requirements\n• Formatting and interpretation of logs (syslog, JSON, XML, CEF, etc.)\n• and other relevant requirements"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BU$15:$BU$300,source!$BT$15:$BT$300=_xlfn.CONCAT($C137,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Documented Monitoring and logging requirements\n• Policies and procedures for Monitoring and logging\n• Review of records\n• Interviews with personnel"},"Advanced",{"$nulls":4},{"$f":"IF(I137=\"\",0,VLOOKUP(I137,tech!$A$13:$B$17,2,0))*E137","v":12},{"$f":"IF(D137=\"\",\"\",IF(B137=0,tech!$B$9,IF(AND(B137=1,N137=0),tech!$B$21,I137)))","v":"Advanced"}]
[null,{"$f":"IF(B$134=0,0,IF(F138=tech!$B$9,0,1))","v":1},"3.3.2.",{"$f":"IFERROR(VLOOKUP(C138,source!$BR$4:$BT$13,3,0),\"\")","v":"Event logs from systems are collected"},{"$f":"IFERROR(VLOOKUP(C138,source!$BR$4:$BT$13,2,0),0)*B138","v":4},{"$f":"IF(Scoping!K92=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BU$15:$BU$300,source!$BT$15:$BT$300=_xlfn.CONCAT($C138,LEFT(G$15,1),\"Y\"),\"\"))","v":"The event logs from systems should be collected and available for analysis, including correlation with other records. Centralized logging is recommended to ensure that the logs are collected and stored consistently. Solution like security information and event management (SIEM) can be used to collect and analyze the logs.\n\nThe availability of records for analysis depends on understanding logging format and interpretation of the information, therefore each system should provide logs in a consistent format that can be further processed and analyzed (or automated).\n\nLogs and events should be collected from all systems that are relevant for the PKI implementation, such as key life cycle management events.\n\nThe event should contain sufficient information to identify the event, including:\n• User Identification\n• Type of event\n• Date and time\n• Success or failure indication\n• Origination of event\n• Identity or name of affected data, system component, or resource\n• Additional details"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BU$15:$BU$300,source!$BT$15:$BT$300=_xlfn.CONCAT($C138,LEFT(H$15,1),\"Y\"),\"\"))","v":"• logs are collected from systems\n• logs have a consistent format and can be further processed and analyzed\n• Review of records and their Formatting\n• Review of configuration standards for logging\n• Interviews with personnel to check the Understanding of logging format and interpretation of the information"},"Advanced",{"$nulls":4},{"$f":"IF(I138=\"\",0,VLOOKUP(I138,tech!$A$13:$B$17,2,0))*E138","v":12},{"$f":"IF(D138=\"\",\"\",IF(B138=0,tech!$B$9,IF(AND(B138=1,N138=0),tech!$B$21,I138)))","v":"Advanced"}]
[null,{"$f":"IF(B$134=0,0,IF(F139=tech!$B$9,0,1))","v":1},"3.3.3.",{"$f":"IFERROR(VLOOKUP(C139,source!$BR$4:$BT$13,3,0),\"\")","v":"Audit trail can be reconstructed from audit logs"},{"$f":"IFERROR(VLOOKUP(C139,source!$BR$4:$BT$13,2,0),0)*B139","v":5},{"$f":"IF(Scoping!K93=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BU$15:$BU$300,source!$BT$15:$BT$300=_xlfn.CONCAT($C139,LEFT(G$15,1),\"Y\"),\"\"))","v":"Audit logging should be implemented to ensure that the audit trail can be reconstructed from audit logs any time. Audit logs are typically recorded for any user executed events that are important for security of the PKI implementation. Audit logs should be stored in a secure location. The audit logs should be protected against unauthorized access, modification, and deletion.\n\nTypically, the following events are important for security of the PKI implementation:\n• all individual User accesses to sensitive data\n• all actions taken by any individual with root or administrative privileges\n• access to all Audit trails\n• Invalid logical access attempts\n• Use of and changes to identification and authentication mechanisms - including but not limited to creation of new accounts and elevation of privileges - and all changes, additions, or deletions to accounts with root or administrative privileges\n• Initialization, stopping, or pausing of the audit logs\n• creation and deletion of system-level objects"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BU$15:$BU$300,source!$BT$15:$BT$300=_xlfn.CONCAT($C139,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Audit trail can be reconstructed from Audit logs\n• Audit logs are stored in a secure location\n• Audit logs are protected against unauthorized access, modification, and deletion\n• Review of records\n• Interviews with personnel to Understand the Audit logging implementation"},"Advanced",{"$nulls":4},{"$f":"IF(I139=\"\",0,VLOOKUP(I139,tech!$A$13:$B$17,2,0))*E139","v":15},{"$f":"IF(D139=\"\",\"\",IF(B139=0,tech!$B$9,IF(AND(B139=1,N139=0),tech!$B$21,I139)))","v":"Advanced"}]
[null,{"$f":"IF(B$134=0,0,IF(F140=tech!$B$9,0,1))","v":1},"3.3.4.",{"$f":"IFERROR(VLOOKUP(C140,source!$BR$4:$BT$13,3,0),\"\")","v":"Monitoring of operational and security events is implemented"},{"$f":"IFERROR(VLOOKUP(C140,source!$BR$4:$BT$13,2,0),0)*B140","v":5},{"$f":"IF(Scoping!K94=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BU$15:$BU$300,source!$BT$15:$BT$300=_xlfn.CONCAT($C140,LEFT(G$15,1),\"Y\"),\"\"))","v":"Monitoring of operational and security events should be implemented to ensure that the PKI implementation is operating as expected and that the security events are detected and responded to in a timely manner and that evidence of any malicious event is identified. The monitoring should be implemented for all critical systems and components, including the CA, RA, OCSP, HSM, and other relevant systems.\n\nMonitoring should be aligned with the monitoring and auditing requirements defined in the CP, CPS, and other relevant documents. The monitoring should be implemented to ensure that the requirements are met."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BU$15:$BU$300,source!$BT$15:$BT$300=_xlfn.CONCAT($C140,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Monitoring of operational and Security events is implemented according to the requirements\n• Review of monitoring implementation, including CA key life cycle management related events, security sensitive events, and other relevant events\n• Review of Monitoring events and alerts\n• Interviews with personnel responsible for Monitoring"},"Advanced",{"$nulls":4},{"$f":"IF(I140=\"\",0,VLOOKUP(I140,tech!$A$13:$B$17,2,0))*E140","v":15},{"$f":"IF(D140=\"\",\"\",IF(B140=0,tech!$B$9,IF(AND(B140=1,N140=0),tech!$B$21,I140)))","v":"Advanced"}]
[null,{"$f":"IF(B$134=0,0,IF(F141=tech!$B$9,0,1))","v":1},"3.3.5.",{"$f":"IFERROR(VLOOKUP(C141,source!$BR$4:$BT$13,3,0),\"\")","v":"Critical events are immediately alerted and resolved according to incident response plans"},{"$f":"IFERROR(VLOOKUP(C141,source!$BR$4:$BT$13,2,0),0)*B141","v":3},{"$f":"IF(Scoping!K95=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BU$15:$BU$300,source!$BT$15:$BT$300=_xlfn.CONCAT($C141,LEFT(G$15,1),\"Y\"),\"\"))","v":"Critical events should be immediately alerted and resolved according to incident response plans. Monitoring implementation should ensure that critical events are detected and alerted in a timely manner. This can be done manually or in an automated way. "},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BU$15:$BU$300,source!$BT$15:$BT$300=_xlfn.CONCAT($C141,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Review of requirements for alerting on critical event, including security sensitive events\n• Review of Monitoring implementation\n• Review of documentation of critical events\n• Interviews with personnel to check the Understanding of critical events and their handling"},"Advanced",{"$nulls":4},{"$f":"IF(I141=\"\",0,VLOOKUP(I141,tech!$A$13:$B$17,2,0))*E141","v":9},{"$f":"IF(D141=\"\",\"\",IF(B141=0,tech!$B$9,IF(AND(B141=1,N141=0),tech!$B$21,I141)))","v":"Advanced"}]
[null,{"$f":"IF(B$134=0,0,IF(F142=tech!$B$9,0,1))","v":1},"3.3.6.",{"$f":"IFERROR(VLOOKUP(C142,source!$BR$4:$BT$13,3,0),\"\")","v":"Review of events and logs is periodically performed"},{"$f":"IFERROR(VLOOKUP(C142,source!$BR$4:$BT$13,2,0),0)*B142","v":2},{"$f":"IF(Scoping!K96=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BU$15:$BU$300,source!$BT$15:$BT$300=_xlfn.CONCAT($C142,LEFT(G$15,1),\"Y\"),\"\"))","v":"Logs and events should be reviewed frequently, preferably automatically, to determine security related issues, potential systems failure, identify anomalies or suspected activity. Regular review should be confirmed by authorized personnel who can proactively identify issues before they become problems.\n\nThe review of logs and events should be performed periodically and the frequency should be based on the risk assessment. Any potential issues should be reported and resolved according to the incident response plans."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$BU$15:$BU$300,source!$BT$15:$BT$300=_xlfn.CONCAT($C142,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Review of logs and events is performed Periodically\n• Review of logs and events is performed according to the requirements\n• Review of logs and events is confirmed by authorized personnel\n• Interview with personnel responsible for Review of logs and events"},"Advanced",{"$nulls":4},{"$f":"IF(I142=\"\",0,VLOOKUP(I142,tech!$A$13:$B$17,2,0))*E142","v":6},{"$f":"IF(D142=\"\",\"\",IF(B142=0,tech!$B$9,IF(AND(B142=1,N142=0),tech!$B$21,I142)))","v":"Advanced"}]
[]
[null,null,{"$f":"tech!A128","v":"3.4. Automation"},null,"Weight",{"$f":"IF(B145=0,tech!$A$9,\"\")","v":""}]
[null,{"$f":"IF(Scoping!F77=tech!$A$5,0,1)","v":1},null,null,{"$f":"VLOOKUP(C144,tech!$A$117:$B$131,2,0)*B145","v":2},{"$nulls":8},{"$f":"IF(SUM(B148:B153)=0,0,TRUNC(SUM(N148:N153)/SUM(E148:E153),0))","v":2}]
[]
[null,null,"#","Requirement","Weight","N/A","Guidance","Assessment","Maturity level","Notes",null,"Evidence"]
[null,{"$f":"IF(B$145=0,0,IF(F148=tech!$B$9,0,1))","v":1},"3.4.1.",{"$f":"IFERROR(VLOOKUP(C148,source!$BX$4:$BZ$13,3,0),\"\")","v":"Process automation description"},{"$f":"IFERROR(VLOOKUP(C148,source!$BX$4:$BZ$13,2,0),0)*B148","v":3},{"$f":"IF(Scoping!K102=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CA$15:$CA$300,source!$BZ$15:$BZ$300=_xlfn.CONCAT($C148,LEFT(G$15,1),\"Y\"),\"\"))","v":"Every automated certificate management process should be properly described and documented. The documentation should contain information relevant to the process automation and understanding the reasons for automation. Monitoring, auditing, and potential measures and controls would be ineffective without proper description and understanding of the automation process.\n\nThe description can include for example the following:\n• use-case or process to be automated\n• Reasons for automation\n• description of the automation process\n• involved Tools and technologies\n• Monitoring and auditing requirements\n• Potential measures and controls\n• Exceptions\n• logging and reporting\n• any other relevant information and requirements"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CA$15:$CA$300,source!$BZ$15:$BZ$300=_xlfn.CONCAT($C148,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• process automation description\n• Interview with the process owner\n• Interview with administrators\n• Sample of automated process logs"},"Basic",{"$nulls":4},{"$f":"IF(I148=\"\",0,VLOOKUP(I148,tech!$A$13:$B$17,2,0))*E148","v":6},{"$f":"IF(D148=\"\",\"\",IF(B148=0,tech!$B$9,IF(AND(B148=1,N148=0),tech!$B$21,I148)))","v":"Basic"}]
[null,{"$f":"IF(B$145=0,0,IF(F149=tech!$B$9,0,1))","v":1},"3.4.2.",{"$f":"IFERROR(VLOOKUP(C149,source!$BX$4:$BZ$13,3,0),\"\")","v":"Monitoring and auditing of automated process"},{"$f":"IFERROR(VLOOKUP(C149,source!$BX$4:$BZ$13,2,0),0)*B149","v":1},{"$f":"IF(Scoping!K103=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CA$15:$CA$300,source!$BZ$15:$BZ$300=_xlfn.CONCAT($C149,LEFT(G$15,1),\"Y\"),\"\"))","v":"The automated process of certificate management can cause significant damage if misused or misconfigured. The monitoring and auditing of the automated process is essential to prevent the risk of misuse and to detect any potential issues, inefficiencies, or exceptions.\n\nThe monitoring and auditing should be performed on a regular basis and should be aligned with the overall monitoring and auditing strategy of the organization.\nIt should provide sufficient information to detect any potential issues with the automated process. For successful detection or identification of issues, proper expectations should be based on the description of the automated process."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CA$15:$CA$300,source!$BZ$15:$BZ$300=_xlfn.CONCAT($C149,LEFT(H$15,1),\"Y\"),\"\"))","v":"Monitoring of automated processes should be supported by monitoring tools and technologies that can provide the necessary overview, reporting, and potential alerting in case of issues.\nThe following is sample evidence that can be used to assess the requirement:\n• Documented Monitoring and auditing measures\n• Monitoring and auditing Tools and technologies applied\n• Sample report or dashboard from Monitoring\n• Interview with responsible personnel\n• Simulate failure of the automated certificate management process and verify that the failure is detected and reported"},"Managed",{"$nulls":4},{"$f":"IF(I149=\"\",0,VLOOKUP(I149,tech!$A$13:$B$17,2,0))*E149","v":4},{"$f":"IF(D149=\"\",\"\",IF(B149=0,tech!$B$9,IF(AND(B149=1,N149=0),tech!$B$21,I149)))","v":"Managed"}]
[null,{"$f":"IF(B$145=0,0,IF(F150=tech!$B$9,0,1))","v":1},"3.4.3.",{"$f":"IFERROR(VLOOKUP(C150,source!$BX$4:$BZ$13,3,0),\"\")","v":"Incidents and exceptions handling"},{"$f":"IFERROR(VLOOKUP(C150,source!$BX$4:$BZ$13,2,0),0)*B150","v":1},{"$f":"IF(Scoping!K104=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CA$15:$CA$300,source!$BZ$15:$BZ$300=_xlfn.CONCAT($C150,LEFT(G$15,1),\"Y\"),\"\"))","v":"No automation is perfect and covers everything. There can be edge cases and other situations that were not part of the initial analysis or were simply forgotten. Therefore, there will always be exceptions and incidents that will require manual intervention. The automated process should be able to handle such exceptions and incidents in a way that will not cause any significant damage or disruption to the service.\n\nIt may happen that some certificates are required to be handled manually and therefore the exception should be approved and documented. \n\nHandling of exceptional situations should be covered in the documentation, stating what should be done in case of an exception or incident:\n• Communication of the exception\n• Approval of the exception\n• incident handling and reporting\n• any other relevant information\n\nThe handling of exceptions should be tested and verified on a regular basis to ensure that the process is working as expected."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CA$15:$CA$300,source!$BZ$15:$BZ$300=_xlfn.CONCAT($C150,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• Documented Exceptions\n• Interview with responsible personnel about how to handle Exceptions or incidents"},"Basic",{"$nulls":4},{"$f":"IF(I150=\"\",0,VLOOKUP(I150,tech!$A$13:$B$17,2,0))*E150","v":2},{"$f":"IF(D150=\"\",\"\",IF(B150=0,tech!$B$9,IF(AND(B150=1,N150=0),tech!$B$21,I150)))","v":"Basic"}]
[null,{"$f":"IF(B$145=0,0,IF(F151=tech!$B$9,0,1))","v":1},"3.4.4.",{"$f":"IFERROR(VLOOKUP(C151,source!$BX$4:$BZ$13,3,0),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(C151,source!$BX$4:$BZ$13,2,0),0)*B151","v":0},{"$f":"IF(Scoping!K105=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CA$15:$CA$300,source!$BZ$15:$BZ$300=_xlfn.CONCAT($C151,LEFT(G$15,1),\"Y\"),\"\"))","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CA$15:$CA$300,source!$BZ$15:$BZ$300=_xlfn.CONCAT($C151,LEFT(H$15,1),\"Y\"),\"\"))","v":""},{"$nulls":5},{"$f":"IF(I151=\"\",0,VLOOKUP(I151,tech!$A$13:$B$17,2,0))*E151","v":0},{"$f":"IF(D151=\"\",\"\",IF(B151=0,tech!$B$9,IF(AND(B151=1,N151=0),tech!$B$21,I151)))","v":""}]
[null,{"$f":"IF(B$145=0,0,IF(F152=tech!$B$9,0,1))","v":1},"3.4.5.",{"$f":"IFERROR(VLOOKUP(C152,source!$BX$4:$BZ$13,3,0),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(C152,source!$BX$4:$BZ$13,2,0),0)*B152","v":0},{"$f":"IF(Scoping!K106=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CA$15:$CA$300,source!$BZ$15:$BZ$300=_xlfn.CONCAT($C152,LEFT(G$15,1),\"Y\"),\"\"))","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CA$15:$CA$300,source!$BZ$15:$BZ$300=_xlfn.CONCAT($C152,LEFT(H$15,1),\"Y\"),\"\"))","v":""},{"$nulls":5},{"$f":"IF(I152=\"\",0,VLOOKUP(I152,tech!$A$13:$B$17,2,0))*E152","v":0},{"$f":"IF(D152=\"\",\"\",IF(B152=0,tech!$B$9,IF(AND(B152=1,N152=0),tech!$B$21,I152)))","v":""}]
[null,{"$f":"IF(B$145=0,0,IF(F153=tech!$B$9,0,1))","v":1},"3.4.6.",{"$f":"IFERROR(VLOOKUP(C153,source!$BX$4:$BZ$13,3,0),\"\")","v":""},{"$f":"IFERROR(VLOOKUP(C153,source!$BX$4:$BZ$13,2,0),0)*B153","v":0},{"$f":"IF(Scoping!K107=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CA$15:$CA$300,source!$BZ$15:$BZ$300=_xlfn.CONCAT($C153,LEFT(G$15,1),\"Y\"),\"\"))","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CA$15:$CA$300,source!$BZ$15:$BZ$300=_xlfn.CONCAT($C153,LEFT(H$15,1),\"Y\"),\"\"))","v":""},{"$nulls":5},{"$f":"IF(I153=\"\",0,VLOOKUP(I153,tech!$A$13:$B$17,2,0))*E153","v":0},{"$f":"IF(D153=\"\",\"\",IF(B153=0,tech!$B$9,IF(AND(B153=1,N153=0),tech!$B$21,I153)))","v":""}]
[]
[]
[null,null,"4. Resources",null,null,{"$f":"IF(AND(B161=0,B172=0,B183=0,B194=0),tech!$A$9,\"\")","v":""}]
[{"$nulls":13},{"$f":"IF(SUM(E161,E170,E180)=0,0,TRUNC((IF(B161=0,0,SUM(N164:N167)/SUM(E164:E167)*E161)+IF(B170=0,0,SUM(N173:N177)/SUM(E173:E177)*E170)+IF(B180=0,0,SUM(N183:N186)/SUM(E183:E186)*E180))/SUM(E161,E170,E180),0))","v":3}]
[{"$nulls":13},{"$f":"IF(SUM(E161,E170,E180)=0,0,(IF(B161=0,0,SUM(N164:N167)/SUM(E164:E167)*E161)+IF(B170=0,0,SUM(N173:N177)/SUM(E173:E177)*E170)+IF(B180=0,0,SUM(N183:N186)/SUM(E183:E186)*E180))/SUM(E161,E170,E180))","v":3.6761904761904765}]
[]
[null,null,{"$f":"tech!A129","v":"4.1. Sourcing"},null,"Weight",{"$f":"IF(B161=0,tech!$A$9,\"\")","v":""}]
[null,{"$f":"IF(Scoping!F83=tech!$A$5,0,1)","v":1},null,null,{"$f":"VLOOKUP(C160,tech!$A$117:$B$131,2,0)*B161","v":4},{"$nulls":8},{"$f":"IF(SUM(B164:B169)=0,0,TRUNC(SUM(N164:N169)/SUM(E164:E169),0))","v":3}]
[null,null,"PKI is a complex system that requires a lot of resources to be managed and maintained. Proper sourcing of the resources is one of key factors for the of mature infrastructure that can maintain and improve trust over the time. The resources can be:\n\n    financial resources needed to maintain the PKI\n    computing resources like hardware, software, tools, technologies\n    human resources (personnel)\n    management resources like processes and procedures\n\nThe sourcing is a process of defining the required resources and their specification, availability, and management. The sourcing requires monitoring and periodic review of the resources needed and alignment with the overall strategy of the organization and scope of the PKI."]
[null,null,"#","Requirement","Weight","N/A","Guidance","Assessment","Maturity level","Notes",null,"Evidence"]
[null,{"$f":"IF(B$161=0,0,IF(F164=tech!$B$9,0,1))","v":1},"4.1.1.",{"$f":"IFERROR(VLOOKUP(C164,source!$CD$4:$CF$13,3,0),\"\")","v":"Resources are identified and documented"},{"$f":"IFERROR(VLOOKUP(C164,source!$CD$4:$CF$13,2,0),0)*B164","v":5},{"$f":"IF(Scoping!K118=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CG$15:$CG$300,source!$CF$15:$CF$300=_xlfn.CONCAT($C164,LEFT(G$15,1),\"Y\"),\"\"))","v":"Resources needed for proper management of the PKI are identified and documented. Resources should be aligned with the PKI scope and use-case(s) that should be supported. The main question to answer here is \"Do we know what resources we need to manage the PKI?\". "},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CG$15:$CG$300,source!$CF$15:$CF$300=_xlfn.CONCAT($C164,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is sample evidence that can be used to assess the requirement:\n• Resource management process\n• Documented requirements on the resources\n• Categorization of resources (an example can be people, processes, procedures, tools, technologies)\n• Alignment with the scope of the use-case"},"Initial",{"$nulls":4},{"$f":"IF(I164=\"\",0,VLOOKUP(I164,tech!$A$13:$B$17,2,0))*E164","v":5},{"$f":"IF(B164=0,tech!$B$9,IF(AND(B164=1,N164=0),tech!$B$21,I164))","v":"Initial"}]
[null,{"$f":"IF(B$161=0,0,IF(F165=tech!$B$9,0,1))","v":1},"4.1.2.",{"$f":"IFERROR(VLOOKUP(C165,source!$CD$4:$CF$13,3,0),\"\")","v":"Resources are clearly defined"},{"$f":"IFERROR(VLOOKUP(C165,source!$CD$4:$CF$13,2,0),0)*B165","v":3},{"$f":"IF(Scoping!K119=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CG$15:$CG$300,source!$CF$15:$CF$300=_xlfn.CONCAT($C165,LEFT(G$15,1),\"Y\"),\"\"))","v":"Identified resources should be properly defined and specified. The specification depends on the type of the resource and can include for example the following:\n• People: required skills to perform the tasks, roles, and responsibilities\n• Tools: description, supported technologies\n• Technologies: required functionality and performance\n• Financial resources: required budget, funding sources\n• Management resources: processes and procedures, inputs, outputs\n• Other resources: description, specification, requirements\n\nWithout clearly defined resources, there could be misuse of the organization’s assets or inconsistent interaction with personnel and other parties, leading to insecure and untrusted implementation of the PKI."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CG$15:$CG$300,source!$CF$15:$CF$300=_xlfn.CONCAT($C165,LEFT(H$15,1),\"Y\"),\"\"))","v":"The following is a sample evidence that can be used to assess the requirement:\n• Resource management process\n• Documented requirements on the resources\n• Categorization of resources (an example can be: people, processes, procedures, tools, technologies)\n• Alignment with the scope of the use-case\n• Interview personnel in various roles"},"Optimized",{"$nulls":4},{"$f":"IF(I165=\"\",0,VLOOKUP(I165,tech!$A$13:$B$17,2,0))*E165","v":15},{"$f":"IF(B165=0,tech!$B$9,IF(AND(B165=1,N165=0),tech!$B$21,I165))","v":"Optimized"}]
[null,{"$f":"IF(B$161=0,0,IF(F166=tech!$B$9,0,1))","v":1},"4.1.3.",{"$f":"IFERROR(VLOOKUP(C166,source!$CD$4:$CF$13,3,0),\"\")","v":"Availability of resources"},{"$f":"IFERROR(VLOOKUP(C166,source!$CD$4:$CF$13,2,0),0)*B166","v":4},{"$f":"IF(Scoping!K120=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CG$15:$CG$300,source!$CF$15:$CF$300=_xlfn.CONCAT($C166,LEFT(G$15,1),\"Y\"),\"\"))","v":"Identified and defined resources should be available at the required capacity. The availability of the resources should be aligned with the overall strategy of the organization and scope of the PKI. The availability of the resources should be controlled to ensure that the resources are available when needed."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CG$15:$CG$300,source!$CF$15:$CF$300=_xlfn.CONCAT($C166,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Review of the Resource management process\n• Review of the capacity or demand management process\n• Alignment with the strategy of the organization and scope of the PKI\n• Review of the assignment of the resources to the tasks\n• Utilization and performance of the services"},"Optimized",{"$nulls":4},{"$f":"IF(I166=\"\",0,VLOOKUP(I166,tech!$A$13:$B$17,2,0))*E166","v":20},{"$f":"IF(B166=0,tech!$B$9,IF(AND(B166=1,N166=0),tech!$B$21,I166))","v":"Optimized"}]
[null,{"$f":"IF(B$161=0,0,IF(F167=tech!$B$9,0,1))","v":1},"4.1.4.",{"$f":"IFERROR(VLOOKUP(C167,source!$CD$4:$CF$13,3,0),\"\")","v":"Resources are periodically reviewed"},{"$f":"IFERROR(VLOOKUP(C167,source!$CD$4:$CF$13,2,0),0)*B167","v":3},{"$f":"IF(Scoping!K121=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CG$15:$CG$300,source!$CF$15:$CF$300=_xlfn.CONCAT($C167,LEFT(G$15,1),\"Y\"),\"\"))","v":"Resource should be periodically reviewed to ensure the accurate use of the resources and secure operations. Frequency of the review depends on the complexity and criticality of the infrastructure. Good practice is to perform reviews at least once a year.\n\nReview includes the following (but not limited to)\n• Analysis that the resources continue to match with the scope and capacity required to provide the services\n• Review of the specifications of the resources to continue support of the PKI\n• Review announcements and technology trends (for example “end of life” plans for a technology)\n• Documentation of any remediation plan, updates to sourcing of the PKI, that should be approved by the management"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CG$15:$CG$300,source!$CF$15:$CF$300=_xlfn.CONCAT($C167,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Review of changes to the PKI scope\n• Review of the capacity or available resources\n• Vendor announcements\n• technology trends\n• skills and knowledge of the personnel"},"Optimized",{"$nulls":4},{"$f":"IF(I167=\"\",0,VLOOKUP(I167,tech!$A$13:$B$17,2,0))*E167","v":15},{"$f":"IF(B167=0,tech!$B$9,IF(AND(B167=1,N167=0),tech!$B$21,I167))","v":"Optimized"}]
[]
[null,null,{"$f":"tech!A130","v":"4.2. Knowledge and Training"},null,"Weight",{"$f":"IF(B170=0,tech!$A$9,\"\")","v":""}]
[null,{"$f":"IF(Scoping!F87=tech!$A$5,0,1)","v":1},null,null,{"$f":"VLOOKUP(C169,tech!$A$117:$B$131,2,0)*B170","v":3},{"$nulls":8},{"$f":"IF(SUM(B173:B178)=0,0,TRUNC(SUM(N173:N178)/SUM(E173:E178),0))","v":4}]
[null,null,"The purpose of this category is to ensure that the PKI personnel has the required knowledge and skills to perform their duties and responsibilities. Education and continuously gathering of required knowledge and skills to manage PKI is important to be aware and properly react on the current trends and threats that have impact on the public key infrastructure.\nEach personnel should be aware of the PKI policies and procedures, and should be able to perform their duties and responsibilities in accordance with the PKI policies and procedures."]
[null,null,"#","Requirement","Weight","N/A","Guidance","Assessment","Maturity level","Notes",null,"Evidence"]
[null,{"$f":"IF(B$170=0,0,IF(F173=tech!$B$9,0,1))","v":1},"4.2.1.",{"$f":"IFERROR(VLOOKUP(C173,source!$CJ$4:$CL$13,3,0),\"\")","v":"Establish training plan"},{"$f":"IFERROR(VLOOKUP(C173,source!$CJ$4:$CL$13,2,0),0)*B173","v":2},{"$f":"IF(Scoping!K127=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CM$15:$CM$300,source!$CL$15:$CL$300=_xlfn.CONCAT($C173,LEFT(G$15,1),\"Y\"),\"\"))","v":"The training plan should be established and maintained to ensure that personnel have the required knowledge and skills to perform their duties and responsibilities. It should reflect the current state of the PKI implementation and be updated when the PKI implementation changes, and provide necessary information for all personnel that are involved in the PKI implementation.\n\nTraining plan is built with PKI needs and requirements in mind and should cover:\n• Training Prerequisites\n• Training matrix (who needs to be trained and what Training should be received)\n• Training schedule\n• Training format and methods\n• requirements on Training reports and records\n• Training plan Review and update\n\nThere can be different methods of training, depending on the needs and requirements:\n• Instructor-led Training\n• internal or external webinars\n• Coaching\n• Self-paced Training\n• Online resources\n• Shadowing or reverse-Shadowing"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CM$15:$CM$300,source!$CL$15:$CL$300=_xlfn.CONCAT($C173,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Documented Training plan\n• Training plan is up-to-Date\n• Training plan is approved and communicated to all personnel\n• Training plan is integrated in organization"},"Managed",{"$nulls":4},{"$f":"IF(I173=\"\",0,VLOOKUP(I173,tech!$A$13:$B$17,2,0))*E173","v":8},{"$f":"IF(B173=0,tech!$B$9,IF(AND(B173=1,N173=0),tech!$B$21,I173))","v":"Managed"}]
[null,{"$f":"IF(B$170=0,0,IF(F174=tech!$B$9,0,1))","v":1},"4.2.2.",{"$f":"IFERROR(VLOOKUP(C174,source!$CJ$4:$CL$13,3,0),\"\")","v":"Responsible personnel receive training"},{"$f":"IFERROR(VLOOKUP(C174,source!$CJ$4:$CL$13,2,0),0)*B174","v":2},{"$f":"IF(Scoping!K128=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CM$15:$CM$300,source!$CL$15:$CL$300=_xlfn.CONCAT($C174,LEFT(G$15,1),\"Y\"),\"\"))","v":"The responsible personnel should be aware of the current policies and procedures that are related to the context of the PKI implementation. Training should be provided to personnel that are responsible for the management, operation, and administration of the PKI.\n\nTraining is provided in accordance with the current and approved training plan.\n\nMethods and training content can vary, depending on personnel roles and covers:\n• New hires as part of the Onboarding process\n• Periodic Training for all personnel (the frequency of the Training depends on the Role and responsibilities)\n\nFor each training, attendance should be recorded and documented, and in case the training is not completed, the reason should be documented.\nIn case there are requirements for score or threshold to be achieved, the results should be documented."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CM$15:$CM$300,source!$CL$15:$CL$300=_xlfn.CONCAT($C174,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Review Training matrix\n• Review Documented Training Results\n• Review Training records\n• Relevancy of the Training content\n• Training is provided in accordance with the Training plan\n• Training Completeness"},"Managed",{"$nulls":4},{"$f":"IF(I174=\"\",0,VLOOKUP(I174,tech!$A$13:$B$17,2,0))*E174","v":8},{"$f":"IF(B174=0,tech!$B$9,IF(AND(B174=1,N174=0),tech!$B$21,I174))","v":"Managed"}]
[null,{"$f":"IF(B$170=0,0,IF(F175=tech!$B$9,0,1))","v":1},"4.2.3.",{"$f":"IFERROR(VLOOKUP(C175,source!$CJ$4:$CL$13,3,0),\"\")","v":"Perform security awareness training"},{"$f":"IFERROR(VLOOKUP(C175,source!$CJ$4:$CL$13,2,0),0)*B175","v":2},{"$f":"IF(Scoping!K129=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CM$15:$CM$300,source!$CL$15:$CL$300=_xlfn.CONCAT($C175,LEFT(G$15,1),\"Y\"),\"\"))","v":"Security awareness education is an ongoing activity. The security awareness program is implemented to make all personnel aware of their role in protecting the security and establishing trust by the PKI implementation. It should stay up to date to reflect latest security trends, threats, and challenges.\n\nSecurity awareness should ensure that personnel are knowledgeable about the threat landscape, their responsibility for the operation of relevant security controls, and are able to access assistance and guidance when required.\n\nDifferent methods can be applied to provide security awareness, for example:\n• Posters and letters with the specific topic\n• team meetings and webinars\n• Security incentives and rewards\n• Training and education"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CM$15:$CM$300,source!$CL$15:$CL$300=_xlfn.CONCAT($C175,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Examine Security awareness program\n• Interview personnel to verify that they are aware of their responsibilities\n• Review Security awareness Training records\n• Security awareness Training is provided in accordance with the Training plan\n• Review content of the Security awareness Training"},"Optimized",{"$nulls":4},{"$f":"IF(I175=\"\",0,VLOOKUP(I175,tech!$A$13:$B$17,2,0))*E175","v":10},{"$f":"IF(B175=0,tech!$B$9,IF(AND(B175=1,N175=0),tech!$B$21,I175))","v":"Optimized"}]
[null,{"$f":"IF(B$170=0,0,IF(F176=tech!$B$9,0,1))","v":1},"4.2.4.",{"$f":"IFERROR(VLOOKUP(C176,source!$CJ$4:$CL$13,3,0),\"\")","v":"Establish education plan"},{"$f":"IFERROR(VLOOKUP(C176,source!$CJ$4:$CL$13,2,0),0)*B176","v":1},{"$f":"IF(Scoping!K130=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CM$15:$CM$300,source!$CL$15:$CL$300=_xlfn.CONCAT($C176,LEFT(G$15,1),\"Y\"),\"\"))","v":"Proper education plan is required to stay up to date with the development of the latest technologies, security practices, and controls that have impact on the PKI and its future development. \n\nThe education plan should establish a robust base for the personnel to gain relevant knowledge that are out of scope of the internal training plan, but should be aligned with it to ensure that the personnel are able to perform their duties and responsibilities. The education plan should cover:\n• education requirements and Prerequisites\n• Recommended education Approach and methods\n• Approach to Monitor and assess the education Results\n\nMethods to provide education can vary:\n• internal or external courses\n• incentives and rewards\n• Mentoring, coaching, and shadowing\n• Competitions and challenges"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CM$15:$CM$300,source!$CL$15:$CL$300=_xlfn.CONCAT($C176,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Review education plan and its Alignment with the Training plan\n• Interview personnel to verify their educational goals\n• Validate education records"},"Managed",{"$nulls":4},{"$f":"IF(I176=\"\",0,VLOOKUP(I176,tech!$A$13:$B$17,2,0))*E176","v":4},{"$f":"IF(B176=0,tech!$B$9,IF(AND(B176=1,N176=0),tech!$B$21,I176))","v":"Managed"}]
[null,{"$f":"IF(B$170=0,0,IF(F177=tech!$B$9,0,1))","v":1},"4.2.5.",{"$f":"IFERROR(VLOOKUP(C177,source!$CJ$4:$CL$13,3,0),\"\")","v":"Periodically review knowledge"},{"$f":"IFERROR(VLOOKUP(C177,source!$CJ$4:$CL$13,2,0),0)*B177","v":2},{"$f":"IF(Scoping!K131=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CM$15:$CM$300,source!$CL$15:$CL$300=_xlfn.CONCAT($C177,LEFT(G$15,1),\"Y\"),\"\"))","v":"The training plan should be reviewed and updated periodically to ensure that it is up-to-date and covers all aspects of the specific PKI implementation.\n\nPeriodical review of the training plans helps to maintain required skills and knowledge for the responsible personnel.\nIt provides assurance that the expected controls are active and working as intended."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CM$15:$CM$300,source!$CL$15:$CL$300=_xlfn.CONCAT($C177,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Training plan Review process\n• implementation of Review process\n• Validation of documentation and reviews"},"Managed",{"$nulls":4},{"$f":"IF(I177=\"\",0,VLOOKUP(I177,tech!$A$13:$B$17,2,0))*E177","v":8},{"$f":"IF(B177=0,tech!$B$9,IF(AND(B177=1,N177=0),tech!$B$21,I177))","v":"Managed"}]
[]
[null,null,{"$f":"tech!A131","v":"4.3. Awareness"},null,"Weight",{"$f":"IF(B180=0,tech!$A$9,\"\")","v":""}]
[null,{"$f":"IF(Scoping!F92=tech!$A$5,0,1)","v":1},null,null,{"$f":"VLOOKUP(C179,tech!$A$117:$B$131,2,0)*B180","v":3},{"$nulls":8},{"$f":"IF(SUM(B183:B188)=0,0,TRUNC(SUM(N183:N188)/SUM(E183:E188),0))","v":3}]
[null,null,"Providing awareness about the PKI and its purpose in the organization and outside ensures that ech PKI participant understands it properly and is timely informed about any important events that may have impact on the participant.\nThe awareness is important for all PKI participants to know how to handle exceptional situations and how to react on them. It is also important to know how to communicate and when and to not misunderstand any issues or incidents."]
[null,null,"#","Requirement","Weight","N/A","Guidance","Assessment","Maturity level","Notes",null,"Evidence"]
[null,{"$f":"IF(B$180=0,0,IF(F183=tech!$B$9,0,1))","v":1},"4.3.1.",{"$f":"IFERROR(VLOOKUP(C183,source!$CP$4:$CR$13,3,0),\"\")","v":"Establish and maintain awareness plan"},{"$f":"IFERROR(VLOOKUP(C183,source!$CP$4:$CR$13,2,0),0)*B183","v":2},{"$f":"IF(Scoping!K137=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CS$15:$CS$300,source!$CR$15:$CR$300=_xlfn.CONCAT($C183,LEFT(G$15,1),\"Y\"),\"\"))","v":"Awareness plan should be established and maintained to ensure that the PKI participants are aware of all relevant events related to the PKI implementation and its purpose in the organization and outside. It should cover at lease the following information:\n• How the organization discloses information to PKI participants\n• Contact information\n• How are changes communicated\n• Who is responsible for accurate awareness\n• Resolving communication issues and incidents\n\nEvery PKI participant should receive information and relevant resource in a timely manner according to the awareness plan."},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CS$15:$CS$300,source!$CR$15:$CR$300=_xlfn.CONCAT($C183,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Documented awareness plan\n• awareness plan is up-to-date\n• Review awareness content to ensure that it is contains relevant information\n• awareness plan is approved and communicated to all PKI participants\n• awareness plan is integrated in the organization"},"Basic",{"$nulls":4},{"$f":"IF(I183=\"\",0,VLOOKUP(I183,tech!$A$13:$B$17,2,0))*E183","v":4},{"$f":"IF(B183=0,tech!$B$9,IF(AND(B183=1,N183=0),tech!$B$21,I183))","v":"Basic"}]
[null,{"$f":"IF(B$180=0,0,IF(F184=tech!$B$9,0,1))","v":1},"4.3.2.",{"$f":"IFERROR(VLOOKUP(C184,source!$CP$4:$CR$13,3,0),\"\")","v":"Disclose PKI information"},{"$f":"IFERROR(VLOOKUP(C184,source!$CP$4:$CR$13,2,0),0)*B184","v":2},{"$f":"IF(Scoping!K138=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CS$15:$CS$300,source!$CR$15:$CR$300=_xlfn.CONCAT($C184,LEFT(G$15,1),\"Y\"),\"\"))","v":"Information about the policies, processes, and procedures that are maintained by the PKI should be disclosed to the PKI participants. This information should be available on a timely basis and in a form that is understandable to the PKI participants.\n\nOrganization maintaining the PKI implementation should disclose the following information on a website or other appropriate media that can be reached by the PKI participants:\n• Certificate Policy\n• Certification Practice Statement\n• Revocation information\n• Valid CA certificates\n• Vulnerability reports\n• Audit reports\n• Contact information\n• Obligations of the PKI participants\n• Legal liability of the PKI participants\n• Warranty information\n• Disclaimer information\n• Privacy and data protection information\n• Other relevant information"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CS$15:$CS$300,source!$CR$15:$CR$300=_xlfn.CONCAT($C184,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Review disclosure Statement content to ensure that it is contains relevant information\n• disclosure Statement is approved and communicated to all PKI participants\n• information is available to all PKI participants\n• information is up-to-date"},"Managed",{"$nulls":4},{"$f":"IF(I184=\"\",0,VLOOKUP(I184,tech!$A$13:$B$17,2,0))*E184","v":8},{"$f":"IF(B184=0,tech!$B$9,IF(AND(B184=1,N184=0),tech!$B$21,I184))","v":"Managed"}]
[null,{"$f":"IF(B$180=0,0,IF(F185=tech!$B$9,0,1))","v":1},"4.3.3.",{"$f":"IFERROR(VLOOKUP(C185,source!$CP$4:$CR$13,3,0),\"\")","v":"Establish single point of contact"},{"$f":"IFERROR(VLOOKUP(C185,source!$CP$4:$CR$13,2,0),0)*B185","v":1},{"$f":"IF(Scoping!K139=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CS$15:$CS$300,source!$CR$15:$CR$300=_xlfn.CONCAT($C185,LEFT(G$15,1),\"Y\"),\"\"))","v":"The single point of contact (SPOC) provides a convenient way for any PKI participant to contact the organization and responsible personnel of the PKI implementation. The single point of contact should be available 24/7 and should be able to provide relevant information and trigger appropriate procedures if needed based on the situation.\n\nContact information for the SPOC should be disclosed to all PKI participants.\nThe SPOC may be reached through different communication channels, such as:\n• Email\n• Phone\n• Web site form\n• Other"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CS$15:$CS$300,source!$CR$15:$CR$300=_xlfn.CONCAT($C185,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Contact SPOC to ensure that it is available and responds in a timely manner\n• Review that the SPOC communicates according to the awareness plan\n• Review that the SPOC is able to provide relevant information and trigger appropriate procedures if needed based on the situation"},"Managed",{"$nulls":4},{"$f":"IF(I185=\"\",0,VLOOKUP(I185,tech!$A$13:$B$17,2,0))*E185","v":4},{"$f":"IF(B185=0,tech!$B$9,IF(AND(B185=1,N185=0),tech!$B$21,I185))","v":"Managed"}]
[null,{"$f":"IF(B$180=0,0,IF(F186=tech!$B$9,0,1))","v":1},"4.3.4.",{"$f":"IFERROR(VLOOKUP(C186,source!$CP$4:$CR$13,3,0),\"\")","v":"Timely communication of important information"},{"$f":"IFERROR(VLOOKUP(C186,source!$CP$4:$CR$13,2,0),0)*B186","v":2},{"$f":"IF(Scoping!K140=tech!$A$5,tech!$B$9,\"\")","v":""},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CS$15:$CS$300,source!$CR$15:$CR$300=_xlfn.CONCAT($C186,LEFT(G$15,1),\"Y\"),\"\"))","v":"In the event of an incident with high impact to the security and established trust of the PKI implementation, the organization should communicate the information to the PKI participants in a timely manner to avoid increased escalation of the event and inform participants of further actions that may be required to execute.\n\nExample of events that require timely communication may be:\n• Compromise of the private key\n• changes in the Certificate Policy\n• changes in the Certification Practice Statement\n• Security breach\n• Other events that may require immediate action by the PKI participants"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),0,_xlfn._xlws.FILTER(source!$CS$15:$CS$300,source!$CR$15:$CR$300=_xlfn.CONCAT($C186,LEFT(H$15,1),\"Y\"),\"\"))","v":"• Documented procedures to timely inform PKI participants about high impact events\n• Review that the procedures are followed\n• Interview personnel to ensure that they are aware of the procedures and know How to communicate the information"},"Advanced",{"$nulls":4},{"$f":"IF(I186=\"\",0,VLOOKUP(I186,tech!$A$13:$B$17,2,0))*E186","v":6},{"$f":"IF(B186=0,tech!$B$9,IF(AND(B186=1,N186=0),tech!$B$21,I186))","v":"Advanced"}]

{"sheet":"Evaluation","index":4,"n_rows":82,"n_cols":22,"rows_kept":82,"merged":[[1,2,4,3],[1,5,3,8],[2,10,2,13],[3,10,3,13],[4,5,4,8],[4,10,4,13],[7,2,8,2],[7,3,8,5],[7,6,7,13],[9,2,11,2],[9,6,10,6],[9,7,10,7],[9,8,10,8],[9,9,10,9],[9,10,10,10],[9,11,10,11],[9,12,10,12],[9,13,10,13],[11,5,11,13],[13,3,13,13],[14,3,14,13],[17,3,17,5],[18,2,19,2],[18,6,19,6],[18,7,19,7],[18,8,19,8],[18,9,19,9],[18,10,19,10],[18,11,19,11],[18,12,19,12],[18,13,19,13],[20,2,21,2],[20,6,21,6],[20,7,21,7],[20,8,21,8],[20,9,21,9],[20,10,21,10],[20,11,21,11],[20,12,21,12],[20,13,21,13],[22,2,23,2],[22,6,23,6],[22,7,23,7],[22,8,23,8],[22,9,23,9],[22,10,23,10],[22,11,23,11],[22,12,23,12],[22,13,23,13],[24,2,25,2],[24,6,25,6],[24,7,25,7],[24,8,25,8],[24,9,25,9],[24,10,25,10],[24,11,25,11],[24,12,25,12],[24,13,25,13],[28,3,28,5],[29,2,30,2],[29,6,30,6],[29,7,30,7],[29,8,30,8],[29,9,30,9],[29,10,30,10],[29,11,30,11],[29,12,30,12],[29,13,30,13],[31,2,32,2],[31,6,32,6],[31,7,32,7],[31,8,32,8],[31,9,32,9],[31,10,32,10],[31,11,32,11],[31,12,32,12],[31,13,32,13],[33,2,34,2],[33,6,34,6],[33,7,34,7],[33,8,34,8],[33,9,34,9],[33,10,34,10],[33,11,34,11],[33,12,34,12],[33,13,34,13],[35,2,36,2],[35,6,36,6],[35,7,36,7],[35,8,36,8],[35,9,36,9],[35,10,36,10],[35,11,36,11],[35,12,36,12],[35,13,36,13],[37,2,38,2],[37,6,38,6],[37,7,38,7],[37,8,38,8],[37,9,38,9],[37,10,38,10],[37,11,38,11],[37,12,38,12],[37,13,38,13],[39,2,40,2],[39,6,40,6],[39,7,40,7],[39,8,40,8],[39,9,40,9],[39,10,40,10],[39,11,40,11],[39,12,40,12],[39,13,40,13],[41,2,42,2],[41,6,42,6],[41,7,42,7],[41,8,42,8],[41,9,42,9],[41,10,42,10],[41,11,42,11],[41,12,42,12],[41,13,42,13],[43,2,44,2],[43,6,44,6],[43,7,44,7],[43,8,44,8],[43,9,44,9],[43,10,44,10],[43,11,44,11],[43,12,44,12],[43,13,44,13],[45,2,46,2],[45,6,46,6],[45,7,46,7],[45,8,46,8],[45,9,46,9],[45,10,46,10],[45,11,46,11],[45,12,46,12],[45,13,46,13],[47,2,48,2],[47,6,48,6],[47,7,48,7],[47,8,48,8],[47,9,48,9],[47,10,48,10],[47,11,48,11],[47,12,48,12],[47,13,48,13],[49,2,50,2],[49,6,50,6],[49,7,50,7],[49,8,50,8],[49,9,50,9],[49,10,50,10],[49,11,50,11],[49,12,50,12],[49,13,50,13],[51,2,52,2],[51,6,52,6],[51,7,52,7],[51,8,52,8],[51,9,52,9],[51,10,52,10],[51,11,52,11],[51,12,52,12],[51,13,52,13],[53,2,54,2],[53,6,54,6],[53,7,54,7],[53,8,54,8],[53,9,54,9],[53,10,54,10],[53,11,54,11],[53,12,54,12],[53,13,54,13],[55,2,56,2],[55,6,56,6],[55,7,56,7],[55,8,56,8],[55,9,56,9],[55,10,56,10],[55,11,56,11],[55,12,56,12],[55,13,56,13],[57,2,58,2],[61,10,61,11]]}
[]
[null,null,"Evaluation",null,null,{"$f":"Overview!D5","v":"Cool PKI"}]
[{"$nulls":10},{"$f":"_xlfn.CONCAT(\"Duration of the assessment: \",TODAY()-Overview!D7,\" days     \")","v":"Duration of the assessment: 321 days     "}]
[{"$nulls":10},{"$f":"IF(Overview!D9<>\"\",\"The assessment has been finished     \",IF(Overview!D8>=TODAY(),_xlfn.CONCAT(\"Remaining time to the target date: \",Overview!D8-TODAY(),\" days     \"),_xlfn.CONCAT(\"Overrunning the target date by: \",TODAY()-Overview!D8,\" days     \")))","v":"The assessment has been finished     "}]
[{"$nulls":5},{"$f":"Overview!D6","v":"3Key Company"},{"$nulls":4},{"$f":"_xlfn.CONCAT(\"Name of responsible assessor: \",Overview!L7,\"     \")","v":"Name of responsible assessor: Franta Hrábě     "}]
[]
[]
[null,null,"Use-case","PKI Maturity Level",null,null,"Statistics"]
[{"$nulls":6},"N/A","Not evaluated","Initial","Basic","Advanced","Managed","Optimized","Total (applicable)",null,"N/A","Not evaluated","Initial","Basic","Advanced","Managed","Optimized"]
[null,1,{"$f":"Overview!D5","v":"Cool PKI"},{"$f":"IF(OR(B10=0,E10=0),\"\",E10)","v":2},{"$f":"Assessment!N6","v":2},{"$f":"VLOOKUP(E10,tech!$A$21:$B$26,2,0)","v":"Basic"},{"$f":"IF(P10=0,\"\",P10)","v":""},{"$f":"IF(Q10=0,\"\",Q10)","v":""},7,21,19,18,7,{"$f":"IF(SUM(Q10:V10)=0,\"\",SUM(Q10:V10))","v":72},null,{"$f":"SUM(P30:P58)","v":0},0,7,21,19,18,7]
[{"$nulls":5},{"$f":"E10","v":2}]
[{"$nulls":5},{"$f":"IF(E10=0,tech!B21,VLOOKUP(E10,tech!$D$3:$H$8,5,0))","v":"Process is characterized by each particular case or project and controls are often reactive"}]
[]
[null,null,"Indicators:",{"$f":"IF(E10=0,tech!B21,VLOOKUP(E10,tech!$D$3:$G$8,3,0))","v":"• PKI is ad-hoc managed, often reactive\n• There are defined processes and procedures which are followed\n• PKI is not managed according to industry standards and regulations\n• Insufficient knowledge"}]
[null,null,"Associated risks:",{"$f":"IF(E10=0,tech!B21,VLOOKUP(E10,tech!$D$3:$G$8,4,0))","v":"• High probability of operational issues\n• Medium probability of compromise\n• no trust"}]
[]
[]
[null,null,"Module","Module Maturity Level",null,null,"N/A","Not evaluated","Initial","Basic","Advanced","Managed","Optimized","Total (applicable)",null,"N/A","Not evaluated","Initial","Basic","Advanced","Managed","Optimized"]
[null,{"$f":"IF(COUNTIF(B30:B36,0)=4,0,1)","v":1},{"$f":"Assessment!C8","v":"1. Governance"},{"$f":"IF(OR(B19=0,E19=0),\"\",E19)","v":2},{"$f":"Assessment!N9","v":2},{"$f":"IF(B19=0,tech!$B$9,VLOOKUP(E19,tech!$A$21:$B$26,2,0))","v":"Basic"},{"$f":"IF(P19=0,\"\",P19)","v":""},{"$f":"IF(Q19=0,\"\",Q19)","v":""},4,9,3,1,1,{"$f":"IF(SUM(Q19:V19)=0,\"\",SUM(Q19:V19))","v":18},null,{"$f":"SUM(P30:P36)","v":0},0,4,9,3,1,1]
[{"$nulls":5},{"$f":"E19","v":2}]
[null,{"$f":"IF(COUNTIF(B38:B44,0)=4,0,1)","v":1},{"$f":"Assessment!C57","v":"2. Management"},{"$f":"IF(OR(B21=0,E21=0),\"\",E21)","v":2},{"$f":"Assessment!N58","v":2},{"$f":"IF(B21=0,tech!$B$9,VLOOKUP(E21,tech!$A$21:$B$26,2,0))","v":"Basic"},{"$f":"IF(P21=0,\"\",P21)","v":""},"",1,9,5,7,1,{"$f":"IF(SUM(Q21:V21)=0,\"\",SUM(Q21:V21))","v":23},null,{"$f":"SUM(P38:P44)","v":0},0,1,9,5,7,1]
[{"$nulls":5},{"$f":"E21","v":2}]
[null,{"$f":"IF(COUNTIF(B46:B52,0)=4,0,1)","v":1},{"$f":"Assessment!C107","v":"3. Operations"},3,{"$f":"Assessment!N108","v":3},{"$f":"IF(B23=0,tech!$B$9,VLOOKUP(E23,tech!$A$21:$B$26,2,0))","v":"Advanced"},"","",1,2,10,4,1,18,null,{"$f":"SUM(P46:P52)","v":0},0,1,2,10,4,1]
[{"$nulls":5},{"$f":"E23","v":3}]
[null,{"$f":"IF(COUNTIF(B54:B58,0)=3,0,1)","v":1},{"$f":"Assessment!C156","v":"4. Resources"},3,{"$f":"Assessment!N157","v":3},{"$f":"IF(B25=0,tech!$B$9,VLOOKUP(E25,tech!$A$21:$B$26,2,0))","v":"Advanced"},"","",1,1,1,6,4,13,null,{"$f":"SUM(P54:P58)","v":0},0,1,1,1,6,4]
[{"$nulls":5},{"$f":"E25","v":3}]
[]
[]
[null,null,"Category","Category Maturity Level",null,null,"N/A","Not evaluated","Initial","Basic","Advanced","Managed","Optimized","Total (applicable)",null,"N/A","Not evaluated","Initial","Basic","Advanced","Managed","Optimized"]
[null,{"$f":"IF(Scoping!F10=tech!$A$5,0,1)","v":1},{"$f":"Assessment!$C$12","v":"1.1. Strategy and vision"},{"$f":"IF(OR(B30=0,E30=0),\"\",E30)","v":1},{"$f":"Assessment!N13","v":1},{"$f":"IF(B30=0,tech!$B$9,VLOOKUP(E30,tech!$A$21:$B$26,2,0))","v":"Initial"},{"$f":"IF(P30=0,\"\",P30)","v":""},{"$f":"IF(Q30=0,\"\",Q30)","v":""},{"$f":"IF(R30=0,\"\",R30)","v":4},{"$f":"IF(S30=0,\"\",S30)","v":""},{"$f":"IF(T30=0,\"\",T30)","v":""},{"$f":"IF(U30=0,\"\",U30)","v":""},{"$f":"IF(V30=0,\"\",V30)","v":""},{"$f":"IF(SUM(Q30:V30)=0,\"\",SUM(Q30:V30))","v":4},null,{"$f":"COUNTIF(Assessment!$O16:$O21,tech!$B$9)","v":0},{"$f":"COUNTIF(Assessment!$O16:$O21,tech!$B$21)","v":0},{"$f":"COUNTIF(Assessment!$O16:$O21,tech!$A$13)","v":4},{"$f":"COUNTIF(Assessment!$O16:$O21,tech!$A$14)","v":0},{"$f":"COUNTIF(Assessment!$O16:$O21,tech!$A$15)","v":0},{"$f":"COUNTIF(Assessment!$O16:$O21,tech!$A$16)","v":0},{"$f":"COUNTIF(Assessment!$O16:$O21,tech!$A$17)","v":0}]
[{"$nulls":5},{"$f":"E30","v":1}]
[null,{"$f":"IF(Scoping!F16=tech!$A$5,0,1)","v":1},{"$f":"Assessment!C23","v":"1.2. Policies and documentation"},{"$f":"IF(OR(B32=0,E32=0),\"\",E32)","v":2},{"$f":"Assessment!N24","v":2},{"$f":"IF(B32=0,tech!$B$9,VLOOKUP(E32,tech!$A$21:$B$26,2,0))","v":"Basic"},"","","",5,"","","",{"$f":"IF(SUM(Q32:V32)=0,\"\",SUM(Q32:V32))","v":5},null,{"$f":"COUNTIF(Assessment!$O27:$O32,tech!$B$9)","v":0},{"$f":"COUNTIF(Assessment!$O27:$O32,tech!$B$21)","v":0},{"$f":"COUNTIF(Assessment!$O27:$O32,tech!$A$13)","v":0},{"$f":"COUNTIF(Assessment!$O27:$O32,tech!$A$14)","v":5},{"$f":"COUNTIF(Assessment!$O27:$O32,tech!$A$15)","v":0},{"$f":"COUNTIF(Assessment!$O27:$O32,tech!$A$16)","v":0},{"$f":"COUNTIF(Assessment!$O27:$O32,tech!$A$17)","v":0}]
[{"$nulls":5},{"$f":"E32","v":2}]
[null,{"$f":"IF(Scoping!F22=tech!$A$5,0,1)","v":1},{"$f":"Assessment!C34","v":"1.3. Compliance"},2,{"$f":"Assessment!N35","v":2},{"$f":"IF(B34=0,tech!$B$9,VLOOKUP(E34,tech!$A$21:$B$26,2,0))","v":"Basic"},"","","",4,"","","",4,null,{"$f":"COUNTIF(Assessment!$O38:$O43,tech!$B$9)","v":0},{"$f":"COUNTIF(Assessment!$O38:$O43,tech!$B$21)","v":0},{"$f":"COUNTIF(Assessment!$O38:$O43,tech!$A$13)","v":0},{"$f":"COUNTIF(Assessment!$O38:$O43,tech!$A$14)","v":4},{"$f":"COUNTIF(Assessment!$O38:$O43,tech!$A$15)","v":0},{"$f":"COUNTIF(Assessment!$O38:$O43,tech!$A$16)","v":0},{"$f":"COUNTIF(Assessment!$O38:$O43,tech!$A$17)","v":0}]
[{"$nulls":5},{"$f":"E34","v":2}]
[null,{"$f":"IF(Scoping!F28=tech!$A$5,0,1)","v":1},{"$f":"Assessment!C45","v":"1.4. Processes and procedures"},3,{"$f":"Assessment!N46","v":3},{"$f":"IF(B36=0,tech!$B$9,VLOOKUP(E36,tech!$A$21:$B$26,2,0))","v":"Advanced"},"","","","",3,1,1,5,null,{"$f":"COUNTIF(Assessment!$O49:$O54,tech!$B$9)","v":0},{"$f":"COUNTIF(Assessment!$O49:$O54,tech!$B$21)","v":0},{"$f":"COUNTIF(Assessment!$O49:$O54,tech!$A$13)","v":0},{"$f":"COUNTIF(Assessment!$O49:$O54,tech!$A$14)","v":0},{"$f":"COUNTIF(Assessment!$O49:$O54,tech!$A$15)","v":3},{"$f":"COUNTIF(Assessment!$O49:$O54,tech!$A$16)","v":1},{"$f":"COUNTIF(Assessment!$O49:$O54,tech!$A$17)","v":1}]
[{"$nulls":5},{"$f":"E36","v":3}]
[null,{"$f":"IF(Scoping!F34=tech!$A$5,0,1)","v":1},{"$f":"Assessment!C61","v":"2.1. Key Management"},3,{"$f":"Assessment!N62","v":3},{"$f":"IF(B38=0,tech!$B$9,VLOOKUP(E38,tech!$A$21:$B$26,2,0))","v":"Advanced"},"","","",2,1,3,"",6,null,{"$f":"COUNTIF(Assessment!$O65:$O70,tech!$B$9)","v":0},{"$f":"COUNTIF(Assessment!$O65:$O70,tech!$B$21)","v":0},{"$f":"COUNTIF(Assessment!$O65:$O70,tech!$A$13)","v":0},{"$f":"COUNTIF(Assessment!$O65:$O70,tech!$A$14)","v":2},{"$f":"COUNTIF(Assessment!$O65:$O70,tech!$A$15)","v":1},{"$f":"COUNTIF(Assessment!$O65:$O70,tech!$A$16)","v":3},{"$f":"COUNTIF(Assessment!$O65:$O70,tech!$A$17)","v":0}]
[{"$nulls":5},{"$f":"E38","v":3}]
[null,{"$f":"IF(Scoping!F40=tech!$A$5,0,1)","v":1},{"$f":"Assessment!C72","v":"2.2. Certificate Management"},2,{"$f":"Assessment!N73","v":2},{"$f":"IF(B40=0,tech!$B$9,VLOOKUP(E40,tech!$A$21:$B$26,2,0))","v":"Basic"},"","",1,3,1,1,1,7,null,{"$f":"COUNTIF(Assessment!$O76:$O82,tech!$B$9)","v":0},{"$f":"COUNTIF(Assessment!$O76:$O82,tech!$B$21)","v":0},{"$f":"COUNTIF(Assessment!$O76:$O82,tech!$A$13)","v":1},{"$f":"COUNTIF(Assessment!$O76:$O82,tech!$A$14)","v":3},{"$f":"COUNTIF(Assessment!$O76:$O82,tech!$A$15)","v":1},{"$f":"COUNTIF(Assessment!$O76:$O82,tech!$A$16)","v":1},{"$f":"COUNTIF(Assessment!$O76:$O82,tech!$A$17)","v":1}]
[{"$nulls":5},{"$f":"E40","v":2}]
[null,{"$f":"IF(Scoping!F47=tech!$A$5,0,1)","v":1},{"$f":"Assessment!C84","v":"2.3. Infrastructure Management"},3,{"$f":"Assessment!N85","v":3},{"$f":"IF(B42=0,tech!$B$9,VLOOKUP(E42,tech!$A$21:$B$26,2,0))","v":"Advanced"},"","","",2,1,2,"",5,null,{"$f":"COUNTIF(Assessment!$O88:$O93,tech!$B$9)","v":0},{"$f":"COUNTIF(Assessment!$O88:$O93,tech!$B$21)","v":0},{"$f":"COUNTIF(Assessment!$O88:$O93,tech!$A$13)","v":0},{"$f":"COUNTIF(Assessment!$O88:$O93,tech!$A$14)","v":2},{"$f":"COUNTIF(Assessment!$O88:$O93,tech!$A$15)","v":1},{"$f":"COUNTIF(Assessment!$O88:$O93,tech!$A$16)","v":2},{"$f":"COUNTIF(Assessment!$O88:$O93,tech!$A$17)","v":0}]
[{"$nulls":5},{"$f":"E42","v":3}]
[null,{"$f":"IF(Scoping!F53=tech!$A$5,0,1)","v":1},{"$f":"Assessment!C95","v":"2.4. Change Management and Agility"},2,{"$f":"Assessment!N96","v":2},{"$f":"IF(B44=0,tech!$B$9,VLOOKUP(E44,tech!$A$21:$B$26,2,0))","v":"Basic"},"","","",2,2,1,"",5,null,{"$f":"COUNTIF(Assessment!$O99:$O104,tech!$B$9)","v":0},{"$f":"COUNTIF(Assessment!$O99:$O104,tech!$B$21)","v":0},{"$f":"COUNTIF(Assessment!$O99:$O104,tech!$A$13)","v":0},{"$f":"COUNTIF(Assessment!$O99:$O104,tech!$A$14)","v":2},{"$f":"COUNTIF(Assessment!$O99:$O104,tech!$A$15)","v":2},{"$f":"COUNTIF(Assessment!$O99:$O104,tech!$A$16)","v":1},{"$f":"COUNTIF(Assessment!$O99:$O104,tech!$A$17)","v":0}]
[{"$nulls":5},{"$f":"E44","v":2}]
[null,{"$f":"IF(Scoping!F59=tech!$A$5,0,1)","v":1},{"$f":"Assessment!C111","v":"3.1. Resilience"},3,{"$f":"Assessment!N112","v":3},{"$f":"IF(B46=0,tech!$B$9,VLOOKUP(E46,tech!$A$21:$B$26,2,0))","v":"Advanced"},"","",1,"",2,2,1,6,null,{"$f":"COUNTIF(Assessment!$O115:$O120,tech!$B$9)","v":0},{"$f":"COUNTIF(Assessment!$O115:$O120,tech!$B$21)","v":0},{"$f":"COUNTIF(Assessment!$O115:$O120,tech!$A$13)","v":1},{"$f":"COUNTIF(Assessment!$O115:$O120,tech!$A$14)","v":0},{"$f":"COUNTIF(Assessment!$O115:$O120,tech!$A$15)","v":2},{"$f":"COUNTIF(Assessment!$O115:$O120,tech!$A$16)","v":2},{"$f":"COUNTIF(Assessment!$O115:$O120,tech!$A$17)","v":1}]
[{"$nulls":5},{"$f":"E46","v":3}]
[null,{"$f":"IF(Scoping!F65=tech!$A$5,0,1)","v":1},{"$f":"Assessment!C122","v":"3.2. Interoperability"},3,{"$f":"Assessment!N123","v":3},{"$f":"IF(B48=0,tech!$B$9,VLOOKUP(E48,tech!$A$21:$B$26,2,0))","v":"Advanced"},"","","","",2,1,"",3,null,{"$f":"COUNTIF(Assessment!$O126:$O131,tech!$B$9)","v":0},{"$f":"COUNTIF(Assessment!$O126:$O131,tech!$B$21)","v":0},{"$f":"COUNTIF(Assessment!$O126:$O131,tech!$A$13)","v":0},{"$f":"COUNTIF(Assessment!$O126:$O131,tech!$A$14)","v":0},{"$f":"COUNTIF(Assessment!$O126:$O131,tech!$A$15)","v":2},{"$f":"COUNTIF(Assessment!$O126:$O131,tech!$A$16)","v":1},{"$f":"COUNTIF(Assessment!$O126:$O131,tech!$A$17)","v":0}]
[{"$nulls":5},{"$f":"E48","v":3}]
[null,{"$f":"IF(Scoping!F71=tech!$A$5,0,1)","v":1},{"$f":"Assessment!C133","v":"3.3. Monitoring and Auditing"},3,{"$f":"Assessment!N134","v":3},{"$f":"IF(B50=0,tech!$B$9,VLOOKUP(E50,tech!$A$21:$B$26,2,0))","v":"Advanced"},"","","","",6,"","",6,null,{"$f":"COUNTIF(Assessment!$O137:$O142,tech!$B$9)","v":0},{"$f":"COUNTIF(Assessment!$O137:$O142,tech!$B$21)","v":0},{"$f":"COUNTIF(Assessment!$O137:$O142,tech!$A$13)","v":0},{"$f":"COUNTIF(Assessment!$O137:$O142,tech!$A$14)","v":0},{"$f":"COUNTIF(Assessment!$O137:$O142,tech!$A$15)","v":6},{"$f":"COUNTIF(Assessment!$O137:$O142,tech!$A$16)","v":0},{"$f":"COUNTIF(Assessment!$O137:$O142,tech!$A$17)","v":0}]
[{"$nulls":5},{"$f":"E50","v":3}]
[null,{"$f":"IF(Scoping!F77=tech!$A$5,0,1)","v":1},{"$f":"Assessment!C144","v":"3.4. Automation"},2,{"$f":"Assessment!N145","v":2},{"$f":"IF(B52=0,tech!$B$9,VLOOKUP(E52,tech!$A$21:$B$26,2,0))","v":"Basic"},"","","",2,"",1,"",3,null,{"$f":"COUNTIF(Assessment!$O148:$O153,tech!$B$9)","v":0},{"$f":"COUNTIF(Assessment!$O148:$O153,tech!$B$21)","v":0},{"$f":"COUNTIF(Assessment!$O148:$O153,tech!$A$13)","v":0},{"$f":"COUNTIF(Assessment!$O148:$O153,tech!$A$14)","v":2},{"$f":"COUNTIF(Assessment!$O148:$O153,tech!$A$15)","v":0},{"$f":"COUNTIF(Assessment!$O148:$O153,tech!$A$16)","v":1},{"$f":"COUNTIF(Assessment!$O148:$O153,tech!$A$17)","v":0}]
[{"$nulls":5},{"$f":"E52","v":2}]
[null,{"$f":"IF(Scoping!F83=tech!$A$5,0,1)","v":1},{"$f":"Assessment!C160","v":"4.1. Sourcing"},3,{"$f":"Assessment!N161","v":3},{"$f":"IF(B54=0,tech!$B$9,VLOOKUP(E54,tech!$A$21:$B$26,2,0))","v":"Advanced"},"","",1,"","","",3,4,null,{"$f":"COUNTIF(Assessment!$O164:$O167,tech!$B$9)","v":0},{"$f":"COUNTIF(Assessment!$O164:$O167,tech!$B$21)","v":0},{"$f":"COUNTIF(Assessment!$O164:$O167,tech!$A$13)","v":1},{"$f":"COUNTIF(Assessment!$O164:$O167,tech!$A$14)","v":0},{"$f":"COUNTIF(Assessment!$O164:$O167,tech!$A$15)","v":0},{"$f":"COUNTIF(Assessment!$O164:$O167,tech!$A$16)","v":0},{"$f":"COUNTIF(Assessment!$O164:$O167,tech!$A$17)","v":3}]
[{"$nulls":5},{"$f":"E54","v":3}]
[null,{"$f":"IF(Scoping!F87=tech!$A$5,0,1)","v":1},{"$f":"Assessment!C169","v":"4.2. Knowledge and Training"},4,{"$f":"Assessment!N170","v":4},{"$f":"IF(B56=0,tech!$B$9,VLOOKUP(E56,tech!$A$21:$B$26,2,0))","v":"Managed"},"","","","","",4,1,5,null,{"$f":"COUNTIF(Assessment!$O173:$O177,tech!$B$9)","v":0},{"$f":"COUNTIF(Assessment!$O173:$O177,tech!$B$21)","v":0},{"$f":"COUNTIF(Assessment!$O173:$O177,tech!$A$13)","v":0},{"$f":"COUNTIF(Assessment!$O173:$O177,tech!$A$14)","v":0},{"$f":"COUNTIF(Assessment!$O173:$O177,tech!$A$15)","v":0},{"$f":"COUNTIF(Assessment!$O173:$O177,tech!$A$16)","v":4},{"$f":"COUNTIF(Assessment!$O173:$O177,tech!$A$17)","v":1}]
[{"$nulls":5},{"$f":"E56","v":4}]
[null,{"$f":"IF(Scoping!F92=tech!$A$5,0,1)","v":1},{"$f":"Assessment!C179","v":"4.3. Awareness"},3,{"$f":"Assessment!N180","v":3},{"$f":"IF(B58=0,tech!$B$9,VLOOKUP(E58,tech!$A$21:$B$26,2,0))","v":"Advanced"},"","","",1,1,2,"",4,null,{"$f":"COUNTIF(Assessment!$O183:$O186,tech!$B$9)","v":0},{"$f":"COUNTIF(Assessment!$O183:$O186,tech!$B$21)","v":0},{"$f":"COUNTIF(Assessment!$O183:$O186,tech!$A$13)","v":0},{"$f":"COUNTIF(Assessment!$O183:$O186,tech!$A$14)","v":1},{"$f":"COUNTIF(Assessment!$O183:$O186,tech!$A$15)","v":1},{"$f":"COUNTIF(Assessment!$O183:$O186,tech!$A$16)","v":2},{"$f":"COUNTIF(Assessment!$O183:$O186,tech!$A$17)","v":0}]
[{"$nulls":5},{"$f":"E58","v":3}]
[]
[]
[{"$nulls":6},"Select value to show relevant requirements:",{"$nulls":3},"Advanced"]
[]
[{"$nulls":5},{"$f":"_xlfn._xlws.FILTER(tech!A140:C225,tech!A140:A225=K62,\"No requirement found\")","v":"Advanced"},"1.4.1.","Scope of processes and procedure is aligned with policies"]
[{"$nulls":5},"Advanced","1.4.2.","Processes and procedures are formally documented and followed"]
[{"$nulls":5},"Advanced","1.4.4.","Evidence from procedures is collected and maintained"]
[{"$nulls":5},"Advanced","2.1.1.","Key management roles and responsibilities are documented and formally assigned"]
[{"$nulls":5},"Advanced","2.2.6.","Certificate management is periodically reviewed and updated"]
[{"$nulls":5},"Advanced","2.3.3.","Network vulnerability management is implemented and maintained"]
[{"$nulls":5},"Advanced","2.4.4.","Requirements for agility are identified"]
[{"$nulls":5},"Advanced","2.4.5.","Change management and agility is periodically reviewed"]
[{"$nulls":5},"Advanced","3.1.2.","Cyber-security management and incident planning"]
[{"$nulls":5},"Advanced","3.1.6.","Continual review and improvement"]
[{"$nulls":5},"Advanced","3.2.1.","Maintain PKI interoperability strategy"]
[{"$nulls":5},"Advanced","3.2.2.","Documented integration guidance"]
[{"$nulls":5},"Advanced","3.3.1.","Monitoring events and logging requirements are defined and documented"]
[{"$nulls":5},"Advanced","3.3.2.","Event logs from systems are collected"]
[{"$nulls":5},"Advanced","3.3.3.","Audit trail can be reconstructed from audit logs"]
[{"$nulls":5},"Advanced","3.3.4.","Monitoring of operational and security events is implemented"]
[{"$nulls":5},"Advanced","3.3.5.","Critical events are immediately alerted and resolved according to incident response plans"]
[{"$nulls":5},"Advanced","3.3.6.","Review of events and logs is periodically performed"]
[{"$nulls":5},"Advanced","4.3.4.","Timely communication of important information"]

{"sheet":"AttestationReport","index":5,"n_rows":22,"n_cols":8,"rows_kept":22,"merged":[[0,1,3,9],[4,1,6,9],[8,1,8,9],[9,1,9,4],[9,5,9,9],[10,1,10,2],[10,3,10,4],[10,5,10,6],[10,7,10,9],[11,1,11,2],[11,3,11,4],[11,5,11,6],[11,7,11,9],[12,1,12,2],[12,3,12,4],[12,5,12,6],[12,7,12,9],[15,1,15,9],[17,1,17,2],[17,3,17,9],[18,1,18,2],[18,3,18,7],[19,1,19,2],[19,3,19,9],[20,1,20,2],[20,3,20,9],[21,1,21,2],[21,3,21,9]]}
[null,"PKI Maturity"]
[]
[]
[]
[null,"Attestation report"]
[]
[]
[]
[null,"Assessment details"]
[null,"Timing",{"$nulls":3},"Assessor"]
[null,"Starting date",null,{"$f":"Overview!D7","v":"2023-05-02"},null,"Position",null,{"$f":"Overview!L5","v":"Internal"}]
[null,"Finishing date",null,{"$f":"Overview!D9","v":"2023-07-01"},null,"Name",null,{"$f":"Overview!L7","v":"Franta Hrábě"}]
[null,"Duration",null,{"$f":"_xlfn.CONCAT(D12-D11,\" days\")","v":"60 days"},null,"Company",null,{"$f":"Overview!L6","v":"3Key Company"}]
[]
[]
[null,"Achieved maturity level"]
[]
[null,"Use-case:",null,{"$f":"Evaluation!C10","v":"Cool PKI"}]
[null,"Maturity level:",null,{"$f":"Evaluation!F10","v":"Basic"}]
[null,"Short description:",null,{"$f":"Evaluation!F12","v":"Process is characterized by each particular case or project and controls are often reactive"}]
[null,"Indicators:",null,{"$f":"Evaluation!D14","v":"• PKI is ad-hoc managed, often reactive\n• There are defined processes and procedures which are followed\n• PKI is not managed according to industry standards and regulations\n• Insufficient knowledge"}]
[null,"Associated risks:",null,{"$f":"Evaluation!D15","v":"• High probability of operational issues\n• Medium probability of compromise\n• no trust"}]

{"sheet":"AssessmentReport","index":6,"n_rows":131,"n_cols":10,"rows_kept":131,"merged":[[0,1,3,9],[4,1,6,9],[8,1,8,9],[9,1,9,4],[9,5,9,9],[10,1,10,2],[10,3,10,4],[10,5,10,6],[10,7,10,9],[11,1,11,2],[11,3,11,4],[11,5,11,6],[11,7,11,9],[12,1,12,2],[12,3,12,4],[12,5,12,6],[12,7,12,9],[15,1,15,9],[17,1,17,2],[17,3,17,9],[18,1,18,2],[18,3,18,7],[19,1,19,2],[19,3,19,9],[20,1,20,2],[20,3,20,9],[21,1,21,2],[21,3,21,9],[35,1,35,9],[36,1,36,4],[37,1,37,9],[39,1,39,5],[40,1,40,9],[42,1,42,4],[43,1,43,9],[51,1,51,9],[53,1,53,5],[54,1,54,9],[56,1,56,6],[57,1,57,9],[70,1,70,9],[72,5,72,6],[73,1,73,3],[73,5,73,6],[74,1,74,3],[76,1,76,4],[76,5,76,6],[77,5,77,6],[78,1,78,4],[78,5,78,6],[79,5,79,6],[80,1,80,4],[80,5,80,6],[81,5,81,6],[82,1,82,4],[82,5,82,6],[84,1,84,3],[86,1,86,4],[86,5,86,6],[87,5,87,6],[88,1,88,4],[88,5,88,6],[89,5,89,6],[90,1,90,4],[90,5,90,6],[91,5,91,6],[92,1,92,4],[92,5,92,6],[93,5,93,6],[94,1,94,4],[94,5,94,6],[95,5,95,6],[96,1,96,4],[96,5,96,6],[97,5,97,6],[98,1,98,4],[98,5,98,6],[99,5,99,6],[100,1,100,4],[100,5,100,6],[101,5,101,6],[102,1,102,4],[102,5,102,6],[103,5,103,6],[104,1,104,4],[104,5,104,6],[105,5,105,6],[106,1,106,4],[106,5,106,6],[107,5,107,6],[108,1,108,4],[108,5,108,6],[109,5,109,6],[110,1,110,4],[110,5,110,6],[111,5,111,6],[112,1,112,4],[112,5,112,6],[113,5,113,6],[114,1,114,4],[114,5,114,6],[130,1,130,9]]}
[null,"PKI Maturity"]
[]
[]
[]
[null,"Assessment report"]
[]
[]
[]
[null,"Assessment details"]
[null,"Timing",{"$nulls":3},"Assessor"]
[null,"Starting date",null,{"$f":"Overview!D7","v":"2023-05-02"},null,"Position",null,{"$f":"Overview!L5","v":"Internal"}]
[null,"Finishing date",null,{"$f":"Overview!D9","v":"2023-07-01"},null,"Name",null,{"$f":"Overview!L7","v":"Franta Hrábě"}]
[null,"Duration",null,{"$f":"_xlfn.CONCAT(D12-D11,\" days\")","v":"60 days"},null,"Company",null,{"$f":"Overview!L6","v":"3Key Company"}]
[]
[]
[null,"Achieved maturity level"]
[]
[null,"Use-case:",null,{"$f":"Evaluation!C10","v":"Cool PKI"}]
[null,"Maturity level:",null,{"$f":"Evaluation!F10","v":"Basic"}]
[null,"Short description:",null,{"$f":"Evaluation!F12","v":"Process is characterized by each particular case or project and controls are often reactive"}]
[null,"Indicators:",null,{"$f":"Evaluation!D14","v":"• PKI is ad-hoc managed, often reactive\n• There are defined processes and procedures which are followed\n• PKI is not managed according to industry standards and regulations\n• Insufficient knowledge"}]
[null,"Associated risks:",null,{"$f":"Evaluation!D15","v":"• High probability of operational issues\n• Medium probability of compromise\n• no trust"}]
{"$rows_empty":13}
[null,"Use-case details"]
[null,"Description of assessed use-case:"]
[null,{"$f":"IF(Overview!B16=\"\",\"\",Overview!B16)","v":""}]
[]
[null,"List of components involved in the use-case:"]
[null,{"$f":"IF(Overview!B20=\"\",\"\",Overview!B20)","v":""}]
[]
[null,"Specific out-of-scope considerations:"]
[null,{"$f":"IF(Overview!B24=\"\",\"\",Overview!B24)","v":""}]
{"$rows_empty":7}
[null,"PKI environment details"]
[]
[null,"High-level design of the PKI environment:"]
[null,{"$f":"IF(Overview!B31=\"\",\"\",Overview!B31)","v":""}]
[]
[null,"Points of interaction between parties involved in the use-cases:"]
[null,{"$f":"IF(Overview!B35=\"\",\"\",Overview!B35)","v":""}]
{"$rows_empty":12}
[null,"Scope overview"]
[]
[{"$nulls":5},"Applicable requirements",{"$nulls":3},"N/A"]
[null,"Overall scope:",{"$nulls":3},{"$f":"_xlfn.CONCAT(Evaluation!N10,\" of \",Evaluation!N10+IF(Evaluation!G10=\"\",0,Evaluation!G10))","v":"72 of 72"},{"$nulls":3},{"$f":"IF(Evaluation!G10=\"\",0,Evaluation!G10)","v":0}]
[null,"Overview by modules:"]
[]
[null,{"$f":"Evaluation!C19","v":"1. Governance"},{"$nulls":3},{"$f":"IF(Evaluation!N19=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N19,\" of \",Evaluation!N19+IF(Evaluation!G19=\"\",0,Evaluation!G19)))","v":"18 of 18"},{"$nulls":3},{"$f":"IF(Evaluation!G19=\"\",0,Evaluation!G19)","v":0}]
[]
[null,{"$f":"Evaluation!C21","v":"2. Management"},{"$nulls":3},{"$f":"IF(Evaluation!N21=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N21,\" of \",Evaluation!N21+IF(Evaluation!G21=\"\",0,Evaluation!G21)))","v":"23 of 23"},{"$nulls":3},{"$f":"IF(Evaluation!G21=\"\",0,Evaluation!G21)","v":0}]
[]
[null,{"$f":"Evaluation!C23","v":"3. Operations"},{"$nulls":3},{"$f":"IF(Evaluation!N23=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N23,\" of \",Evaluation!N23+IF(Evaluation!G23=\"\",0,Evaluation!G23)))","v":"18 of 18"},{"$nulls":3},{"$f":"IF(Evaluation!G23=\"\",0,Evaluation!G23)","v":0}]
[]
[null,{"$f":"Evaluation!C25","v":"4. Resources"},{"$nulls":3},{"$f":"IF(Evaluation!N25=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N25,\" of \",Evaluation!N25+IF(Evaluation!G25=\"\",0,Evaluation!G25)))","v":"13 of 13"},{"$nulls":3},{"$f":"IF(Evaluation!G25=\"\",0,Evaluation!G25)","v":0}]
[]
[null,"Overview by categories:"]
[]
[null,{"$f":"Evaluation!C30","v":"1.1. Strategy and vision"},{"$nulls":3},{"$f":"IF(Evaluation!N30=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N30,\" of \",Evaluation!N30+IF(Evaluation!G30=\"\",0,Evaluation!G30)))","v":"4 of 4"},{"$nulls":3},{"$f":"IF(Evaluation!G30=\"\",0,Evaluation!G30)","v":0}]
[]
[null,{"$f":"Evaluation!C32","v":"1.2. Policies and documentation"},{"$nulls":3},{"$f":"IF(Evaluation!N32=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N32,\" of \",Evaluation!N32+IF(Evaluation!G32=\"\",0,Evaluation!G32)))","v":"5 of 5"},{"$nulls":3},{"$f":"IF(Evaluation!G32=\"\",0,Evaluation!G32)","v":0}]
[]
[null,{"$f":"Evaluation!C34","v":"1.3. Compliance"},{"$nulls":3},{"$f":"IF(Evaluation!N34=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N34,\" of \",Evaluation!N34+IF(Evaluation!G34=\"\",0,Evaluation!G34)))","v":"4 of 4"},{"$nulls":3},{"$f":"IF(Evaluation!G34=\"\",0,Evaluation!G34)","v":0}]
[]
[null,{"$f":"Evaluation!C36","v":"1.4. Processes and procedures"},{"$nulls":3},{"$f":"IF(Evaluation!N36=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N36,\" of \",Evaluation!N36+IF(Evaluation!G36=\"\",0,Evaluation!G36)))","v":"5 of 5"},{"$nulls":3},{"$f":"IF(Evaluation!G36=\"\",0,Evaluation!G36)","v":0}]
[]
[null,{"$f":"Evaluation!C38","v":"2.1. Key Management"},{"$nulls":3},{"$f":"IF(Evaluation!N38=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N38,\" of \",Evaluation!N38+IF(Evaluation!G38=\"\",0,Evaluation!G38)))","v":"6 of 6"},{"$nulls":3},{"$f":"IF(Evaluation!G38=\"\",0,Evaluation!G38)","v":0}]
[]
[null,{"$f":"Evaluation!C40","v":"2.2. Certificate Management"},{"$nulls":3},{"$f":"IF(Evaluation!N40=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N40,\" of \",Evaluation!N40+IF(Evaluation!G40=\"\",0,Evaluation!G40)))","v":"7 of 7"},{"$nulls":3},{"$f":"IF(Evaluation!G40=\"\",0,Evaluation!G40)","v":0}]
[]
[null,{"$f":"Evaluation!C42","v":"2.3. Infrastructure Management"},{"$nulls":3},{"$f":"IF(Evaluation!N42=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N42,\" of \",Evaluation!N42+IF(Evaluation!G42=\"\",0,Evaluation!G42)))","v":"5 of 5"},{"$nulls":3},{"$f":"IF(Evaluation!G42=\"\",0,Evaluation!G42)","v":0}]
[]
[null,{"$f":"Evaluation!C44","v":"2.4. Change Management and Agility"},{"$nulls":3},{"$f":"IF(Evaluation!N44=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N44,\" of \",Evaluation!N44+IF(Evaluation!G44=\"\",0,Evaluation!G44)))","v":"5 of 5"},{"$nulls":3},{"$f":"IF(Evaluation!G44=\"\",0,Evaluation!G44)","v":0}]
[]
[null,{"$f":"Evaluation!C46","v":"3.1. Resilience"},{"$nulls":3},{"$f":"IF(Evaluation!N46=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N46,\" of \",Evaluation!N46+IF(Evaluation!G46=\"\",0,Evaluation!G46)))","v":"6 of 6"},{"$nulls":3},{"$f":"IF(Evaluation!G46=\"\",0,Evaluation!G46)","v":0}]
[]
[null,{"$f":"Evaluation!C48","v":"3.2. Interoperability"},{"$nulls":3},{"$f":"IF(Evaluation!N48=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N48,\" of \",Evaluation!N48+IF(Evaluation!G48=\"\",0,Evaluation!G48)))","v":"3 of 3"},{"$nulls":3},{"$f":"IF(Evaluation!G48=\"\",0,Evaluation!G48)","v":0}]
[]
[null,{"$f":"Evaluation!C50","v":"3.3. Monitoring and Auditing"},{"$nulls":3},{"$f":"IF(Evaluation!N50=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N50,\" of \",Evaluation!N50+IF(Evaluation!G50=\"\",0,Evaluation!G50)))","v":"6 of 6"},{"$nulls":3},{"$f":"IF(Evaluation!G50=\"\",0,Evaluation!G50)","v":0}]
[]
[null,{"$f":"Evaluation!C52","v":"3.4. Automation"},{"$nulls":3},{"$f":"IF(Evaluation!N52=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N52,\" of \",Evaluation!N52+IF(Evaluation!G52=\"\",0,Evaluation!G52)))","v":"3 of 3"},{"$nulls":3},{"$f":"IF(Evaluation!G52=\"\",0,Evaluation!G52)","v":0}]
[]
[null,{"$f":"Evaluation!C54","v":"4.1. Sourcing"},{"$nulls":3},{"$f":"IF(Evaluation!N54=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N54,\" of \",Evaluation!N54+IF(Evaluation!G54=\"\",0,Evaluation!G54)))","v":"4 of 4"},{"$nulls":3},{"$f":"IF(Evaluation!G54=\"\",0,Evaluation!G54)","v":0}]
[]
[null,{"$f":"Evaluation!C56","v":"4.2. Knowledge and Training"},{"$nulls":3},{"$f":"IF(Evaluation!N56=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N56,\" of \",Evaluation!N56+IF(Evaluation!G56=\"\",0,Evaluation!G56)))","v":"5 of 5"},{"$nulls":3},{"$f":"IF(Evaluation!G56=\"\",0,Evaluation!G56)","v":0}]
[]
[null,{"$f":"Evaluation!C58","v":"4.3. Awareness"},{"$nulls":3},{"$f":"IF(Evaluation!N58=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N58,\" of \",Evaluation!N58+IF(Evaluation!G58=\"\",0,Evaluation!G58)))","v":"4 of 4"},{"$nulls":3},{"$f":"IF(Evaluation!G58=\"\",0,Evaluation!G58)","v":0}]
{"$rows_empty":15}
[null,"Maturity levels chart"]

{"sheet":"DetailedReport","index":7,"n_rows":294,"n_cols":10,"rows_kept":294,"merged":[[0,1,3,9],[4,1,6,9],[8,1,8,9],[9,1,9,4],[9,5,9,9],[10,1,10,2],[10,3,10,4],[10,5,10,6],[10,7,10,9],[11,1,11,2],[11,3,11,4],[11,5,11,6],[11,7,11,9],[12,1,12,2],[12,3,12,4],[12,5,12,6],[12,7,12,9],[15,1,15,9],[17,1,17,2],[17,3,17,9],[18,1,18,2],[18,3,18,7],[19,1,19,2],[19,3,19,9],[20,1,20,2],[20,3,20,9],[21,1,21,2],[21,3,21,9],[35,1,35,9],[36,1,36,4],[37,1,37,9],[39,1,39,5],[40,1,40,9],[42,1,42,4],[43,1,43,9],[51,1,51,9],[53,1,53,5],[54,1,54,9],[56,1,56,6],[57,1,57,9],[70,1,70,9],[72,5,72,6],[73,1,73,3],[73,5,73,6],[74,1,74,3],[76,1,76,4],[76,5,76,6],[77,5,77,6],[78,1,78,4],[78,5,78,6],[79,5,79,6],[80,1,80,4],[80,5,80,6],[81,5,81,6],[82,1,82,4],[82,5,82,6],[84,1,84,3],[86,1,86,4],[86,5,86,6],[87,5,87,6],[88,1,88,4],[88,5,88,6],[89,5,89,6],[90,1,90,4],[90,5,90,6],[91,5,91,6],[92,1,92,4],[92,5,92,6],[93,5,93,6],[94,1,94,4],[94,5,94,6],[95,5,95,6],[96,1,96,4],[96,5,96,6],[97,5,97,6],[98,1,98,4],[98,5,98,6],[99,5,99,6],[100,1,100,4],[100,5,100,6],[101,5,101,6],[102,1,102,4],[102,5,102,6],[103,5,103,6],[104,1,104,4],[104,5,104,6],[105,5,105,6],[106,1,106,4],[106,5,106,6],[107,5,107,6],[108,1,108,4],[108,5,108,6],[109,5,109,6],[110,1,110,4],[110,5,110,6],[111,5,111,6],[112,1,112,4],[112,5,112,6],[113,5,113,6],[114,1,114,4],[114,5,114,6],[130,1,130,9],[179,1,179,9],[181,2,181,6],[182,2,182,6],[183,2,183,6],[183,7,183,9],[184,2,184,6],[184,7,184,9],[185,2,185,6],[185,7,185,9],[186,2,186,6],[186,7,186,9],[187,2,187,6],[187,7,187,9],[188,2,188,6],[188,7,188,9],[189,2,189,6],[190,2,190,6],[190,7,190,9],[191,2,191,6],[191,7,191,9],[192,2,192,6],[192,7,192,9],[193,2,193,6],[193,7,193,9],[194,2,194,6],[194,7,194,9],[195,2,195,6],[195,7,195,9],[196,2,196,6],[197,2,197,6],[197,7,197,9],[198,2,198,6],[198,7,198,9],[199,2,199,6],[199,7,199,9],[200,2,200,6],[200,7,200,9],[201,2,201,6],[201,7,201,9],[202,2,202,6],[202,7,202,9],[203,2,203,6],[204,2,204,6],[204,7,204,9],[205,2,205,6],[205,7,205,9],[206,2,206,6],[206,7,206,9],[207,2,207,6],[207,7,207,9],[208,2,208,6],[208,7,208,9],[209,2,209,6],[209,7,209,9],[212,2,212,6],[213,2,213,6],[214,2,214,6],[214,7,214,9],[215,2,215,6],[215,7,215,9],[216,2,216,6],[216,7,216,9],[217,2,217,6],[217,7,217,9],[218,2,218,6],[218,7,218,9],[219,2,219,6],[219,7,219,9],[220,2,220,6],[221,2,221,6],[221,7,221,9],[222,2,222,6],[222,7,222,9],[223,2,223,6],[223,7,223,9],[224,2,224,6],[224,7,224,9],[225,2,225,6],[225,7,225,9],[226,2,226,6],[226,7,226,9],[227,2,227,6],[227,7,227,9],[228,2,228,6],[229,2,229,6],[229,7,229,9],[230,2,230,6],[230,7,230,9],[231,2,231,6],[231,7,231,9],[232,2,232,6],[232,7,232,9],[233,2,233,6],[233,7,233,9],[234,2,234,6],[234,7,234,9],[235,2,235,6],[236,2,236,6],[236,7,236,9],[237,2,237,6],[237,7,237,9],[238,2,238,6],[238,7,238,9],[239,2,239,6],[239,7,239,9],[240,2,240,6],[240,7,240,9],[241,2,241,6],[241,7,241,9],[244,2,244,6],[245,2,245,6],[246,2,246,6],[246,7,246,9],[247,2,247,6],[247,7,247,9],[248,2,248,6],[248,7,248,9],[249,2,249,6],[249,7,249,9],[250,2,250,6],[250,7,250,9],[251,2,251,6],[251,7,251,9],[252,2,252,6],[253,2,253,6],[253,7,253,9],[254,2,254,6],[254,7,254,9],[255,2,255,6],[255,7,255,9],[256,2,256,6],[256,7,256,9],[257,2,257,6],[257,7,257,9],[258,2,258,6],[258,7,258,9],[259,2,259,6],[260,2,260,6],[260,7,260,9],[261,2,261,6],[261,7,261,9],[262,2,262,6],[262,7,262,9],[263,2,263,6],[263,7,263,9],[264,2,264,6],[264,7,264,9],[265,2,265,6],[265,7,265,9],[266,2,266,6],[267,2,267,6],[267,7,267,9],[268,2,268,6],[268,7,268,9],[269,2,269,6],[269,7,269,9],[270,2,270,6],[270,7,270,9],[271,2,271,6],[271,7,271,9],[272,2,272,6],[272,7,272,9],[277,2,277,6],[278,2,278,6],[279,2,279,6],[279,7,279,9],[280,2,280,6],[280,7,280,9],[281,2,281,6],[281,7,281,9],[282,2,282,6],[282,7,282,9],[283,2,283,6],[284,2,284,6],[284,7,284,9],[285,2,285,6],[285,7,285,9],[286,2,286,6],[286,7,286,9],[287,2,287,6],[287,7,287,9],[288,2,288,6],[288,7,288,9],[289,2,289,6],[290,2,290,6],[290,7,290,9],[291,2,291,6],[291,7,291,9],[292,2,292,6],[292,7,292,9],[293,2,293,6],[293,7,293,9]]}
[null,"PKI Maturity"]
[]
[]
[]
[null,"Detailed report"]
[]
[]
[]
[null,"Assessment details"]
[null,"Timing",{"$nulls":3},"Assessor"]
[null,"Starting date",null,{"$f":"Overview!D7","v":"2023-05-02"},null,"Position",null,{"$f":"Overview!L5","v":"Internal"}]
[null,"Finishing date",null,{"$f":"Overview!D9","v":"2023-07-01"},null,"Name",null,{"$f":"Overview!L7","v":"Franta Hrábě"}]
[null,"Duration",null,{"$f":"_xlfn.CONCAT(D12-D11,\" days\")","v":"60 days"},null,"Company",null,{"$f":"Overview!L6","v":"3Key Company"}]
[]
[]
[null,"Achieved maturity level"]
[]
[null,"Use-case:",null,{"$f":"Evaluation!C10","v":"Cool PKI"}]
[null,"Maturity level:",null,{"$f":"Evaluation!F10","v":"Basic"}]
[null,"Short description:",null,{"$f":"Evaluation!F12","v":"Process is characterized by each particular case or project and controls are often reactive"}]
[null,"Indicators:",null,{"$f":"Evaluation!D14","v":"• PKI is ad-hoc managed, often reactive\n• There are defined processes and procedures which are followed\n• PKI is not managed according to industry standards and regulations\n• Insufficient knowledge"}]
[null,"Associated risks:",null,{"$f":"Evaluation!D15","v":"• High probability of operational issues\n• Medium probability of compromise\n• no trust"}]
{"$rows_empty":13}
[null,"Use-case details"]
[null,"Description of assessed use-case:"]
[null,{"$f":"IF(Overview!B16=\"\",\"\",Overview!B16)","v":""}]
[]
[null,"List of components involved in the use-case:"]
[null,{"$f":"IF(Overview!B20=\"\",\"\",Overview!B20)","v":""}]
[]
[null,"Specific out-of-scope considerations:"]
[null,{"$f":"IF(Overview!B24=\"\",\"\",Overview!B24)","v":""}]
{"$rows_empty":7}
[null,"PKI environment details"]
[]
[null,"High-level design of the PKI environment:"]
[null,{"$f":"IF(Overview!B31=\"\",\"\",Overview!B31)","v":""}]
[]
[null,"Points of interaction between parties involved in the use-cases:"]
[null,{"$f":"IF(Overview!B35=\"\",\"\",Overview!B35)","v":""}]
{"$rows_empty":12}
[null,"Scope overview"]
[]
[{"$nulls":5},"Applicable requirements",{"$nulls":3},"N/A"]
[null,"Overall scope:",{"$nulls":3},{"$f":"_xlfn.CONCAT(Evaluation!N10,\" of \",Evaluation!N10+IF(Evaluation!G10=\"\",0,Evaluation!G10))","v":"72 of 72"},{"$nulls":3},{"$f":"IF(Evaluation!G10=\"\",0,Evaluation!G10)","v":0}]
[null,"Overview by modules:"]
[]
[null,{"$f":"Evaluation!C19","v":"1. Governance"},{"$nulls":3},{"$f":"IF(Evaluation!N19=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N19,\" of \",Evaluation!N19+IF(Evaluation!G19=\"\",0,Evaluation!G19)))","v":"18 of 18"},{"$nulls":3},{"$f":"IF(Evaluation!G19=\"\",0,Evaluation!G19)","v":0}]
[]
[null,{"$f":"Evaluation!C21","v":"2. Management"},{"$nulls":3},{"$f":"IF(Evaluation!N21=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N21,\" of \",Evaluation!N21+IF(Evaluation!G21=\"\",0,Evaluation!G21)))","v":"23 of 23"},{"$nulls":3},{"$f":"IF(Evaluation!G21=\"\",0,Evaluation!G21)","v":0}]
[]
[null,{"$f":"Evaluation!C23","v":"3. Operations"},{"$nulls":3},{"$f":"IF(Evaluation!N23=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N23,\" of \",Evaluation!N23+IF(Evaluation!G23=\"\",0,Evaluation!G23)))","v":"18 of 18"},{"$nulls":3},{"$f":"IF(Evaluation!G23=\"\",0,Evaluation!G23)","v":0}]
[]
[null,{"$f":"Evaluation!C25","v":"4. Resources"},{"$nulls":3},{"$f":"IF(Evaluation!N25=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N25,\" of \",Evaluation!N25+IF(Evaluation!G25=\"\",0,Evaluation!G25)))","v":"13 of 13"},{"$nulls":3},{"$f":"IF(Evaluation!G25=\"\",0,Evaluation!G25)","v":0}]
[]
[null,"Overview by categories:"]
[]
[null,{"$f":"Evaluation!C30","v":"1.1. Strategy and vision"},{"$nulls":3},{"$f":"IF(Evaluation!N30=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N30,\" of \",Evaluation!N30+IF(Evaluation!G30=\"\",0,Evaluation!G30)))","v":"4 of 4"},{"$nulls":3},{"$f":"IF(Evaluation!G30=\"\",0,Evaluation!G30)","v":0}]
[]
[null,{"$f":"Evaluation!C32","v":"1.2. Policies and documentation"},{"$nulls":3},{"$f":"IF(Evaluation!N32=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N32,\" of \",Evaluation!N32+IF(Evaluation!G32=\"\",0,Evaluation!G32)))","v":"5 of 5"},{"$nulls":3},{"$f":"IF(Evaluation!G32=\"\",0,Evaluation!G32)","v":0}]
[]
[null,{"$f":"Evaluation!C34","v":"1.3. Compliance"},{"$nulls":3},{"$f":"IF(Evaluation!N34=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N34,\" of \",Evaluation!N34+IF(Evaluation!G34=\"\",0,Evaluation!G34)))","v":"4 of 4"},{"$nulls":3},{"$f":"IF(Evaluation!G34=\"\",0,Evaluation!G34)","v":0}]
[]
[null,{"$f":"Evaluation!C36","v":"1.4. Processes and procedures"},{"$nulls":3},{"$f":"IF(Evaluation!N36=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N36,\" of \",Evaluation!N36+IF(Evaluation!G36=\"\",0,Evaluation!G36)))","v":"5 of 5"},{"$nulls":3},{"$f":"IF(Evaluation!G36=\"\",0,Evaluation!G36)","v":0}]
[]
[null,{"$f":"Evaluation!C38","v":"2.1. Key Management"},{"$nulls":3},{"$f":"IF(Evaluation!N38=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N38,\" of \",Evaluation!N38+IF(Evaluation!G38=\"\",0,Evaluation!G38)))","v":"6 of 6"},{"$nulls":3},{"$f":"IF(Evaluation!G38=\"\",0,Evaluation!G38)","v":0}]
[]
[null,{"$f":"Evaluation!C40","v":"2.2. Certificate Management"},{"$nulls":3},{"$f":"IF(Evaluation!N40=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N40,\" of \",Evaluation!N40+IF(Evaluation!G40=\"\",0,Evaluation!G40)))","v":"7 of 7"},{"$nulls":3},{"$f":"IF(Evaluation!G40=\"\",0,Evaluation!G40)","v":0}]
[]
[null,{"$f":"Evaluation!C42","v":"2.3. Infrastructure Management"},{"$nulls":3},{"$f":"IF(Evaluation!N42=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N42,\" of \",Evaluation!N42+IF(Evaluation!G42=\"\",0,Evaluation!G42)))","v":"5 of 5"},{"$nulls":3},{"$f":"IF(Evaluation!G42=\"\",0,Evaluation!G42)","v":0}]
[]
[null,{"$f":"Evaluation!C44","v":"2.4. Change Management and Agility"},{"$nulls":3},{"$f":"IF(Evaluation!N44=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N44,\" of \",Evaluation!N44+IF(Evaluation!G44=\"\",0,Evaluation!G44)))","v":"5 of 5"},{"$nulls":3},{"$f":"IF(Evaluation!G44=\"\",0,Evaluation!G44)","v":0}]
[]
[null,{"$f":"Evaluation!C46","v":"3.1. Resilience"},{"$nulls":3},{"$f":"IF(Evaluation!N46=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N46,\" of \",Evaluation!N46+IF(Evaluation!G46=\"\",0,Evaluation!G46)))","v":"6 of 6"},{"$nulls":3},{"$f":"IF(Evaluation!G46=\"\",0,Evaluation!G46)","v":0}]
[]
[null,{"$f":"Evaluation!C48","v":"3.2. Interoperability"},{"$nulls":3},{"$f":"IF(Evaluation!N48=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N48,\" of \",Evaluation!N48+IF(Evaluation!G48=\"\",0,Evaluation!G48)))","v":"3 of 3"},{"$nulls":3},{"$f":"IF(Evaluation!G48=\"\",0,Evaluation!G48)","v":0}]
[]
[null,{"$f":"Evaluation!C50","v":"3.3. Monitoring and Auditing"},{"$nulls":3},{"$f":"IF(Evaluation!N50=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N50,\" of \",Evaluation!N50+IF(Evaluation!G50=\"\",0,Evaluation!G50)))","v":"6 of 6"},{"$nulls":3},{"$f":"IF(Evaluation!G50=\"\",0,Evaluation!G50)","v":0}]
[]
[null,{"$f":"Evaluation!C52","v":"3.4. Automation"},{"$nulls":3},{"$f":"IF(Evaluation!N52=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N52,\" of \",Evaluation!N52+IF(Evaluation!G52=\"\",0,Evaluation!G52)))","v":"3 of 3"},{"$nulls":3},{"$f":"IF(Evaluation!G52=\"\",0,Evaluation!G52)","v":0}]
[]
[null,{"$f":"Evaluation!C54","v":"4.1. Sourcing"},{"$nulls":3},{"$f":"IF(Evaluation!N54=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N54,\" of \",Evaluation!N54+IF(Evaluation!G54=\"\",0,Evaluation!G54)))","v":"4 of 4"},{"$nulls":3},{"$f":"IF(Evaluation!G54=\"\",0,Evaluation!G54)","v":0}]
[]
[null,{"$f":"Evaluation!C56","v":"4.2. Knowledge and Training"},{"$nulls":3},{"$f":"IF(Evaluation!N56=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N56,\" of \",Evaluation!N56+IF(Evaluation!G56=\"\",0,Evaluation!G56)))","v":"5 of 5"},{"$nulls":3},{"$f":"IF(Evaluation!G56=\"\",0,Evaluation!G56)","v":0}]
[]
[null,{"$f":"Evaluation!C58","v":"4.3. Awareness"},{"$nulls":3},{"$f":"IF(Evaluation!N58=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N58,\" of \",Evaluation!N58+IF(Evaluation!G58=\"\",0,Evaluation!G58)))","v":"4 of 4"},{"$nulls":3},{"$f":"IF(Evaluation!G58=\"\",0,Evaluation!G58)","v":0}]
{"$rows_empty":15}
[null,"Maturity levels chart"]
{"$rows_empty":48}
[null,"Requirements overview"]
[]
[null,{"$f":"LEFT(Evaluation!C19,2)","v":"1."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C19,\" \")","v":"Governance"}]
[null,{"$f":"LEFT(Evaluation!C30,4)","v":"1.1."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C30,\" \")","v":"Strategy and vision"}]
[null,{"$f":"tech!B140","v":"1.1.1."},{"$f":"tech!C140","v":"Organizational sponsor and support"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B184,tech!$B$140:$B$225,0))","v":"Initial"}]
[null,{"$f":"tech!B141","v":"1.1.2."},{"$f":"tech!C141","v":"Formal assignment of responsible leadership"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B185,tech!$B$140:$B$225,0))","v":"Initial"}]
[null,{"$f":"tech!B142","v":"1.1.3."},{"$f":"tech!C142","v":"Scope and business drivers for PKI"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B186,tech!$B$140:$B$225,0))","v":"Initial"}]
[null,{"$f":"tech!B143","v":"1.1.4."},{"$f":"tech!C143","v":"Architecture and design of the PKI"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B187,tech!$B$140:$B$225,0))","v":"Initial"}]
[null,{"$f":"tech!B144","v":"1.1.5."},{"$f":"tech!C144","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B188,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"tech!B145","v":"1.1.6."},{"$f":"tech!C145","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B189,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"LEFT(Evaluation!C32,4)","v":"1.2."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C32,\" \")","v":"Policies and documentation"}]
[null,{"$f":"tech!B146","v":"1.2.1."},{"$f":"tech!C146","v":"The scope of policies is defined and documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B191,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B147","v":"1.2.2."},{"$f":"tech!C147","v":"Certificate Policy is documented and published"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B192,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B148","v":"1.2.3."},{"$f":"tech!C148","v":"Certification Practice Statement is documented and published"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B193,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B149","v":"1.2.4."},{"$f":"tech!C149","v":"Disclosure statement is documented and published"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B194,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B150","v":"1.2.5."},{"$f":"tech!C150","v":"Policies are periodically reviewed and updated"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B195,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B151","v":"1.2.6."},{"$f":"tech!C151","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B196,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"LEFT(Evaluation!C34,4)","v":"1.3."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C34,\" \")","v":"Compliance"}]
[null,{"$f":"tech!B152","v":"1.3.1."},{"$f":"tech!C152","v":"Compliance policies are defined, implemented, and communicated"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B198,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B153","v":"1.3.2."},{"$f":"tech!C153","v":"A program to monitor compliance with the policies is established"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B199,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B154","v":"1.3.3."},{"$f":"tech!C154","v":"Responsibilities for the compliance are formally defined and assigned"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B200,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B155","v":"1.3.4."},{"$f":"tech!C155","v":"List of relevant laws, regulations, and standards, exist and is maintained"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B201,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B156","v":"1.3.5."},{"$f":"tech!C156","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B202,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"tech!B157","v":"1.3.6."},{"$f":"tech!C157","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B203,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"LEFT(Evaluation!C36,4)","v":"1.4."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C36,\" \")","v":"Processes and procedures"}]
[null,{"$f":"tech!B158","v":"1.4.1."},{"$f":"tech!C158","v":"Scope of processes and procedure is aligned with policies"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B205,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B159","v":"1.4.2."},{"$f":"tech!C159","v":"Processes and procedures are formally documented and followed"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B206,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B160","v":"1.4.3."},{"$f":"tech!C160","v":"Recurring activities are executed on time"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B207,tech!$B$140:$B$225,0))","v":"Optimized"}]
[null,{"$f":"tech!B161","v":"1.4.4."},{"$f":"tech!C161","v":"Evidence from procedures is collected and maintained"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B208,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B162","v":"1.4.5."},{"$f":"tech!C162","v":"Processes and procedures are reviewed and updated"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B209,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B163","v":"1.4.6."},{"$f":"tech!C163","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B210,tech!$B$140:$B$225,0))","v":""}]
[]
[]
[null,{"$f":"LEFT(Evaluation!C21,2)","v":"2."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C21,\" \")","v":"Management"}]
[null,{"$f":"LEFT(Evaluation!C38,4)","v":"2.1."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C38,\" \")","v":"Key Management"}]
[null,{"$f":"tech!B164","v":"2.1.1."},{"$f":"tech!C164","v":"Key management roles and responsibilities are documented and formally assigned"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B215,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B165","v":"2.1.2."},{"$f":"tech!C165","v":"Inventory of cryptographic keys is documented and maintained"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B216,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B166","v":"2.1.3."},{"$f":"tech!C166","v":"Inventory of cryptographic devices is documented and maintained"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B217,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B167","v":"2.1.4."},{"$f":"tech!C167","v":"Each cryptographic key is defined and has documented lifecycle procedures"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B218,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B168","v":"2.1.5."},{"$f":"tech!C168","v":"Cryptographic cipher suites and protocols are documented and maintained"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B219,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B169","v":"2.1.6."},{"$f":"tech!C169","v":"Key management is periodically reviewed and updated"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B220,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"LEFT(Evaluation!C40,4)","v":"2.2."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C40,\" \")","v":"Certificate Management"}]
[null,{"$f":"tech!B170","v":"2.2.1."},{"$f":"tech!C170","v":"Certificate profiles are documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B222,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B171","v":"2.2.2."},{"$f":"tech!C171","v":"Certificate cipher suites are documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B223,tech!$B$140:$B$225,0))","v":"Optimized"}]
[null,{"$f":"tech!B172","v":"2.2.3."},{"$f":"tech!C172","v":"Certificate lifecycle management is documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B224,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B173","v":"2.2.4."},{"$f":"tech!C173","v":"Inventory of issued certificates is documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B225,tech!$B$140:$B$225,0))","v":"Initial"}]
[null,{"$f":"tech!B174","v":"2.2.5."},{"$f":"tech!C174","v":"Certificate discovery process is documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B226,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B175","v":"2.2.6."},{"$f":"tech!C175","v":"Certificate management is periodically reviewed and updated"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B227,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B176","v":"2.2.7."},{"$f":"tech!C176","v":"Organizational PKI governance"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B228,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"LEFT(Evaluation!C42,4)","v":"2.3."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C42,\" \")","v":"Infrastructure Management"}]
[null,{"$f":"tech!B177","v":"2.3.1."},{"$f":"tech!C177","v":"Network and deployment infrastructure is documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B230,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B178","v":"2.3.2."},{"$f":"tech!C178","v":"Separation and segmentation principles are applied"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B231,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B179","v":"2.3.3."},{"$f":"tech!C179","v":"Network vulnerability management is implemented and maintained"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B232,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B180","v":"2.3.4."},{"$f":"tech!C180","v":"Infrastructure recovery objectives controls"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B233,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B181","v":"2.3.5."},{"$f":"tech!C181","v":"Infrastructure activities are periodically reviewed"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B234,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B182","v":"2.3.6."},{"$f":"tech!C182","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B235,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"LEFT(Evaluation!C44,4)","v":"2.4."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C44,\" \")","v":"Change Management and Agility"}]
[null,{"$f":"tech!B183","v":"2.4.1."},{"$f":"tech!C183","v":"The policy for change management and agility is documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B237,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B184","v":"2.4.2."},{"$f":"tech!C184","v":"Request for change structure is documented and followed"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B238,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B185","v":"2.4.3."},{"$f":"tech!C185","v":"The change management process is documented and implemented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B239,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B186","v":"2.4.4."},{"$f":"tech!C186","v":"Requirements for agility are identified"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B240,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B187","v":"2.4.5."},{"$f":"tech!C187","v":"Change management and agility is periodically reviewed"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B241,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B188","v":"2.4.6."},{"$f":"tech!C188","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B242,tech!$B$140:$B$225,0))","v":""}]
[]
[]
[null,{"$f":"LEFT(Evaluation!C23,2)","v":"3."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C23,\" \")","v":"Operations"}]
[null,{"$f":"LEFT(Evaluation!C46,4)","v":"3.1."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C46,\" \")","v":"Resilience"}]
[null,{"$f":"tech!B189","v":"3.1.1."},{"$f":"tech!C189","v":"Risk assessment and business impact analysis"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B247,tech!$B$140:$B$225,0))","v":"Optimized"}]
[null,{"$f":"tech!B190","v":"3.1.2."},{"$f":"tech!C190","v":"Cyber-security management and incident planning"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B248,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B191","v":"3.1.3."},{"$f":"tech!C191","v":"Business continuity planning and disaster recovery"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B249,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B192","v":"3.1.4."},{"$f":"tech!C192","v":"Technology future proofing"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B250,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B193","v":"3.1.5."},{"$f":"tech!C193","v":"Competence and information sharing"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B251,tech!$B$140:$B$225,0))","v":"Initial"}]
[null,{"$f":"tech!B194","v":"3.1.6."},{"$f":"tech!C194","v":"Continual review and improvement"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B252,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"LEFT(Evaluation!C48,4)","v":"3.2."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C48,\" \")","v":"Interoperability"}]
[null,{"$f":"tech!B195","v":"3.2.1."},{"$f":"tech!C195","v":"Maintain PKI interoperability strategy"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B254,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B196","v":"3.2.2."},{"$f":"tech!C196","v":"Documented integration guidance"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B255,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B197","v":"3.2.3."},{"$f":"tech!C197","v":"Adoption and application of open standards"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B256,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B198","v":"3.2.4."},{"$f":"tech!C198","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B257,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"tech!B199","v":"3.2.5."},{"$f":"tech!C199","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B258,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"tech!B200","v":"3.2.6."},{"$f":"tech!C200","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B259,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"LEFT(Evaluation!C50,4)","v":"3.3."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C50,\" \")","v":"Monitoring and Auditing"}]
[null,{"$f":"tech!B201","v":"3.3.1."},{"$f":"tech!C201","v":"Monitoring events and logging requirements are defined and documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B261,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B202","v":"3.3.2."},{"$f":"tech!C202","v":"Event logs from systems are collected"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B262,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B203","v":"3.3.3."},{"$f":"tech!C203","v":"Audit trail can be reconstructed from audit logs"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B263,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B204","v":"3.3.4."},{"$f":"tech!C204","v":"Monitoring of operational and security events is implemented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B264,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B205","v":"3.3.5."},{"$f":"tech!C205","v":"Critical events are immediately alerted and resolved according to incident response plans"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B265,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B206","v":"3.3.6."},{"$f":"tech!C206","v":"Review of events and logs is periodically performed"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B266,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"LEFT(Evaluation!C52,4)","v":"3.4."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C52,\" \")","v":"Automation"}]
[null,{"$f":"tech!B207","v":"3.4.1."},{"$f":"tech!C207","v":"Process automation description"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B268,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B208","v":"3.4.2."},{"$f":"tech!C208","v":"Monitoring and auditing of automated process"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B269,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B209","v":"3.4.3."},{"$f":"tech!C209","v":"Incidents and exceptions handling"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B270,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B210","v":"3.4.4."},{"$f":"tech!C210","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B271,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"tech!B211","v":"3.4.5."},{"$f":"tech!C211","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B272,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"tech!B212","v":"3.4.6."},{"$f":"tech!C212","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B273,tech!$B$140:$B$225,0))","v":""}]
[]
[]
[]
[]
[null,{"$f":"LEFT(Evaluation!C25,2)","v":"4."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C25,\" \")","v":"Resources"}]
[null,{"$f":"LEFT(Evaluation!C54,4)","v":"4.1."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C54,\" \")","v":"Sourcing"}]
[null,{"$f":"tech!B213","v":"4.1.1."},{"$f":"tech!C213","v":"Resources are identified and documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B280,tech!$B$140:$B$225,0))","v":"Initial"}]
[null,{"$f":"tech!B214","v":"4.1.2."},{"$f":"tech!C214","v":"Resources are clearly defined"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B281,tech!$B$140:$B$225,0))","v":"Optimized"}]
[null,{"$f":"tech!B215","v":"4.1.3."},{"$f":"tech!C215","v":"Availability of resources"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B282,tech!$B$140:$B$225,0))","v":"Optimized"}]
[null,{"$f":"tech!B216","v":"4.1.4."},{"$f":"tech!C216","v":"Resources are periodically reviewed"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B283,tech!$B$140:$B$225,0))","v":"Optimized"}]
[null,{"$f":"LEFT(Evaluation!C56,4)","v":"4.2."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C56,\" \")","v":"Knowledge and Training"}]
[null,{"$f":"tech!B217","v":"4.2.1."},{"$f":"tech!C217","v":"Establish training plan"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B285,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B218","v":"4.2.2."},{"$f":"tech!C218","v":"Responsible personnel receive training"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B286,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B219","v":"4.2.3."},{"$f":"tech!C219","v":"Perform security awareness training"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B287,tech!$B$140:$B$225,0))","v":"Optimized"}]
[null,{"$f":"tech!B220","v":"4.2.4."},{"$f":"tech!C220","v":"Establish education plan"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B288,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B221","v":"4.2.5."},{"$f":"tech!C221","v":"Periodically review knowledge"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B289,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"LEFT(Evaluation!C58,4)","v":"4.3."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C58,\" \")","v":"Awareness"}]
[null,{"$f":"tech!B222","v":"4.3.1."},{"$f":"tech!C222","v":"Establish and maintain awareness plan"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B291,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B223","v":"4.3.2."},{"$f":"tech!C223","v":"Disclose PKI information"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B292,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B224","v":"4.3.3."},{"$f":"tech!C224","v":"Establish single point of contact"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B293,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B225","v":"4.3.4."},{"$f":"tech!C225","v":"Timely communication of important information"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B294,tech!$B$140:$B$225,0))","v":"Advanced"}]

{"sheet":"Reporting","index":8,"n_rows":294,"n_cols":10,"rows_kept":294,"hidden":true,"merged":[[0,1,3,9],[4,1,6,9],[8,1,8,9],[9,1,9,4],[9,5,9,9],[10,1,10,2],[10,3,10,4],[10,5,10,6],[10,7,10,9],[11,1,11,2],[11,3,11,4],[11,5,11,6],[11,7,11,9],[12,1,12,2],[12,3,12,4],[12,5,12,6],[12,7,12,9],[15,1,15,9],[17,1,17,2],[17,3,17,9],[18,1,18,2],[18,3,18,7],[19,1,19,2],[19,3,19,9],[20,1,20,2],[20,3,20,9],[21,1,21,2],[21,3,21,9],[35,1,35,9],[36,1,36,4],[37,1,37,9],[39,1,39,5],[40,1,40,9],[42,1,42,4],[43,1,43,9],[51,1,51,9],[53,1,53,5],[54,1,54,9],[56,1,56,6],[57,1,57,9],[70,1,70,9],[72,5,72,6],[73,1,73,3],[73,5,73,6],[74,1,74,3],[76,1,76,4],[76,5,76,6],[77,5,77,6],[78,1,78,4],[78,5,78,6],[79,5,79,6],[80,1,80,4],[80,5,80,6],[81,5,81,6],[82,1,82,4],[82,5,82,6],[84,1,84,3],[86,1,86,4],[86,5,86,6],[87,5,87,6],[88,1,88,4],[88,5,88,6],[89,5,89,6],[90,1,90,4],[90,5,90,6],[91,5,91,6],[92,1,92,4],[92,5,92,6],[93,5,93,6],[94,1,94,4],[94,5,94,6],[95,5,95,6],[96,1,96,4],[96,5,96,6],[97,5,97,6],[98,1,98,4],[98,5,98,6],[99,5,99,6],[100,1,100,4],[100,5,100,6],[101,5,101,6],[102,1,102,4],[102,5,102,6],[103,5,103,6],[104,1,104,4],[104,5,104,6],[105,5,105,6],[106,1,106,4],[106,5,106,6],[107,5,107,6],[108,1,108,4],[108,5,108,6],[109,5,109,6],[110,1,110,4],[110,5,110,6],[111,5,111,6],[112,1,112,4],[112,5,112,6],[113,5,113,6],[114,1,114,4],[114,5,114,6],[130,1,130,9],[179,1,179,9],[181,2,181,6],[182,2,182,6],[183,2,183,6],[183,7,183,9],[184,2,184,6],[184,7,184,9],[185,2,185,6],[185,7,185,9],[186,2,186,6],[186,7,186,9],[187,2,187,6],[187,7,187,9],[188,2,188,6],[188,7,188,9],[189,2,189,6],[190,2,190,6],[190,7,190,9],[191,2,191,6],[191,7,191,9],[192,2,192,6],[192,7,192,9],[193,2,193,6],[193,7,193,9],[194,2,194,6],[194,7,194,9],[195,2,195,6],[195,7,195,9],[196,2,196,6],[197,2,197,6],[197,7,197,9],[198,2,198,6],[198,7,198,9],[199,2,199,6],[199,7,199,9],[200,2,200,6],[200,7,200,9],[201,2,201,6],[201,7,201,9],[202,2,202,6],[202,7,202,9],[203,2,203,6],[204,2,204,6],[204,7,204,9],[205,2,205,6],[205,7,205,9],[206,2,206,6],[206,7,206,9],[207,2,207,6],[207,7,207,9],[208,2,208,6],[208,7,208,9],[209,2,209,6],[209,7,209,9],[212,2,212,6],[213,2,213,6],[214,2,214,6],[214,7,214,9],[215,2,215,6],[215,7,215,9],[216,2,216,6],[216,7,216,9],[217,2,217,6],[217,7,217,9],[218,2,218,6],[218,7,218,9],[219,2,219,6],[219,7,219,9],[220,2,220,6],[221,2,221,6],[221,7,221,9],[222,2,222,6],[222,7,222,9],[223,2,223,6],[223,7,223,9],[224,2,224,6],[224,7,224,9],[225,2,225,6],[225,7,225,9],[226,2,226,6],[226,7,226,9],[227,2,227,6],[227,7,227,9],[228,2,228,6],[229,2,229,6],[229,7,229,9],[230,2,230,6],[230,7,230,9],[231,2,231,6],[231,7,231,9],[232,2,232,6],[232,7,232,9],[233,2,233,6],[233,7,233,9],[234,2,234,6],[234,7,234,9],[235,2,235,6],[236,2,236,6],[236,7,236,9],[237,2,237,6],[237,7,237,9],[238,2,238,6],[238,7,238,9],[239,2,239,6],[239,7,239,9],[240,2,240,6],[240,7,240,9],[241,2,241,6],[241,7,241,9],[244,2,244,6],[245,2,245,6],[246,2,246,6],[246,7,246,9],[247,2,247,6],[247,7,247,9],[248,2,248,6],[248,7,248,9],[249,2,249,6],[249,7,249,9],[250,2,250,6],[250,7,250,9],[251,2,251,6],[251,7,251,9],[252,2,252,6],[253,2,253,6],[253,7,253,9],[254,2,254,6],[254,7,254,9],[255,2,255,6],[255,7,255,9],[256,2,256,6],[256,7,256,9],[257,2,257,6],[257,7,257,9],[258,2,258,6],[258,7,258,9],[259,2,259,6],[260,2,260,6],[260,7,260,9],[261,2,261,6],[261,7,261,9],[262,2,262,6],[262,7,262,9],[263,2,263,6],[263,7,263,9],[264,2,264,6],[264,7,264,9],[265,2,265,6],[265,7,265,9],[266,2,266,6],[267,2,267,6],[267,7,267,9],[268,2,268,6],[268,7,268,9],[269,2,269,6],[269,7,269,9],[270,2,270,6],[270,7,270,9],[271,2,271,6],[271,7,271,9],[272,2,272,6],[272,7,272,9],[277,2,277,6],[278,2,278,6],[279,2,279,6],[279,7,279,9],[280,2,280,6],[280,7,280,9],[281,2,281,6],[281,7,281,9],[282,2,282,6],[282,7,282,9],[283,2,283,6],[284,2,284,6],[284,7,284,9],[285,2,285,6],[285,7,285,9],[286,2,286,6],[286,7,286,9],[287,2,287,6],[287,7,287,9],[288,2,288,6],[288,7,288,9],[289,2,289,6],[290,2,290,6],[290,7,290,9],[291,2,291,6],[291,7,291,9],[292,2,292,6],[292,7,292,9],[293,2,293,6],[293,7,293,9]]}
[null,"PKI Maturity"]
[]
[]
[]
[null,"Attestation report"]
[]
[]
[]
[null,"Assessment details"]
[null,"Timing",{"$nulls":3},"Assessor"]
[null,"Starting date",null,{"$f":"Overview!D7","v":"2023-05-02"},null,"Position",null,{"$f":"Overview!L5","v":"Internal"}]
[null,"Finishing date",null,{"$f":"Overview!D9","v":"2023-07-01"},null,"Name",null,{"$f":"Overview!L7","v":"Franta Hrábě"}]
[null,"Duration",null,{"$f":"_xlfn.CONCAT(D12-D11,\" days\")","v":"60 days"},null,"Company",null,{"$f":"Overview!L6","v":"3Key Company"}]
[]
[]
[null,"Achieved maturity level"]
[]
[null,"Use-case:",null,{"$f":"Evaluation!C10","v":"Cool PKI"}]
[null,"Maturity level:",null,{"$f":"Evaluation!F10","v":"Basic"}]
[null,"Short description:",null,{"$f":"Evaluation!F12","v":"Process is characterized by each particular case or project and controls are often reactive"}]
[null,"Indicators:",null,{"$f":"Evaluation!D14","v":"• PKI is ad-hoc managed, often reactive\n• There are defined processes and procedures which are followed\n• PKI is not managed according to industry standards and regulations\n• Insufficient knowledge"}]
[null,"Associated risks:",null,{"$f":"Evaluation!D15","v":"• High probability of operational issues\n• Medium probability of compromise\n• no trust"}]
{"$rows_empty":13}
[null,"Use-case details"]
[null,"Description of assessed use-case:"]
[null,{"$f":"IF(Overview!B16=\"\",\"\",Overview!B16)","v":""}]
[]
[null,"List of components involved in the use-case:"]
[null,{"$f":"IF(Overview!B20=\"\",\"\",Overview!B20)","v":""}]
[]
[null,"Specific out-of-scope considerations:"]
[null,{"$f":"IF(Overview!B24=\"\",\"\",Overview!B24)","v":""}]
{"$rows_empty":7}
[null,"PKI environment details"]
[]
[null,"High-level design of the PKI environment:"]
[null,{"$f":"IF(Overview!B31=\"\",\"\",Overview!B31)","v":""}]
[]
[null,"Points of interaction between parties involved in the use-cases:"]
[null,{"$f":"IF(Overview!B35=\"\",\"\",Overview!B35)","v":""}]
{"$rows_empty":12}
[null,"Scope overview"]
[]
[{"$nulls":5},"Applicable requirements",{"$nulls":3},"N/A"]
[null,"Overall scope:",{"$nulls":3},{"$f":"_xlfn.CONCAT(Evaluation!N10,\" of \",Evaluation!N10+IF(Evaluation!G10=\"\",0,Evaluation!G10))","v":"72 of 72"},{"$nulls":3},{"$f":"IF(Evaluation!G10=\"\",0,Evaluation!G10)","v":0}]
[null,"Overview by modules:"]
[]
[null,{"$f":"Evaluation!C19","v":"1. Governance"},{"$nulls":3},{"$f":"IF(Evaluation!N19=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N19,\" of \",Evaluation!N19+IF(Evaluation!G19=\"\",0,Evaluation!G19)))","v":"18 of 18"},{"$nulls":3},{"$f":"IF(Evaluation!G19=\"\",0,Evaluation!G19)","v":0}]
[]
[null,{"$f":"Evaluation!C21","v":"2. Management"},{"$nulls":3},{"$f":"IF(Evaluation!N21=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N21,\" of \",Evaluation!N21+IF(Evaluation!G21=\"\",0,Evaluation!G21)))","v":"23 of 23"},{"$nulls":3},{"$f":"IF(Evaluation!G21=\"\",0,Evaluation!G21)","v":0}]
[]
[null,{"$f":"Evaluation!C23","v":"3. Operations"},{"$nulls":3},{"$f":"IF(Evaluation!N23=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N23,\" of \",Evaluation!N23+IF(Evaluation!G23=\"\",0,Evaluation!G23)))","v":"18 of 18"},{"$nulls":3},{"$f":"IF(Evaluation!G23=\"\",0,Evaluation!G23)","v":0}]
[]
[null,{"$f":"Evaluation!C25","v":"4. Resources"},{"$nulls":3},{"$f":"IF(Evaluation!N25=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N25,\" of \",Evaluation!N25+IF(Evaluation!G25=\"\",0,Evaluation!G25)))","v":"13 of 13"},{"$nulls":3},{"$f":"IF(Evaluation!G25=\"\",0,Evaluation!G25)","v":0}]
[]
[null,"Overview by categories:"]
[]
[null,{"$f":"Evaluation!C30","v":"1.1. Strategy and vision"},{"$nulls":3},{"$f":"IF(Evaluation!N30=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N30,\" of \",Evaluation!N30+IF(Evaluation!G30=\"\",0,Evaluation!G30)))","v":"4 of 4"},{"$nulls":3},{"$f":"IF(Evaluation!G30=\"\",0,Evaluation!G30)","v":0}]
[]
[null,{"$f":"Evaluation!C32","v":"1.2. Policies and documentation"},{"$nulls":3},{"$f":"IF(Evaluation!N32=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N32,\" of \",Evaluation!N32+IF(Evaluation!G32=\"\",0,Evaluation!G32)))","v":"5 of 5"},{"$nulls":3},{"$f":"IF(Evaluation!G32=\"\",0,Evaluation!G32)","v":0}]
[]
[null,{"$f":"Evaluation!C34","v":"1.3. Compliance"},{"$nulls":3},{"$f":"IF(Evaluation!N34=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N34,\" of \",Evaluation!N34+IF(Evaluation!G34=\"\",0,Evaluation!G34)))","v":"4 of 4"},{"$nulls":3},{"$f":"IF(Evaluation!G34=\"\",0,Evaluation!G34)","v":0}]
[]
[null,{"$f":"Evaluation!C36","v":"1.4. Processes and procedures"},{"$nulls":3},{"$f":"IF(Evaluation!N36=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N36,\" of \",Evaluation!N36+IF(Evaluation!G36=\"\",0,Evaluation!G36)))","v":"5 of 5"},{"$nulls":3},{"$f":"IF(Evaluation!G36=\"\",0,Evaluation!G36)","v":0}]
[]
[null,{"$f":"Evaluation!C38","v":"2.1. Key Management"},{"$nulls":3},{"$f":"IF(Evaluation!N38=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N38,\" of \",Evaluation!N38+IF(Evaluation!G38=\"\",0,Evaluation!G38)))","v":"6 of 6"},{"$nulls":3},{"$f":"IF(Evaluation!G38=\"\",0,Evaluation!G38)","v":0}]
[]
[null,{"$f":"Evaluation!C40","v":"2.2. Certificate Management"},{"$nulls":3},{"$f":"IF(Evaluation!N40=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N40,\" of \",Evaluation!N40+IF(Evaluation!G40=\"\",0,Evaluation!G40)))","v":"7 of 7"},{"$nulls":3},{"$f":"IF(Evaluation!G40=\"\",0,Evaluation!G40)","v":0}]
[]
[null,{"$f":"Evaluation!C42","v":"2.3. Infrastructure Management"},{"$nulls":3},{"$f":"IF(Evaluation!N42=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N42,\" of \",Evaluation!N42+IF(Evaluation!G42=\"\",0,Evaluation!G42)))","v":"5 of 5"},{"$nulls":3},{"$f":"IF(Evaluation!G42=\"\",0,Evaluation!G42)","v":0}]
[]
[null,{"$f":"Evaluation!C44","v":"2.4. Change Management and Agility"},{"$nulls":3},{"$f":"IF(Evaluation!N44=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N44,\" of \",Evaluation!N44+IF(Evaluation!G44=\"\",0,Evaluation!G44)))","v":"5 of 5"},{"$nulls":3},{"$f":"IF(Evaluation!G44=\"\",0,Evaluation!G44)","v":0}]
[]
[null,{"$f":"Evaluation!C46","v":"3.1. Resilience"},{"$nulls":3},{"$f":"IF(Evaluation!N46=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N46,\" of \",Evaluation!N46+IF(Evaluation!G46=\"\",0,Evaluation!G46)))","v":"6 of 6"},{"$nulls":3},{"$f":"IF(Evaluation!G46=\"\",0,Evaluation!G46)","v":0}]
[]
[null,{"$f":"Evaluation!C48","v":"3.2. Interoperability"},{"$nulls":3},{"$f":"IF(Evaluation!N48=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N48,\" of \",Evaluation!N48+IF(Evaluation!G48=\"\",0,Evaluation!G48)))","v":"3 of 3"},{"$nulls":3},{"$f":"IF(Evaluation!G48=\"\",0,Evaluation!G48)","v":0}]
[]
[null,{"$f":"Evaluation!C50","v":"3.3. Monitoring and Auditing"},{"$nulls":3},{"$f":"IF(Evaluation!N50=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N50,\" of \",Evaluation!N50+IF(Evaluation!G50=\"\",0,Evaluation!G50)))","v":"6 of 6"},{"$nulls":3},{"$f":"IF(Evaluation!G50=\"\",0,Evaluation!G50)","v":0}]
[]
[null,{"$f":"Evaluation!C52","v":"3.4. Automation"},{"$nulls":3},{"$f":"IF(Evaluation!N52=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N52,\" of \",Evaluation!N52+IF(Evaluation!G52=\"\",0,Evaluation!G52)))","v":"3 of 3"},{"$nulls":3},{"$f":"IF(Evaluation!G52=\"\",0,Evaluation!G52)","v":0}]
[]
[null,{"$f":"Evaluation!C54","v":"4.1. Sourcing"},{"$nulls":3},{"$f":"IF(Evaluation!N54=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N54,\" of \",Evaluation!N54+IF(Evaluation!G54=\"\",0,Evaluation!G54)))","v":"4 of 4"},{"$nulls":3},{"$f":"IF(Evaluation!G54=\"\",0,Evaluation!G54)","v":0}]
[]
[null,{"$f":"Evaluation!C56","v":"4.2. Knowledge and Training"},{"$nulls":3},{"$f":"IF(Evaluation!N56=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N56,\" of \",Evaluation!N56+IF(Evaluation!G56=\"\",0,Evaluation!G56)))","v":"5 of 5"},{"$nulls":3},{"$f":"IF(Evaluation!G56=\"\",0,Evaluation!G56)","v":0}]
[]
[null,{"$f":"Evaluation!C58","v":"4.3. Awareness"},{"$nulls":3},{"$f":"IF(Evaluation!N58=\"\",tech!$A$18,_xlfn.CONCAT(Evaluation!N58,\" of \",Evaluation!N58+IF(Evaluation!G58=\"\",0,Evaluation!G58)))","v":"4 of 4"},{"$nulls":3},{"$f":"IF(Evaluation!G58=\"\",0,Evaluation!G58)","v":0}]
{"$rows_empty":15}
[null,"Maturity levels chart"]
{"$rows_empty":48}
[null,"Requirements overview"]
[]
[null,{"$f":"LEFT(Evaluation!C19,2)","v":"1."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C19,\" \")","v":"Governance"}]
[null,{"$f":"LEFT(Evaluation!C30,4)","v":"1.1."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C30,\" \")","v":"Strategy and vision"}]
[null,{"$f":"tech!B140","v":"1.1.1."},{"$f":"tech!C140","v":"Organizational sponsor and support"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B184,tech!$B$140:$B$225,0))","v":"Initial"}]
[null,{"$f":"tech!B141","v":"1.1.2."},{"$f":"tech!C141","v":"Formal assignment of responsible leadership"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B185,tech!$B$140:$B$225,0))","v":"Initial"}]
[null,{"$f":"tech!B142","v":"1.1.3."},{"$f":"tech!C142","v":"Scope and business drivers for PKI"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B186,tech!$B$140:$B$225,0))","v":"Initial"}]
[null,{"$f":"tech!B143","v":"1.1.4."},{"$f":"tech!C143","v":"Architecture and design of the PKI"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B187,tech!$B$140:$B$225,0))","v":"Initial"}]
[null,{"$f":"tech!B144","v":"1.1.5."},{"$f":"tech!C144","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B188,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"tech!B145","v":"1.1.6."},{"$f":"tech!C145","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B189,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"LEFT(Evaluation!C32,4)","v":"1.2."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C32,\" \")","v":"Policies and documentation"}]
[null,{"$f":"tech!B146","v":"1.2.1."},{"$f":"tech!C146","v":"The scope of policies is defined and documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B191,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B147","v":"1.2.2."},{"$f":"tech!C147","v":"Certificate Policy is documented and published"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B192,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B148","v":"1.2.3."},{"$f":"tech!C148","v":"Certification Practice Statement is documented and published"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B193,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B149","v":"1.2.4."},{"$f":"tech!C149","v":"Disclosure statement is documented and published"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B194,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B150","v":"1.2.5."},{"$f":"tech!C150","v":"Policies are periodically reviewed and updated"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B195,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B151","v":"1.2.6."},{"$f":"tech!C151","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B196,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"LEFT(Evaluation!C34,4)","v":"1.3."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C34,\" \")","v":"Compliance"}]
[null,{"$f":"tech!B152","v":"1.3.1."},{"$f":"tech!C152","v":"Compliance policies are defined, implemented, and communicated"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B198,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B153","v":"1.3.2."},{"$f":"tech!C153","v":"A program to monitor compliance with the policies is established"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B199,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B154","v":"1.3.3."},{"$f":"tech!C154","v":"Responsibilities for the compliance are formally defined and assigned"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B200,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B155","v":"1.3.4."},{"$f":"tech!C155","v":"List of relevant laws, regulations, and standards, exist and is maintained"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B201,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B156","v":"1.3.5."},{"$f":"tech!C156","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B202,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"tech!B157","v":"1.3.6."},{"$f":"tech!C157","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B203,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"LEFT(Evaluation!C36,4)","v":"1.4."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C36,\" \")","v":"Processes and procedures"}]
[null,{"$f":"tech!B158","v":"1.4.1."},{"$f":"tech!C158","v":"Scope of processes and procedure is aligned with policies"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B205,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B159","v":"1.4.2."},{"$f":"tech!C159","v":"Processes and procedures are formally documented and followed"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B206,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B160","v":"1.4.3."},{"$f":"tech!C160","v":"Recurring activities are executed on time"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B207,tech!$B$140:$B$225,0))","v":"Optimized"}]
[null,{"$f":"tech!B161","v":"1.4.4."},{"$f":"tech!C161","v":"Evidence from procedures is collected and maintained"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B208,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B162","v":"1.4.5."},{"$f":"tech!C162","v":"Processes and procedures are reviewed and updated"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B209,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B163","v":"1.4.6."},{"$f":"tech!C163","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B210,tech!$B$140:$B$225,0))","v":""}]
[]
[]
[null,{"$f":"LEFT(Evaluation!C21,2)","v":"2."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C21,\" \")","v":"Management"}]
[null,{"$f":"LEFT(Evaluation!C38,4)","v":"2.1."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C38,\" \")","v":"Key Management"}]
[null,{"$f":"tech!B164","v":"2.1.1."},{"$f":"tech!C164","v":"Key management roles and responsibilities are documented and formally assigned"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B215,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B165","v":"2.1.2."},{"$f":"tech!C165","v":"Inventory of cryptographic keys is documented and maintained"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B216,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B166","v":"2.1.3."},{"$f":"tech!C166","v":"Inventory of cryptographic devices is documented and maintained"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B217,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B167","v":"2.1.4."},{"$f":"tech!C167","v":"Each cryptographic key is defined and has documented lifecycle procedures"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B218,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B168","v":"2.1.5."},{"$f":"tech!C168","v":"Cryptographic cipher suites and protocols are documented and maintained"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B219,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B169","v":"2.1.6."},{"$f":"tech!C169","v":"Key management is periodically reviewed and updated"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B220,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"LEFT(Evaluation!C40,4)","v":"2.2."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C40,\" \")","v":"Certificate Management"}]
[null,{"$f":"tech!B170","v":"2.2.1."},{"$f":"tech!C170","v":"Certificate profiles are documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B222,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B171","v":"2.2.2."},{"$f":"tech!C171","v":"Certificate cipher suites are documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B223,tech!$B$140:$B$225,0))","v":"Optimized"}]
[null,{"$f":"tech!B172","v":"2.2.3."},{"$f":"tech!C172","v":"Certificate lifecycle management is documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B224,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B173","v":"2.2.4."},{"$f":"tech!C173","v":"Inventory of issued certificates is documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B225,tech!$B$140:$B$225,0))","v":"Initial"}]
[null,{"$f":"tech!B174","v":"2.2.5."},{"$f":"tech!C174","v":"Certificate discovery process is documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B226,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B175","v":"2.2.6."},{"$f":"tech!C175","v":"Certificate management is periodically reviewed and updated"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B227,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B176","v":"2.2.7."},{"$f":"tech!C176","v":"Organizational PKI governance"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B228,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"LEFT(Evaluation!C42,4)","v":"2.3."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C42,\" \")","v":"Infrastructure Management"}]
[null,{"$f":"tech!B177","v":"2.3.1."},{"$f":"tech!C177","v":"Network and deployment infrastructure is documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B230,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B178","v":"2.3.2."},{"$f":"tech!C178","v":"Separation and segmentation principles are applied"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B231,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B179","v":"2.3.3."},{"$f":"tech!C179","v":"Network vulnerability management is implemented and maintained"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B232,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B180","v":"2.3.4."},{"$f":"tech!C180","v":"Infrastructure recovery objectives controls"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B233,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B181","v":"2.3.5."},{"$f":"tech!C181","v":"Infrastructure activities are periodically reviewed"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B234,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B182","v":"2.3.6."},{"$f":"tech!C182","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B235,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"LEFT(Evaluation!C44,4)","v":"2.4."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C44,\" \")","v":"Change Management and Agility"}]
[null,{"$f":"tech!B183","v":"2.4.1."},{"$f":"tech!C183","v":"The policy for change management and agility is documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B237,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B184","v":"2.4.2."},{"$f":"tech!C184","v":"Request for change structure is documented and followed"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B238,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B185","v":"2.4.3."},{"$f":"tech!C185","v":"The change management process is documented and implemented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B239,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B186","v":"2.4.4."},{"$f":"tech!C186","v":"Requirements for agility are identified"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B240,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B187","v":"2.4.5."},{"$f":"tech!C187","v":"Change management and agility is periodically reviewed"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B241,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B188","v":"2.4.6."},{"$f":"tech!C188","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B242,tech!$B$140:$B$225,0))","v":""}]
[]
[]
[null,{"$f":"LEFT(Evaluation!C23,2)","v":"3."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C23,\" \")","v":"Operations"}]
[null,{"$f":"LEFT(Evaluation!C46,4)","v":"3.1."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C46,\" \")","v":"Resilience"}]
[null,{"$f":"tech!B189","v":"3.1.1."},{"$f":"tech!C189","v":"Risk assessment and business impact analysis"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B247,tech!$B$140:$B$225,0))","v":"Optimized"}]
[null,{"$f":"tech!B190","v":"3.1.2."},{"$f":"tech!C190","v":"Cyber-security management and incident planning"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B248,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B191","v":"3.1.3."},{"$f":"tech!C191","v":"Business continuity planning and disaster recovery"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B249,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B192","v":"3.1.4."},{"$f":"tech!C192","v":"Technology future proofing"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B250,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B193","v":"3.1.5."},{"$f":"tech!C193","v":"Competence and information sharing"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B251,tech!$B$140:$B$225,0))","v":"Initial"}]
[null,{"$f":"tech!B194","v":"3.1.6."},{"$f":"tech!C194","v":"Continual review and improvement"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B252,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"LEFT(Evaluation!C48,4)","v":"3.2."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C48,\" \")","v":"Interoperability"}]
[null,{"$f":"tech!B195","v":"3.2.1."},{"$f":"tech!C195","v":"Maintain PKI interoperability strategy"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B254,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B196","v":"3.2.2."},{"$f":"tech!C196","v":"Documented integration guidance"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B255,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B197","v":"3.2.3."},{"$f":"tech!C197","v":"Adoption and application of open standards"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B256,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B198","v":"3.2.4."},{"$f":"tech!C198","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B257,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"tech!B199","v":"3.2.5."},{"$f":"tech!C199","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B258,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"tech!B200","v":"3.2.6."},{"$f":"tech!C200","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B259,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"LEFT(Evaluation!C50,4)","v":"3.3."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C50,\" \")","v":"Monitoring and Auditing"}]
[null,{"$f":"tech!B201","v":"3.3.1."},{"$f":"tech!C201","v":"Monitoring events and logging requirements are defined and documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B261,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B202","v":"3.3.2."},{"$f":"tech!C202","v":"Event logs from systems are collected"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B262,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B203","v":"3.3.3."},{"$f":"tech!C203","v":"Audit trail can be reconstructed from audit logs"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B263,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B204","v":"3.3.4."},{"$f":"tech!C204","v":"Monitoring of operational and security events is implemented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B264,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B205","v":"3.3.5."},{"$f":"tech!C205","v":"Critical events are immediately alerted and resolved according to incident response plans"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B265,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"tech!B206","v":"3.3.6."},{"$f":"tech!C206","v":"Review of events and logs is periodically performed"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B266,tech!$B$140:$B$225,0))","v":"Advanced"}]
[null,{"$f":"LEFT(Evaluation!C52,4)","v":"3.4."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C52,\" \")","v":"Automation"}]
[null,{"$f":"tech!B207","v":"3.4.1."},{"$f":"tech!C207","v":"Process automation description"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B268,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B208","v":"3.4.2."},{"$f":"tech!C208","v":"Monitoring and auditing of automated process"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B269,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B209","v":"3.4.3."},{"$f":"tech!C209","v":"Incidents and exceptions handling"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B270,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B210","v":"3.4.4."},{"$f":"tech!C210","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B271,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"tech!B211","v":"3.4.5."},{"$f":"tech!C211","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B272,tech!$B$140:$B$225,0))","v":""}]
[null,{"$f":"tech!B212","v":"3.4.6."},{"$f":"tech!C212","v":""},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B273,tech!$B$140:$B$225,0))","v":""}]
[]
[]
[]
[]
[null,{"$f":"LEFT(Evaluation!C25,2)","v":"4."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C25,\" \")","v":"Resources"}]
[null,{"$f":"LEFT(Evaluation!C54,4)","v":"4.1."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C54,\" \")","v":"Sourcing"}]
[null,{"$f":"tech!B213","v":"4.1.1."},{"$f":"tech!C213","v":"Resources are identified and documented"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B280,tech!$B$140:$B$225,0))","v":"Initial"}]
[null,{"$f":"tech!B214","v":"4.1.2."},{"$f":"tech!C214","v":"Resources are clearly defined"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B281,tech!$B$140:$B$225,0))","v":"Optimized"}]
[null,{"$f":"tech!B215","v":"4.1.3."},{"$f":"tech!C215","v":"Availability of resources"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B282,tech!$B$140:$B$225,0))","v":"Optimized"}]
[null,{"$f":"tech!B216","v":"4.1.4."},{"$f":"tech!C216","v":"Resources are periodically reviewed"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B283,tech!$B$140:$B$225,0))","v":"Optimized"}]
[null,{"$f":"LEFT(Evaluation!C56,4)","v":"4.2."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C56,\" \")","v":"Knowledge and Training"}]
[null,{"$f":"tech!B217","v":"4.2.1."},{"$f":"tech!C217","v":"Establish training plan"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B285,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B218","v":"4.2.2."},{"$f":"tech!C218","v":"Responsible personnel receive training"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B286,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B219","v":"4.2.3."},{"$f":"tech!C219","v":"Perform security awareness training"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B287,tech!$B$140:$B$225,0))","v":"Optimized"}]
[null,{"$f":"tech!B220","v":"4.2.4."},{"$f":"tech!C220","v":"Establish education plan"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B288,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B221","v":"4.2.5."},{"$f":"tech!C221","v":"Periodically review knowledge"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B289,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"LEFT(Evaluation!C58,4)","v":"4.3."},{"$f":"_xlfn.TEXTAFTER(Evaluation!C58,\" \")","v":"Awareness"}]
[null,{"$f":"tech!B222","v":"4.3.1."},{"$f":"tech!C222","v":"Establish and maintain awareness plan"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B291,tech!$B$140:$B$225,0))","v":"Basic"}]
[null,{"$f":"tech!B223","v":"4.3.2."},{"$f":"tech!C223","v":"Disclose PKI information"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B292,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B224","v":"4.3.3."},{"$f":"tech!C224","v":"Establish single point of contact"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B293,tech!$B$140:$B$225,0))","v":"Managed"}]
[null,{"$f":"tech!B225","v":"4.3.4."},{"$f":"tech!C225","v":"Timely communication of important information"},{"$nulls":4},{"$f":"INDEX(tech!$A$140:$A$225,MATCH(B294,tech!$B$140:$B$225,0))","v":"Advanced"}]

{"sheet":"ActionPlans","index":9,"n_rows":171,"n_cols":17,"rows_kept":171,"merged":[[1,1,4,5],[1,6,3,9],[2,10,2,13],[3,10,3,13],[4,6,4,9],[4,10,4,13],[7,1,7,13],[9,5,9,6],[9,7,9,8],[10,5,10,6],[10,7,10,8],[35,1,35,13],[37,1,37,4],[38,1,38,2],[38,3,38,13],[39,1,39,2],[39,3,39,13],[40,1,40,2],[40,3,40,13],[41,1,41,2],[41,3,41,13],[42,1,42,2],[42,3,42,13],[43,1,43,2],[43,3,43,13],[44,1,44,2],[44,3,44,13],[46,1,46,4],[47,1,47,2],[47,3,47,13],[48,1,48,2],[48,3,48,13],[49,1,49,2],[49,3,49,13],[50,1,50,2],[50,3,50,13],[51,1,51,2],[51,3,51,13],[52,1,52,2],[52,3,52,13],[53,1,53,2],[53,3,53,13],[55,1,55,4],[56,1,56,2],[56,3,56,13],[57,1,57,2],[57,3,57,13],[58,1,58,2],[58,3,58,13],[59,1,59,2],[59,3,59,13],[60,1,60,2],[60,3,60,13],[61,1,61,2],[61,3,61,13],[62,1,62,2],[62,3,62,13],[64,1,64,4],[65,1,65,2],[65,3,65,13],[66,1,66,2],[66,3,66,13],[67,1,67,2],[67,3,67,13],[68,1,68,2],[68,3,68,13],[69,1,69,2],[69,3,69,13],[70,1,70,2],[70,3,70,13],[71,1,71,2],[71,3,71,13],[73,1,73,4],[74,1,74,2],[74,3,74,13],[75,1,75,2],[75,3,75,13],[76,1,76,2],[76,3,76,13],[77,1,77,2],[77,3,77,13],[78,1,78,2],[78,3,78,13],[79,1,79,2],[79,3,79,13],[80,1,80,2],[80,3,80,13],[82,1,82,4],[83,1,83,2],[83,3,83,13],[84,1,84,2],[84,3,84,13],[85,1,85,2],[85,3,85,13],[86,1,86,2],[86,3,86,13],[87,1,87,2],[87,3,87,13],[88,1,88,2],[88,3,88,13],[89,1,89,2],[89,3,89,13],[91,1,91,4],[92,1,92,2],[92,3,92,13],[93,1,93,2],[93,3,93,13],[94,1,94,2],[94,3,94,13],[95,1,95,2],[95,3,95,13],[96,1,96,2],[96,3,96,13],[97,1,97,2],[97,3,97,13],[98,1,98,2],[98,3,98,13],[100,1,100,4],[101,1,101,2],[101,3,101,13],[102,1,102,2],[102,3,102,13],[103,1,103,2],[103,3,103,13],[104,1,104,2],[104,3,104,13],[105,1,105,2],[105,3,105,13],[106,1,106,2],[106,3,106,13],[107,1,107,2],[107,3,107,13],[109,1,109,4],[110,1,110,2],[110,3,110,13],[111,1,111,2],[111,3,111,13],[112,1,112,2],[112,3,112,13],[113,1,113,2],[113,3,113,13],[114,1,114,2],[114,3,114,13],[115,1,115,2],[115,3,115,13],[116,1,116,2],[116,3,116,13],[118,1,118,4],[119,1,119,2],[119,3,119,13],[120,1,120,2],[120,3,120,13],[121,1,121,2],[121,3,121,13],[122,1,122,2],[122,3,122,13],[123,1,123,2],[123,3,123,13],[124,1,124,2],[124,3,124,13],[125,1,125,2],[125,3,125,13],[127,1,127,4],[128,1,128,2],[128,3,128,13],[129,1,129,2],[129,3,129,13],[130,1,130,2],[130,3,130,13],[131,1,131,2],[131,3,131,13],[132,1,132,2],[132,3,132,13],[133,1,133,2],[133,3,133,13],[134,1,134,2],[134,3,134,13],[136,1,136,4],[137,1,137,2],[137,3,137,13],[138,1,138,2],[138,3,138,13],[139,1,139,2],[139,3,139,13],[140,1,140,2],[140,3,140,13],[141,1,141,2],[141,3,141,13],[142,1,142,2],[142,3,142,13],[143,1,143,2],[143,3,143,13],[145,1,145,4],[146,1,146,2],[146,3,146,13],[147,1,147,2],[147,3,147,13],[148,1,148,2],[148,3,148,13],[149,1,149,2],[149,3,149,13],[150,1,150,2],[150,3,150,13],[151,1,151,2],[151,3,151,13],[152,1,152,2],[152,3,152,13],[154,1,154,4],[155,1,155,2],[155,3,155,13],[156,1,156,2],[156,3,156,13],[157,1,157,2],[157,3,157,13],[158,1,158,2],[158,3,158,13],[159,1,159,2],[159,3,159,13],[160,1,160,2],[160,3,160,13],[161,1,161,2],[161,3,161,13],[163,1,163,4],[164,1,164,2],[164,3,164,13],[165,1,165,2],[165,3,165,13],[166,1,166,2],[166,3,166,13],[167,1,167,2],[167,3,167,13],[168,1,168,2],[168,3,168,13],[169,1,169,2],[169,3,169,13],[170,1,170,2],[170,3,170,13]]}
[]
[null,"Action plans",{"$nulls":4},{"$f":"Overview!D5","v":"Cool PKI"}]
[{"$nulls":10},{"$f":"_xlfn.CONCAT(\"Duration of the assessment: \",TODAY()-Overview!D7,\" days     \")","v":"Duration of the assessment: 321 days     "}]
[{"$nulls":10},{"$f":"IF(Overview!D9<>\"\",\"The assessment has been finished     \",IF(Overview!D8>=TODAY(),_xlfn.CONCAT(\"Remaining time to the target date: \",Overview!D8-TODAY(),\" days     \"),_xlfn.CONCAT(\"Overrunning the target date by: \",TODAY()-Overview!D8,\" days     \")))","v":"The assessment has been finished     "}]
[{"$nulls":6},{"$f":"Overview!D6","v":"3Key Company"},{"$nulls":3},{"$f":"_xlfn.CONCAT(\"Name of responsible assessor: \",Overview!L7,\"     \")","v":"Name of responsible assessor: Franta Hrábě     "}]
[]
[]
[null,"1. Select maturity level you want to achieve in future for each category."]
[]
[{"$nulls":5},"Achieved level",null,"Required level",null,"Initial","Basic","Advanced","Managed","Optimized"]
[{"$nulls":5},2,null,0,null,1,2,3,4,5]
[]
[null,{"$f":"Evaluation!C19","v":"1. Governance"}]
[null,{"$f":"Evaluation!C30","v":"1.1. Strategy and vision"},{"$nulls":3},{"$f":"Evaluation!F30","v":"Initial"},{"$f":"VLOOKUP(F14,tech!$A$13:$B$18,2,0)","v":1},null,{"$f":"IF(H14=\"\",\"\",VLOOKUP(H14,tech!$A$13:$B$18,2,0))","v":""},{"$f":"IF(G14=$J$11,tech!$D$23,\"\")","v":2},{"$f":"IF(G14=$K$11,tech!$D$23,IF(I14=$K$11,tech!D21,\"\"))","v":""},{"$f":"IF(G14=$L$11,tech!$D$23,IF(I14=$L$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G14=$M$11,tech!$D$23,IF(I14=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G14=$N$11,tech!$D$23,IF(I14=$N$11,tech!$D$21,\"\"))","v":""},1,{"$f":"B14","v":"1.1. Strategy and vision"},{"$f":"IF(AND(G14>0,I14<>\"\"),1,0)","v":0}]
[null,{"$f":"Evaluation!C32","v":"1.2. Policies and documentation"},{"$nulls":3},{"$f":"Evaluation!F32","v":"Basic"},{"$f":"VLOOKUP(F15,tech!$A$13:$B$18,2,0)","v":2},null,{"$f":"IF(H15=\"\",\"\",VLOOKUP(H15,tech!$A$13:$B$18,2,0))","v":""},{"$f":"IF(G15=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G15=$K$11,tech!$D$23,IF(I15=$K$11,tech!D22,\"\"))","v":2},{"$f":"IF(G15=$L$11,tech!$D$23,IF(I15=$L$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G15=$M$11,tech!$D$23,IF(I15=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G15=$N$11,tech!$D$23,IF(I15=$N$11,tech!$D$21,\"\"))","v":""},2,{"$f":"B15","v":"1.2. Policies and documentation"},{"$f":"IF(AND(G15>0,I15<>\"\"),1,0)","v":0}]
[null,{"$f":"Evaluation!C34","v":"1.3. Compliance"},{"$nulls":3},{"$f":"Evaluation!F34","v":"Basic"},{"$f":"VLOOKUP(F16,tech!$A$13:$B$18,2,0)","v":2},null,{"$f":"IF(H16=\"\",\"\",VLOOKUP(H16,tech!$A$13:$B$18,2,0))","v":""},{"$f":"IF(G16=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G16=$K$11,tech!$D$23,IF(I16=$K$11,tech!D23,\"\"))","v":2},{"$f":"IF(G16=$L$11,tech!$D$23,IF(I16=$L$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G16=$M$11,tech!$D$23,IF(I16=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G16=$N$11,tech!$D$23,IF(I16=$N$11,tech!$D$21,\"\"))","v":""},3,{"$f":"B16","v":"1.3. Compliance"},0]
[null,{"$f":"Evaluation!C36","v":"1.4. Processes and procedures"},{"$nulls":3},{"$f":"Evaluation!F36","v":"Advanced"},{"$f":"VLOOKUP(F17,tech!$A$13:$B$18,2,0)","v":3},null,{"$f":"IF(H17=\"\",\"\",VLOOKUP(H17,tech!$A$13:$B$18,2,0))","v":""},{"$f":"IF(G17=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G17=$K$11,tech!$D$23,IF(I17=$K$11,tech!D24,\"\"))","v":""},{"$f":"IF(G17=$L$11,tech!$D$23,IF(I17=$L$11,tech!$D$21,\"\"))","v":2},{"$f":"IF(G17=$M$11,tech!$D$23,IF(I17=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G17=$N$11,tech!$D$23,IF(I17=$N$11,tech!$D$21,\"\"))","v":""},4,{"$f":"B17","v":"1.4. Processes and procedures"},0]
[{"$nulls":9},{"$f":"IF(G18=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G18=$K$11,tech!$D$23,IF(I18=$K$11,tech!D25,\"\"))","v":""},{"$f":"IF(G18=$L$11,tech!$D$23,IF(I18=$L$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G18=$M$11,tech!$D$23,IF(I18=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G18=$N$11,tech!$D$23,IF(I18=$N$11,tech!$D$21,\"\"))","v":""},5,{"$f":"B20","v":"2.1. Key Management"},{"$f":"IF(AND(G20>0,I20<>\"\"),1,0)","v":0}]
[null,{"$f":"Evaluation!C21","v":"2. Management"},{"$nulls":7},{"$f":"IF(G19=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G19=$K$11,tech!$D$23,IF(I19=$K$11,tech!D26,\"\"))","v":""},{"$f":"IF(G19=$L$11,tech!$D$23,IF(I19=$L$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G19=$M$11,tech!$D$23,IF(I19=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G19=$N$11,tech!$D$23,IF(I19=$N$11,tech!$D$21,\"\"))","v":""},6,{"$f":"B21","v":"2.2. Certificate Management"},{"$f":"IF(AND(G21>0,I21<>\"\"),1,0)","v":0}]
[null,{"$f":"Evaluation!C38","v":"2.1. Key Management"},{"$nulls":3},{"$f":"Evaluation!F38","v":"Advanced"},{"$f":"VLOOKUP(F20,tech!$A$13:$B$18,2,0)","v":3},null,{"$f":"IF(H20=\"\",\"\",VLOOKUP(H20,tech!$A$13:$B$18,2,0))","v":""},{"$f":"IF(G20=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G20=$K$11,tech!$D$23,IF(I20=$K$11,tech!D27,\"\"))","v":""},{"$f":"IF(G20=$L$11,tech!$D$23,IF(I20=$L$11,tech!$D$21,\"\"))","v":2},{"$f":"IF(G20=$M$11,tech!$D$23,IF(I20=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G20=$N$11,tech!$D$23,IF(I20=$N$11,tech!$D$21,\"\"))","v":""},7,{"$f":"B22","v":"2.3. Infrastructure Management"},0]
[null,{"$f":"Evaluation!C40","v":"2.2. Certificate Management"},{"$nulls":3},{"$f":"Evaluation!F40","v":"Basic"},{"$f":"VLOOKUP(F21,tech!$A$13:$B$18,2,0)","v":2},null,{"$f":"IF(H21=\"\",\"\",VLOOKUP(H21,tech!$A$13:$B$18,2,0))","v":""},{"$f":"IF(G21=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G21=$K$11,tech!$D$23,IF(I21=$K$11,tech!D28,\"\"))","v":2},{"$f":"IF(G21=$L$11,tech!$D$23,IF(I21=$L$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G21=$M$11,tech!$D$23,IF(I21=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G21=$N$11,tech!$D$23,IF(I21=$N$11,tech!$D$21,\"\"))","v":""},8,{"$f":"B23","v":"2.4. Change Management and Agility"},0]
[null,{"$f":"Evaluation!C42","v":"2.3. Infrastructure Management"},{"$nulls":3},{"$f":"Evaluation!F42","v":"Advanced"},{"$f":"VLOOKUP(F22,tech!$A$13:$B$18,2,0)","v":3},null,{"$f":"IF(H22=\"\",\"\",VLOOKUP(H22,tech!$A$13:$B$18,2,0))","v":""},{"$f":"IF(G22=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G22=$K$11,tech!$D$23,IF(I22=$K$11,tech!D29,\"\"))","v":""},{"$f":"IF(G22=$L$11,tech!$D$23,IF(I22=$L$11,tech!$D$21,\"\"))","v":2},{"$f":"IF(G22=$M$11,tech!$D$23,IF(I22=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G22=$N$11,tech!$D$23,IF(I22=$N$11,tech!$D$21,\"\"))","v":""},9,{"$f":"B26","v":"3.1. Resilience"},{"$f":"IF(AND(G26>0,I26<>\"\"),1,0)","v":0}]
[null,{"$f":"Evaluation!C44","v":"2.4. Change Management and Agility"},{"$nulls":3},{"$f":"Evaluation!F44","v":"Basic"},{"$f":"VLOOKUP(F23,tech!$A$13:$B$18,2,0)","v":2},null,{"$f":"IF(H23=\"\",\"\",VLOOKUP(H23,tech!$A$13:$B$18,2,0))","v":""},{"$f":"IF(G23=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G23=$K$11,tech!$D$23,IF(I23=$K$11,tech!D30,\"\"))","v":2},{"$f":"IF(G23=$L$11,tech!$D$23,IF(I23=$L$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G23=$M$11,tech!$D$23,IF(I23=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G23=$N$11,tech!$D$23,IF(I23=$N$11,tech!$D$21,\"\"))","v":""},10,{"$f":"B27","v":"3.2. Interoperability"},{"$f":"IF(AND(G27>0,I27<>\"\"),1,0)","v":0}]
[{"$nulls":9},{"$f":"IF(G24=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G24=$K$11,tech!$D$23,IF(I24=$K$11,tech!D31,\"\"))","v":""},{"$f":"IF(G24=$L$11,tech!$D$23,IF(I24=$L$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G24=$M$11,tech!$D$23,IF(I24=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G24=$N$11,tech!$D$23,IF(I24=$N$11,tech!$D$21,\"\"))","v":""},11,{"$f":"B28","v":"3.3. Monitoring and Auditing"},0]
[null,{"$f":"Evaluation!C23","v":"3. Operations"},{"$nulls":7},{"$f":"IF(G25=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G25=$K$11,tech!$D$23,IF(I25=$K$11,tech!D32,\"\"))","v":""},{"$f":"IF(G25=$L$11,tech!$D$23,IF(I25=$L$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G25=$M$11,tech!$D$23,IF(I25=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G25=$N$11,tech!$D$23,IF(I25=$N$11,tech!$D$21,\"\"))","v":""},12,{"$f":"B29","v":"3.4. Automation"},0]
[null,{"$f":"Evaluation!C46","v":"3.1. Resilience"},{"$nulls":3},{"$f":"Evaluation!F46","v":"Advanced"},{"$f":"VLOOKUP(F26,tech!$A$13:$B$18,2,0)","v":3},null,{"$f":"IF(H26=\"\",\"\",VLOOKUP(H26,tech!$A$13:$B$18,2,0))","v":""},{"$f":"IF(G26=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G26=$K$11,tech!$D$23,IF(I26=$K$11,tech!D33,\"\"))","v":""},{"$f":"IF(G26=$L$11,tech!$D$23,IF(I26=$L$11,tech!$D$21,\"\"))","v":2},{"$f":"IF(G26=$M$11,tech!$D$23,IF(I26=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G26=$N$11,tech!$D$23,IF(I26=$N$11,tech!$D$21,\"\"))","v":""},13,{"$f":"B32","v":"4.1. Sourcing"},{"$f":"IF(AND(G32>0,I32<>\"\"),1,0)","v":0}]
[null,{"$f":"Evaluation!C48","v":"3.2. Interoperability"},{"$nulls":3},{"$f":"Evaluation!F48","v":"Advanced"},{"$f":"VLOOKUP(F27,tech!$A$13:$B$18,2,0)","v":3},null,{"$f":"IF(H27=\"\",\"\",VLOOKUP(H27,tech!$A$13:$B$18,2,0))","v":""},{"$f":"IF(G27=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G27=$K$11,tech!$D$23,IF(I27=$K$11,tech!D34,\"\"))","v":""},{"$f":"IF(G27=$L$11,tech!$D$23,IF(I27=$L$11,tech!$D$21,\"\"))","v":2},{"$f":"IF(G27=$M$11,tech!$D$23,IF(I27=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G27=$N$11,tech!$D$23,IF(I27=$N$11,tech!$D$21,\"\"))","v":""},14,{"$f":"B33","v":"4.2. Knowledge and Training"},{"$f":"IF(AND(G33>0,I33<>\"\"),1,0)","v":0}]
[null,{"$f":"Evaluation!C50","v":"3.3. Monitoring and Auditing"},{"$nulls":3},{"$f":"Evaluation!F50","v":"Advanced"},{"$f":"VLOOKUP(F28,tech!$A$13:$B$18,2,0)","v":3},null,{"$f":"IF(H28=\"\",\"\",VLOOKUP(H28,tech!$A$13:$B$18,2,0))","v":""},{"$f":"IF(G28=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G28=$K$11,tech!$D$23,IF(I28=$K$11,tech!D35,\"\"))","v":""},{"$f":"IF(G28=$L$11,tech!$D$23,IF(I28=$L$11,tech!$D$21,\"\"))","v":2},{"$f":"IF(G28=$M$11,tech!$D$23,IF(I28=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G28=$N$11,tech!$D$23,IF(I28=$N$11,tech!$D$21,\"\"))","v":""},15,{"$f":"B34","v":"4.3. Awareness"},0]
[null,{"$f":"Evaluation!C52","v":"3.4. Automation"},{"$nulls":3},{"$f":"Evaluation!F52","v":"Basic"},{"$f":"VLOOKUP(F29,tech!$A$13:$B$18,2,0)","v":2},null,{"$f":"IF(H29=\"\",\"\",VLOOKUP(H29,tech!$A$13:$B$18,2,0))","v":""},{"$f":"IF(G29=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G29=$K$11,tech!$D$23,IF(I29=$K$11,tech!D36,\"\"))","v":2},{"$f":"IF(G29=$L$11,tech!$D$23,IF(I29=$L$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G29=$M$11,tech!$D$23,IF(I29=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G29=$N$11,tech!$D$23,IF(I29=$N$11,tech!$D$21,\"\"))","v":""}]
[{"$nulls":9},{"$f":"IF(G30=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G30=$K$11,tech!$D$23,IF(I30=$K$11,tech!D37,\"\"))","v":""},{"$f":"IF(G30=$L$11,tech!$D$23,IF(I30=$L$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G30=$M$11,tech!$D$23,IF(I30=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G30=$N$11,tech!$D$23,IF(I30=$N$11,tech!$D$21,\"\"))","v":""}]
[null,{"$f":"Evaluation!C25","v":"4. Resources"},{"$nulls":7},{"$f":"IF(G31=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G31=$K$11,tech!$D$23,IF(I31=$K$11,tech!D38,\"\"))","v":""},{"$f":"IF(G31=$L$11,tech!$D$23,IF(I31=$L$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G31=$M$11,tech!$D$23,IF(I31=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G31=$N$11,tech!$D$23,IF(I31=$N$11,tech!$D$21,\"\"))","v":""}]
[null,{"$f":"Evaluation!C54","v":"4.1. Sourcing"},{"$nulls":3},{"$f":"Evaluation!F54","v":"Advanced"},{"$f":"VLOOKUP(F32,tech!$A$13:$B$18,2,0)","v":3},null,{"$f":"IF(H32=\"\",\"\",VLOOKUP(H32,tech!$A$13:$B$18,2,0))","v":""},{"$f":"IF(G32=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G32=$K$11,tech!$D$23,IF(I32=$K$11,tech!D39,\"\"))","v":""},{"$f":"IF(G32=$L$11,tech!$D$23,IF(I32=$L$11,tech!$D$21,\"\"))","v":2},{"$f":"IF(G32=$M$11,tech!$D$23,IF(I32=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G32=$N$11,tech!$D$23,IF(I32=$N$11,tech!$D$21,\"\"))","v":""}]
[null,{"$f":"Evaluation!C56","v":"4.2. Knowledge and Training"},{"$nulls":3},{"$f":"Evaluation!F56","v":"Managed"},{"$f":"VLOOKUP(F33,tech!$A$13:$B$18,2,0)","v":4},null,{"$f":"IF(H33=\"\",\"\",VLOOKUP(H33,tech!$A$13:$B$18,2,0))","v":""},{"$f":"IF(G33=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G33=$K$11,tech!$D$23,IF(I33=$K$11,tech!D40,\"\"))","v":""},{"$f":"IF(G33=$L$11,tech!$D$23,IF(I33=$L$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G33=$M$11,tech!$D$23,IF(I33=$M$11,tech!$D$21,\"\"))","v":2},{"$f":"IF(G33=$N$11,tech!$D$23,IF(I33=$N$11,tech!$D$21,\"\"))","v":""}]
[null,{"$f":"Evaluation!C58","v":"4.3. Awareness"},{"$nulls":3},{"$f":"Evaluation!F58","v":"Advanced"},{"$f":"VLOOKUP(F34,tech!$A$13:$B$18,2,0)","v":3},null,{"$f":"IF(H34=\"\",\"\",VLOOKUP(H34,tech!$A$13:$B$18,2,0))","v":""},{"$f":"IF(G34=$J$11,tech!$D$23,\"\")","v":""},{"$f":"IF(G34=$K$11,tech!$D$23,IF(I34=$K$11,tech!D41,\"\"))","v":""},{"$f":"IF(G34=$L$11,tech!$D$23,IF(I34=$L$11,tech!$D$21,\"\"))","v":2},{"$f":"IF(G34=$M$11,tech!$D$23,IF(I34=$M$11,tech!$D$21,\"\"))","v":""},{"$f":"IF(G34=$N$11,tech!$D$23,IF(I34=$N$11,tech!$D$21,\"\"))","v":""}]
[]
[null,"2. Define your own action plans for each category to the dedicated boxes below."]
[]
[{"$f":"IF(OR($F$38=0,$F$38=\"\"),0,1)","v":0},{"$f":"IFERROR(INDEX(_xlfn._xlws.FILTER($P$14:$P$28,$Q$14:$Q$28=1,\"\"),O14),0)","v":""},{"$nulls":3},{"$f":"LEFT(B38,1)","v":""}]
[{"$f":"IF(OR($F$38=0,$F$38=\"\"),0,1)","v":0},"Objectives"]
[0,"Responsibility"]
[0,"Schedule"]
[0,"Resources"]
[0,"Outputs"]
[0,"Tasks"]
[0,"Comments"]
[]
[{"$f":"IF(OR($F$47=\"0\",$F$47=\"\"),0,1)","v":0},{"$f":"IFERROR(INDEX(_xlfn._xlws.FILTER($P$14:$P$28,$Q$14:$Q$28=1,\"\"),O15),0)","v":0},{"$nulls":3},{"$f":"LEFT(B47,1)","v":"0"}]
[{"$f":"IF(OR($F$47=\"0\",$F$47=\"\"),0,1)","v":0},"Objectives"]
[0,"Responsibility"]
[0,"Schedule"]
[0,"Resources"]
[0,"Outputs"]
[0,"Tasks"]
[0,"Comments"]
[]
[{"$f":"IF(OR($F$56=\"0\",$F$56=\"\"),0,1)","v":0},{"$f":"IFERROR(INDEX(_xlfn._xlws.FILTER($P$14:$P$28,$Q$14:$Q$28=1,\"\"),O16),0)","v":0},{"$nulls":3},{"$f":"LEFT(B56,1)","v":"0"}]
[{"$f":"IF(OR($F$56=\"0\",$F$56=\"\"),0,1)","v":0},"Objectives"]
[0,"Responsibility"]
[0,"Schedule"]
[0,"Resources"]
[0,"Outputs"]
[0,"Tasks"]
[0,"Comments"]
[]
[{"$f":"IF(OR($F$65=\"0\",$F$65=\"\"),0,1)","v":0},{"$f":"IFERROR(INDEX(_xlfn._xlws.FILTER($P$14:$P$28,$Q$14:$Q$28=1,\"\"),O17),0)","v":0},{"$nulls":3},{"$f":"LEFT(B65,1)","v":"0"}]
[{"$f":"IF(OR($F$65=\"0\",$F$65=\"\"),0,1)","v":0},"Objectives"]
[0,"Responsibility"]
[0,"Schedule"]
[0,"Resources"]
[0,"Outputs"]
[0,"Tasks"]
[0,"Comments"]
[]
[{"$f":"IF(OR($F$74=\"0\",$F$74=\"\"),0,1)","v":0},{"$f":"IFERROR(INDEX(_xlfn._xlws.FILTER($P$14:$P$28,$Q$14:$Q$28=1,\"\"),O18),0)","v":0},{"$nulls":3},{"$f":"LEFT(B74,1)","v":"0"}]
[{"$f":"IF(OR($F$74=\"0\",$F$74=\"\"),0,1)","v":0},"Objectives"]
[0,"Responsibility"]
[0,"Schedule"]
[0,"Resources"]
[0,"Outputs"]
[0,"Tasks"]
[0,"Comments"]
[]
[{"$f":"IF(OR($F$83=\"0\",$F$83=\"\"),0,1)","v":0},{"$f":"IFERROR(INDEX(_xlfn._xlws.FILTER($P$14:$P$28,$Q$14:$Q$28=1,\"\"),O19),0)","v":0},{"$nulls":3},{"$f":"LEFT(B83,1)","v":"0"}]
[{"$f":"IF(OR($F$83=\"0\",$F$83=\"\"),0,1)","v":0},"Objectives"]
[0,"Responsibility"]
[0,"Schedule"]
[0,"Resources"]
[0,"Outputs"]
[0,"Tasks"]
[0,"Comments"]
[]
[{"$f":"IF(OR($F$92=\"0\",$F$92=\"\"),0,1)","v":0},{"$f":"IFERROR(INDEX(_xlfn._xlws.FILTER($P$14:$P$28,$Q$14:$Q$28=1,\"\"),O20),0)","v":0},{"$nulls":3},{"$f":"LEFT(B92,1)","v":"0"}]
[{"$f":"IF(OR($F$92=\"0\",$F$92=\"\"),0,1)","v":0},"Objectives"]
[0,"Responsibility"]
[0,"Schedule"]
[0,"Resources"]
[0,"Outputs"]
[0,"Tasks"]
[0,"Comments"]
[]
[{"$f":"IF(OR($F$101=\"0\",$F$101=\"\"),0,1)","v":0},{"$f":"IFERROR(INDEX(_xlfn._xlws.FILTER($P$14:$P$28,$Q$14:$Q$28=1,\"\"),O21),0)","v":0},{"$nulls":3},{"$f":"LEFT(B101,1)","v":"0"}]
[{"$f":"IF(OR($F$101=\"0\",$F$101=\"\"),0,1)","v":0},"Objectives"]
[0,"Responsibility"]
[0,"Schedule"]
[0,"Resources"]
[0,"Outputs"]
[0,"Tasks"]
[0,"Comments"]
[]
[{"$f":"IF(OR($F$110=\"0\",$F$110=\"\"),0,1)","v":0},{"$f":"IFERROR(INDEX(_xlfn._xlws.FILTER($P$14:$P$28,$Q$14:$Q$28=1,\"\"),O22),0)","v":0},{"$nulls":3},{"$f":"LEFT(B110,1)","v":"0"}]
[{"$f":"IF(OR($F$110=\"0\",$F$110=\"\"),0,1)","v":0},"Objectives"]
[0,"Responsibility"]
[0,"Schedule"]
[0,"Resources"]
[0,"Outputs"]
[0,"Tasks"]
[0,"Comments"]
[]
[{"$f":"IF(OR($F$119=\"0\",$F$119=\"\"),0,1)","v":0},{"$f":"IFERROR(INDEX(_xlfn._xlws.FILTER($P$14:$P$28,$Q$14:$Q$28=1,\"\"),O23),0)","v":0},{"$nulls":3},{"$f":"LEFT(B119,1)","v":"0"}]
[{"$f":"IF(OR($F$119=\"0\",$F$119=\"\"),0,1)","v":0},"Objectives"]
[0,"Responsibility"]
[0,"Schedule"]
[0,"Resources"]
[0,"Outputs"]
[0,"Tasks"]
[0,"Comments"]
[]
[{"$f":"IF(OR($F$128=\"0\",$F$128=\"\"),0,1)","v":0},{"$f":"IFERROR(INDEX(_xlfn._xlws.FILTER($P$14:$P$28,$Q$14:$Q$28=1,\"\"),O24),0)","v":0},{"$nulls":3},{"$f":"LEFT(B128,1)","v":"0"}]
[{"$f":"IF(OR($F$128=\"0\",$F$128=\"\"),0,1)","v":0},"Objectives"]
[0,"Responsibility"]
[0,"Schedule"]
[0,"Resources"]
[0,"Outputs"]
[0,"Tasks"]
[0,"Comments"]
[]
[{"$f":"IF(OR($F$137=\"0\",$F$137=\"\"),0,1)","v":0},{"$f":"IFERROR(INDEX(_xlfn._xlws.FILTER($P$14:$P$28,$Q$14:$Q$28=1,\"\"),O25),0)","v":0},{"$nulls":3},{"$f":"LEFT(B137,1)","v":"0"}]
[{"$f":"IF(OR($F$137=\"0\",$F$137=\"\"),0,1)","v":0},"Objectives"]
[0,"Responsibility"]
[0,"Schedule"]
[0,"Resources"]
[0,"Outputs"]
[0,"Tasks"]
[0,"Comments"]
[]
[{"$f":"IF(OR($F$146=\"0\",$F$146=\"\"),0,1)","v":0},{"$f":"IFERROR(INDEX(_xlfn._xlws.FILTER($P$14:$P$28,$Q$14:$Q$28=1,\"\"),O26),0)","v":0},{"$nulls":3},{"$f":"LEFT(B146,1)","v":"0"}]
[{"$f":"IF(OR($F$146=\"0\",$F$146=\"\"),0,1)","v":0},"Objectives"]
[0,"Responsibility"]
[0,"Schedule"]
[0,"Resources"]
[0,"Outputs"]
[0,"Tasks"]
[0,"Comments"]
[]
[{"$f":"IF(OR($F$155=\"0\",$F$155=\"\"),0,1)","v":0},{"$f":"IFERROR(INDEX(_xlfn._xlws.FILTER($P$14:$P$28,$Q$14:$Q$28=1,\"\"),O27),0)","v":0},{"$nulls":3},{"$f":"LEFT(B155,1)","v":"0"}]
[{"$f":"IF(OR($F$155=\"0\",$F$155=\"\"),0,1)","v":0},"Objectives"]
[0,"Responsibility"]
[0,"Schedule"]
[0,"Resources"]
[0,"Outputs"]
[0,"Tasks"]
[0,"Comments"]
[]
[{"$f":"IF(OR($F$164=\"0\",$F$164=\"\"),0,1)","v":0},{"$f":"IFERROR(INDEX(_xlfn._xlws.FILTER($P$14:$P$28,$Q$14:$Q$28=1,\"\"),O28),0)","v":0},{"$nulls":3},{"$f":"LEFT(B164,1)","v":"0"}]
[{"$f":"IF(OR($F$164=\"0\",$F$164=\"\"),0,1)","v":0},"Objectives"]
[0,"Responsibility"]
[0,"Schedule"]
[0,"Resources"]
[0,"Outputs"]
[0,"Tasks"]
[0,"Comments"]

{"sheet":"©","index":10,"n_rows":3,"n_cols":3,"rows_kept":3}
[]
[]
[null,null,"This PKI maturity assessment tool is licensed under the Creative Commons Attribution 4.0 International (CC BY 4.0)."]

{"sheet":"RepoData","index":11,"n_rows":84,"n_cols":17,"rows_kept":84,"hidden":true}
[]
["Date","Beginning of the assessment",{"$f":"Overview!D7","v":"2023-05-02"}]
["Date","Target date",{"$f":"Overview!$D$8","v":"2023-06-26"}]
["Date","Real finish of the assessment","2023-06-15"]
["Date",{"$f":"IF(C3>C4,\"Lead of\",\"Delay of\")","v":"Lead of"},{"$f":"IF(C3>C4,C3-C4,C4-C3)","v":11}]
["Assessor","Position",{"$f":"Overview!L5","v":"Internal"}]
["Assessor","Company",{"$f":"Overview!L6","v":"3Key Company"}]
["Assessor","Name",{"$f":"Overview!L7","v":"Franta Hrábě"}]
["PKImodel","Name"]
["PKImodel","Version"]
["Scope","Applicable_count",{"$f":"COUNTIF(tech!C29:C114,1)","v":72},{"$f":"SUM(Evaluation!H10:M11)","v":72}]
["Scope","N/A_count",{"$f":"COUNTIF(tech!C29:C114,0)","v":0},{"$f":"Evaluation!G10","v":""}]
["Scope","Total",{"$f":"SUM(C11:C12)","v":72},{"$f":"SUM(D11:D12)","v":72},{"$f":"C13-D13","v":0}]
["Use-case","Description"]
["Use-case","Components"]
["Use-case","Out-of-scope considerations"]
["PKI environment","Highlevel design"]
["PKI environment","Points of interaction"]
["Achievement","Level",{"$f":"Evaluation!F10","v":"Basic"}]
["Achievement","Description"]
["Chart","Category","Maturity level of Categories",{"$nulls":11},"Category","Maturity level of Categories"]
["Chart",{"$f":"IF(Scoping!F10=tech!A5,\"\",Assessment!$C$12)","v":"1.1. Strategy and vision"},{"$f":"Assessment!N13","v":1},{"$f":"Assessment!$N$9","v":2},{"$nulls":10},{"$f":"_xlfn._xlws.FILTER(B22:C36,B22:B36<>\"\",\"\")","v":"1.1. Strategy and vision"},1]
["Chart",{"$f":"IF(Scoping!F16=tech!A5,\"\",Assessment!C23)","v":"1.2. Policies and documentation"},{"$f":"Assessment!N24","v":2},{"$f":"Assessment!$N$9","v":2},{"$nulls":10},"1.2. Policies and documentation",2]
["Chart",{"$f":"IF(Scoping!F22=tech!A5,\"\",Assessment!C34)","v":"1.3. Compliance"},{"$f":"Assessment!N35","v":2},{"$f":"Assessment!$N$9","v":2},{"$nulls":10},"1.3. Compliance",2]
["Chart",{"$f":"IF(Scoping!F28=tech!A5,\"\",Assessment!C45)","v":"1.4. Processes and procedures"},{"$f":"Assessment!N46","v":3},{"$f":"Assessment!$N$9","v":2},{"$nulls":10},"1.4. Processes and procedures",3]
["Chart",{"$f":"IF(Scoping!F34=tech!A5,\"\",Assessment!C61)","v":"2.1. Key Management"},{"$f":"Assessment!N62","v":3},{"$f":"Assessment!$N$58","v":2},{"$nulls":10},"2.1. Key Management",3]
["Chart",{"$f":"IF(Scoping!F40=tech!A5,\"\",Assessment!C72)","v":"2.2. Certificate Management"},{"$f":"Assessment!N73","v":2},{"$f":"Assessment!$N$58","v":2},{"$nulls":10},"2.2. Certificate Management",2]
["Chart",{"$f":"IF(Scoping!F47=tech!A5,\"\",Assessment!C84)","v":"2.3. Infrastructure Management"},{"$f":"Assessment!N85","v":3},{"$f":"Assessment!$N$58","v":2},{"$nulls":10},"2.3. Infrastructure Management",3]
["Chart",{"$f":"IF(Scoping!F53=tech!A5,\"\",Assessment!C95)","v":"2.4. Change Management and Agility"},{"$f":"Assessment!N96","v":2},{"$f":"Assessment!$N$58","v":2},{"$nulls":10},"2.4. Change Management and Agility",2]
["Chart",{"$f":"IF(Scoping!F59=tech!A5,\"\",Assessment!C111)","v":"3.1. Resilience"},{"$f":"Assessment!N112","v":3},{"$f":"Assessment!$N$108","v":3},{"$nulls":10},"3.1. Resilience",3]
["Chart",{"$f":"IF(Scoping!F65=tech!A5,\"\",Assessment!C122)","v":"3.2. Interoperability"},{"$f":"Assessment!N123","v":3},{"$f":"Assessment!$N$108","v":3},{"$nulls":10},"3.2. Interoperability",3]
["Chart",{"$f":"IF(Scoping!F71=tech!A5,\"\",Assessment!C133)","v":"3.3. Monitoring and Auditing"},{"$f":"Assessment!N134","v":3},{"$f":"Assessment!$N$108","v":3},{"$nulls":10},"3.3. Monitoring and Auditing",3]
["Chart",{"$f":"IF(Scoping!F77=tech!A5,\"\",Assessment!C144)","v":"3.4. Automation"},{"$f":"Assessment!N145","v":2},{"$f":"Assessment!$N$108","v":3},{"$nulls":10},"3.4. Automation",2]
["Chart",{"$f":"IF(Scoping!F83=tech!A5,\"\",Assessment!C160)","v":"4.1. Sourcing"},{"$f":"Assessment!N161","v":3},{"$f":"Assessment!$N$157","v":3},{"$nulls":10},"4.1. Sourcing",3]
["Chart",{"$f":"IF(Scoping!F87=tech!A5,\"\",Assessment!C169)","v":"4.2. Knowledge and Training"},{"$f":"IF(B35=\"\",\"\",Assessment!N170)","v":4},{"$f":"Assessment!$N$157","v":3},{"$nulls":10},"4.2. Knowledge and Training",4]
["Chart",{"$f":"IF(Scoping!F92=tech!A5,\"\",Assessment!C179)","v":"4.3. Awareness"},{"$f":"Assessment!N180","v":3},{"$f":"Assessment!$N$157","v":3},{"$nulls":10},"4.3. Awareness",3]
["Chart"]
["Chart"]
["Chart"]
["Chart"]
[]
[]
[null,"Category","Maturity level of Modules",{"$nulls":11},"Category","Maturity level of Categories","Maturity level of Modules"]
[null,{"$f":"Assessment!C8","v":"1. Governance"},{"$f":"Assessment!N9","v":2},{"$nulls":11},{"$f":"_xlfn._xlws.FILTER(B22:D36,B22:B36<>\"\",\"\")","v":"1.1. Strategy and vision"},1,2]
[null,{"$f":"Assessment!C57","v":"2. Management"},{"$f":"Assessment!N58","v":2},{"$nulls":11},"1.2. Policies and documentation",2,2]
[null,{"$f":"Assessment!C107","v":"3. Operations"},{"$f":"Assessment!N108","v":3},{"$nulls":11},"1.3. Compliance",2,2]
[null,{"$f":"Assessment!C156","v":"4. Resources"},{"$f":"Assessment!N157","v":3},{"$nulls":11},"1.4. Processes and procedures",3,2]
[{"$nulls":14},"2.1. Key Management",3,2]
[{"$nulls":14},"2.2. Certificate Management",2,2]
[{"$nulls":14},"2.3. Infrastructure Management",3,2]
[{"$nulls":14},"2.4. Change Management and Agility",2,2]
[{"$nulls":14},"3.1. Resilience",3,3]
[{"$nulls":14},"3.2. Interoperability",3,3]
[{"$nulls":14},"3.3. Monitoring and Auditing",3,3]
[{"$nulls":14},"3.4. Automation",2,3]
[{"$nulls":14},"4.1. Sourcing",3,3]
[{"$nulls":14},"4.2. Knowledge and Training",4,3]
[{"$nulls":14},"4.3. Awareness",3,3]
{"$rows_empty":10}
[null,"Category","Maturity level of Categories","Maturity level of Modules"]
[null,"1.1. Strategy and vision",2,2]
[null,"1.2. Policies and documentation",2,2]
[null,"1.3. Compliance",2,2]
[null,"1.4. Processes and procedures",3,2]
[null,"2.1. Key Management",2,2]
[null,"2.2. Certificate Management",2,2]
[null,"2.3. Infrastructure Management",3,2]
[null,"2.4. Change Management and Agility",2,2]
[null,"3.1. Resilience",3,3]
[null,"3.2. Interoperability",3,3]
[null,"3.3. Monitoring and Auditing",3,3]
[null,"3.4. Automation",2,3]
[null,"4.1. Sourcing",5,4]
[null,"4.2. Knowledge and Training",4,4]
[null,"4.3. Awareness",3,4]

{"sheet":"tech","index":12,"n_rows":325,"n_cols":11,"rows_kept":325,"hidden":true}
[]
[{"$nulls":5},"✔ ","➤","•"]
["Scope",null,null,"#","Maturity level","Indicators","Associated risks","Description"]
["IN",null,null,1,"Initial",{"$f":"_xlfn.TEXTJOIN(CHAR(10),,_xlfn._xlws.FILTER(source!G15:G161,source!F15:F161=\"1IY\",\"\"))","v":"• PKI is ad-hoc managed, reactive\n• There are minimum processes and procedures, which are typically not followed and\n• There is no approach how to address certificate related issues\n• PKI does not take into account any industry standards or regulations\n• Insufficient resources and knowledge"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),,_xlfn._xlws.FILTER(source!G15:G161,source!F15:F161=\"1AY\",\"\"))","v":"• High probability of compromise\n• High probability of operational issues\n• no trust"},{"$f":"INDEX(source!$G$4:$G$13,tech!D4)","v":"Unpredictable process with poor control and always reactive"},null,null,{"$f":"E4","v":"Initial"}]
["OUT OF",null,null,2,"Basic",{"$f":"_xlfn.TEXTJOIN(CHAR(10),,_xlfn._xlws.FILTER(source!G15:G161,source!F15:F161=\"2IY\",\"\"))","v":"• PKI is ad-hoc managed, often reactive\n• There are defined processes and procedures which are followed\n• PKI is not managed according to industry standards and regulations\n• Insufficient knowledge"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),,_xlfn._xlws.FILTER(source!G15:G161,source!F15:F161=\"2AY\",\"\"))","v":"• High probability of operational issues\n• Medium probability of compromise\n• no trust"},{"$f":"INDEX(source!$G$4:$G$13,tech!D5)","v":"Process is characterized by each particular case or project and controls are often reactive"},null,null,{"$f":"E5","v":"Basic"}]
[{"$nulls":3},3,"Advanced",{"$f":"_xlfn.TEXTJOIN(CHAR(10),,_xlfn._xlws.FILTER(source!G15:G161,source!F15:F161=\"3IY\",\"\"))","v":"• certificate services are not consistently managed\n• procedures are defined and followed\n• CP and CPS partially exist but not followed\n• partially available resources and knowledge"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),,_xlfn._xlws.FILTER(source!G15:G161,source!F15:F161=\"3AY\",\"\"))","v":"• Medium probability of operational issues\n• Low probability of compromise"},{"$f":"INDEX(source!$G$4:$G$13,tech!D6)","v":"Process is characterized by organizational standards and controls are proactive"},null,null,"Advanced"]
["Applicability",null,null,4,"Managed",{"$f":"_xlfn.TEXTJOIN(CHAR(10),,_xlfn._xlws.FILTER(source!G15:G161,source!F15:F161=\"4IY\",\"\"))","v":"• PKI is consistently managed\n• Well defined CP and CPS for provided services\n• available skilled resources\n• Documented processes and procedures to manage certificates and related keys\n• Inconsistent approach to certificate related activities"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),,_xlfn._xlws.FILTER(source!G15:G161,source!F15:F161=\"4AY\",\"\"))","v":"• Low probability of operational issues\n• Low probability of compromise and loosing trust"},{"$f":"INDEX(source!$G$4:$G$13,tech!D7)","v":"Processes are measured and controlled, proactive approach"},null,null,"Managed"]
["Applicable",null,null,5,"Optimized",{"$f":"_xlfn.TEXTJOIN(CHAR(10),,_xlfn._xlws.FILTER(source!G15:G161,source!F15:F161=\"5IY\",\"\"))","v":"• Well-defined CP and CPS\n• Effective procedures for certificate management exist and are followed\n• resources with knowledge and experience available\n• Consistent PKI with alignment to current practice and regulation\n• Future proof"},{"$f":"_xlfn.TEXTJOIN(CHAR(10),,_xlfn._xlws.FILTER(source!G15:G161,source!F15:F161=\"5AY\",\"\"))","v":"• Minimal probability of operational issues\n• Minimal probability of compromise and loosing trust"},{"$f":"INDEX(source!$G$4:$G$13,tech!D8)","v":"Continuous improvement of the processes and procedures, proactive approach for future technology improvement"},null,null,"Optimized"]
["Not Applicable","N/A"]
["Partially Applicable",{"$nulls":5},"Target date warning",30]
[]
["Scoring"]
["Initial",1]
["Basic",2]
["Advanced",3]
["Managed",4]
["Optimized",5]
["N/A",0]
[]
["Levels"]
[0,"Not evaluated",null,0]
[1,"Initial",null,1]
[2,"Basic",null,2]
[3,"Advanced"]
[4,"Managed"]
[5,"Optimized"]
[]
["Req","Weight","Applicability","Req."]
["1.1.1.",{"$f":"IFERROR(VLOOKUP(A29,source!$J$4:$L$13,2,0),\"\")","v":"3"},{"$f":"IF(B29=\"\",9,Scoping!H10)","v":1},{"$f":"A29","v":"1.1.1."}]
["1.1.2.",{"$f":"IFERROR(VLOOKUP(A30,source!$J$4:$L$13,2,0),\"\")","v":"2"},{"$f":"IF(B30=\"\",9,Scoping!H11)","v":1},{"$f":"A30","v":"1.1.2."}]
["1.1.3.",{"$f":"IFERROR(VLOOKUP(A31,source!$J$4:$L$13,2,0),\"\")","v":"2"},{"$f":"IF(B31=\"\",9,Scoping!H12)","v":1},"1.1.3."]
["1.1.4.",{"$f":"IFERROR(VLOOKUP(A32,source!$J$4:$L$13,2,0),\"\")","v":"1"},{"$f":"IF(B32=\"\",9,Scoping!H13)","v":1},"1.1.4."]
["1.1.5.",{"$f":"IFERROR(VLOOKUP(A33,source!$J$4:$L$13,2,0),\"\")","v":""},{"$f":"IF(B33=\"\",9,Scoping!H14)","v":9},"1.1.5."]
["1.1.6.",{"$f":"IFERROR(VLOOKUP(A34,source!$J$4:$L$13,2,0),\"\")","v":""},{"$f":"IF(B34=\"\",9,Scoping!H15)","v":9},"1.1.6."]
["1.2.1.",{"$f":"IFERROR(VLOOKUP(A35,source!$P$4:$R$13,2,0),\"\")","v":"2"},{"$f":"IF(B35=\"\",9,Scoping!H16)","v":1},"1.2.1."]
["1.2.2.",{"$f":"IFERROR(VLOOKUP(A36,source!$P$4:$R$13,2,0),\"\")","v":"5"},{"$f":"IF(B36=\"\",9,Scoping!H17)","v":1},"1.2.2."]
["1.2.3.",{"$f":"IFERROR(VLOOKUP(A37,source!$P$4:$R$13,2,0),\"\")","v":"5"},{"$f":"IF(B37=\"\",9,Scoping!H18)","v":1},"1.2.3."]
["1.2.4.",{"$f":"IFERROR(VLOOKUP(A38,source!$P$4:$R$13,2,0),\"\")","v":"4"},{"$f":"IF(B38=\"\",9,Scoping!H19)","v":1},"1.2.4."]
["1.2.5.",{"$f":"IFERROR(VLOOKUP(A39,source!$P$4:$R$13,2,0),\"\")","v":"3"},{"$f":"IF(B39=\"\",9,Scoping!H20)","v":1},"1.2.5."]
["1.2.6.",{"$f":"IFERROR(VLOOKUP(A40,source!$P$4:$R$13,2,0),\"\")","v":""},{"$f":"IF(B40=\"\",9,Scoping!H21)","v":9},"1.2.6."]
["1.3.1.",{"$f":"IFERROR(VLOOKUP(A41,source!$V$4:$X$13,2,0),\"\")","v":"3"},{"$f":"IF(B41=\"\",9,Scoping!H22)","v":1},"1.3.1."]
["1.3.2.",{"$f":"IFERROR(VLOOKUP(A42,source!$V$4:$X$13,2,0),\"\")","v":"4"},{"$f":"IF(B42=\"\",9,Scoping!H23)","v":1},"1.3.2."]
["1.3.3.",{"$f":"IFERROR(VLOOKUP(A43,source!$V$4:$X$13,2,0),\"\")","v":"3"},{"$f":"IF(B43=\"\",9,Scoping!H24)","v":1},"1.3.3."]
["1.3.4.",{"$f":"IFERROR(VLOOKUP(A44,source!$V$4:$X$13,2,0),\"\")","v":"5"},{"$f":"IF(B44=\"\",9,Scoping!H25)","v":1},"1.3.4."]
["1.3.5.",{"$f":"IFERROR(VLOOKUP(A45,source!$V$4:$X$13,2,0),\"\")","v":""},{"$f":"IF(B45=\"\",9,Scoping!H26)","v":9},"1.3.5."]
["1.3.6.",{"$f":"IFERROR(VLOOKUP(A46,source!$V$4:$X$13,2,0),\"\")","v":""},{"$f":"IF(B46=\"\",9,Scoping!H27)","v":9},"1.3.6."]
["1.4.1.",{"$f":"IFERROR(VLOOKUP(A47,source!$AB$4:$AD$13,2,0),\"\")","v":"4"},{"$f":"IF(B47=\"\",9,Scoping!H28)","v":1},"1.4.1."]
["1.4.2.",{"$f":"IFERROR(VLOOKUP(A48,source!$AB$4:$AD$13,2,0),\"\")","v":"3"},{"$f":"IF(B48=\"\",9,Scoping!H29)","v":1},"1.4.2."]
["1.4.3.",{"$f":"IFERROR(VLOOKUP(A49,source!$AB$4:$AD$13,2,0),\"\")","v":"5"},{"$f":"IF(B49=\"\",9,Scoping!H30)","v":1},"1.4.3."]
["1.4.4.",{"$f":"IFERROR(VLOOKUP(A50,source!$AB$4:$AD$13,2,0),\"\")","v":"3"},{"$f":"IF(B50=\"\",9,Scoping!H31)","v":1},"1.4.4."]
["1.4.5.",{"$f":"IFERROR(VLOOKUP(A51,source!$AB$4:$AD$13,2,0),\"\")","v":"2"},{"$f":"IF(B51=\"\",9,Scoping!H32)","v":1},"1.4.5."]
["1.4.6.",{"$f":"IFERROR(VLOOKUP(A52,source!$AB$4:$AD$13,2,0),\"\")","v":""},{"$f":"IF(B52=\"\",9,Scoping!H33)","v":9},"1.4.6."]
["2.1.1.",{"$f":"IFERROR(VLOOKUP(A53,source!$AH$4:$AJ$13,2,0),\"\")","v":"2"},{"$f":"IF(B53=\"\",9,Scoping!H34)","v":1},"2.1.1."]
["2.1.2.",{"$f":"IFERROR(VLOOKUP(A54,source!$AH$4:$AJ$13,2,0),\"\")","v":"2"},{"$f":"IF(B54=\"\",9,Scoping!H35)","v":1},"2.1.2."]
["2.1.3.",{"$f":"IFERROR(VLOOKUP(A55,source!$AH$4:$AJ$13,2,0),\"\")","v":"1"},{"$f":"IF(B55=\"\",9,Scoping!H36)","v":1},"2.1.3."]
["2.1.4.",{"$f":"IFERROR(VLOOKUP(A56,source!$AH$4:$AJ$13,2,0),\"\")","v":"2"},{"$f":"IF(B56=\"\",9,Scoping!H37)","v":1},"2.1.4."]
["2.1.5.",{"$f":"IFERROR(VLOOKUP(A57,source!$AH$4:$AJ$13,2,0),\"\")","v":"2"},{"$f":"IF(B57=\"\",9,Scoping!H38)","v":1},"2.1.5."]
["2.1.6.",{"$f":"IFERROR(VLOOKUP(A58,source!$AH$4:$AJ$13,2,0),\"\")","v":"3"},{"$f":"IF(B58=\"\",9,Scoping!H39)","v":1},"2.1.6."]
["2.2.1.",{"$f":"IFERROR(VLOOKUP(A59,source!$AN$4:$AP$13,2,0),\"\")","v":"2"},{"$f":"IF(B59=\"\",9,Scoping!H40)","v":1},"2.2.1."]
["2.2.2.",{"$f":"IFERROR(VLOOKUP(A60,source!$AN$4:$AP$13,2,0),\"\")","v":"3"},{"$f":"IF(B60=\"\",9,Scoping!H41)","v":1},"2.2.2."]
["2.2.3.",{"$f":"IFERROR(VLOOKUP(A61,source!$AN$4:$AP$13,2,0),\"\")","v":"4"},{"$f":"IF(B61=\"\",9,Scoping!H42)","v":1},"2.2.3."]
["2.2.4.",{"$f":"IFERROR(VLOOKUP(A62,source!$AN$4:$AP$13,2,0),\"\")","v":"3"},{"$f":"IF(B62=\"\",9,Scoping!H43)","v":1},"2.2.4."]
["2.2.5.",{"$f":"IFERROR(VLOOKUP(A63,source!$AN$4:$AP$13,2,0),\"\")","v":"2"},{"$f":"IF(B63=\"\",9,Scoping!H44)","v":1},"2.2.5."]
["2.2.6.",{"$f":"IFERROR(VLOOKUP(A64,source!$AN$4:$AP$13,2,0),\"\")","v":"4"},{"$f":"IF(B64=\"\",9,Scoping!H45)","v":1},"2.2.6."]
["2.2.7.",{"$f":"IFERROR(VLOOKUP(A65,source!$AN$4:$AP$13,2,0),\"\")","v":"2"},{"$f":"IF(B65=\"\",9,Scoping!H46)","v":1},"2.2.7."]
["2.3.1.",{"$f":"IFERROR(VLOOKUP(A66,source!$AT$4:$AV$13,2,0),\"\")","v":"4"},{"$f":"IF(B66=\"\",9,Scoping!H47)","v":1},"2.3.1."]
["2.3.2.",{"$f":"IFERROR(VLOOKUP(A67,source!$AT$4:$AV$13,2,0),\"\")","v":"3"},{"$f":"IF(B67=\"\",9,Scoping!H48)","v":1},"2.3.2."]
["2.3.3.",{"$f":"IFERROR(VLOOKUP(A68,source!$AT$4:$AV$13,2,0),\"\")","v":"3"},{"$f":"IF(B68=\"\",9,Scoping!H49)","v":1},"2.3.3."]
["2.3.4.",{"$f":"IFERROR(VLOOKUP(A69,source!$AT$4:$AV$13,2,0),\"\")","v":"1"},{"$f":"IF(B69=\"\",9,Scoping!H50)","v":1},"2.3.4."]
["2.3.5.",{"$f":"IFERROR(VLOOKUP(A70,source!$AT$4:$AV$13,2,0),\"\")","v":"2"},{"$f":"IF(B70=\"\",9,Scoping!H51)","v":1},"2.3.5."]
["2.3.6.",{"$f":"IFERROR(VLOOKUP(A71,source!$AT$4:$AV$13,2,0),\"\")","v":""},{"$f":"IF(B71=\"\",9,Scoping!H52)","v":9},"2.3.6."]
["2.4.1.",{"$f":"IFERROR(VLOOKUP(A72,source!$AZ$4:$BB$13,2,0),\"\")","v":"4"},{"$f":"IF(B72=\"\",9,Scoping!H53)","v":1},"2.4.1."]
["2.4.2.",{"$f":"IFERROR(VLOOKUP(A73,source!$AZ$4:$BB$13,2,0),\"\")","v":"3"},{"$f":"IF(B73=\"\",9,Scoping!H54)","v":1},"2.4.2."]
["2.4.3.",{"$f":"IFERROR(VLOOKUP(A74,source!$AZ$4:$BB$13,2,0),\"\")","v":"4"},{"$f":"IF(B74=\"\",9,Scoping!H55)","v":1},"2.4.3."]
["2.4.4.",{"$f":"IFERROR(VLOOKUP(A75,source!$AZ$4:$BB$13,2,0),\"\")","v":"2"},{"$f":"IF(B75=\"\",9,Scoping!H56)","v":1},"2.4.4."]
["2.4.5.",{"$f":"IFERROR(VLOOKUP(A76,source!$AZ$4:$BB$13,2,0),\"\")","v":"2"},{"$f":"IF(B76=\"\",9,Scoping!H57)","v":1},"2.4.5."]
["2.4.6.",{"$f":"IFERROR(VLOOKUP(A77,source!$AZ$4:$BB$13,2,0),\"\")","v":""},{"$f":"IF(B77=\"\",9,Scoping!H58)","v":9},"2.4.6."]
["3.1.1.",{"$f":"IFERROR(VLOOKUP(A78,source!$BF$4:$BH$13,2,0),\"\")","v":"6"},{"$f":"IF(B78=\"\",9,Scoping!H59)","v":1},"3.1.1."]
["3.1.2.",{"$f":"IFERROR(VLOOKUP(A79,source!$BF$4:$BH$13,2,0),\"\")","v":"4"},{"$f":"IF(B79=\"\",9,Scoping!H60)","v":1},"3.1.2."]
["3.1.3.",{"$f":"IFERROR(VLOOKUP(A80,source!$BF$4:$BH$13,2,0),\"\")","v":"5"},{"$f":"IF(B80=\"\",9,Scoping!H61)","v":1},"3.1.3."]
["3.1.4.",{"$f":"IFERROR(VLOOKUP(A81,source!$BF$4:$BH$13,2,0),\"\")","v":"3"},{"$f":"IF(B81=\"\",9,Scoping!H62)","v":1},"3.1.4."]
["3.1.5.",{"$f":"IFERROR(VLOOKUP(A82,source!$BF$4:$BH$13,2,0),\"\")","v":"3"},{"$f":"IF(B82=\"\",9,Scoping!H63)","v":1},"3.1.5."]
["3.1.6.",{"$f":"IFERROR(VLOOKUP(A83,source!$BF$4:$BH$13,2,0),\"\")","v":"4"},{"$f":"IF(B83=\"\",9,Scoping!H64)","v":1},"3.1.6."]
["3.2.1.",{"$f":"IFERROR(VLOOKUP(A84,source!$BL$4:$BN$13,2,0),\"\")","v":"3"},{"$f":"IF(B84=\"\",9,Scoping!H65)","v":1},"3.2.1."]
["3.2.2.",{"$f":"IFERROR(VLOOKUP(A85,source!$BL$4:$BN$13,2,0),\"\")","v":"1"},{"$f":"IF(B85=\"\",9,Scoping!H66)","v":1},"3.2.2."]
["3.2.3.",{"$f":"IFERROR(VLOOKUP(A86,source!$BL$4:$BN$13,2,0),\"\")","v":"3"},{"$f":"IF(B86=\"\",9,Scoping!H67)","v":1},"3.2.3."]
["3.2.4.",{"$f":"IFERROR(VLOOKUP(A87,source!$BL$4:$BN$13,2,0),\"\")","v":""},{"$f":"IF(B87=\"\",9,Scoping!H68)","v":9},"3.2.4."]
["3.2.5.",{"$f":"IFERROR(VLOOKUP(A88,source!$BL$4:$BN$13,2,0),\"\")","v":""},{"$f":"IF(B88=\"\",9,Scoping!H69)","v":9},"3.2.5."]
["3.2.6.",{"$f":"IFERROR(VLOOKUP(A89,source!$BL$4:$BN$13,2,0),\"\")","v":""},{"$f":"IF(B89=\"\",9,Scoping!H70)","v":9},"3.2.6."]
["3.3.1.",{"$f":"IFERROR(VLOOKUP(A90,source!$BR$4:$BT$13,2,0),\"\")","v":"4"},{"$f":"IF(B90=\"\",9,Scoping!H71)","v":1},"3.3.1."]
["3.3.2.",{"$f":"IFERROR(VLOOKUP(A91,source!$BR$4:$BT$13,2,0),\"\")","v":"4"},{"$f":"IF(B91=\"\",9,Scoping!H72)","v":1},"3.3.2."]
["3.3.3.",{"$f":"IFERROR(VLOOKUP(A92,source!$BR$4:$BT$13,2,0),\"\")","v":"5"},{"$f":"IF(B92=\"\",9,Scoping!H73)","v":1},"3.3.3."]
["3.3.4.",{"$f":"IFERROR(VLOOKUP(A93,source!$BR$4:$BT$13,2,0),\"\")","v":"5"},{"$f":"IF(B93=\"\",9,Scoping!H74)","v":1},"3.3.4."]
["3.3.5.",{"$f":"IFERROR(VLOOKUP(A94,source!$BR$4:$BT$13,2,0),\"\")","v":"3"},{"$f":"IF(B94=\"\",9,Scoping!H75)","v":1},{"$f":"A94","v":"3.3.5."}]
["3.3.6.",{"$f":"IFERROR(VLOOKUP(A95,source!$BR$4:$BT$13,2,0),\"\")","v":"2"},{"$f":"IF(B95=\"\",9,Scoping!H76)","v":1},"3.3.6."]
["3.4.1.",{"$f":"IFERROR(VLOOKUP(A96,source!$BX$4:$BZ$13,2,0),\"\")","v":"3"},{"$f":"IF(B96=\"\",9,Scoping!H77)","v":1},"3.4.1."]
["3.4.2.",{"$f":"IFERROR(VLOOKUP(A97,source!$BX$4:$BZ$13,2,0),\"\")","v":"1"},{"$f":"IF(B97=\"\",9,Scoping!H78)","v":1},"3.4.2."]
["3.4.3.",{"$f":"IFERROR(VLOOKUP(A98,source!$BX$4:$BZ$13,2,0),\"\")","v":"1"},{"$f":"IF(B98=\"\",9,Scoping!H79)","v":1},"3.4.3."]
["3.4.4.",{"$f":"IFERROR(VLOOKUP(A99,source!$BX$4:$BZ$13,2,0),\"\")","v":""},{"$f":"IF(B99=\"\",9,Scoping!H80)","v":9},"3.4.4."]
["3.4.5.",{"$f":"IFERROR(VLOOKUP(A100,source!$BX$4:$BZ$13,2,0),\"\")","v":""},{"$f":"IF(B100=\"\",9,Scoping!H81)","v":9},"3.4.5."]
["3.4.6.",{"$f":"IFERROR(VLOOKUP(A101,source!$BX$4:$BZ$13,2,0),\"\")","v":""},{"$f":"IF(B101=\"\",9,Scoping!H82)","v":9},"3.4.6."]
["4.1.1.",{"$f":"IFERROR(VLOOKUP(A102,source!$CD$4:$CF$13,2,0),\"\")","v":"5"},{"$f":"IF(B102=\"\",9,Scoping!H83)","v":1},"4.1.1."]
["4.1.2.",{"$f":"IFERROR(VLOOKUP(A103,source!$CD$4:$CF$13,2,0),\"\")","v":"3"},{"$f":"IF(B103=\"\",9,Scoping!H84)","v":1},"4.1.2."]
["4.1.3.",{"$f":"IFERROR(VLOOKUP(A104,source!$CD$4:$CF$13,2,0),\"\")","v":"4"},{"$f":"IF(B104=\"\",9,Scoping!H85)","v":1},"4.1.3."]
["4.1.4.",{"$f":"IFERROR(VLOOKUP(A105,source!$CD$4:$CF$13,2,0),\"\")","v":"3"},{"$f":"IF(B105=\"\",9,Scoping!H86)","v":1},"4.1.4."]
["4.2.1.",{"$f":"IFERROR(VLOOKUP(A106,source!$CJ$4:$CL$13,2,0),\"\")","v":"2"},{"$f":"IF(B106=\"\",9,Scoping!H87)","v":1},"4.2.1."]
["4.2.2.",{"$f":"IFERROR(VLOOKUP(A107,source!$CJ$4:$CL$13,2,0),\"\")","v":"2"},{"$f":"IF(B107=\"\",9,Scoping!H88)","v":1},"4.2.2."]
["4.2.3.",{"$f":"IFERROR(VLOOKUP(A108,source!$CJ$4:$CL$13,2,0),\"\")","v":"2"},{"$f":"IF(B108=\"\",9,Scoping!H89)","v":1},"4.2.3."]
["4.2.4.",{"$f":"IFERROR(VLOOKUP(A109,source!$CJ$4:$CL$13,2,0),\"\")","v":"1"},{"$f":"IF(B109=\"\",9,Scoping!H90)","v":1},"4.2.4."]
["4.2.5.",{"$f":"IFERROR(VLOOKUP(A110,source!$CJ$4:$CL$13,2,0),\"\")","v":"2"},{"$f":"IF(B110=\"\",9,Scoping!H91)","v":1},"4.2.5."]
["4.3.1.",{"$f":"IFERROR(VLOOKUP(A111,source!$CP$4:$CR$13,2,0),\"\")","v":"2"},{"$f":"IF(B111=\"\",9,Scoping!H92)","v":1},"4.3.1."]
["4.3.2.",{"$f":"IFERROR(VLOOKUP(A112,source!$CP$4:$CR$13,2,0),\"\")","v":"2"},{"$f":"IF(B112=\"\",9,Scoping!H93)","v":1},"4.3.2."]
["4.3.3.",{"$f":"IFERROR(VLOOKUP(A113,source!$CP$4:$CR$13,2,0),\"\")","v":"1"},{"$f":"IF(B113=\"\",9,Scoping!H94)","v":1},"4.3.3."]
["4.3.4.",{"$f":"IFERROR(VLOOKUP(A114,source!$CP$4:$CR$13,2,0),\"\")","v":"2"},{"$f":"IF(B114=\"\",9,Scoping!H95)","v":1},"4.3.4."]
[]
["Weight categories"]
["1.1. Strategy and vision",{"$f":"VLOOKUP(E117,source!$CZ$4:$DA$18,2,0)","v":"5"},null,null,{"$f":"_xlfn.TEXTAFTER(A117,\" \")","v":"Strategy and vision"},{"$f":"LEFT(A117,4)","v":"1.1."}]
["1.2. Policies and documentation",{"$f":"VLOOKUP(E118,source!$CZ$4:$DA$18,2,0)","v":"4"},null,null,{"$f":"_xlfn.TEXTAFTER(A118,\" \")","v":"Policies and documentation"},{"$f":"LEFT(A118,4)","v":"1.2."}]
["1.3. Compliance",{"$f":"VLOOKUP(E119,source!$CZ$4:$DA$18,2,0)","v":"2"},null,null,"Compliance","1.3."]
["1.4. Processes and procedures",{"$f":"VLOOKUP(E120,source!$CZ$4:$DA$18,2,0)","v":"3"},null,null,"Processes and procedures","1.4."]
["2.1. Key Management",{"$f":"VLOOKUP(E121,source!$CZ$4:$DA$18,2,0)","v":"4"},null,null,"Key Management","2.1."]
["2.2. Certificate Management",{"$f":"VLOOKUP(E122,source!$CZ$4:$DA$18,2,0)","v":"4"},null,null,"Certificate Management","2.2."]
["2.3. Infrastructure Management",{"$f":"VLOOKUP(E123,source!$CZ$4:$DA$18,2,0)","v":"2"},null,null,"Infrastructure Management","2.3."]
["2.4. Change Management and Agility",{"$f":"VLOOKUP(E124,source!$CZ$4:$DA$18,2,0)","v":"3"},null,null,"Change Management and Agility","2.4."]
["3.1. Resilience",{"$f":"VLOOKUP(E125,source!$CZ$4:$DA$18,2,0)","v":"4"},null,null,"Resilience","3.1."]
["3.2. Interoperability",{"$f":"VLOOKUP(E126,source!$CZ$4:$DA$18,2,0)","v":"2"},null,null,"Interoperability","3.2."]
["3.3. Monitoring and Auditing",{"$f":"VLOOKUP(E127,source!$CZ$4:$DA$18,2,0)","v":"2"},null,null,"Monitoring and Auditing","3.3."]
["3.4. Automation",{"$f":"VLOOKUP(E128,source!$CZ$4:$DA$18,2,0)","v":"2"},null,null,"Automation","3.4."]
["4.1. Sourcing",{"$f":"VLOOKUP(E129,source!$CZ$4:$DA$18,2,0)","v":"4"},null,null,"Sourcing","4.1."]
["4.2. Knowledge and Training",{"$f":"VLOOKUP(E130,source!$CZ$4:$DA$18,2,0)","v":"3"},null,null,"Knowledge and Training","4.2."]
["4.3. Awareness",{"$f":"VLOOKUP(E131,source!$CZ$4:$DA$18,2,0)","v":"3"},null,null,"Awareness","4.3."]
[]
["Duration"]
["in advance","day"]
["late","days"]
[]
[]
["requirements"]
["assessment","#","req","cat","mod"]
[{"$f":"VLOOKUP(B140,Assessment!C16:O186,13,0)","v":"Initial"},{"$f":"Scoping!I10","v":"1.1.1."},{"$f":"Scoping!J10","v":"Organizational sponsor and support"}]
[{"$f":"VLOOKUP(B141,Assessment!C17:O187,13,0)","v":"Initial"},{"$f":"Scoping!I11","v":"1.1.2."},{"$f":"Scoping!J11","v":"Formal assignment of responsible leadership"}]
[{"$f":"VLOOKUP(B142,Assessment!C18:O188,13,0)","v":"Initial"},{"$f":"Scoping!I12","v":"1.1.3."},{"$f":"Scoping!J12","v":"Scope and business drivers for PKI"}]
[{"$f":"VLOOKUP(B143,Assessment!C19:O189,13,0)","v":"Initial"},{"$f":"Scoping!I13","v":"1.1.4."},{"$f":"Scoping!J13","v":"Architecture and design of the PKI"}]
[{"$f":"VLOOKUP(B144,Assessment!C20:O190,13,0)","v":""},{"$f":"Scoping!I14","v":"1.1.5."},{"$f":"Scoping!J14","v":""}]
[{"$f":"VLOOKUP(B145,Assessment!C21:O191,13,0)","v":""},{"$f":"Scoping!I15","v":"1.1.6."},{"$f":"Scoping!J15","v":""}]
[{"$f":"VLOOKUP(B146,Assessment!C22:O192,13,0)","v":"Basic"},{"$f":"Scoping!I16","v":"1.2.1."},{"$f":"Scoping!J16","v":"The scope of policies is defined and documented"}]
[{"$f":"VLOOKUP(B147,Assessment!C23:O193,13,0)","v":"Basic"},{"$f":"Scoping!I17","v":"1.2.2."},{"$f":"Scoping!J17","v":"Certificate Policy is documented and published"}]
[{"$f":"VLOOKUP(B148,Assessment!C24:O194,13,0)","v":"Basic"},{"$f":"Scoping!I18","v":"1.2.3."},{"$f":"Scoping!J18","v":"Certification Practice Statement is documented and published"}]
[{"$f":"VLOOKUP(B149,Assessment!C25:O195,13,0)","v":"Basic"},{"$f":"Scoping!I19","v":"1.2.4."},{"$f":"Scoping!J19","v":"Disclosure statement is documented and published"}]
[{"$f":"VLOOKUP(B150,Assessment!C26:O196,13,0)","v":"Basic"},{"$f":"Scoping!I20","v":"1.2.5."},{"$f":"Scoping!J20","v":"Policies are periodically reviewed and updated"}]
[{"$f":"VLOOKUP(B151,Assessment!C27:O197,13,0)","v":""},{"$f":"Scoping!I21","v":"1.2.6."},{"$f":"Scoping!J21","v":""}]
[{"$f":"VLOOKUP(B152,Assessment!C28:O198,13,0)","v":"Basic"},{"$f":"Scoping!I22","v":"1.3.1."},{"$f":"Scoping!J22","v":"Compliance policies are defined, implemented, and communicated"}]
[{"$f":"VLOOKUP(B153,Assessment!C29:O199,13,0)","v":"Basic"},{"$f":"Scoping!I23","v":"1.3.2."},{"$f":"Scoping!J23","v":"A program to monitor compliance with the policies is established"}]
[{"$f":"VLOOKUP(B154,Assessment!C30:O200,13,0)","v":"Basic"},{"$f":"Scoping!I24","v":"1.3.3."},{"$f":"Scoping!J24","v":"Responsibilities for the compliance are formally defined and assigned"}]
[{"$f":"VLOOKUP(B155,Assessment!C31:O201,13,0)","v":"Basic"},{"$f":"Scoping!I25","v":"1.3.4."},{"$f":"Scoping!J25","v":"List of relevant laws, regulations, and standards, exist and is maintained"}]
[{"$f":"VLOOKUP(B156,Assessment!C32:O202,13,0)","v":""},{"$f":"Scoping!I26","v":"1.3.5."},{"$f":"Scoping!J26","v":""}]
[{"$f":"VLOOKUP(B157,Assessment!C33:O203,13,0)","v":""},{"$f":"Scoping!I27","v":"1.3.6."},{"$f":"Scoping!J27","v":""}]
[{"$f":"VLOOKUP(B158,Assessment!C34:O204,13,0)","v":"Advanced"},{"$f":"Scoping!I28","v":"1.4.1."},{"$f":"Scoping!J28","v":"Scope of processes and procedure is aligned with policies"}]
[{"$f":"VLOOKUP(B159,Assessment!C35:O205,13,0)","v":"Advanced"},{"$f":"Scoping!I29","v":"1.4.2."},{"$f":"Scoping!J29","v":"Processes and procedures are formally documented and followed"}]
[{"$f":"VLOOKUP(B160,Assessment!C36:O206,13,0)","v":"Optimized"},{"$f":"Scoping!I30","v":"1.4.3."},{"$f":"Scoping!J30","v":"Recurring activities are executed on time"}]
[{"$f":"VLOOKUP(B161,Assessment!C37:O207,13,0)","v":"Advanced"},{"$f":"Scoping!I31","v":"1.4.4."},{"$f":"Scoping!J31","v":"Evidence from procedures is collected and maintained"}]
[{"$f":"VLOOKUP(B162,Assessment!C38:O208,13,0)","v":"Managed"},{"$f":"Scoping!I32","v":"1.4.5."},{"$f":"Scoping!J32","v":"Processes and procedures are reviewed and updated"}]
[{"$f":"VLOOKUP(B163,Assessment!C39:O209,13,0)","v":""},{"$f":"Scoping!I33","v":"1.4.6."},{"$f":"Scoping!J33","v":""}]
[{"$f":"VLOOKUP(B164,Assessment!C40:O210,13,0)","v":"Advanced"},{"$f":"Scoping!I34","v":"2.1.1."},{"$f":"Scoping!J34","v":"Key management roles and responsibilities are documented and formally assigned"}]
[{"$f":"VLOOKUP(B165,Assessment!C41:O211,13,0)","v":"Basic"},{"$f":"Scoping!I35","v":"2.1.2."},{"$f":"Scoping!J35","v":"Inventory of cryptographic keys is documented and maintained"}]
[{"$f":"VLOOKUP(B166,Assessment!C42:O212,13,0)","v":"Managed"},{"$f":"Scoping!I36","v":"2.1.3."},{"$f":"Scoping!J36","v":"Inventory of cryptographic devices is documented and maintained"}]
[{"$f":"VLOOKUP(B167,Assessment!C43:O213,13,0)","v":"Managed"},{"$f":"Scoping!I37","v":"2.1.4."},{"$f":"Scoping!J37","v":"Each cryptographic key is defined and has documented lifecycle procedures"}]
[{"$f":"VLOOKUP(B168,Assessment!C44:O214,13,0)","v":"Basic"},{"$f":"Scoping!I38","v":"2.1.5."},{"$f":"Scoping!J38","v":"Cryptographic cipher suites and protocols are documented and maintained"}]
[{"$f":"VLOOKUP(B169,Assessment!C45:O215,13,0)","v":"Managed"},{"$f":"Scoping!I39","v":"2.1.6."},{"$f":"Scoping!J39","v":"Key management is periodically reviewed and updated"}]
[{"$f":"VLOOKUP(B170,Assessment!C46:O216,13,0)","v":"Managed"},{"$f":"Scoping!I40","v":"2.2.1."},{"$f":"Scoping!J40","v":"Certificate profiles are documented"}]
[{"$f":"VLOOKUP(B171,Assessment!C47:O217,13,0)","v":"Optimized"},{"$f":"Scoping!I41","v":"2.2.2."},{"$f":"Scoping!J41","v":"Certificate cipher suites are documented"}]
[{"$f":"VLOOKUP(B172,Assessment!C48:O218,13,0)","v":"Basic"},{"$f":"Scoping!I42","v":"2.2.3."},{"$f":"Scoping!J42","v":"Certificate lifecycle management is documented"}]
[{"$f":"VLOOKUP(B173,Assessment!C49:O219,13,0)","v":"Initial"},{"$f":"Scoping!I43","v":"2.2.4."},{"$f":"Scoping!J43","v":"Inventory of issued certificates is documented"}]
[{"$f":"VLOOKUP(B174,Assessment!C50:O220,13,0)","v":"Basic"},{"$f":"Scoping!I44","v":"2.2.5."},{"$f":"Scoping!J44","v":"Certificate discovery process is documented"}]
[{"$f":"VLOOKUP(B175,Assessment!C51:O221,13,0)","v":"Advanced"},{"$f":"Scoping!I45","v":"2.2.6."},{"$f":"Scoping!J45","v":"Certificate management is periodically reviewed and updated"}]
[{"$f":"VLOOKUP(B176,Assessment!C52:O222,13,0)","v":"Basic"},{"$f":"Scoping!I46","v":"2.2.7."},{"$f":"Scoping!J46","v":"Organizational PKI governance"}]
[{"$f":"VLOOKUP(B177,Assessment!C53:O223,13,0)","v":"Managed"},{"$f":"Scoping!I47","v":"2.3.1."},{"$f":"Scoping!J47","v":"Network and deployment infrastructure is documented"}]
[{"$f":"VLOOKUP(B178,Assessment!C54:O224,13,0)","v":"Basic"},{"$f":"Scoping!I48","v":"2.3.2."},{"$f":"Scoping!J48","v":"Separation and segmentation principles are applied"}]
[{"$f":"VLOOKUP(B179,Assessment!C55:O225,13,0)","v":"Advanced"},{"$f":"Scoping!I49","v":"2.3.3."},{"$f":"Scoping!J49","v":"Network vulnerability management is implemented and maintained"}]
[{"$f":"VLOOKUP(B180,Assessment!C56:O226,13,0)","v":"Basic"},{"$f":"Scoping!I50","v":"2.3.4."},{"$f":"Scoping!J50","v":"Infrastructure recovery objectives controls"}]
[{"$f":"VLOOKUP(B181,Assessment!C57:O227,13,0)","v":"Managed"},{"$f":"Scoping!I51","v":"2.3.5."},{"$f":"Scoping!J51","v":"Infrastructure activities are periodically reviewed"}]
[{"$f":"VLOOKUP(B182,Assessment!C58:O228,13,0)","v":""},{"$f":"Scoping!I52","v":"2.3.6."},{"$f":"Scoping!J52","v":""}]
[{"$f":"VLOOKUP(B183,Assessment!C59:O229,13,0)","v":"Basic"},{"$f":"Scoping!I53","v":"2.4.1."},{"$f":"Scoping!J53","v":"The policy for change management and agility is documented"}]
[{"$f":"VLOOKUP(B184,Assessment!C60:O230,13,0)","v":"Managed"},{"$f":"Scoping!I54","v":"2.4.2."},{"$f":"Scoping!J54","v":"Request for change structure is documented and followed"}]
[{"$f":"VLOOKUP(B185,Assessment!C61:O231,13,0)","v":"Basic"},{"$f":"Scoping!I55","v":"2.4.3."},{"$f":"Scoping!J55","v":"The change management process is documented and implemented"}]
[{"$f":"VLOOKUP(B186,Assessment!C62:O232,13,0)","v":"Advanced"},{"$f":"Scoping!I56","v":"2.4.4."},{"$f":"Scoping!J56","v":"Requirements for agility are identified"}]
[{"$f":"VLOOKUP(B187,Assessment!C63:O233,13,0)","v":"Advanced"},{"$f":"Scoping!I57","v":"2.4.5."},{"$f":"Scoping!J57","v":"Change management and agility is periodically reviewed"}]
[{"$f":"VLOOKUP(B188,Assessment!C64:O234,13,0)","v":""},{"$f":"Scoping!I58","v":"2.4.6."},{"$f":"Scoping!J58","v":""}]
[{"$f":"VLOOKUP(B189,Assessment!C65:O235,13,0)","v":"Optimized"},{"$f":"Scoping!I59","v":"3.1.1."},{"$f":"Scoping!J59","v":"Risk assessment and business impact analysis"}]
[{"$f":"VLOOKUP(B190,Assessment!C66:O236,13,0)","v":"Advanced"},{"$f":"Scoping!I60","v":"3.1.2."},{"$f":"Scoping!J60","v":"Cyber-security management and incident planning"}]
[{"$f":"VLOOKUP(B191,Assessment!C67:O237,13,0)","v":"Managed"},{"$f":"Scoping!I61","v":"3.1.3."},{"$f":"Scoping!J61","v":"Business continuity planning and disaster recovery"}]
[{"$f":"VLOOKUP(B192,Assessment!C68:O238,13,0)","v":"Managed"},{"$f":"Scoping!I62","v":"3.1.4."},{"$f":"Scoping!J62","v":"Technology future proofing"}]
[{"$f":"VLOOKUP(B193,Assessment!C69:O239,13,0)","v":"Initial"},{"$f":"Scoping!I63","v":"3.1.5."},{"$f":"Scoping!J63","v":"Competence and information sharing"}]
[{"$f":"VLOOKUP(B194,Assessment!C70:O240,13,0)","v":"Advanced"},{"$f":"Scoping!I64","v":"3.1.6."},{"$f":"Scoping!J64","v":"Continual review and improvement"}]
[{"$f":"VLOOKUP(B195,Assessment!C71:O241,13,0)","v":"Advanced"},{"$f":"Scoping!I65","v":"3.2.1."},{"$f":"Scoping!J65","v":"Maintain PKI interoperability strategy"}]
[{"$f":"VLOOKUP(B196,Assessment!C72:O242,13,0)","v":"Advanced"},{"$f":"Scoping!I66","v":"3.2.2."},{"$f":"Scoping!J66","v":"Documented integration guidance"}]
[{"$f":"VLOOKUP(B197,Assessment!C73:O243,13,0)","v":"Managed"},{"$f":"Scoping!I67","v":"3.2.3."},{"$f":"Scoping!J67","v":"Adoption and application of open standards"}]
[{"$f":"VLOOKUP(B198,Assessment!C74:O244,13,0)","v":""},{"$f":"Scoping!I68","v":"3.2.4."},{"$f":"Scoping!J68","v":""}]
[{"$f":"VLOOKUP(B199,Assessment!C75:O245,13,0)","v":""},{"$f":"Scoping!I69","v":"3.2.5."},{"$f":"Scoping!J69","v":""}]
[{"$f":"VLOOKUP(B200,Assessment!C76:O246,13,0)","v":""},{"$f":"Scoping!I70","v":"3.2.6."},{"$f":"Scoping!J70","v":""}]
[{"$f":"VLOOKUP(B201,Assessment!C77:O247,13,0)","v":"Advanced"},{"$f":"Scoping!I71","v":"3.3.1."},{"$f":"Scoping!J71","v":"Monitoring events and logging requirements are defined and documented"}]
[{"$f":"VLOOKUP(B202,Assessment!C78:O248,13,0)","v":"Advanced"},{"$f":"Scoping!I72","v":"3.3.2."},{"$f":"Scoping!J72","v":"Event logs from systems are collected"}]
[{"$f":"VLOOKUP(B203,Assessment!C79:O249,13,0)","v":"Advanced"},{"$f":"Scoping!I73","v":"3.3.3."},{"$f":"Scoping!J73","v":"Audit trail can be reconstructed from audit logs"}]
[{"$f":"VLOOKUP(B204,Assessment!C80:O250,13,0)","v":"Advanced"},{"$f":"Scoping!I74","v":"3.3.4."},{"$f":"Scoping!J74","v":"Monitoring of operational and security events is implemented"}]
[{"$f":"VLOOKUP(B205,Assessment!C81:O251,13,0)","v":"Advanced"},{"$f":"Scoping!I75","v":"3.3.5."},{"$f":"Scoping!J75","v":"Critical events are immediately alerted and resolved according to incident response plans"}]
[{"$f":"VLOOKUP(B206,Assessment!C82:O252,13,0)","v":"Advanced"},{"$f":"Scoping!I76","v":"3.3.6."},{"$f":"Scoping!J76","v":"Review of events and logs is periodically performed"}]
[{"$f":"VLOOKUP(B207,Assessment!C83:O253,13,0)","v":"Basic"},{"$f":"Scoping!I77","v":"3.4.1."},{"$f":"Scoping!J77","v":"Process automation description"}]
[{"$f":"VLOOKUP(B208,Assessment!C84:O254,13,0)","v":"Managed"},{"$f":"Scoping!I78","v":"3.4.2."},{"$f":"Scoping!J78","v":"Monitoring and auditing of automated process"}]
[{"$f":"VLOOKUP(B209,Assessment!C85:O255,13,0)","v":"Basic"},{"$f":"Scoping!I79","v":"3.4.3."},{"$f":"Scoping!J79","v":"Incidents and exceptions handling"}]
[{"$f":"VLOOKUP(B210,Assessment!C86:O256,13,0)","v":""},{"$f":"Scoping!I80","v":"3.4.4."},{"$f":"Scoping!J80","v":""}]
[{"$f":"VLOOKUP(B211,Assessment!C87:O257,13,0)","v":""},{"$f":"Scoping!I81","v":"3.4.5."},{"$f":"Scoping!J81","v":""}]
[{"$f":"VLOOKUP(B212,Assessment!C88:O258,13,0)","v":""},{"$f":"Scoping!I82","v":"3.4.6."},{"$f":"Scoping!J82","v":""}]
[{"$f":"VLOOKUP(B213,Assessment!C89:O259,13,0)","v":"Initial"},{"$f":"Scoping!I83","v":"4.1.1."},{"$f":"Scoping!J83","v":"Resources are identified and documented"}]
[{"$f":"VLOOKUP(B214,Assessment!C90:O260,13,0)","v":"Optimized"},{"$f":"Scoping!I84","v":"4.1.2."},{"$f":"Scoping!J84","v":"Resources are clearly defined"}]
[{"$f":"VLOOKUP(B215,Assessment!C91:O261,13,0)","v":"Optimized"},{"$f":"Scoping!I85","v":"4.1.3."},{"$f":"Scoping!J85","v":"Availability of resources"}]
[{"$f":"VLOOKUP(B216,Assessment!C92:O262,13,0)","v":"Optimized"},{"$f":"Scoping!I86","v":"4.1.4."},{"$f":"Scoping!J86","v":"Resources are periodically reviewed"}]
[{"$f":"VLOOKUP(B217,Assessment!C93:O263,13,0)","v":"Managed"},{"$f":"Scoping!I87","v":"4.2.1."},{"$f":"Scoping!J87","v":"Establish training plan"}]
[{"$f":"VLOOKUP(B218,Assessment!C94:O264,13,0)","v":"Managed"},{"$f":"Scoping!I88","v":"4.2.2."},{"$f":"Scoping!J88","v":"Responsible personnel receive training"}]
[{"$f":"VLOOKUP(B219,Assessment!C95:O265,13,0)","v":"Optimized"},{"$f":"Scoping!I89","v":"4.2.3."},{"$f":"Scoping!J89","v":"Perform security awareness training"}]
[{"$f":"VLOOKUP(B220,Assessment!C96:O266,13,0)","v":"Managed"},{"$f":"Scoping!I90","v":"4.2.4."},{"$f":"Scoping!J90","v":"Establish education plan"}]
[{"$f":"VLOOKUP(B221,Assessment!C97:O267,13,0)","v":"Managed"},{"$f":"Scoping!I91","v":"4.2.5."},{"$f":"Scoping!J91","v":"Periodically review knowledge"}]
[{"$f":"VLOOKUP(B222,Assessment!C98:O268,13,0)","v":"Basic"},{"$f":"Scoping!I92","v":"4.3.1."},{"$f":"Scoping!J92","v":"Establish and maintain awareness plan"}]
[{"$f":"VLOOKUP(B223,Assessment!C99:O269,13,0)","v":"Managed"},{"$f":"Scoping!I93","v":"4.3.2."},{"$f":"Scoping!J93","v":"Disclose PKI information"}]
[{"$f":"VLOOKUP(B224,Assessment!C100:O270,13,0)","v":"Managed"},{"$f":"Scoping!I94","v":"4.3.3."},{"$f":"Scoping!J94","v":"Establish single point of contact"}]
[{"$f":"VLOOKUP(B225,Assessment!C101:O271,13,0)","v":"Advanced"},{"$f":"Scoping!I95","v":"4.3.4."},{"$f":"Scoping!J95","v":"Timely communication of important information"}]
[]
[]
["Assessor's position"]
["Internal"]
["External"]
[]
["Reporting"]
["Attestation report"]
["Assessment report"]
["Detailed report"]
[]
[]
["ActionPlans Lists"]
["1.1. Strategy and vision",{"$f":"VLOOKUP(A239,ActionPlans!$B$14:$F$34,5,0)","v":"Initial"}]
[{"$f":"IF(B239=\"N/A\",\"\",_xlfn._xlws.FILTER($A$13:$A$17,$B$13:$B$17>VLOOKUP(A239,ActionPlans!$B$14:$G$34,6,0),\"\"))","v":"Basic"}]
["Advanced"]
["Managed"]
["Optimized"]
[]
["1.2. Policies and documentation",{"$f":"VLOOKUP(A245,ActionPlans!$B$14:$F$34,5,0)","v":"Basic"}]
[{"$f":"IF(B245=\"N/A\",\"\",_xlfn._xlws.FILTER($A$13:$A$17,$B$13:$B$17>VLOOKUP(A245,ActionPlans!$B$14:$G$34,6,0),\"\"))","v":"Advanced"}]
["Managed"]
["Optimized"]
[]
[]
["1.3. Compliance",{"$f":"VLOOKUP(A251,ActionPlans!$B$14:$F$34,5,0)","v":"Basic"}]
[{"$f":"IF(B251=\"N/A\",\"\",_xlfn._xlws.FILTER($A$13:$A$17,$B$13:$B$17>VLOOKUP(A251,ActionPlans!$B$14:$G$34,6,0),\"\"))","v":"Advanced"}]
["Managed"]
["Optimized"]
[]
[]
["1.4. Processes and procedures",{"$f":"VLOOKUP(A257,ActionPlans!$B$14:$F$34,5,0)","v":"Advanced"}]
[{"$f":"IF(B257=\"N/A\",\"\",_xlfn._xlws.FILTER($A$13:$A$17,$B$13:$B$17>VLOOKUP(A257,ActionPlans!$B$14:$G$34,6,0),\"\"))","v":"Managed"}]
["Optimized"]
[]
[]
[]
["2.1. Key Management",{"$f":"VLOOKUP(A263,ActionPlans!$B$14:$F$34,5,0)","v":"Advanced"}]
[{"$f":"IF(B263=\"N/A\",\"\",_xlfn._xlws.FILTER($A$13:$A$17,$B$13:$B$17>VLOOKUP(A263,ActionPlans!$B$14:$G$34,6,0),\"\"))","v":"Managed"}]
["Optimized"]
[]
[]
[]
["2.2. Certificate Management",{"$f":"VLOOKUP(A269,ActionPlans!$B$14:$F$34,5,0)","v":"Basic"}]
[{"$f":"IF(B269=\"N/A\",\"\",_xlfn._xlws.FILTER($A$13:$A$17,$B$13:$B$17>VLOOKUP(A269,ActionPlans!$B$14:$G$34,6,0),\"\"))","v":"Advanced"}]
["Managed"]
["Optimized"]
[]
[]
["2.3. Infrastructure Management",{"$f":"VLOOKUP(A275,ActionPlans!$B$14:$F$34,5,0)","v":"Advanced"}]
[{"$f":"IF(B275=\"N/A\",\"\",_xlfn._xlws.FILTER($A$13:$A$17,$B$13:$B$17>VLOOKUP(A275,ActionPlans!$B$14:$G$34,6,0),\"\"))","v":"Managed"}]
["Optimized"]
[]
[]
[]
["2.4. Change Management and Agility",{"$f":"VLOOKUP(A281,ActionPlans!$B$14:$F$34,5,0)","v":"Basic"}]
[{"$f":"IF(B281=\"N/A\",\"\",_xlfn._xlws.FILTER($A$13:$A$17,$B$13:$B$17>VLOOKUP(A281,ActionPlans!$B$14:$G$34,6,0),\"\"))","v":"Advanced"}]
["Managed"]
["Optimized"]
[]
[]
["3.1. Resilience",{"$f":"VLOOKUP(A287,ActionPlans!$B$14:$F$34,5,0)","v":"Advanced"}]
[{"$f":"IF(B287=\"N/A\",\"\",_xlfn._xlws.FILTER($A$13:$A$17,$B$13:$B$17>VLOOKUP(A287,ActionPlans!$B$14:$G$34,6,0),\"\"))","v":"Managed"}]
["Optimized"]
[]
[]
[]
["3.2. Interoperability",{"$f":"VLOOKUP(A293,ActionPlans!$B$14:$F$34,5,0)","v":"Advanced"}]
[{"$f":"IF(B293=\"N/A\",\"\",_xlfn._xlws.FILTER($A$13:$A$17,$B$13:$B$17>VLOOKUP(A293,ActionPlans!$B$14:$G$34,6,0),\"\"))","v":"Managed"}]
["Optimized"]
[]
[]
[]
["3.3. Monitoring and Auditing",{"$f":"VLOOKUP(A299,ActionPlans!$B$14:$F$34,5,0)","v":"Advanced"}]
[{"$f":"IF(B299=\"N/A\",\"\",_xlfn._xlws.FILTER($A$13:$A$17,$B$13:$B$17>VLOOKUP(A299,ActionPlans!$B$14:$G$34,6,0),\"\"))","v":"Managed"}]
["Optimized"]
[]
[]
[]
["3.4. Automation",{"$f":"VLOOKUP(A305,ActionPlans!$B$14:$F$34,5,0)","v":"Basic"}]
[{"$f":"IF(B305=\"N/A\",\"\",_xlfn._xlws.FILTER($A$13:$A$17,$B$13:$B$17>VLOOKUP(A305,ActionPlans!$B$14:$G$34,6,0),\"\"))","v":"Advanced"}]
["Managed"]
["Optimized"]
[]
[]
["4.1. Sourcing",{"$f":"VLOOKUP(A311,ActionPlans!$B$14:$F$34,5,0)","v":"Advanced"}]
[{"$f":"IF(B311=\"N/A\",\"\",_xlfn._xlws.FILTER($A$13:$A$17,$B$13:$B$17>VLOOKUP(A311,ActionPlans!$B$14:$G$34,6,0),\"\"))","v":"Managed"}]
["Optimized"]
[]
[]
[]
["4.2. Knowledge and Training",{"$f":"VLOOKUP(A317,ActionPlans!$B$14:$F$34,5,0)","v":"Managed"}]
[{"$f":"IF(B317=\"N/A\",\"\",_xlfn._xlws.FILTER($A$13:$A$17,$B$13:$B$17>VLOOKUP(A317,ActionPlans!$B$14:$G$34,6,0),\"\"))","v":"Optimized"}]
[]
[]
[]
[]
["4.3. Awareness",{"$f":"VLOOKUP(A323,ActionPlans!$B$14:$F$34,5,0)","v":"Advanced"}]
[{"$f":"IF(B323=\"N/A\",\"\",_xlfn._xlws.FILTER($A$13:$A$17,$B$13:$B$17>VLOOKUP(A323,ActionPlans!$B$14:$G$34,6,0),\"\"))","v":"Managed"}]
["Optimized"]

{"sheet":"source","index":13,"n_rows":230,"n_cols":106,"rows_kept":230,"hidden":true}
[]
[null,null,"Maturity levels",{"$nulls":5},{"$f":"tech!A117","v":"1.1. Strategy and vision"},{"$f":"LEFT(I2,4)","v":"1.1."},{"$nulls":4},{"$f":"tech!A118","v":"1.2. Policies and documentation"},{"$f":"LEFT(O2,4)","v":"1.2."},{"$nulls":4},{"$f":"tech!A119","v":"1.3. Compliance"},{"$f":"LEFT(U2,4)","v":"1.3."},{"$nulls":4},{"$f":"tech!A120","v":"1.4. Processes and procedures"},{"$f":"LEFT(AA2,4)","v":"1.4."},{"$nulls":4},{"$f":"tech!A121","v":"2.1. Key Management"},{"$f":"LEFT(AG2,4)","v":"2.1."},{"$nulls":4},{"$f":"tech!A122","v":"2.2. Certificate Management"},{"$f":"LEFT(AM2,4)","v":"2.2."},{"$nulls":4},{"$f":"tech!A123","v":"2.3. Infrastructure Management"},{"$f":"LEFT(AS2,4)","v":"2.3."},{"$nulls":4},{"$f":"tech!A124","v":"2.4. Change Management and Agility"},{"$f":"LEFT(AY2,4)","v":"2.4."},{"$nulls":4},{"$f":"tech!A125","v":"3.1. Resilience"},{"$f":"LEFT(BE2,4)","v":"3.1."},{"$nulls":4},{"$f":"tech!A126","v":"3.2. Interoperability"},{"$f":"LEFT(BK2,4)","v":"3.2."},{"$nulls":4},{"$f":"tech!A127","v":"3.3. Monitoring and Auditing"},{"$f":"LEFT(BQ2,4)","v":"3.3."},{"$nulls":4},{"$f":"tech!A128","v":"3.4. Automation"},{"$f":"LEFT(BW2,4)","v":"3.4."},{"$nulls":4},{"$f":"tech!A129","v":"4.1. Sourcing"},{"$f":"LEFT(CC2,4)","v":"4.1."},{"$nulls":4},{"$f":"tech!A130","v":"4.2. Knowledge and Training"},{"$f":"LEFT(CI2,4)","v":"4.2."},{"$nulls":4},{"$f":"tech!A131","v":"4.3. Awareness"},{"$f":"LEFT(CO2,4)","v":"4.3."},{"$nulls":4},"Categories",{"$nulls":3},"Categories weight"]
[null,null,"model/maturity-levels/_index.md",{"$nulls":5},"categories/strategy-and-vision/_index.md",null,"Weight","Req",null,null,"categories/policies-and-documentation/_index.md",null,"Weight","Req",null,null,"categories/compliance/_index.md",null,"Weight","Req",null,null,"categories/processes-and-procedures/_index.md",null,"Weight","Req",null,null,"categories/key-management/_index.md",null,"Weight","Req",null,null,"categories/certificate-management/_index.md",null,"Weight","Req",null,null,"categories/infrastructure-management/_index.md",null,"Weight","Req",null,null,"categories/change-management-and-agility/_index.md",null,"Weight","Req",null,null,"categories/resilience/_index.md",null,"Weight","Req",null,null,"categories/interoperability/_index.md",null,"Weight","Req",null,null,"categories/monitoring-and-auditing/_index.md",null,"Weight","Req",null,null,"categories/automation/_index.md",null,"Weight","Req",null,null,"categories/sourcing/_index.md",null,"Weight","Req",null,null,"categories/knowledge-and-training/_index.md",null,"Weight","Req",null,null,"categories/awareness/_index.md",null,"Weight","Req",null,null,"categories/list-of-categories/_index.md"]
["Input procedure:",1,"| 1 | **[Initial](#initial-maturity-level)**     | Unpredictable process with poor control and always reactive                                                  |",{"$f":"TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(C4,\"|\"),\"|\"))","v":"1"},null,null,{"$f":"TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(C4,\"|\",3),\"|\"))","v":"Unpredictable process with poor control and always reactive"},"|","|          [1](#organizational-sponsor-and-support) | Organizational sponsor and support          |      3 |",{"$f":"IF(I4=\"\",\"\",_xlfn.CONCAT(J$2,$B4,\".\"))","v":"1.1.1."},{"$f":"IF(I4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(I4,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(I4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(I4,\"|\",2),\"|\")))","v":"Organizational sponsor and support"},{"$f":"J4","v":"1.1.1."},"|","|              [1](#the-scope-of-policies-is-defined-and-documented) | The scope of policies is defined and documented              |      2 |",{"$f":"IF(O4=\"\",\"\",_xlfn.CONCAT(P$2,$B4,\".\"))","v":"1.2.1."},{"$f":"IF(O4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(O4,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(O4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(O4,\"|\",2),\"|\")))","v":"The scope of policies is defined and documented"},{"$f":"P4","v":"1.2.1."},"|","|            [1](#compliance-policies-are-defined-implemented-and-communicated) | Compliance policies are defined, implemented, and communicated             |      3 |",{"$f":"IF(U4=\"\",\"\",_xlfn.CONCAT(V$2,$B4,\".\"))","v":"1.3.1."},{"$f":"IF(U4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(U4,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(U4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(U4,\"|\",2),\"|\")))","v":"Compliance policies are defined, implemented, and communicated"},{"$f":"V4","v":"1.3.1."},"|","|     [1](#scope-of-processes-and-procedure-is-aligned-with-policies) | Scope of processes and procedure is aligned with policies     |      4 |",{"$f":"IF(AA4=\"\",\"\",_xlfn.CONCAT(AB$2,$B4,\".\"))","v":"1.4.1."},{"$f":"IF(AA4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AA4,\"|\",3),\"|\")))","v":"4"},{"$f":"IF(AA4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AA4,\"|\",2),\"|\")))","v":"Scope of processes and procedure is aligned with policies"},{"$f":"AB4","v":"1.4.1."},"|","| [1](#key-management-roles-and-responsibilities-are-documented-and-formally-assigned) | Key management roles and responsibilities are documented and formally assigned |      2 |",{"$f":"IF(AG4=\"\",\"\",_xlfn.CONCAT(AH$2,$B4,\".\"))","v":"2.1.1."},{"$f":"IF(AG4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AG4,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(AG4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AG4,\"|\",2),\"|\")))","v":"Key management roles and responsibilities are documented and formally assigned"},{"$f":"AH4","v":"2.1.1."},"|","|                         [1](#certificate-profiles-are-documented) | Certificate profiles are documented                         |      2 |",{"$f":"IF(AM4=\"\",\"\",_xlfn.CONCAT(AN$2,$B4,\".\"))","v":"2.2.1."},{"$f":"IF(AM4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AM4,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(AM4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AM4,\"|\",2),\"|\")))","v":"Certificate profiles are documented"},{"$f":"AN4","v":"2.2.1."},"|","|            [1](#network-and-deployment-infrastructure-is-documented) | Network and deployment infrastructure is documented            |      4 |",{"$f":"IF(AS4=\"\",\"\",_xlfn.CONCAT(AT$2,$B4,\".\"))","v":"2.3.1."},{"$f":"IF(AS4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AS4,\"|\",3),\"|\")))","v":"4"},{"$f":"IF(AS4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AS4,\"|\",2),\"|\")))","v":"Network and deployment infrastructure is documented"},{"$f":"AT4","v":"2.3.1."},"|","|  [1](#the-policy-for-change-management-and-agility-is-documented) | The policy for change management and agility is documented  |      4 |",{"$f":"IF(AY4=\"\",\"\",_xlfn.CONCAT(AZ$2,$B4,\".\"))","v":"2.4.1."},{"$f":"IF(AY4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AY4,\"|\",3),\"|\")))","v":"4"},{"$f":"IF(AY4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AY4,\"|\",2),\"|\")))","v":"The policy for change management and agility is documented"},{"$f":"AZ4","v":"2.4.1."},"|","|       [1](#risk-assessment-and-business-impact-analysis) | Risk assessment and business impact analysis       |      6 |",{"$f":"IF(BE4=\"\",\"\",_xlfn.CONCAT(BF$2,$B4,\".\"))","v":"3.1.1."},{"$f":"IF(BE4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BE4,\"|\",3),\"|\")))","v":"6"},{"$f":"IF(BE4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BE4,\"|\",2),\"|\")))","v":"Risk assessment and business impact analysis"},{"$f":"BF4","v":"3.1.1."},"|","|     [1](#maintain-pki-interoperability-strategy) | Maintain PKI interoperability strategy     |      3 |",{"$f":"IF(BK4=\"\",\"\",_xlfn.CONCAT(BL$2,$B4,\".\"))","v":"3.2.1."},{"$f":"IF(BK4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BK4,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(BK4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BK4,\"|\",2),\"|\")))","v":"Maintain PKI interoperability strategy"},{"$f":"BL4","v":"3.2.1."},"|","|                     [1](#monitoring-events-and-logging-requirements-are-defined-and-documented) | Monitoring events and logging requirements are defined and documented                     |      4 |",{"$f":"IF(BQ4=\"\",\"\",_xlfn.CONCAT(BR$2,$B4,\".\"))","v":"3.3.1."},{"$f":"IF(BQ4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BQ4,\"|\",3),\"|\")))","v":"4"},{"$f":"IF(BQ4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BQ4,\"|\",2),\"|\")))","v":"Monitoring events and logging requirements are defined and documented"},{"$f":"BR4","v":"3.3.1."},"|","|               [1](#process-automation-description) | Process automation description               |      3 |",{"$f":"IF(BW4=\"\",\"\",_xlfn.CONCAT(BX$2,$B4,\".\"))","v":"3.4.1."},{"$f":"IF(BW4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BW4,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(BW4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BW4,\"|\",2),\"|\")))","v":"Process automation description"},{"$f":"BX4","v":"3.4.1."},"|","| [1](#resources-are-identified-and-documented) | Resources are identified and documented |      5 |",{"$f":"IF(CC4=\"\",\"\",_xlfn.CONCAT(CD$2,$B4,\".\"))","v":"4.1.1."},{"$f":"IF(CC4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CC4,\"|\",3),\"|\")))","v":"5"},{"$f":"IF(CC4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CC4,\"|\",2),\"|\")))","v":"Resources are identified and documented"},{"$f":"CD4","v":"4.1.1."},"|","|                [1](#establish-training-plan) | Establish training plan                |      2 |",{"$f":"IF(CI4=\"\",\"\",_xlfn.CONCAT(CJ$2,$B4,\".\"))","v":"4.2.1."},{"$f":"IF(CI4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CI4,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(CI4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CI4,\"|\",2),\"|\")))","v":"Establish training plan"},{"$f":"CJ4","v":"4.2.1."},"|","|         [1](#establish-and-maintain-awareness-plan) | Establish and maintain awareness plan         |      2 |",{"$f":"IF(CO4=\"\",\"\",_xlfn.CONCAT(CP$2,$B4,\".\"))","v":"4.3.1."},{"$f":"IF(CO4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CO4,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(CO4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CO4,\"|\",2),\"|\")))","v":"Establish and maintain awareness plan"},{"$f":"CP4","v":"4.3.1."},"|","|  1 | **[Strategy and vision](../strategy-and-vision/)**                     | Responsible for the PKI management and strategy. Includes alignment with organizational goals and requirements, risk management, and policy decisions.                                                                                      |",{"$f":"IF(CU4=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU4,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":"1.1."},{"$f":"IF(CU4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU4,\"|\",3),\"|\")))","v":"Responsible for the PKI management and strategy. Includes alignment with organizational goals and requirements, risk management, and policy decisions."},"|","| **Strategy and vision**           |      5 |",{"$f":"IF(CY4=\"\",\"\",SUBSTITUTE(TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CY4,\"|\"),\"|\")),\"*\",\"\"))","v":"Strategy and vision"},{"$f":"IF(CY4=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CY4,\"|\",2),\"|\")))","v":"5"},"|"]
[null,2,"| 2 | **[Basic](#basic-maturity-level)**         | Process is characterized by each particular case or project and controls are often reactive                  |",{"$f":"TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(C5,\"|\"),\"|\"))","v":"2"},null,null,"Process is characterized by each particular case or project and controls are often reactive","|","| [2](#formal-assignment-of-responsible-leadership) | Formal assignment of responsible leadership |      2 |",{"$f":"IF(I5=\"\",\"\",_xlfn.CONCAT($J$2,$B5,\".\"))","v":"1.1.2."},{"$f":"IF(I5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(I5,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(I5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(I5,\"|\",2),\"|\")))","v":"Formal assignment of responsible leadership"},{"$f":"J5","v":"1.1.2."},"|","|               [2](#certificate-policy-is-documented-and-published) | Certificate Policy is documented and published               |      5 |",{"$f":"IF(O5=\"\",\"\",_xlfn.CONCAT(P$2,$B5,\".\"))","v":"1.2.2."},{"$f":"IF(O5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(O5,\"|\",3),\"|\")))","v":"5"},{"$f":"IF(O5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(O5,\"|\",2),\"|\")))","v":"Certificate Policy is documented and published"},{"$f":"P5","v":"1.2.2."},"|","|        [2](#a-program-to-monitor-compliance-with-the-policies-is-established) | A program to monitor compliance with the policies is established           |      4 |",{"$f":"IF(U5=\"\",\"\",_xlfn.CONCAT(V$2,$B5,\".\"))","v":"1.3.2."},{"$f":"IF(U5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(U5,\"|\",3),\"|\")))","v":"4"},{"$f":"IF(U5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(U5,\"|\",2),\"|\")))","v":"A program to monitor compliance with the policies is established"},{"$f":"V5","v":"1.3.2."},"|","| [2](#processes-and-procedures-are-formally-documented-and-followed) | Processes and procedures are formally documented and followed |      3 |",{"$f":"IF(AA5=\"\",\"\",_xlfn.CONCAT(AB$2,$B5,\".\"))","v":"1.4.2."},{"$f":"IF(AA5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AA5,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(AA5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AA5,\"|\",2),\"|\")))","v":"Processes and procedures are formally documented and followed"},{"$f":"AB5","v":"1.4.2."},"|","|                   [2](#inventory-of-cryptographic-keys-is-documented-and-maintained) | Inventory of cryptographic keys is documented and maintained                   |      2 |",{"$f":"IF(AG5=\"\",\"\",_xlfn.CONCAT(AH$2,$B5,\".\"))","v":"2.1.2."},{"$f":"IF(AG5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AG5,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(AG5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AG5,\"|\",2),\"|\")))","v":"Inventory of cryptographic keys is documented and maintained"},{"$f":"AH5","v":"2.1.2."},"|","|                    [2](#certificate-cipher-suites-are-documented) | Certificate cipher suites are documented                    |      3 |",{"$f":"IF(AM5=\"\",\"\",_xlfn.CONCAT(AN$2,$B5,\".\"))","v":"2.2.2."},{"$f":"IF(AM5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AM5,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(AM5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AM5,\"|\",2),\"|\")))","v":"Certificate cipher suites are documented"},{"$f":"AN5","v":"2.2.2."},"|","|             [2](#separation-and-segmentation-principles-are-applied) | Separation and segmentation principles are applied             |      3 |",{"$f":"IF(AS5=\"\",\"\",_xlfn.CONCAT(AT$2,$B5,\".\"))","v":"2.3.2."},{"$f":"IF(AS5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AS5,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(AS5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AS5,\"|\",2),\"|\")))","v":"Separation and segmentation principles are applied"},{"$f":"AT5","v":"2.3.2."},"|","|     [2](#request-for-change-structure-is-documented-and-followed) | Request for change structure is documented and followed     |      3 |",{"$f":"IF(AY5=\"\",\"\",_xlfn.CONCAT(AZ$2,$B5,\".\"))","v":"2.4.2."},{"$f":"IF(AY5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AY5,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(AY5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AY5,\"|\",2),\"|\")))","v":"Request for change structure is documented and followed"},{"$f":"AZ5","v":"2.4.2."},"|","|    [2](#cyber-security-management-and-incident-planning) | Cyber-security management and incident planning    |      4 |",{"$f":"IF(BE5=\"\",\"\",_xlfn.CONCAT(BF$2,$B5,\".\"))","v":"3.1.2."},{"$f":"IF(BE5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BE5,\"|\",3),\"|\")))","v":"4"},{"$f":"IF(BE5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BE5,\"|\",2),\"|\")))","v":"Cyber-security management and incident planning"},{"$f":"BF5","v":"3.1.2."},"|","|            [2](#documented-integration-guidance) | Documented integration guidance            |      1 |",{"$f":"IF(BK5=\"\",\"\",_xlfn.CONCAT(BL$2,$B5,\".\"))","v":"3.2.2."},{"$f":"IF(BK5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BK5,\"|\",3),\"|\")))","v":"1"},{"$f":"IF(BK5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BK5,\"|\",2),\"|\")))","v":"Documented integration guidance"},{"$f":"BL5","v":"3.2.2."},"|","|                                                     [2](#event-logs-from-systems-are-collected) | Event logs from systems are collected                                                     |      4 |",{"$f":"IF(BQ5=\"\",\"\",_xlfn.CONCAT(BR$2,$B5,\".\"))","v":"3.3.2."},{"$f":"IF(BQ5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BQ5,\"|\",3),\"|\")))","v":"4"},{"$f":"IF(BQ5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BQ5,\"|\",2),\"|\")))","v":"Event logs from systems are collected"},{"$f":"BR5","v":"3.3.2."},"|","| [2](#monitoring-and-auditing-of-automated-process) | Monitoring and auditing of automated process |      1 |",{"$f":"IF(BW5=\"\",\"\",_xlfn.CONCAT(BX$2,$B5,\".\"))","v":"3.4.2."},{"$f":"IF(BW5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BW5,\"|\",3),\"|\")))","v":"1"},{"$f":"IF(BW5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BW5,\"|\",2),\"|\")))","v":"Monitoring and auditing of automated process"},{"$f":"BX5","v":"3.4.2."},"|","|           [2](#resources-are-clearly-defined) | Resources are clearly defined           |      3 |",{"$f":"IF(CC5=\"\",\"\",_xlfn.CONCAT(CD$2,$B5,\".\"))","v":"4.1.2."},{"$f":"IF(CC5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CC5,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(CC5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CC5,\"|\",2),\"|\")))","v":"Resources are clearly defined"},{"$f":"CD5","v":"4.1.2."},"|","| [2](#responsible-personnel-receive-training) | Responsible personnel receive training |      2 |",{"$f":"IF(CI5=\"\",\"\",_xlfn.CONCAT(CJ$2,$B5,\".\"))","v":"4.2.2."},{"$f":"IF(CI5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CI5,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(CI5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CI5,\"|\",2),\"|\")))","v":"Responsible personnel receive training"},{"$f":"CJ5","v":"4.2.2."},"|","|                      [2](#disclose-pki-information) | Disclose PKI information                      |      2 |",{"$f":"IF(CO5=\"\",\"\",_xlfn.CONCAT(CP$2,$B5,\".\"))","v":"4.3.2."},{"$f":"IF(CO5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CO5,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(CO5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CO5,\"|\",2),\"|\")))","v":"Disclose PKI information"},{"$f":"CP5","v":"4.3.2."},"|","|  2 | **[Policies and documentation](../policies-and-documentation/)**       | Formal policies and practice statements for supported PKI services and use-cases. Formal management of agreements between parties involved in the PKI.                                                                                      |",{"$f":"IF(CU5=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU5,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":"1.2."},{"$f":"IF(CU5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU5,\"|\",3),\"|\")))","v":"Formal policies and practice statements for supported PKI services and use-cases. Formal management of agreements between parties involved in the PKI."},"|","| **Policies and documentation**    |      4 |",{"$f":"IF(CY5=\"\",\"\",SUBSTITUTE(TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CY5,\"|\"),\"|\")),\"*\",\"\"))","v":"Policies and documentation"},{"$f":"IF(CY5=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CY5,\"|\",2),\"|\")))","v":"4"},"|"]
["1. in Github on the Code tab, highlight the table below the horizontal line, ",3,"| 3 | **[Advanced](#advanced-maturity-level)**   | Process is characterized by organizational standards and controls are proactive                              |",{"$f":"TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(C6,\"|\"),\"|\"))","v":"3"},null,null,"Process is characterized by organizational standards and controls are proactive","|","|          [3](#scope-and-business-drivers-for-PKI) | Scope and business drivers for PKI          |      2 |",{"$f":"IF(I6=\"\",\"\",_xlfn.CONCAT($J$2,$B6,\".\"))","v":"1.1.3."},{"$f":"IF(I6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(I6,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(I6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(I6,\"|\",2),\"|\")))","v":"Scope and business drivers for PKI"},"1.1.3.","|","| [3](#certification-practice-statement-is-documented-and-published) | Certification Practice Statement is documented and published |      5 |","1.2.3.",{"$f":"IF(O6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(O6,\"|\",3),\"|\")))","v":"5"},{"$f":"IF(O6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(O6,\"|\",2),\"|\")))","v":"Certification Practice Statement is documented and published"},"1.2.3.","|","|   [3](#responsibilities-for-the-compliance-are-formally-defined-and-assigned) | Responsibilities for the compliance are formally defined and assigned      |      3 |","1.3.3.",{"$f":"IF(U6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(U6,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(U6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(U6,\"|\",2),\"|\")))","v":"Responsibilities for the compliance are formally defined and assigned"},"1.3.3.","|","|                     [3](#recurring-activities-are-executed-on-time) | Recurring activities are executed on time                     |      5 |","1.4.3.",{"$f":"IF(AA6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AA6,\"|\",3),\"|\")))","v":"5"},{"$f":"IF(AA6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AA6,\"|\",2),\"|\")))","v":"Recurring activities are executed on time"},"1.4.3.","|","|                [3](#inventory-of-cryptographic-devices-is-documented-and-maintained) | Inventory of cryptographic devices is documented and maintained                |      1 |","2.1.3.",{"$f":"IF(AG6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AG6,\"|\",3),\"|\")))","v":"1"},{"$f":"IF(AG6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AG6,\"|\",2),\"|\")))","v":"Inventory of cryptographic devices is documented and maintained"},"2.1.3.","|","|              [3](#certificate-lifecycle-management-is-documented) | Certificate lifecycle management is documented              |      4 |","2.2.3.",{"$f":"IF(AM6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AM6,\"|\",3),\"|\")))","v":"4"},{"$f":"IF(AM6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AM6,\"|\",2),\"|\")))","v":"Certificate lifecycle management is documented"},"2.2.3.","|","| [3](#network-vulnerability-management-is-implemented-and-maintained) | Network vulnerability management is implemented and maintained |      3 |","2.3.3.",{"$f":"IF(AS6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AS6,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(AS6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AS6,\"|\",2),\"|\")))","v":"Network vulnerability management is implemented and maintained"},"2.3.3.","|","| [3](#the-change-management-process-is-documented-and-implemented) | The change management process is documented and implemented |      4 |","2.4.3.",{"$f":"IF(AY6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AY6,\"|\",3),\"|\")))","v":"4"},{"$f":"IF(AY6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AY6,\"|\",2),\"|\")))","v":"The change management process is documented and implemented"},"2.4.3.","|","| [3](#business-continuity-planning-and-disaster-recovery) | Business continuity planning and disaster recovery |      5 |","3.1.3.",{"$f":"IF(BE6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BE6,\"|\",3),\"|\")))","v":"5"},{"$f":"IF(BE6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BE6,\"|\",2),\"|\")))","v":"Business continuity planning and disaster recovery"},"3.1.3.","|","| [3](#adoption-and-application-of-open-standards) | Adoption and application of open standards |      3 |","3.2.3.",{"$f":"IF(BK6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BK6,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(BK6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BK6,\"|\",2),\"|\")))","v":"Adoption and application of open standards"},"3.2.3.","|","|                                          [3](#audit-trail-can-be-reconstructed-from-audit-logs) | Audit trail can be reconstructed from audit logs                                          |      5 |","3.3.3.",{"$f":"IF(BQ6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BQ6,\"|\",3),\"|\")))","v":"5"},{"$f":"IF(BQ6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BQ6,\"|\",2),\"|\")))","v":"Audit trail can be reconstructed from audit logs"},"3.3.3.","|","|            [3](#incidents-and-exceptions-handling) | Incidents and exceptions handling            |      1 |","3.4.3.",{"$f":"IF(BW6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BW6,\"|\",3),\"|\")))","v":"1"},{"$f":"IF(BW6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BW6,\"|\",2),\"|\")))","v":"Incidents and exceptions handling"},"3.4.3.","|","|               [3](#availability-of-resources) | Availability of resources               |      4 |","4.1.3.",{"$f":"IF(CC6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CC6,\"|\",3),\"|\")))","v":"4"},{"$f":"IF(CC6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CC6,\"|\",2),\"|\")))","v":"Availability of resources"},"4.1.3.","|","|    [3](#perform-security-awareness-training) | Perform security awareness training    |      2 |","4.2.3.",{"$f":"IF(CI6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CI6,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(CI6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CI6,\"|\",2),\"|\")))","v":"Perform security awareness training"},"4.2.3.","|","|             [3](#establish-single-point-of-contact) | Establish single point of contact             |      1 |","4.3.3.",{"$f":"IF(CO6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CO6,\"|\",3),\"|\")))","v":"1"},{"$f":"IF(CO6=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CO6,\"|\",2),\"|\")))","v":"Establish single point of contact"},"4.3.3.","|","|  3 | **[Compliance](../compliance/)**                                       | Adherence to standards and applicable regulations and requirements for the PKI and trust services. Standards and regulations may be internal or external, country specific or purpose specific.                                             |",{"$f":"IF(CU6=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU6,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":"1.3."},"Adherence to standards and applicable regulations and requirements for the PKI and trust services. Standards and regulations may be internal or external, country specific or purpose specific.","|","| **Compliance**                    |      2 |","Compliance","2","|"]
["only the actual content and copy",4,"| 4 | **[Managed](#managed-maturity-level)**     | Processes are measured and controlled, proactive approach                                                    |",{"$f":"TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(C7,\"|\"),\"|\"))","v":"4"},null,null,"Processes are measured and controlled, proactive approach","|","|          [4](#architecture-and-design-of-the-PKI) | Architecture and design of the PKI          |      1 |",{"$f":"IF(I7=\"\",\"\",_xlfn.CONCAT($J$2,$B7,\".\"))","v":"1.1.4."},{"$f":"IF(I7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(I7,\"|\",3),\"|\")))","v":"1"},{"$f":"IF(I7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(I7,\"|\",2),\"|\")))","v":"Architecture and design of the PKI"},"1.1.4.","|","|             [4](#disclosure-statement-is-documented-and-published) | Disclosure statement is documented and published             |      4 |","1.2.4.",{"$f":"IF(O7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(O7,\"|\",3),\"|\")))","v":"4"},{"$f":"IF(O7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(O7,\"|\",2),\"|\")))","v":"Disclosure statement is documented and published"},"1.2.4.","|","| [4](#list-of-relevant-laws-regulations-and-standards-exist-and-is-maintained) | List of relevant laws, regulations, and standards, exist and is maintained |      5 |","1.3.4.",{"$f":"IF(U7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(U7,\"|\",3),\"|\")))","v":"5"},{"$f":"IF(U7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(U7,\"|\",2),\"|\")))","v":"List of relevant laws, regulations, and standards, exist and is maintained"},"1.3.4.","|","|          [4](#evidence-from-procedures-is-collected-and-maintained) | Evidence from procedures is collected and maintained          |      3 |","1.4.4.",{"$f":"IF(AA7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AA7,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(AA7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AA7,\"|\",2),\"|\")))","v":"Evidence from procedures is collected and maintained"},"1.4.4.","|","|      [4](#each-cryptographic-key-is-defined-and-has-documented-lifecycle-procedures) | Each cryptographic key is defined and has documented lifecycle procedures      |      2 |","2.1.4.",{"$f":"IF(AG7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AG7,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(AG7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AG7,\"|\",2),\"|\")))","v":"Each cryptographic key is defined and has documented lifecycle procedures"},"2.1.4.","|","|              [4](#inventory-of-issued-certificates-is-documented) | Inventory of issued certificates is documented              |      3 |","2.2.4.",{"$f":"IF(AM7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AM7,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(AM7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AM7,\"|\",2),\"|\")))","v":"Inventory of issued certificates is documented"},"2.2.4.","|","|                    [4](#infrastructure-recovery-objectives-controls) | Infrastructure recovery objectives controls                    |      1 |","2.3.4.",{"$f":"IF(AS7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AS7,\"|\",3),\"|\")))","v":"1"},{"$f":"IF(AS7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AS7,\"|\",2),\"|\")))","v":"Infrastructure recovery objectives controls"},"2.3.4.","|","|                     [4](#requirements-for-agility-are-identified) | Requirements for agility are identified                     |      2 |","2.4.4.",{"$f":"IF(AY7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AY7,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(AY7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AY7,\"|\",2),\"|\")))","v":"Requirements for agility are identified"},"2.4.4.","|","|                         [4](#technology-future-proofing) | Technology future proofing                         |      3 |","3.1.4.",{"$f":"IF(BE7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BE7,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(BE7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BE7,\"|\",2),\"|\")))","v":"Technology future proofing"},"3.1.4.","|",null,"",{"$f":"IF(BK7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BK7,\"|\",3),\"|\")))","v":""},{"$f":"IF(BK7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BK7,\"|\",2),\"|\")))","v":""},"","|","|                              [4](#monitoring-of-operational-and-security-events-is-implemented) | Monitoring of operational and security events is implemented                              |      5 |","3.3.4.",{"$f":"IF(BQ7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BQ7,\"|\",3),\"|\")))","v":"5"},{"$f":"IF(BQ7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BQ7,\"|\",2),\"|\")))","v":"Monitoring of operational and security events is implemented"},"3.3.4.","|",null,"",{"$f":"IF(BW7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BW7,\"|\",3),\"|\")))","v":""},{"$f":"IF(BW7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BW7,\"|\",2),\"|\")))","v":""},"","|","|     [4](#resources-are-periodically-reviewed) | Resources are periodically reviewed     |      3 |","4.1.4.",{"$f":"IF(CC7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CC7,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(CC7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CC7,\"|\",2),\"|\")))","v":"Resources are periodically reviewed"},"4.1.4.","|","|               [4](#establish-education-plan) | Establish education plan               |      1 |","4.2.4.",{"$f":"IF(CI7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CI7,\"|\",3),\"|\")))","v":"1"},{"$f":"IF(CI7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CI7,\"|\",2),\"|\")))","v":"Establish education plan"},"4.2.4.","|","| [4](#timely-communication-of-important-information) | Timely communication of important information |      2 |","4.3.4.",{"$f":"IF(CO7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CO7,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(CO7=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CO7,\"|\",2),\"|\")))","v":"Timely communication of important information"},"4.3.4.","|","|  4 | **[Processes and procedures](../processes-and-procedures/)**           | Processes and procedures related to PKI management tasks and operational activities. This includes also the supply chain procedures and processes that includes acceptance or receipt of the HW and SW related to the PKI.                  |",{"$f":"IF(CU7=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU7,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":"1.4."},"Processes and procedures related to PKI management tasks and operational activities. This includes also the supply chain procedures and processes that includes acceptance or receipt of the HW and SW related to the PKI.","|","| **Processes and procedures**      |      3 |","Processes and procedures","3","|"]
["2. in Excel, insert in the upper box on the source sheet",5,"| 5 | **[Optimized](#optimized-maturity-level)** | Continuous improvement of the processes and procedures, proactive approach for future technology improvement |",{"$f":"TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(C8,\"|\"),\"|\"))","v":"5"},null,null,"Continuous improvement of the processes and procedures, proactive approach for future technology improvement","|",null,{"$f":"IF(I8=\"\",\"\",_xlfn.CONCAT($J$2,$B8,\".\"))","v":""},{"$f":"IF(I8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(I8,\"|\",3),\"|\")))","v":""},{"$f":"IF(I8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(I8,\"|\",3),\"|\")))","v":""},"","|","|               [5](#policies-are-periodically-reviewed-and-updated) | Policies are periodically reviewed and updated               |      3 |","1.2.5.",{"$f":"IF(O8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(O8,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(O8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(O8,\"|\",2),\"|\")))","v":"Policies are periodically reviewed and updated"},"1.2.5.","|",null,"",{"$f":"IF(U8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(U8,\"|\",3),\"|\")))","v":""},{"$f":"IF(U8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(U8,\"|\",2),\"|\")))","v":""},"","|","|             [5](#processes-and-procedures-are-reviewed-and-updated) | Processes and procedures are reviewed and updated             |      2 |","1.4.5.",{"$f":"IF(AA8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AA8,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(AA8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AA8,\"|\",2),\"|\")))","v":"Processes and procedures are reviewed and updated"},"1.4.5.","|","|        [5](#cryptographic-cipher-suites-and-protocols-are-documented-and-maintained) | Cryptographic cipher suites and protocols are documented and maintained        |      2 |","2.1.5.",{"$f":"IF(AG8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AG8,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(AG8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AG8,\"|\",2),\"|\")))","v":"Cryptographic cipher suites and protocols are documented and maintained"},"2.1.5.","|","|                 [5](#certificate-discovery-process-is-documented) | Certificate discovery process is documented                 |      2 |","2.2.5.",{"$f":"IF(AM8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AM8,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(AM8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AM8,\"|\",2),\"|\")))","v":"Certificate discovery process is documented"},"2.2.5.","|","|            [5](#infrastructure-activities-are-periodically-reviewed) | Infrastructure activities are periodically reviewed            |      2 |","2.3.5.",{"$f":"IF(AS8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AS8,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(AS8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AS8,\"|\",2),\"|\")))","v":"Infrastructure activities are periodically reviewed"},"2.3.5.","|","|      [5](#change-management-and-agility-is-periodically-reviewed) | Change management and agility is periodically reviewed      |      2 |","2.4.5.",{"$f":"IF(AY8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AY8,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(AY8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(AY8,\"|\",2),\"|\")))","v":"Change management and agility is periodically reviewed"},"2.4.5.","|","|                 [5](#competence-and-information-sharing) | Competence and information sharing                 |      3 |","3.1.5.",{"$f":"IF(BE8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BE8,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(BE8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BE8,\"|\",2),\"|\")))","v":"Competence and information sharing"},"3.1.5.","|",null,"",{"$f":"IF(BK8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BK8,\"|\",3),\"|\")))","v":""},{"$f":"IF(BK8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BK8,\"|\",2),\"|\")))","v":""},"","|","| [5](#critical-events-are-immediately-alerted-and-resolved-according-to-incident-response-plans) | Critical events are immediately alerted and resolved according to incident response plans |      3 |","3.3.5.",{"$f":"IF(BQ8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BQ8,\"|\",3),\"|\")))","v":"3"},{"$f":"IF(BQ8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BQ8,\"|\",2),\"|\")))","v":"Critical events are immediately alerted and resolved according to incident response plans"},"3.3.5.","|",null,"",{"$f":"IF(BW8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BW8,\"|\",3),\"|\")))","v":""},{"$f":"IF(BW8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(BW8,\"|\",2),\"|\")))","v":""},"","|",null,"",{"$f":"IF(CC8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CC8,\"|\",3),\"|\")))","v":""},{"$f":"IF(CC8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CC8,\"|\",2),\"|\")))","v":""},"","|","|          [5](#periodically-review-knowledge) | Periodically review knowledge          |      2 |","4.2.5.",{"$f":"IF(CI8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CI8,\"|\",3),\"|\")))","v":"2"},{"$f":"IF(CI8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CI8,\"|\",2),\"|\")))","v":"Periodically review knowledge"},"4.2.5.","|",null,"",{"$f":"IF(CO8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CO8,\"|\",3),\"|\")))","v":""},{"$f":"IF(CO8=\"\",\"\",TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CO8,\"|\",2),\"|\")))","v":""},"","|","|  5 | **[Key Management](../key-management/)**                               | Key management policy and procedures related to PKI cryptographic keys and its lifecycle. Inventory of cryptographic keys. Secure and trusted key ceremonies. Key escrow and key recovery if applicable.                                    |",{"$f":"IF(CU8=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU8,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":"2.1."},"Key management policy and procedures related to PKI cryptographic keys and its lifecycle. Inventory of cryptographic keys. Secure and trusted key ceremonies. Key escrow and key recovery if applicable.","|","| **Key Management**                |      4 |","Key Management","4","|"]
["3. in Github, mark everything from 2nd level anchor (like ## Details) bellow ",6,{"$nulls":5},"|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|","|                            [6](#key-management-is-periodically-reviewed-and-updated) | Key management is periodically reviewed and updated                            |      3 |","2.1.6.","3","Key management is periodically reviewed and updated","2.1.6.","|","| [6](#certificate-management-is-periodically-reviewed-and-updated) | Certificate management is periodically reviewed and updated |      4 |","2.2.6.","4","Certificate management is periodically reviewed and updated","2.2.6.","|",null,"","","","","|",null,"","","","","|","|                   [6](#continual-review-and-improvement) | Continual review and improvement                   |      4 |","3.1.6.","4","Continual review and improvement","3.1.6.","|",null,"","","","","|","|                                       [6](#review-of-events-and-logs-is-periodically-performed) | Review of events and logs is periodically performed                                       |      2 |","3.3.6.","2","Review of events and logs is periodically performed","3.3.6.","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|","|  6 | **[Certificate Management](../certificate-management/)**               | Certificate management policy and lifecycle. Inventory of certificates. Definition of the certificate profiles and supported states of the certificate including the transitions between the states. Proper validation fo the certificates. |",{"$f":"IF(CU9=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU9,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":"2.2."},"Certificate management policy and lifecycle. Inventory of certificates. Definition of the certificate profiles and supported states of the certificate including the transitions between the states. Proper validation fo the certificates.","|","| **Certificate Management**        |      4 |","Certificate Management","4","|"]
["the table to the end of the code and copy",7,{"$nulls":5},"|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|","|                               [7](#organizational-PKI-governance) | Organizational PKI governance                               |      2 |","2.2.7.","2","Organizational PKI governance","2.2.7.","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|","|  7 | **[Interoperability](../interoperability/)**                           | Interoperability between applications, implementations, and technologies. Application of interoperable protocols and standards. Transparency and vendor lock avoidance strategy.                                                            |",{"$f":"IF(CU10=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU10,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":"3.2."},"Interoperability between applications, implementations, and technologies. Application of interoperable protocols and standards. Transparency and vendor lock avoidance strategy.","|","| **Interoperability**              |      2 |","Interoperability","2","|"]
["4. in Excel, insert in the bottom box on the source sheet",8,{"$nulls":5},"|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|","|  8 | **[Infrastructure Management](../infrastructure-management/)**         | Availability of the PKI services, infrastructure setup to achieve availability goals. PKI continuity testing and infrastructure recovery. Infrastructure security controls.                                                                 |",{"$f":"IF(CU11=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU11,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":"2.3."},"Availability of the PKI services, infrastructure setup to achieve availability goals. PKI continuity testing and infrastructure recovery. Infrastructure security controls.","|","| **Infrastructure Management**     |      2 |","Infrastructure Management","2","|"]
["5. in Excel, mark the entire lower box after insertion (leave it marked after ",9,{"$nulls":5},"|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|","|  9 | **[Change Management and Agility](../change-management-and-agility/)** | Secure and controlled process for the change management. Formal process to request changes in the PKI, approval, staging, roll-back.                                                                                                        |",{"$f":"IF(CU12=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU12,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":"2.4."},"Secure and controlled process for the change management. Formal process to request changes in the PKI, approval, staging, roll-back.","|","| **Change Management and Agility** |      3 |","Change Management and Agility","3","|"]
["insertion) and replace \"=\" --> \"\" (not even a space)",10,{"$nulls":5},"|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|",null,"","","","","|","| 10 | **[Sourcing](../sourcing/)**                                           | Availability of skilled resources to manage PKI. Processes and procedures to maintain the required resources in time, monitoring of the skills.                                                                                             |",{"$f":"IF(CU13=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU13,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":"4.1."},"Availability of skilled resources to manage PKI. Processes and procedures to maintain the required resources in time, monitoring of the skills.","|","| **Sourcing**                      |      4 |","Sourcing","4","|"]
[{"$nulls":7},"|",{"$nulls":5},"|",{"$nulls":5},"|",{"$nulls":5},"|",{"$nulls":5},"|",{"$nulls":5},"|",{"$nulls":5},"|",{"$nulls":5},"|",{"$nulls":5},"|",{"$nulls":5},"|",{"$nulls":5},"|",{"$nulls":5},"|",{"$nulls":5},"|",{"$nulls":5},"|",{"$nulls":5},"|",{"$nulls":5},"|","| 11 | **[Knowledge and Training](../knowledge-and-training/)**               | Education of people and continuously gathering required knowledge and skills to manage PKI. Training plans and improvement.                                                                                                                 |",{"$f":"IF(CU14=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU14,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":"4.2."},"Education of people and continuously gathering required knowledge and skills to manage PKI. Training plans and improvement.","|","| **Knowledge and Training**        |      3 |","Knowledge and Training","3","|"]
[null,null,"## Initial maturity level",{"$f":"IF(AND(LEFT(C15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(C15,\" \"))=2,0)),_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(C15,\" \"),\" \"),D14)","v":"Initial"},{"$f":"IF(AND(LEFT(C15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(C15,\" \"))=3,0)),_xlfn.TEXTAFTER(C15,\" \"),E14)","v":0},{"$f":"_xlfn.CONCAT(VLOOKUP(D15,tech!$A$13:$B$17,2,0),LEFT(E15,1),IF(G15=\"\",\"X\",\"Y\"))","v":"10X"},{"$f":"IF(IF(LEFT(C15,1)=\"-\",C15,\"\")=\"\",\"\",REPLACE(IF(LEFT(C15,1)=\"-\",C15,\"\"),1,1,tech!$H$2))","v":""},"|","## Details",{"$f":"IF(AND(LEFT(I15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(I15,\" \"))=3,0)),_xlfn.TEXTAFTER(I15,\" \"),J14)","v":0},{"$f":"IF(AND(LEFT(I15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(I15,\" \"))=4,0)),_xlfn.TEXTAFTER(I15,\" \"),K14)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(J15,L$4:M$13,2,0),\"\"),LEFT(K15,1),IF(M15=\"\",IF(AND(M14<>\"\",M16<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(I15<>\"\",LEFT(I15,1)<>\"#\"),IF(LEFT(I15,1)=\"-\",REPLACE(I15,1,1,tech!$H$2),I15),\"\")","v":""},"|","## Details",{"$f":"IF(AND(LEFT(O15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(O15,\" \"))=3,0)),_xlfn.TEXTAFTER(O15,\" \"),P14)","v":0},{"$f":"IF(AND(LEFT(O15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(O15,\" \"))=4,0)),_xlfn.TEXTAFTER(O15,\" \"),Q14)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(P15,R$4:S$13,2,0),\"\"),LEFT(Q15,1),IF(S15=\"\",IF(AND(S14<>\"\",S16<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(O15<>\"\",LEFT(O15,1)<>\"#\"),IF(LEFT(O15,1)=\"-\",REPLACE(O15,1,1,tech!$H$2),O15),\"\")","v":""},"|","## Details",{"$f":"IF(AND(LEFT(U15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(U15,\" \"))=3,0)),_xlfn.TEXTAFTER(U15,\" \"),V14)","v":0},{"$f":"IF(AND(LEFT(U15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(U15,\" \"))=4,0)),_xlfn.TEXTAFTER(U15,\" \"),W14)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(V15,X$4:Y$13,2,0),\"\"),LEFT(W15,1),IF(Y15=\"\",IF(AND(Y14<>\"\",Y16<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(U15<>\"\",LEFT(U15,1)<>\"#\"),IF(LEFT(U15,1)=\"-\",REPLACE(U15,1,1,tech!$H$2),U15),\"\")","v":""},"|","## Details",{"$f":"IF(AND(LEFT(AA15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AA15,\" \"))=3,0)),_xlfn.TEXTAFTER(AA15,\" \"),AB14)","v":0},{"$f":"IF(AND(LEFT(AA15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AA15,\" \"))=4,0)),_xlfn.TEXTAFTER(AA15,\" \"),AC14)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AB15,AD$4:AE$13,2,0),\"\"),LEFT(AC15,1),IF(AE15=\"\",IF(AND(AE14<>\"\",AE16<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(AA15<>\"\",LEFT(AA15,1)<>\"#\"),IF(LEFT(AA15,1)=\"-\",REPLACE(AA15,1,1,tech!$H$2),AA15),\"\")","v":""},"|","## Details",{"$f":"IF(AND(LEFT(AG15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AG15,\" \"))=3,0)),_xlfn.TEXTAFTER(AG15,\" \"),AH14)","v":0},{"$f":"IF(AND(LEFT(AG15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AG15,\" \"))=4,0)),_xlfn.TEXTAFTER(AG15,\" \"),AI14)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AH15,AJ$4:AK$13,2,0),\"\"),LEFT(AI15,1),IF(AK15=\"\",IF(AND(AK14<>\"\",AK16<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(AG15<>\"\",LEFT(AG15,1)<>\"#\"),IF(LEFT(AG15,1)=\"-\",REPLACE(AG15,1,1,tech!$H$2),AG15),\"\")","v":""},"|","## Details",{"$f":"IF(AND(LEFT(AM15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AM15,\" \"))=3,0)),_xlfn.TEXTAFTER(AM15,\" \"),AN14)","v":0},{"$f":"IF(AND(LEFT(AM15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AM15,\" \"))=4,0)),_xlfn.TEXTAFTER(AM15,\" \"),AO14)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AN15,AP$4:AQ$13,2,0),\"\"),LEFT(AO15,1),IF(AQ15=\"\",IF(AND(AQ14<>\"\",AQ16<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(AM15<>\"\",LEFT(AM15,1)<>\"#\"),IF(LEFT(AM15,1)=\"-\",REPLACE(AM15,1,1,tech!$H$2),AM15),\"\")","v":""},"|","## Details",{"$f":"IF(AND(LEFT(AS15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AS15,\" \"))=3,0)),_xlfn.TEXTAFTER(AS15,\" \"),AT14)","v":0},{"$f":"IF(AND(LEFT(AS15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AS15,\" \"))=4,0)),_xlfn.TEXTAFTER(AS15,\" \"),AU14)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AT15,AV$4:AW$13,2,0),\"\"),LEFT(AU15,1),IF(AW15=\"\",IF(AND(AW14<>\"\",AW16<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(AS15<>\"\",LEFT(AS15,1)<>\"#\"),IF(LEFT(AS15,1)=\"-\",REPLACE(AS15,1,1,tech!$H$2),AS15),\"\")","v":""},"|","## Details",{"$f":"IF(AND(LEFT(AY15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AY15,\" \"))=3,0)),_xlfn.TEXTAFTER(AY15,\" \"),AZ14)","v":0},{"$f":"IF(AND(LEFT(AY15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AY15,\" \"))=4,0)),_xlfn.TEXTAFTER(AY15,\" \"),BA14)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AZ15,BB$4:BC$13,2,0),\"\"),LEFT(BA15,1),IF(BC15=\"\",IF(AND(BC14<>\"\",BC16<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(AY15<>\"\",LEFT(AY15,1)<>\"#\"),IF(LEFT(AY15,1)=\"-\",REPLACE(AY15,1,1,tech!$H$2),AY15),\"\")","v":""},"|","## Details",{"$f":"IF(AND(LEFT(BE15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BE15,\" \"))=3,0)),_xlfn.TEXTAFTER(BE15,\" \"),BF14)","v":0},{"$f":"IF(AND(LEFT(BE15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BE15,\" \"))=4,0)),_xlfn.TEXTAFTER(BE15,\" \"),BG14)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BF15,BH$4:BI$13,2,0),\"\"),LEFT(BG15,1),IF(BI15=\"\",IF(AND(BI14<>\"\",BI16<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(BE15<>\"\",LEFT(BE15,1)<>\"#\"),IF(LEFT(BE15,1)=\"-\",REPLACE(BE15,1,1,tech!$H$2),BE15),\"\")","v":""},"|","## Details",{"$f":"IF(AND(LEFT(BK15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BK15,\" \"))=3,0)),_xlfn.TEXTAFTER(BK15,\" \"),BL14)","v":0},{"$f":"IF(AND(LEFT(BK15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BK15,\" \"))=4,0)),_xlfn.TEXTAFTER(BK15,\" \"),BM14)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BL15,BN$4:BO$13,2,0),\"\"),LEFT(BM15,1),IF(BO15=\"\",IF(AND(BO14<>\"\",BO16<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(BK15<>\"\",LEFT(BK15,1)<>\"#\"),IF(LEFT(BK15,1)=\"-\",REPLACE(BK15,1,1,tech!$H$2),BK15),\"\")","v":""},"|","## Details",{"$f":"IF(AND(LEFT(BQ15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BQ15,\" \"))=3,0)),_xlfn.TEXTAFTER(BQ15,\" \"),BR14)","v":0},{"$f":"IF(AND(LEFT(BQ15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BQ15,\" \"))=4,0)),_xlfn.TEXTAFTER(BQ15,\" \"),BS14)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BR15,BT$4:BU$13,2,0),\"\"),LEFT(BS15,1),IF(BU15=\"\",IF(AND(BU14<>\"\",BU16<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(BQ15<>\"\",LEFT(BQ15,1)<>\"#\"),IF(LEFT(BQ15,1)=\"-\",REPLACE(BQ15,1,1,tech!$H$2),BQ15),\"\")","v":""},"|","## Details",{"$f":"IF(AND(LEFT(BW15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BW15,\" \"))=3,0)),_xlfn.TEXTAFTER(BW15,\" \"),BX14)","v":0},{"$f":"IF(AND(LEFT(BW15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BW15,\" \"))=4,0)),_xlfn.TEXTAFTER(BW15,\" \"),BY14)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BX15,BZ$4:CA$13,2,0),\"\"),LEFT(BY15,1),IF(CA15=\"\",IF(AND(CA14<>\"\",CA16<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(BW15<>\"\",LEFT(BW15,1)<>\"#\"),IF(LEFT(BW15,1)=\"-\",REPLACE(BW15,1,1,tech!$H$2),BW15),\"\")","v":""},"|","## Details",{"$f":"IF(AND(LEFT(CC15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CC15,\" \"))=3,0)),_xlfn.TEXTAFTER(CC15,\" \"),CD14)","v":0},{"$f":"IF(AND(LEFT(CC15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CC15,\" \"))=4,0)),_xlfn.TEXTAFTER(CC15,\" \"),CE14)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(CD15,CF$4:CG$13,2,0),\"\"),LEFT(CE15,1),IF(CG15=\"\",IF(AND(CG14<>\"\",CG16<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(CC15<>\"\",LEFT(CC15,1)<>\"#\"),IF(LEFT(CC15,1)=\"-\",REPLACE(CC15,1,1,tech!$H$2),CC15),\"\")","v":""},"|","## Details",{"$f":"IF(AND(LEFT(CI15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CI15,\" \"))=3,0)),_xlfn.TEXTAFTER(CI15,\" \"),CJ14)","v":0},{"$f":"IF(AND(LEFT(CI15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CI15,\" \"))=4,0)),_xlfn.TEXTAFTER(CI15,\" \"),CK14)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(CJ15,CL$4:CM$13,2,0),\"\"),LEFT(CK15,1),IF(CM15=\"\",IF(AND(CM14<>\"\",CM16<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(CI15<>\"\",LEFT(CI15,1)<>\"#\"),IF(LEFT(CI15,1)=\"-\",REPLACE(CI15,1,1,tech!$H$2),CI15),\"\")","v":""},"|","## Details",{"$f":"IF(AND(LEFT(CO15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CO15,\" \"))=3,0)),_xlfn.TEXTAFTER(CO15,\" \"),CP14)","v":0},{"$f":"IF(AND(LEFT(CO15,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CO15,\" \"))=4,0)),_xlfn.TEXTAFTER(CO15,\" \"),CQ14)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(CP15,CR$4:CS$13,2,0),\"\"),LEFT(CQ15,1),IF(CS15=\"\",IF(AND(CS14<>\"\",CS16<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(CO15<>\"\",LEFT(CO15,1)<>\"#\"),IF(LEFT(CO15,1)=\"-\",REPLACE(CO15,1,1,tech!$H$2),CO15),\"\")","v":""},"|","| 12 | **[Monitoring and Auditing](../monitoring-and-auditing/)**             | Measurement of the PKI metrics, collecting evidence, monitoring and alerting of relevant issues, including references to incident response management.                                                                                      |",{"$f":"IF(CU15=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU15,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":"3.3."},"Measurement of the PKI metrics, collecting evidence, monitoring and alerting of relevant issues, including references to incident response management.","|","| **Monitoring and Auditing**       |      2 |","Monitoring and Auditing","2","|"]
[{"$nulls":3},{"$f":"IF(AND(LEFT(C16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(C16,\" \"))=2,0)),_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(C16,\" \"),\" \"),D15)","v":"Initial"},{"$f":"IF(AND(LEFT(C16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(C16,\" \"))=3,0)),_xlfn.TEXTAFTER(C16,\" \"),E15)","v":0},{"$f":"_xlfn.CONCAT(VLOOKUP(D16,tech!$A$13:$B$17,2,0),LEFT(E16,1),IF(G16=\"\",\"X\",\"Y\"))","v":"10X"},{"$f":"IF(IF(LEFT(C16,1)=\"-\",C16,\"\")=\"\",\"\",REPLACE(IF(LEFT(C16,1)=\"-\",C16,\"\"),1,1,tech!$H$2))","v":""},"|",null,{"$f":"IF(AND(LEFT(I16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(I16,\" \"))=3,0)),_xlfn.TEXTAFTER(I16,\" \"),J15)","v":0},{"$f":"IF(AND(LEFT(I16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(I16,\" \"))=4,0)),_xlfn.TEXTAFTER(I16,\" \"),K15)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(J16,$L$4:$M$13,2,0),\"\"),LEFT(K16,1),IF(M16=\"\",IF(AND(M15<>\"\",M17<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(I16<>\"\",LEFT(I16,1)<>\"#\"),IF(LEFT(I16,1)=\"-\",REPLACE(I16,1,1,tech!$H$2),I16),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(O16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(O16,\" \"))=3,0)),_xlfn.TEXTAFTER(O16,\" \"),P15)","v":0},{"$f":"IF(AND(LEFT(O16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(O16,\" \"))=4,0)),_xlfn.TEXTAFTER(O16,\" \"),Q15)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(P16,$R$4:$S$13,2,0),\"\"),LEFT(Q16,1),IF(S16=\"\",IF(AND(S15<>\"\",S17<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(O16<>\"\",LEFT(O16,1)<>\"#\"),IF(LEFT(O16,1)=\"-\",REPLACE(O16,1,1,tech!$H$2),O16),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(U16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(U16,\" \"))=3,0)),_xlfn.TEXTAFTER(U16,\" \"),V15)","v":0},{"$f":"IF(AND(LEFT(U16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(U16,\" \"))=4,0)),_xlfn.TEXTAFTER(U16,\" \"),W15)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(V16,X$4:Y$13,2,0),\"\"),LEFT(W16,1),IF(Y16=\"\",IF(AND(Y15<>\"\",Y17<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(U16<>\"\",LEFT(U16,1)<>\"#\"),IF(LEFT(U16,1)=\"-\",REPLACE(U16,1,1,tech!$H$2),U16),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(AA16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AA16,\" \"))=3,0)),_xlfn.TEXTAFTER(AA16,\" \"),AB15)","v":0},{"$f":"IF(AND(LEFT(AA16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AA16,\" \"))=4,0)),_xlfn.TEXTAFTER(AA16,\" \"),AC15)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AB16,AD$4:AE$13,2,0),\"\"),LEFT(AC16,1),IF(AE16=\"\",IF(AND(AE15<>\"\",AE17<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(AA16<>\"\",LEFT(AA16,1)<>\"#\"),IF(LEFT(AA16,1)=\"-\",REPLACE(AA16,1,1,tech!$H$2),AA16),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(AG16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AG16,\" \"))=3,0)),_xlfn.TEXTAFTER(AG16,\" \"),AH15)","v":0},{"$f":"IF(AND(LEFT(AG16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AG16,\" \"))=4,0)),_xlfn.TEXTAFTER(AG16,\" \"),AI15)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AH16,AJ$4:AK$13,2,0),\"\"),LEFT(AI16,1),IF(AK16=\"\",IF(AND(AK15<>\"\",AK17<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(AG16<>\"\",LEFT(AG16,1)<>\"#\"),IF(LEFT(AG16,1)=\"-\",REPLACE(AG16,1,1,tech!$H$2),AG16),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(AM16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AM16,\" \"))=3,0)),_xlfn.TEXTAFTER(AM16,\" \"),AN15)","v":0},{"$f":"IF(AND(LEFT(AM16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AM16,\" \"))=4,0)),_xlfn.TEXTAFTER(AM16,\" \"),AO15)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AN16,AP$4:AQ$13,2,0),\"\"),LEFT(AO16,1),IF(AQ16=\"\",IF(AND(AQ15<>\"\",AQ17<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(AM16<>\"\",LEFT(AM16,1)<>\"#\"),IF(LEFT(AM16,1)=\"-\",REPLACE(AM16,1,1,tech!$H$2),AM16),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(AS16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AS16,\" \"))=3,0)),_xlfn.TEXTAFTER(AS16,\" \"),AT15)","v":0},{"$f":"IF(AND(LEFT(AS16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AS16,\" \"))=4,0)),_xlfn.TEXTAFTER(AS16,\" \"),AU15)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AT16,AV$4:AW$13,2,0),\"\"),LEFT(AU16,1),IF(AW16=\"\",IF(AND(AW15<>\"\",AW17<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(AS16<>\"\",LEFT(AS16,1)<>\"#\"),IF(LEFT(AS16,1)=\"-\",REPLACE(AS16,1,1,tech!$H$2),AS16),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(AY16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AY16,\" \"))=3,0)),_xlfn.TEXTAFTER(AY16,\" \"),AZ15)","v":0},{"$f":"IF(AND(LEFT(AY16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AY16,\" \"))=4,0)),_xlfn.TEXTAFTER(AY16,\" \"),BA15)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AZ16,BB$4:BC$13,2,0),\"\"),LEFT(BA16,1),IF(BC16=\"\",IF(AND(BC15<>\"\",BC17<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(AY16<>\"\",LEFT(AY16,1)<>\"#\"),IF(LEFT(AY16,1)=\"-\",REPLACE(AY16,1,1,tech!$H$2),AY16),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(BE16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BE16,\" \"))=3,0)),_xlfn.TEXTAFTER(BE16,\" \"),BF15)","v":0},{"$f":"IF(AND(LEFT(BE16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BE16,\" \"))=4,0)),_xlfn.TEXTAFTER(BE16,\" \"),BG15)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BF16,BH$4:BI$13,2,0),\"\"),LEFT(BG16,1),IF(BI16=\"\",IF(AND(BI15<>\"\",BI17<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(BE16<>\"\",LEFT(BE16,1)<>\"#\"),IF(LEFT(BE16,1)=\"-\",REPLACE(BE16,1,1,tech!$H$2),BE16),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(BK16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BK16,\" \"))=3,0)),_xlfn.TEXTAFTER(BK16,\" \"),BL15)","v":0},{"$f":"IF(AND(LEFT(BK16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BK16,\" \"))=4,0)),_xlfn.TEXTAFTER(BK16,\" \"),BM15)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BL16,BN$4:BO$13,2,0),\"\"),LEFT(BM16,1),IF(BO16=\"\",IF(AND(BO15<>\"\",BO17<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(BK16<>\"\",LEFT(BK16,1)<>\"#\"),IF(LEFT(BK16,1)=\"-\",REPLACE(BK16,1,1,tech!$H$2),BK16),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(BQ16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BQ16,\" \"))=3,0)),_xlfn.TEXTAFTER(BQ16,\" \"),BR15)","v":0},{"$f":"IF(AND(LEFT(BQ16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BQ16,\" \"))=4,0)),_xlfn.TEXTAFTER(BQ16,\" \"),BS15)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BR16,BT$4:BU$13,2,0),\"\"),LEFT(BS16,1),IF(BU16=\"\",IF(AND(BU15<>\"\",BU17<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(BQ16<>\"\",LEFT(BQ16,1)<>\"#\"),IF(LEFT(BQ16,1)=\"-\",REPLACE(BQ16,1,1,tech!$H$2),BQ16),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(BW16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BW16,\" \"))=3,0)),_xlfn.TEXTAFTER(BW16,\" \"),BX15)","v":0},{"$f":"IF(AND(LEFT(BW16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BW16,\" \"))=4,0)),_xlfn.TEXTAFTER(BW16,\" \"),BY15)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BX16,BZ$4:CA$13,2,0),\"\"),LEFT(BY16,1),IF(CA16=\"\",IF(AND(CA15<>\"\",CA17<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(BW16<>\"\",LEFT(BW16,1)<>\"#\"),IF(LEFT(BW16,1)=\"-\",REPLACE(BW16,1,1,tech!$H$2),BW16),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(CC16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CC16,\" \"))=3,0)),_xlfn.TEXTAFTER(CC16,\" \"),CD15)","v":0},{"$f":"IF(AND(LEFT(CC16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CC16,\" \"))=4,0)),_xlfn.TEXTAFTER(CC16,\" \"),CE15)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(CD16,CF$4:CG$13,2,0),\"\"),LEFT(CE16,1),IF(CG16=\"\",IF(AND(CG15<>\"\",CG17<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(CC16<>\"\",LEFT(CC16,1)<>\"#\"),IF(LEFT(CC16,1)=\"-\",REPLACE(CC16,1,1,tech!$H$2),CC16),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(CI16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CI16,\" \"))=3,0)),_xlfn.TEXTAFTER(CI16,\" \"),CJ15)","v":0},{"$f":"IF(AND(LEFT(CI16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CI16,\" \"))=4,0)),_xlfn.TEXTAFTER(CI16,\" \"),CK15)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(CJ16,CL$4:CM$13,2,0),\"\"),LEFT(CK16,1),IF(CM16=\"\",IF(AND(CM15<>\"\",CM17<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(CI16<>\"\",LEFT(CI16,1)<>\"#\"),IF(LEFT(CI16,1)=\"-\",REPLACE(CI16,1,1,tech!$H$2),CI16),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(CO16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CO16,\" \"))=3,0)),_xlfn.TEXTAFTER(CO16,\" \"),CP15)","v":0},{"$f":"IF(AND(LEFT(CO16,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CO16,\" \"))=4,0)),_xlfn.TEXTAFTER(CO16,\" \"),CQ15)","v":0},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(CP16,CR$4:CS$13,2,0),\"\"),LEFT(CQ16,1),IF(CS16=\"\",IF(AND(CS15<>\"\",CS17<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"0X"},{"$f":"IF(AND(CO16<>\"\",LEFT(CO16,1)<>\"#\"),IF(LEFT(CO16,1)=\"-\",REPLACE(CO16,1,1,tech!$H$2),CO16),\"\")","v":""},"|","| 13 | **[Automation](../automation/)**                                       | Automation of certificate lifecycle management. Technology and tools for the automation. Monitoring of automated certificate operations.                                                                                                    |",{"$f":"IF(CU16=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU16,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":"3.4."},"Automation of certificate lifecycle management. Technology and tools for the automation. Monitoring of automated certificate operations.","|","| **Automation**                    |      2 |","Automation","2","|"]
[null,null,"### Indicators","Initial",{"$f":"IF(AND(LEFT(C17,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(C17,\" \"))=3,0)),_xlfn.TEXTAFTER(C17,\" \"),E16)","v":"Indicators"},{"$f":"_xlfn.CONCAT(VLOOKUP(D17,tech!$A$13:$B$17,2,0),LEFT(E17,1),IF(G17=\"\",\"X\",\"Y\"))","v":"1IX"},{"$f":"IF(IF(LEFT(C17,1)=\"-\",C17,\"\")=\"\",\"\",REPLACE(IF(LEFT(C17,1)=\"-\",C17,\"\"),1,1,tech!$H$2))","v":""},"|","### Organizational sponsor and support","Organizational sponsor and support",0,"1.1.1.0X",{"$f":"IF(AND(I17<>\"\",LEFT(I17,1)<>\"#\"),IF(LEFT(I17,1)=\"-\",REPLACE(I17,1,1,tech!$H$2),I17),\"\")","v":""},"|","### The scope of policies is defined and documented","The scope of policies is defined and documented",0,"1.2.1.0X",{"$f":"IF(AND(O17<>\"\",LEFT(O17,1)<>\"#\"),IF(LEFT(O17,1)=\"-\",REPLACE(O17,1,1,tech!$H$2),O17),\"\")","v":""},"|","### Compliance policies are defined, implemented, and communicated","Compliance policies are defined, implemented, and communicated",0,"1.3.1.0X",{"$f":"IF(AND(U17<>\"\",LEFT(U17,1)<>\"#\"),IF(LEFT(U17,1)=\"-\",REPLACE(U17,1,1,tech!$H$2),U17),\"\")","v":""},"|","### Scope of processes and procedure is aligned with policies","Scope of processes and procedure is aligned with policies",0,"1.4.1.0X",{"$f":"IF(AND(AA17<>\"\",LEFT(AA17,1)<>\"#\"),IF(LEFT(AA17,1)=\"-\",REPLACE(AA17,1,1,tech!$H$2),AA17),\"\")","v":""},"|","### Key management roles and responsibilities are documented and formally assigned","Key management roles and responsibilities are documented and formally assigned",0,"2.1.1.0X",{"$f":"IF(AND(AG17<>\"\",LEFT(AG17,1)<>\"#\"),IF(LEFT(AG17,1)=\"-\",REPLACE(AG17,1,1,tech!$H$2),AG17),\"\")","v":""},"|","### Certificate profiles are documented","Certificate profiles are documented",0,"2.2.1.0X",{"$f":"IF(AND(AM17<>\"\",LEFT(AM17,1)<>\"#\"),IF(LEFT(AM17,1)=\"-\",REPLACE(AM17,1,1,tech!$H$2),AM17),\"\")","v":""},"|","### Network and deployment infrastructure is documented","Network and deployment infrastructure is documented",0,"2.3.1.0X",{"$f":"IF(AND(AS17<>\"\",LEFT(AS17,1)<>\"#\"),IF(LEFT(AS17,1)=\"-\",REPLACE(AS17,1,1,tech!$H$2),AS17),\"\")","v":""},"|","### The policy for change management and agility is documented","The policy for change management and agility is documented",0,"2.4.1.0X",{"$f":"IF(AND(AY17<>\"\",LEFT(AY17,1)<>\"#\"),IF(LEFT(AY17,1)=\"-\",REPLACE(AY17,1,1,tech!$H$2),AY17),\"\")","v":""},"|","### Risk assessment and business impact analysis","Risk assessment and business impact analysis",0,"3.1.1.0X",{"$f":"IF(AND(BE17<>\"\",LEFT(BE17,1)<>\"#\"),IF(LEFT(BE17,1)=\"-\",REPLACE(BE17,1,1,tech!$H$2),BE17),\"\")","v":""},"|","### Maintain PKI interoperability strategy","Maintain PKI interoperability strategy",0,"3.2.1.0X",{"$f":"IF(AND(BK17<>\"\",LEFT(BK17,1)<>\"#\"),IF(LEFT(BK17,1)=\"-\",REPLACE(BK17,1,1,tech!$H$2),BK17),\"\")","v":""},"|","### Monitoring events and logging requirements are defined and documented","Monitoring events and logging requirements are defined and documented",0,"3.3.1.0X",{"$f":"IF(AND(BQ17<>\"\",LEFT(BQ17,1)<>\"#\"),IF(LEFT(BQ17,1)=\"-\",REPLACE(BQ17,1,1,tech!$H$2),BQ17),\"\")","v":""},"|","### Process automation description","Process automation description",0,"3.4.1.0X",{"$f":"IF(AND(BW17<>\"\",LEFT(BW17,1)<>\"#\"),IF(LEFT(BW17,1)=\"-\",REPLACE(BW17,1,1,tech!$H$2),BW17),\"\")","v":""},"|","### Resources are identified and documented","Resources are identified and documented",0,"4.1.1.0X",{"$f":"IF(AND(CC17<>\"\",LEFT(CC17,1)<>\"#\"),IF(LEFT(CC17,1)=\"-\",REPLACE(CC17,1,1,tech!$H$2),CC17),\"\")","v":""},"|","### Establish training plan","Establish training plan",0,"4.2.1.0X",{"$f":"IF(AND(CI17<>\"\",LEFT(CI17,1)<>\"#\"),IF(LEFT(CI17,1)=\"-\",REPLACE(CI17,1,1,tech!$H$2),CI17),\"\")","v":""},"|","### Establish and maintain awareness plan","Establish and maintain awareness plan",0,"4.3.1.0X",{"$f":"IF(AND(CO17<>\"\",LEFT(CO17,1)<>\"#\"),IF(LEFT(CO17,1)=\"-\",REPLACE(CO17,1,1,tech!$H$2),CO17),\"\")","v":""},"|","| 14 | **[Awareness](../awareness/)**                                         | Providing awareness about the PKI in the organization and its purpose. Awareness how to apply the PKI in a trusted and secure way.                                                                                                          |",{"$f":"IF(CU17=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU17,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":"4.3."},"Providing awareness about the PKI in the organization and its purpose. Awareness how to apply the PKI in a trusted and secure way.","|","| **Awareness**                     |      3 |","Awareness","3","|"]
[{"$nulls":3},"Initial","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D18,tech!$A$13:$B$17,2,0),LEFT(E18,1),IF(G18=\"\",\"X\",\"Y\"))","v":"1IX"},{"$f":"IF(IF(LEFT(C18,1)=\"-\",C18,\"\")=\"\",\"\",REPLACE(IF(LEFT(C18,1)=\"-\",C18,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Organizational sponsor and support",0,"1.1.1.0X",{"$f":"IF(AND(I18<>\"\",LEFT(I18,1)<>\"#\"),IF(LEFT(I18,1)=\"-\",REPLACE(I18,1,1,tech!$H$2),I18),\"\")","v":""},"|",null,"The scope of policies is defined and documented",0,"1.2.1.0X",{"$f":"IF(AND(O18<>\"\",LEFT(O18,1)<>\"#\"),IF(LEFT(O18,1)=\"-\",REPLACE(O18,1,1,tech!$H$2),O18),\"\")","v":""},"|",null,"Compliance policies are defined, implemented, and communicated",0,"1.3.1.0X",{"$f":"IF(AND(U18<>\"\",LEFT(U18,1)<>\"#\"),IF(LEFT(U18,1)=\"-\",REPLACE(U18,1,1,tech!$H$2),U18),\"\")","v":""},"|",null,"Scope of processes and procedure is aligned with policies",0,"1.4.1.0X",{"$f":"IF(AND(AA18<>\"\",LEFT(AA18,1)<>\"#\"),IF(LEFT(AA18,1)=\"-\",REPLACE(AA18,1,1,tech!$H$2),AA18),\"\")","v":""},"|",null,"Key management roles and responsibilities are documented and formally assigned",0,"2.1.1.0X",{"$f":"IF(AND(AG18<>\"\",LEFT(AG18,1)<>\"#\"),IF(LEFT(AG18,1)=\"-\",REPLACE(AG18,1,1,tech!$H$2),AG18),\"\")","v":""},"|",null,"Certificate profiles are documented",0,"2.2.1.0X",{"$f":"IF(AND(AM18<>\"\",LEFT(AM18,1)<>\"#\"),IF(LEFT(AM18,1)=\"-\",REPLACE(AM18,1,1,tech!$H$2),AM18),\"\")","v":""},"|",null,"Network and deployment infrastructure is documented",0,"2.3.1.0X",{"$f":"IF(AND(AS18<>\"\",LEFT(AS18,1)<>\"#\"),IF(LEFT(AS18,1)=\"-\",REPLACE(AS18,1,1,tech!$H$2),AS18),\"\")","v":""},"|",null,"The policy for change management and agility is documented",0,"2.4.1.0X",{"$f":"IF(AND(AY18<>\"\",LEFT(AY18,1)<>\"#\"),IF(LEFT(AY18,1)=\"-\",REPLACE(AY18,1,1,tech!$H$2),AY18),\"\")","v":""},"|",null,"Risk assessment and business impact analysis",0,"3.1.1.0X",{"$f":"IF(AND(BE18<>\"\",LEFT(BE18,1)<>\"#\"),IF(LEFT(BE18,1)=\"-\",REPLACE(BE18,1,1,tech!$H$2),BE18),\"\")","v":""},"|",null,"Maintain PKI interoperability strategy",0,"3.2.1.0X",{"$f":"IF(AND(BK18<>\"\",LEFT(BK18,1)<>\"#\"),IF(LEFT(BK18,1)=\"-\",REPLACE(BK18,1,1,tech!$H$2),BK18),\"\")","v":""},"|",null,"Monitoring events and logging requirements are defined and documented",0,"3.3.1.0X",{"$f":"IF(AND(BQ18<>\"\",LEFT(BQ18,1)<>\"#\"),IF(LEFT(BQ18,1)=\"-\",REPLACE(BQ18,1,1,tech!$H$2),BQ18),\"\")","v":""},"|",null,"Process automation description",0,"3.4.1.0X",{"$f":"IF(AND(BW18<>\"\",LEFT(BW18,1)<>\"#\"),IF(LEFT(BW18,1)=\"-\",REPLACE(BW18,1,1,tech!$H$2),BW18),\"\")","v":""},"|",null,"Resources are identified and documented",0,"4.1.1.0X",{"$f":"IF(AND(CC18<>\"\",LEFT(CC18,1)<>\"#\"),IF(LEFT(CC18,1)=\"-\",REPLACE(CC18,1,1,tech!$H$2),CC18),\"\")","v":""},"|",null,"Establish training plan",0,"4.2.1.0X",{"$f":"IF(AND(CI18<>\"\",LEFT(CI18,1)<>\"#\"),IF(LEFT(CI18,1)=\"-\",REPLACE(CI18,1,1,tech!$H$2),CI18),\"\")","v":""},"|",null,"Establish and maintain awareness plan",0,"4.3.1.0X",{"$f":"IF(AND(CO18<>\"\",LEFT(CO18,1)<>\"#\"),IF(LEFT(CO18,1)=\"-\",REPLACE(CO18,1,1,tech!$H$2),CO18),\"\")","v":""},"|","| 15 | **[Resilience](../resilience/)**                                       | Quickly respond to potential attack and unavailability of the PKI services or other related resources.                                                                                                                                      |",{"$f":"IF(CU18=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU18,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":"3.1."},"Quickly respond to potential attack and unavailability of the PKI services or other related resources.","|","| **Resilience**                    |      4 |","Resilience","4","|"]
[null,null,"- PKI is ad-hoc managed, reactive","Initial","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D19,tech!$A$13:$B$17,2,0),LEFT(E19,1),IF(G19=\"\",\"X\",\"Y\"))","v":"1IY"},{"$f":"IF(IF(LEFT(C19,1)=\"-\",C19,\"\")=\"\",\"\",REPLACE(IF(LEFT(C19,1)=\"-\",C19,\"\"),1,1,tech!$H$2))","v":"• PKI is ad-hoc managed, reactive"},"|","#### Guidance","Organizational sponsor and support","Guidance","1.1.1.GX",{"$f":"IF(AND(I19<>\"\",LEFT(I19,1)<>\"#\"),IF(LEFT(I19,1)=\"-\",REPLACE(I19,1,1,tech!$H$2),I19),\"\")","v":""},"|","#### Guidance","The scope of policies is defined and documented","Guidance","1.2.1.GX",{"$f":"IF(AND(O19<>\"\",LEFT(O19,1)<>\"#\"),IF(LEFT(O19,1)=\"-\",REPLACE(O19,1,1,tech!$H$2),O19),\"\")","v":""},"|","#### Guidance","Compliance policies are defined, implemented, and communicated","Guidance","1.3.1.GX",{"$f":"IF(AND(U19<>\"\",LEFT(U19,1)<>\"#\"),IF(LEFT(U19,1)=\"-\",REPLACE(U19,1,1,tech!$H$2),U19),\"\")","v":""},"|","#### Guidance","Scope of processes and procedure is aligned with policies","Guidance","1.4.1.GX",{"$f":"IF(AND(AA19<>\"\",LEFT(AA19,1)<>\"#\"),IF(LEFT(AA19,1)=\"-\",REPLACE(AA19,1,1,tech!$H$2),AA19),\"\")","v":""},"|","#### Guidance","Key management roles and responsibilities are documented and formally assigned","Guidance","2.1.1.GX",{"$f":"IF(AND(AG19<>\"\",LEFT(AG19,1)<>\"#\"),IF(LEFT(AG19,1)=\"-\",REPLACE(AG19,1,1,tech!$H$2),AG19),\"\")","v":""},"|","#### Guidance","Certificate profiles are documented","Guidance","2.2.1.GX",{"$f":"IF(AND(AM19<>\"\",LEFT(AM19,1)<>\"#\"),IF(LEFT(AM19,1)=\"-\",REPLACE(AM19,1,1,tech!$H$2),AM19),\"\")","v":""},"|","#### Guidance","Network and deployment infrastructure is documented","Guidance","2.3.1.GX",{"$f":"IF(AND(AS19<>\"\",LEFT(AS19,1)<>\"#\"),IF(LEFT(AS19,1)=\"-\",REPLACE(AS19,1,1,tech!$H$2),AS19),\"\")","v":""},"|","#### Guidance","The policy for change management and agility is documented","Guidance","2.4.1.GX",{"$f":"IF(AND(AY19<>\"\",LEFT(AY19,1)<>\"#\"),IF(LEFT(AY19,1)=\"-\",REPLACE(AY19,1,1,tech!$H$2),AY19),\"\")","v":""},"|","#### Guidance","Risk assessment and business impact analysis","Guidance","3.1.1.GX",{"$f":"IF(AND(BE19<>\"\",LEFT(BE19,1)<>\"#\"),IF(LEFT(BE19,1)=\"-\",REPLACE(BE19,1,1,tech!$H$2),BE19),\"\")","v":""},"|","#### Guidance","Maintain PKI interoperability strategy","Guidance","3.2.1.GX",{"$f":"IF(AND(BK19<>\"\",LEFT(BK19,1)<>\"#\"),IF(LEFT(BK19,1)=\"-\",REPLACE(BK19,1,1,tech!$H$2),BK19),\"\")","v":""},"|","#### Guidance","Monitoring events and logging requirements are defined and documented","Guidance","3.3.1.GX",{"$f":"IF(AND(BQ19<>\"\",LEFT(BQ19,1)<>\"#\"),IF(LEFT(BQ19,1)=\"-\",REPLACE(BQ19,1,1,tech!$H$2),BQ19),\"\")","v":""},"|","#### Guidance","Process automation description","Guidance","3.4.1.GX",{"$f":"IF(AND(BW19<>\"\",LEFT(BW19,1)<>\"#\"),IF(LEFT(BW19,1)=\"-\",REPLACE(BW19,1,1,tech!$H$2),BW19),\"\")","v":""},"|","#### Guidance","Resources are identified and documented","Guidance","4.1.1.GX",{"$f":"IF(AND(CC19<>\"\",LEFT(CC19,1)<>\"#\"),IF(LEFT(CC19,1)=\"-\",REPLACE(CC19,1,1,tech!$H$2),CC19),\"\")","v":""},"|","#### Guidance","Establish training plan","Guidance","4.2.1.GX",{"$f":"IF(AND(CI19<>\"\",LEFT(CI19,1)<>\"#\"),IF(LEFT(CI19,1)=\"-\",REPLACE(CI19,1,1,tech!$H$2),CI19),\"\")","v":""},"|","#### Guidance","Establish and maintain awareness plan","Guidance","4.3.1.GX",{"$f":"IF(AND(CO19<>\"\",LEFT(CO19,1)<>\"#\"),IF(LEFT(CO19,1)=\"-\",REPLACE(CO19,1,1,tech!$H$2),CO19),\"\")","v":""},"|",null,{"$f":"IF(CU19=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU19,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":""},"","|",null,"","","|"]
[null,null,"- There are minimum processes and procedures, which are typically not followed and","Initial","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D20,tech!$A$13:$B$17,2,0),LEFT(E20,1),IF(G20=\"\",\"X\",\"Y\"))","v":"1IY"},{"$f":"IF(IF(LEFT(C20,1)=\"-\",C20,\"\")=\"\",\"\",REPLACE(IF(LEFT(C20,1)=\"-\",C20,\"\"),1,1,tech!$H$2))","v":"• There are minimum processes and procedures, which are typically not followed and"},"|",null,"Organizational sponsor and support","Guidance","1.1.1.GX",{"$f":"IF(AND(I20<>\"\",LEFT(I20,1)<>\"#\"),IF(LEFT(I20,1)=\"-\",REPLACE(I20,1,1,tech!$H$2),I20),\"\")","v":""},"|",null,"The scope of policies is defined and documented","Guidance","1.2.1.GX",{"$f":"IF(AND(O20<>\"\",LEFT(O20,1)<>\"#\"),IF(LEFT(O20,1)=\"-\",REPLACE(O20,1,1,tech!$H$2),O20),\"\")","v":""},"|",null,"Compliance policies are defined, implemented, and communicated","Guidance","1.3.1.GX",{"$f":"IF(AND(U20<>\"\",LEFT(U20,1)<>\"#\"),IF(LEFT(U20,1)=\"-\",REPLACE(U20,1,1,tech!$H$2),U20),\"\")","v":""},"|",null,"Scope of processes and procedure is aligned with policies","Guidance","1.4.1.GX",{"$f":"IF(AND(AA20<>\"\",LEFT(AA20,1)<>\"#\"),IF(LEFT(AA20,1)=\"-\",REPLACE(AA20,1,1,tech!$H$2),AA20),\"\")","v":""},"|",null,"Key management roles and responsibilities are documented and formally assigned","Guidance","2.1.1.GX",{"$f":"IF(AND(AG20<>\"\",LEFT(AG20,1)<>\"#\"),IF(LEFT(AG20,1)=\"-\",REPLACE(AG20,1,1,tech!$H$2),AG20),\"\")","v":""},"|",null,"Certificate profiles are documented","Guidance","2.2.1.GX",{"$f":"IF(AND(AM20<>\"\",LEFT(AM20,1)<>\"#\"),IF(LEFT(AM20,1)=\"-\",REPLACE(AM20,1,1,tech!$H$2),AM20),\"\")","v":""},"|",null,"Network and deployment infrastructure is documented","Guidance","2.3.1.GX",{"$f":"IF(AND(AS20<>\"\",LEFT(AS20,1)<>\"#\"),IF(LEFT(AS20,1)=\"-\",REPLACE(AS20,1,1,tech!$H$2),AS20),\"\")","v":""},"|",null,"The policy for change management and agility is documented","Guidance","2.4.1.GX",{"$f":"IF(AND(AY20<>\"\",LEFT(AY20,1)<>\"#\"),IF(LEFT(AY20,1)=\"-\",REPLACE(AY20,1,1,tech!$H$2),AY20),\"\")","v":""},"|",null,"Risk assessment and business impact analysis","Guidance","3.1.1.GX",{"$f":"IF(AND(BE20<>\"\",LEFT(BE20,1)<>\"#\"),IF(LEFT(BE20,1)=\"-\",REPLACE(BE20,1,1,tech!$H$2),BE20),\"\")","v":""},"|",null,"Maintain PKI interoperability strategy","Guidance","3.2.1.GX",{"$f":"IF(AND(BK20<>\"\",LEFT(BK20,1)<>\"#\"),IF(LEFT(BK20,1)=\"-\",REPLACE(BK20,1,1,tech!$H$2),BK20),\"\")","v":""},"|",null,"Monitoring events and logging requirements are defined and documented","Guidance","3.3.1.GX",{"$f":"IF(AND(BQ20<>\"\",LEFT(BQ20,1)<>\"#\"),IF(LEFT(BQ20,1)=\"-\",REPLACE(BQ20,1,1,tech!$H$2),BQ20),\"\")","v":""},"|",null,"Process automation description","Guidance","3.4.1.GX",{"$f":"IF(AND(BW20<>\"\",LEFT(BW20,1)<>\"#\"),IF(LEFT(BW20,1)=\"-\",REPLACE(BW20,1,1,tech!$H$2),BW20),\"\")","v":""},"|",null,"Resources are identified and documented","Guidance","4.1.1.GX",{"$f":"IF(AND(CC20<>\"\",LEFT(CC20,1)<>\"#\"),IF(LEFT(CC20,1)=\"-\",REPLACE(CC20,1,1,tech!$H$2),CC20),\"\")","v":""},"|",null,"Establish training plan","Guidance","4.2.1.GX",{"$f":"IF(AND(CI20<>\"\",LEFT(CI20,1)<>\"#\"),IF(LEFT(CI20,1)=\"-\",REPLACE(CI20,1,1,tech!$H$2),CI20),\"\")","v":""},"|",null,"Establish and maintain awareness plan","Guidance","4.3.1.GX",{"$f":"IF(AND(CO20<>\"\",LEFT(CO20,1)<>\"#\"),IF(LEFT(CO20,1)=\"-\",REPLACE(CO20,1,1,tech!$H$2),CO20),\"\")","v":""},"|",null,{"$f":"IF(CU20=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU20,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":""},"","|",null,"","","|"]
[null,null,"- There is no approach how to address certificate related issues","Initial","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D21,tech!$A$13:$B$17,2,0),LEFT(E21,1),IF(G21=\"\",\"X\",\"Y\"))","v":"1IY"},{"$f":"IF(IF(LEFT(C21,1)=\"-\",C21,\"\")=\"\",\"\",REPLACE(IF(LEFT(C21,1)=\"-\",C21,\"\"),1,1,tech!$H$2))","v":"• There is no approach how to address certificate related issues"},"|","The success of the PKI implementation highly depends on the organization top management support. Top management typically also acts as a sponsor of the PKI, meaning that they allocate and approve budget needed to build and maintain the PKI.","Organizational sponsor and support","Guidance","1.1.1.GY",{"$f":"IF(AND(I21<>\"\",LEFT(I21,1)<>\"#\"),IF(LEFT(I21,1)=\"-\",REPLACE(I21,1,1,tech!$H$2),I21),\"\")","v":"The success of the PKI implementation highly depends on the organization top management support. Top management typically also acts as a sponsor of the PKI, meaning that they allocate and approve budget needed to build and maintain the PKI."},"|","Each PKI implementation and use case is different, therefore it requires different care. The scope of policies that are applicable for the implementation should be defined and documented. When the proper description of the policies scope is provided, it helps all parties involved to understand the purpose of the policies and their applicability.","The scope of policies is defined and documented","Guidance","1.2.1.GY",{"$f":"IF(AND(O21<>\"\",LEFT(O21,1)<>\"#\"),IF(LEFT(O21,1)=\"-\",REPLACE(O21,1,1,tech!$H$2),O21),\"\")","v":"Each PKI implementation and use case is different, therefore it requires different care. The scope of policies that are applicable for the implementation should be defined and documented. When the proper description of the policies scope is provided, it helps all parties involved to understand the purpose of the policies and their applicability."},"|","Compliance policies are a critical component of an organization’s risk management strategy to help ensure that the PKI system is secure, reliable, trustworthy, and meets any applicable regulatory requirements.","Compliance policies are defined, implemented, and communicated","Guidance","1.3.1.GY",{"$f":"IF(AND(U21<>\"\",LEFT(U21,1)<>\"#\"),IF(LEFT(U21,1)=\"-\",REPLACE(U21,1,1,tech!$H$2),U21),\"\")","v":"Compliance policies are a critical component of an organization’s risk management strategy to help ensure that the PKI system is secure, reliable, trustworthy, and meets any applicable regulatory requirements."},"|","The scope of the processes and procedures should be aligned with the policies and statements. Each implementation and use case can have different scope, but the scope should be defined and documented, with all applicable processes, procedures, and eventually instructions.","Scope of processes and procedure is aligned with policies","Guidance","1.4.1.GY",{"$f":"IF(AND(AA21<>\"\",LEFT(AA21,1)<>\"#\"),IF(LEFT(AA21,1)=\"-\",REPLACE(AA21,1,1,tech!$H$2),AA21),\"\")","v":"The scope of the processes and procedures should be aligned with the policies and statements. Each implementation and use case can have different scope, but the scope should be defined and documented, with all applicable processes, procedures, and eventually instructions."},"|","Proper definition of roles and responsibilities for key management operations establishes a good basis for accountability and auditing. The roles and responsibilities should follow key management policy, principles, and boundaries.","Key management roles and responsibilities are documented and formally assigned","Guidance","2.1.1.GY",{"$f":"IF(AND(AG21<>\"\",LEFT(AG21,1)<>\"#\"),IF(LEFT(AG21,1)=\"-\",REPLACE(AG21,1,1,tech!$H$2),AG21),\"\")","v":"Proper definition of roles and responsibilities for key management operations establishes a good basis for accountability and auditing. The roles and responsibilities should follow key management policy, principles, and boundaries."},"|","Certificate profiles specify the contents of certificates for one or more use cases. It defines things such as:","Certificate profiles are documented","Guidance","2.2.1.GY",{"$f":"IF(AND(AM21<>\"\",LEFT(AM21,1)<>\"#\"),IF(LEFT(AM21,1)=\"-\",REPLACE(AM21,1,1,tech!$H$2),AM21),\"\")","v":"Certificate profiles specify the contents of certificates for one or more use cases. It defines things such as:"},"|","The network and deployment documentation of the infrastructure should be aligned with the architecture and design of the PKI. In other terms, it provides details about how the implementation is done in the real environment.","Network and deployment infrastructure is documented","Guidance","2.3.1.GY",{"$f":"IF(AND(AS21<>\"\",LEFT(AS21,1)<>\"#\"),IF(LEFT(AS21,1)=\"-\",REPLACE(AS21,1,1,tech!$H$2),AS21),\"\")","v":"The network and deployment documentation of the infrastructure should be aligned with the architecture and design of the PKI. In other terms, it provides details about how the implementation is done in the real environment."},"|","The policy for change management and agility should be documented and approved by the management. The policy contains principles and boundaries for the implementation of the change management and agility requirements. Typically, it can be documented on the organizational level and applied to all systems and services, including the PKI implementation.","The policy for change management and agility is documented","Guidance","2.4.1.GY",{"$f":"IF(AND(AY21<>\"\",LEFT(AY21,1)<>\"#\"),IF(LEFT(AY21,1)=\"-\",REPLACE(AY21,1,1,tech!$H$2),AY21),\"\")","v":"The policy for change management and agility should be documented and approved by the management. The policy contains principles and boundaries for the implementation of the change management and agility requirements. Typically, it can be documented on the organizational level and applied to all systems and services, including the PKI implementation."},"|","Proper risk assessment provides robust understanding about the risks and their impact on the business and organization PKI. The risk assessment results (for example potential loss scenarios) are documented and serves as input for the business impact analysis to identify the critical PKI-related business processes and their dependencies.","Risk assessment and business impact analysis","Guidance","3.1.1.GY",{"$f":"IF(AND(BE21<>\"\",LEFT(BE21,1)<>\"#\"),IF(LEFT(BE21,1)=\"-\",REPLACE(BE21,1,1,tech!$H$2),BE21),\"\")","v":"Proper risk assessment provides robust understanding about the risks and their impact on the business and organization PKI. The risk assessment results (for example potential loss scenarios) are documented and serves as input for the business impact analysis to identify the critical PKI-related business processes and their dependencies."},"|","The interoperability strategy defines the interoperability requirements and the approach to achieve interoperability between the PKI components to ensure the PKI implementation is able to adopt new technologies and standards in the future, and will not be locked-in to a specific vendor.","Maintain PKI interoperability strategy","Guidance","3.2.1.GY",{"$f":"IF(AND(BK21<>\"\",LEFT(BK21,1)<>\"#\"),IF(LEFT(BK21,1)=\"-\",REPLACE(BK21,1,1,tech!$H$2),BK21),\"\")","v":"The interoperability strategy defines the interoperability requirements and the approach to achieve interoperability between the PKI components to ensure the PKI implementation is able to adopt new technologies and standards in the future, and will not be locked-in to a specific vendor."},"|","The monitoring and logging requirements should be defined and documented in the CP, CPS, or other relevant documents. The requirements should be aligned with the overall PKI policies and statements, and should be based on the risk assessment and management activities.","Monitoring events and logging requirements are defined and documented","Guidance","3.3.1.GY",{"$f":"IF(AND(BQ21<>\"\",LEFT(BQ21,1)<>\"#\"),IF(LEFT(BQ21,1)=\"-\",REPLACE(BQ21,1,1,tech!$H$2),BQ21),\"\")","v":"The monitoring and logging requirements should be defined and documented in the CP, CPS, or other relevant documents. The requirements should be aligned with the overall PKI policies and statements, and should be based on the risk assessment and management activities."},"|","Every automated certificate management process should be properly described and documented. The documentation should contain information relevant to the process automation and understanding the reasons for automation. Monitoring, auditing, and potential measures and controls would be ineffective without proper description and understanding of the automation process.","Process automation description","Guidance","3.4.1.GY",{"$f":"IF(AND(BW21<>\"\",LEFT(BW21,1)<>\"#\"),IF(LEFT(BW21,1)=\"-\",REPLACE(BW21,1,1,tech!$H$2),BW21),\"\")","v":"Every automated certificate management process should be properly described and documented. The documentation should contain information relevant to the process automation and understanding the reasons for automation. Monitoring, auditing, and potential measures and controls would be ineffective without proper description and understanding of the automation process."},"|","Resources needed for proper management of the PKI are identified and documented. Resources should be aligned with the PKI scope and use-case(s) that should be supported. The main question to answer here is \"Do we know what resources we need to manage the PKI?\". ","Resources are identified and documented","Guidance","4.1.1.GY",{"$f":"IF(AND(CC21<>\"\",LEFT(CC21,1)<>\"#\"),IF(LEFT(CC21,1)=\"-\",REPLACE(CC21,1,1,tech!$H$2),CC21),\"\")","v":"Resources needed for proper management of the PKI are identified and documented. Resources should be aligned with the PKI scope and use-case(s) that should be supported. The main question to answer here is \"Do we know what resources we need to manage the PKI?\". "},"|","The training plan should be established and maintained to ensure that personnel have the required knowledge and skills to perform their duties and responsibilities. It should reflect the current state of the PKI implementation and be updated when the PKI implementation changes, and provide necessary information for all personnel that are involved in the PKI implementation.","Establish training plan","Guidance","4.2.1.GY",{"$f":"IF(AND(CI21<>\"\",LEFT(CI21,1)<>\"#\"),IF(LEFT(CI21,1)=\"-\",REPLACE(CI21,1,1,tech!$H$2),CI21),\"\")","v":"The training plan should be established and maintained to ensure that personnel have the required knowledge and skills to perform their duties and responsibilities. It should reflect the current state of the PKI implementation and be updated when the PKI implementation changes, and provide necessary information for all personnel that are involved in the PKI implementation."},"|","Awareness plan should be established and maintained to ensure that the PKI participants are aware of all relevant events related to the PKI implementation and its purpose in the organization and outside. It should cover at lease the following information:","Establish and maintain awareness plan","Guidance","4.3.1.GY",{"$f":"IF(AND(CO21<>\"\",LEFT(CO21,1)<>\"#\"),IF(LEFT(CO21,1)=\"-\",REPLACE(CO21,1,1,tech!$H$2),CO21),\"\")","v":"Awareness plan should be established and maintained to ensure that the PKI participants are aware of all relevant events related to the PKI implementation and its purpose in the organization and outside. It should cover at lease the following information:"},"|",null,{"$f":"IF(CU21=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU21,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":""},"","|",null,"","","|"]
[null,null,"- PKI does not take into account any industry standards or regulations","Initial","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D22,tech!$A$13:$B$17,2,0),LEFT(E22,1),IF(G22=\"\",\"X\",\"Y\"))","v":"1IY"},{"$f":"IF(IF(LEFT(C22,1)=\"-\",C22,\"\")=\"\",\"\",REPLACE(IF(LEFT(C22,1)=\"-\",C22,\"\"),1,1,tech!$H$2))","v":"• PKI does not take into account any industry standards or regulations"},"|",null,"Organizational sponsor and support","Guidance","1.1.1.GY",{"$f":"IF(AND(I22<>\"\",LEFT(I22,1)<>\"#\"),IF(LEFT(I22,1)=\"-\",REPLACE(I22,1,1,tech!$H$2),I22),\"\")","v":""},"|",null,"The scope of policies is defined and documented","Guidance","1.2.1.GY",{"$f":"IF(AND(O22<>\"\",LEFT(O22,1)<>\"#\"),IF(LEFT(O22,1)=\"-\",REPLACE(O22,1,1,tech!$H$2),O22),\"\")","v":""},"|",null,"Compliance policies are defined, implemented, and communicated","Guidance","1.3.1.GY",{"$f":"IF(AND(U22<>\"\",LEFT(U22,1)<>\"#\"),IF(LEFT(U22,1)=\"-\",REPLACE(U22,1,1,tech!$H$2),U22),\"\")","v":""},"|",null,"Scope of processes and procedure is aligned with policies","Guidance","1.4.1.GY",{"$f":"IF(AND(AA22<>\"\",LEFT(AA22,1)<>\"#\"),IF(LEFT(AA22,1)=\"-\",REPLACE(AA22,1,1,tech!$H$2),AA22),\"\")","v":""},"|",null,"Key management roles and responsibilities are documented and formally assigned","Guidance","2.1.1.GY",{"$f":"IF(AND(AG22<>\"\",LEFT(AG22,1)<>\"#\"),IF(LEFT(AG22,1)=\"-\",REPLACE(AG22,1,1,tech!$H$2),AG22),\"\")","v":""},"|","* Certificate use case(s) for certificates covered by specific profiles","Certificate profiles are documented","Guidance","2.2.1.GY",{"$f":"IF(AND(AM22<>\"\",LEFT(AM22,1)<>\"#\"),IF(LEFT(AM22,1)=\"-\",REPLACE(AM22,1,1,tech!$H$2),AM22),\"\")","v":"* Certificate use case(s) for certificates covered by specific profiles"},"|",null,"Network and deployment infrastructure is documented","Guidance","2.3.1.GY",{"$f":"IF(AND(AS22<>\"\",LEFT(AS22,1)<>\"#\"),IF(LEFT(AS22,1)=\"-\",REPLACE(AS22,1,1,tech!$H$2),AS22),\"\")","v":""},"|",null,"The policy for change management and agility is documented","Guidance","2.4.1.GY",{"$f":"IF(AND(AY22<>\"\",LEFT(AY22,1)<>\"#\"),IF(LEFT(AY22,1)=\"-\",REPLACE(AY22,1,1,tech!$H$2),AY22),\"\")","v":""},"|",null,"Risk assessment and business impact analysis","Guidance","3.1.1.GY",{"$f":"IF(AND(BE22<>\"\",LEFT(BE22,1)<>\"#\"),IF(LEFT(BE22,1)=\"-\",REPLACE(BE22,1,1,tech!$H$2),BE22),\"\")","v":""},"|",null,"Maintain PKI interoperability strategy","Guidance","3.2.1.GY",{"$f":"IF(AND(BK22<>\"\",LEFT(BK22,1)<>\"#\"),IF(LEFT(BK22,1)=\"-\",REPLACE(BK22,1,1,tech!$H$2),BK22),\"\")","v":""},"|",null,"Monitoring events and logging requirements are defined and documented","Guidance","3.3.1.GY",{"$f":"IF(AND(BQ22<>\"\",LEFT(BQ22,1)<>\"#\"),IF(LEFT(BQ22,1)=\"-\",REPLACE(BQ22,1,1,tech!$H$2),BQ22),\"\")","v":""},"|",null,"Process automation description","Guidance","3.4.1.GY",{"$f":"IF(AND(BW22<>\"\",LEFT(BW22,1)<>\"#\"),IF(LEFT(BW22,1)=\"-\",REPLACE(BW22,1,1,tech!$H$2),BW22),\"\")","v":""},"|",null,"Resources are identified and documented","Guidance","4.1.1.GX",{"$f":"IF(AND(CC22<>\"\",LEFT(CC22,1)<>\"#\"),IF(LEFT(CC22,1)=\"-\",REPLACE(CC22,1,1,tech!$H$2),CC22),\"\")","v":""},"|",null,"Establish training plan","Guidance","4.2.1.GY",{"$f":"IF(AND(CI22<>\"\",LEFT(CI22,1)<>\"#\"),IF(LEFT(CI22,1)=\"-\",REPLACE(CI22,1,1,tech!$H$2),CI22),\"\")","v":""},"|","- How the organization discloses information to PKI participants","Establish and maintain awareness plan","Guidance","4.3.1.GY",{"$f":"IF(AND(CO22<>\"\",LEFT(CO22,1)<>\"#\"),IF(LEFT(CO22,1)=\"-\",REPLACE(CO22,1,1,tech!$H$2),CO22),\"\")","v":"• How the organization discloses information to PKI participants"},"|",null,{"$f":"IF(CU22=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU22,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":""},"","|",null,"","","|"]
[null,null,"- Insufficient resources and knowledge","Initial","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D23,tech!$A$13:$B$17,2,0),LEFT(E23,1),IF(G23=\"\",\"X\",\"Y\"))","v":"1IY"},{"$f":"IF(IF(LEFT(C23,1)=\"-\",C23,\"\")=\"\",\"\",REPLACE(IF(LEFT(C23,1)=\"-\",C23,\"\"),1,1,tech!$H$2))","v":"• Insufficient resources and knowledge"},"|","The basic assumption is that the established digital trust is going to be maintained and developed for years, and therefore it is important to have a long-term vision and strategy for the PKI. The strategy and vision should be aligned with the overall organizational goals and approach.","Organizational sponsor and support","Guidance","1.1.1.GY",{"$f":"IF(AND(I23<>\"\",LEFT(I23,1)<>\"#\"),IF(LEFT(I23,1)=\"-\",REPLACE(I23,1,1,tech!$H$2),I23),\"\")","v":"The basic assumption is that the established digital trust is going to be maintained and developed for years, and therefore it is important to have a long-term vision and strategy for the PKI. The strategy and vision should be aligned with the overall organizational goals and approach."},"|","The scope can include the following:","The scope of policies is defined and documented","Guidance","1.2.1.GY",{"$f":"IF(AND(O23<>\"\",LEFT(O23,1)<>\"#\"),IF(LEFT(O23,1)=\"-\",REPLACE(O23,1,1,tech!$H$2),O23),\"\")","v":"The scope can include the following:"},"|","By defining appropriate policies and related procedures and communicating these to all stakeholders who rely on the PKI, the organization can ensure that administrators, operators, and users are properly authenticated and authorized to access the system and that appropriate controls are in place to prevent unauthorized access or misuse of the PKI.","Compliance policies are defined, implemented, and communicated","Guidance","1.3.1.GY",{"$f":"IF(AND(U23<>\"\",LEFT(U23,1)<>\"#\"),IF(LEFT(U23,1)=\"-\",REPLACE(U23,1,1,tech!$H$2),U23),\"\")","v":"By defining appropriate policies and related procedures and communicating these to all stakeholders who rely on the PKI, the organization can ensure that administrators, operators, and users are properly authenticated and authorized to access the system and that appropriate controls are in place to prevent unauthorized access or misuse of the PKI."},"|","The alignment with the policies helps to ensure that the processes and procedures are aligned with the PKI implementation goals and needs, and can be effectively trusted over the time. A simple matrix can be used to ensure that all applicable policies and statements are covered by the processes and procedures.","Scope of processes and procedure is aligned with policies","Guidance","1.4.1.GY",{"$f":"IF(AND(AA23<>\"\",LEFT(AA23,1)<>\"#\"),IF(LEFT(AA23,1)=\"-\",REPLACE(AA23,1,1,tech!$H$2),AA23),\"\")","v":"The alignment with the policies helps to ensure that the processes and procedures are aligned with the PKI implementation goals and needs, and can be effectively trusted over the time. A simple matrix can be used to ensure that all applicable policies and statements are covered by the processes and procedures."},"|","Personnel should be formally assigned to the role based on appropriate skills, and background check to ensure that there are no external risks associated that can cause potential compromise of key management.","Key management roles and responsibilities are documented and formally assigned","Guidance","2.1.1.GY",{"$f":"IF(AND(AG23<>\"\",LEFT(AG23,1)<>\"#\"),IF(LEFT(AG23,1)=\"-\",REPLACE(AG23,1,1,tech!$H$2),AG23),\"\")","v":"Personnel should be formally assigned to the role based on appropriate skills, and background check to ensure that there are no external risks associated that can cause potential compromise of key management."},"|","* Naming standards for subject distinguished name and subject alternative names, which are allowed and mandatory fields.","Certificate profiles are documented","Guidance","2.2.1.GY",{"$f":"IF(AND(AM23<>\"\",LEFT(AM23,1)<>\"#\"),IF(LEFT(AM23,1)=\"-\",REPLACE(AM23,1,1,tech!$H$2),AM23),\"\")","v":"* Naming standards for subject distinguished name and subject alternative names, which are allowed and mandatory fields."},"|","The network and deployment infrastructure should be properly documented and maintained. The documentation should include the following:","Network and deployment infrastructure is documented","Guidance","2.3.1.GY",{"$f":"IF(AND(AS23<>\"\",LEFT(AS23,1)<>\"#\"),IF(LEFT(AS23,1)=\"-\",REPLACE(AS23,1,1,tech!$H$2),AS23),\"\")","v":"The network and deployment infrastructure should be properly documented and maintained. The documentation should include the following:"},"|","The PKI may have specific requirements for change management and agility, and therefore it may be recommended to have a separate policy for the PKI implementation. The policy should be aligned with organizational policy and should be approved by the responsible personnel for the PKI.","The policy for change management and agility is documented","Guidance","2.4.1.GY",{"$f":"IF(AND(AY23<>\"\",LEFT(AY23,1)<>\"#\"),IF(LEFT(AY23,1)=\"-\",REPLACE(AY23,1,1,tech!$H$2),AY23),\"\")","v":"The PKI may have specific requirements for change management and agility, and therefore it may be recommended to have a separate policy for the PKI implementation. The policy should be aligned with organizational policy and should be approved by the responsible personnel for the PKI."},"|","Documented results of the business impact analysis are used to develop recovery strategies for the PKI implementation with required resources and availability.","Risk assessment and business impact analysis","Guidance","3.1.1.GY",{"$f":"IF(AND(BE23<>\"\",LEFT(BE23,1)<>\"#\"),IF(LEFT(BE23,1)=\"-\",REPLACE(BE23,1,1,tech!$H$2),BE23),\"\")","v":"Documented results of the business impact analysis are used to develop recovery strategies for the PKI implementation with required resources and availability."},"|","PKI interoperability strategy should be maintained, documented, and integrated in the organization. It should cover at least the following information:","Maintain PKI interoperability strategy","Guidance","3.2.1.GY",{"$f":"IF(AND(BK23<>\"\",LEFT(BK23,1)<>\"#\"),IF(LEFT(BK23,1)=\"-\",REPLACE(BK23,1,1,tech!$H$2),BK23),\"\")","v":"PKI interoperability strategy should be maintained, documented, and integrated in the organization. It should cover at least the following information:"},"|","The requirements can typically include:","Monitoring events and logging requirements are defined and documented","Guidance","3.3.1.GY",{"$f":"IF(AND(BQ23<>\"\",LEFT(BQ23,1)<>\"#\"),IF(LEFT(BQ23,1)=\"-\",REPLACE(BQ23,1,1,tech!$H$2),BQ23),\"\")","v":"The requirements can typically include:"},"|","The description can include for example the following:","Process automation description","Guidance","3.4.1.GY",{"$f":"IF(AND(BW23<>\"\",LEFT(BW23,1)<>\"#\"),IF(LEFT(BW23,1)=\"-\",REPLACE(BW23,1,1,tech!$H$2),BW23),\"\")","v":"The description can include for example the following:"},"|","#### Assessment","Resources are identified and documented","Assessment","4.1.1.AX",{"$f":"IF(AND(CC23<>\"\",LEFT(CC23,1)<>\"#\"),IF(LEFT(CC23,1)=\"-\",REPLACE(CC23,1,1,tech!$H$2),CC23),\"\")","v":""},"|","Training plan is built with PKI needs and requirements in mind and should cover:","Establish training plan","Guidance","4.2.1.GY",{"$f":"IF(AND(CI23<>\"\",LEFT(CI23,1)<>\"#\"),IF(LEFT(CI23,1)=\"-\",REPLACE(CI23,1,1,tech!$H$2),CI23),\"\")","v":"Training plan is built with PKI needs and requirements in mind and should cover:"},"|","- Contact information","Establish and maintain awareness plan","Guidance","4.3.1.GY",{"$f":"IF(AND(CO23<>\"\",LEFT(CO23,1)<>\"#\"),IF(LEFT(CO23,1)=\"-\",REPLACE(CO23,1,1,tech!$H$2),CO23),\"\")","v":"• Contact information"},"|",null,{"$f":"IF(CU23=\"\",\"\",VLOOKUP(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(CU23,\"[\"),\"]\"),tech!$E$117:$F$131,2,0))","v":""},"","|",null,"","","|"]
[{"$nulls":3},"Initial","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D24,tech!$A$13:$B$17,2,0),LEFT(E24,1),IF(G24=\"\",\"X\",\"Y\"))","v":"1IX"},{"$f":"IF(IF(LEFT(C24,1)=\"-\",C24,\"\")=\"\",\"\",REPLACE(IF(LEFT(C24,1)=\"-\",C24,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Organizational sponsor and support","Guidance","1.1.1.GX",{"$f":"IF(AND(I24<>\"\",LEFT(I24,1)<>\"#\"),IF(LEFT(I24,1)=\"-\",REPLACE(I24,1,1,tech!$H$2),I24),\"\")","v":""},"|","- Identification of the policies required for the implementation","The scope of policies is defined and documented","Guidance","1.2.1.GY",{"$f":"IF(AND(O24<>\"\",LEFT(O24,1)<>\"#\"),IF(LEFT(O24,1)=\"-\",REPLACE(O24,1,1,tech!$H$2),O24),\"\")","v":"• Identification of the policies required for the implementation"},"|",null,"Compliance policies are defined, implemented, and communicated","Guidance","1.3.1.GY",{"$f":"IF(AND(U24<>\"\",LEFT(U24,1)<>\"#\"),IF(LEFT(U24,1)=\"-\",REPLACE(U24,1,1,tech!$H$2),U24),\"\")","v":""},"|",null,"Scope of processes and procedure is aligned with policies","Guidance","1.4.1.GY",{"$f":"IF(AND(AA24<>\"\",LEFT(AA24,1)<>\"#\"),IF(LEFT(AA24,1)=\"-\",REPLACE(AA24,1,1,tech!$H$2),AA24),\"\")","v":""},"|",null,"Key management roles and responsibilities are documented and formally assigned","Guidance","2.1.1.GY",{"$f":"IF(AND(AG24<>\"\",LEFT(AG24,1)<>\"#\"),IF(LEFT(AG24,1)=\"-\",REPLACE(AG24,1,1,tech!$H$2),AG24),\"\")","v":""},"|","* Certificate validity periods","Certificate profiles are documented","Guidance","2.2.1.GY",{"$f":"IF(AND(AM24<>\"\",LEFT(AM24,1)<>\"#\"),IF(LEFT(AM24,1)=\"-\",REPLACE(AM24,1,1,tech!$H$2),AM24),\"\")","v":"* Certificate validity periods"},"|","- PKI components and their dependencies","Network and deployment infrastructure is documented","Guidance","2.3.1.GY",{"$f":"IF(AND(AS24<>\"\",LEFT(AS24,1)<>\"#\"),IF(LEFT(AS24,1)=\"-\",REPLACE(AS24,1,1,tech!$H$2),AS24),\"\")","v":"• PKI components and their dependencies"},"|",null,"The policy for change management and agility is documented","Guidance","2.4.1.GY",{"$f":"IF(AND(AY24<>\"\",LEFT(AY24,1)<>\"#\"),IF(LEFT(AY24,1)=\"-\",REPLACE(AY24,1,1,tech!$H$2),AY24),\"\")","v":""},"|",null,"Risk assessment and business impact analysis","Guidance","3.1.1.GX",{"$f":"IF(AND(BE24<>\"\",LEFT(BE24,1)<>\"#\"),IF(LEFT(BE24,1)=\"-\",REPLACE(BE24,1,1,tech!$H$2),BE24),\"\")","v":""},"|","- Application of interoperability","Maintain PKI interoperability strategy","Guidance","3.2.1.GY",{"$f":"IF(AND(BK24<>\"\",LEFT(BK24,1)<>\"#\"),IF(LEFT(BK24,1)=\"-\",REPLACE(BK24,1,1,tech!$H$2),BK24),\"\")","v":"• Application of interoperability"},"|","- events to be monitored","Monitoring events and logging requirements are defined and documented","Guidance","3.3.1.GY",{"$f":"IF(AND(BQ24<>\"\",LEFT(BQ24,1)<>\"#\"),IF(LEFT(BQ24,1)=\"-\",REPLACE(BQ24,1,1,tech!$H$2),BQ24),\"\")","v":"• events to be monitored"},"|","- use-case or process to be automated","Process automation description","Guidance","3.4.1.GY",{"$f":"IF(AND(BW24<>\"\",LEFT(BW24,1)<>\"#\"),IF(LEFT(BW24,1)=\"-\",REPLACE(BW24,1,1,tech!$H$2),BW24),\"\")","v":"• use-case or process to be automated"},"|",null,"Resources are identified and documented","Assessment","4.1.1.AX",{"$f":"IF(AND(CC24<>\"\",LEFT(CC24,1)<>\"#\"),IF(LEFT(CC24,1)=\"-\",REPLACE(CC24,1,1,tech!$H$2),CC24),\"\")","v":""},"|","- Training Prerequisites","Establish training plan","Guidance","4.2.1.GY",{"$f":"IF(AND(CI24<>\"\",LEFT(CI24,1)<>\"#\"),IF(LEFT(CI24,1)=\"-\",REPLACE(CI24,1,1,tech!$H$2),CI24),\"\")","v":"• Training Prerequisites"},"|","- How are changes communicated","Establish and maintain awareness plan","Guidance","4.3.1.GY",{"$f":"IF(AND(CO24<>\"\",LEFT(CO24,1)<>\"#\"),IF(LEFT(CO24,1)=\"-\",REPLACE(CO24,1,1,tech!$H$2),CO24),\"\")","v":"• How are changes communicated"},"|"]
[null,null,"### Associated risks","Initial","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D25,tech!$A$13:$B$17,2,0),LEFT(E25,1),IF(G25=\"\",\"X\",\"Y\"))","v":"1AX"},{"$f":"IF(IF(LEFT(C25,1)=\"-\",C25,\"\")=\"\",\"\",REPLACE(IF(LEFT(C25,1)=\"-\",C25,\"\"),1,1,tech!$H$2))","v":""},"|","#### Assessment","Organizational sponsor and support","Assessment","1.1.1.AX",{"$f":"IF(AND(I25<>\"\",LEFT(I25,1)<>\"#\"),IF(LEFT(I25,1)=\"-\",REPLACE(I25,1,1,tech!$H$2),I25),\"\")","v":""},"|","- Reasoning why the policies are required or not required","The scope of policies is defined and documented","Guidance","1.2.1.GY",{"$f":"IF(AND(O25<>\"\",LEFT(O25,1)<>\"#\"),IF(LEFT(O25,1)=\"-\",REPLACE(O25,1,1,tech!$H$2),O25),\"\")","v":"• Reasoning why the policies are required or not required"},"|","Having a sound set of compliance policies defined, implemented, and communicated can help to demonstrate that the organization took reasonable steps to protect the PKI and may result in reduced legal liability in the event of a breach due to improper or malicious use of the PKI.","Compliance policies are defined, implemented, and communicated","Guidance","1.3.1.GY",{"$f":"IF(AND(U25<>\"\",LEFT(U25,1)<>\"#\"),IF(LEFT(U25,1)=\"-\",REPLACE(U25,1,1,tech!$H$2),U25),\"\")","v":"Having a sound set of compliance policies defined, implemented, and communicated can help to demonstrate that the organization took reasonable steps to protect the PKI and may result in reduced legal liability in the event of a breach due to improper or malicious use of the PKI."},"|","The completeness of the processes and procedures can be evaluated by the risk assessment, audit, or by the feedback from the users.","Scope of processes and procedure is aligned with policies","Guidance","1.4.1.GY",{"$f":"IF(AND(AA25<>\"\",LEFT(AA25,1)<>\"#\"),IF(LEFT(AA25,1)=\"-\",REPLACE(AA25,1,1,tech!$H$2),AA25),\"\")","v":"The completeness of the processes and procedures can be evaluated by the risk assessment, audit, or by the feedback from the users."},"|","Naming or assignment records should contain relevant information such as:","Key management roles and responsibilities are documented and formally assigned","Guidance","2.1.1.GY",{"$f":"IF(AND(AG25<>\"\",LEFT(AG25,1)<>\"#\"),IF(LEFT(AG25,1)=\"-\",REPLACE(AG25,1,1,tech!$H$2),AG25),\"\")","v":"Naming or assignment records should contain relevant information such as:"},"|","* Certificate extensions, mandatory and allowed extensions, their criticality and possible values","Certificate profiles are documented","Guidance","2.2.1.GY",{"$f":"IF(AND(AM25<>\"\",LEFT(AM25,1)<>\"#\"),IF(LEFT(AM25,1)=\"-\",REPLACE(AM25,1,1,tech!$H$2),AM25),\"\")","v":"* Certificate extensions, mandatory and allowed extensions, their criticality and possible values"},"|","- Facilities and equipment","Network and deployment infrastructure is documented","Guidance","2.3.1.GY",{"$f":"IF(AND(AS25<>\"\",LEFT(AS25,1)<>\"#\"),IF(LEFT(AS25,1)=\"-\",REPLACE(AS25,1,1,tech!$H$2),AS25),\"\")","v":"• Facilities and equipment"},"|","The policy contains the following information:","The policy for change management and agility is documented","Guidance","2.4.1.GY",{"$f":"IF(AND(AY25<>\"\",LEFT(AY25,1)<>\"#\"),IF(LEFT(AY25,1)=\"-\",REPLACE(AY25,1,1,tech!$H$2),AY25),\"\")","v":"The policy contains the following information:"},"|","#### Assessment","Risk assessment and business impact analysis","Assessment","3.1.1.AX",{"$f":"IF(AND(BE25<>\"\",LEFT(BE25,1)<>\"#\"),IF(LEFT(BE25,1)=\"-\",REPLACE(BE25,1,1,tech!$H$2),BE25),\"\")","v":""},"|","- Using open standards and protocols","Maintain PKI interoperability strategy","Guidance","3.2.1.GY",{"$f":"IF(AND(BK25<>\"\",LEFT(BK25,1)<>\"#\"),IF(LEFT(BK25,1)=\"-\",REPLACE(BK25,1,1,tech!$H$2),BK25),\"\")","v":"• Using open standards and protocols"},"|","- frequency of Monitoring","Monitoring events and logging requirements are defined and documented","Guidance","3.3.1.GY",{"$f":"IF(AND(BQ25<>\"\",LEFT(BQ25,1)<>\"#\"),IF(LEFT(BQ25,1)=\"-\",REPLACE(BQ25,1,1,tech!$H$2),BQ25),\"\")","v":"• frequency of Monitoring"},"|","- Reasons for automation","Process automation description","Guidance","3.4.1.GY",{"$f":"IF(AND(BW25<>\"\",LEFT(BW25,1)<>\"#\"),IF(LEFT(BW25,1)=\"-\",REPLACE(BW25,1,1,tech!$H$2),BW25),\"\")","v":"• Reasons for automation"},"|","The following is sample evidence that can be used to assess the requirement:","Resources are identified and documented","Assessment","4.1.1.AY",{"$f":"IF(AND(CC25<>\"\",LEFT(CC25,1)<>\"#\"),IF(LEFT(CC25,1)=\"-\",REPLACE(CC25,1,1,tech!$H$2),CC25),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|","- Training matrix (who needs to be trained and what Training should be received)","Establish training plan","Guidance","4.2.1.GY",{"$f":"IF(AND(CI25<>\"\",LEFT(CI25,1)<>\"#\"),IF(LEFT(CI25,1)=\"-\",REPLACE(CI25,1,1,tech!$H$2),CI25),\"\")","v":"• Training matrix (who needs to be trained and what Training should be received)"},"|","- Who is responsible for accurate awareness","Establish and maintain awareness plan","Guidance","4.3.1.GY",{"$f":"IF(AND(CO25<>\"\",LEFT(CO25,1)<>\"#\"),IF(LEFT(CO25,1)=\"-\",REPLACE(CO25,1,1,tech!$H$2),CO25),\"\")","v":"• Who is responsible for accurate awareness"},"|"]
[{"$nulls":3},"Initial","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D26,tech!$A$13:$B$17,2,0),LEFT(E26,1),IF(G26=\"\",\"X\",\"Y\"))","v":"1AX"},{"$f":"IF(IF(LEFT(C26,1)=\"-\",C26,\"\")=\"\",\"\",REPLACE(IF(LEFT(C26,1)=\"-\",C26,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Organizational sponsor and support","Assessment","1.1.1.AX",{"$f":"IF(AND(I26<>\"\",LEFT(I26,1)<>\"#\"),IF(LEFT(I26,1)=\"-\",REPLACE(I26,1,1,tech!$H$2),I26),\"\")","v":""},"|","- Structure of policies and documentation","The scope of policies is defined and documented","Guidance","1.2.1.GY",{"$f":"IF(AND(O26<>\"\",LEFT(O26,1)<>\"#\"),IF(LEFT(O26,1)=\"-\",REPLACE(O26,1,1,tech!$H$2),O26),\"\")","v":"• Structure of policies and documentation"},"|",null,"Compliance policies are defined, implemented, and communicated","Guidance","1.3.1.GY",{"$f":"IF(AND(U26<>\"\",LEFT(U26,1)<>\"#\"),IF(LEFT(U26,1)=\"-\",REPLACE(U26,1,1,tech!$H$2),U26),\"\")","v":""},"|",null,"Scope of processes and procedure is aligned with policies","Guidance","1.4.1.GX",{"$f":"IF(AND(AA26<>\"\",LEFT(AA26,1)<>\"#\"),IF(LEFT(AA26,1)=\"-\",REPLACE(AA26,1,1,tech!$H$2),AA26),\"\")","v":""},"|","- Identification of personnel","Key management roles and responsibilities are documented and formally assigned","Guidance","2.1.1.GY",{"$f":"IF(AND(AG26<>\"\",LEFT(AG26,1)<>\"#\"),IF(LEFT(AG26,1)=\"-\",REPLACE(AG26,1,1,tech!$H$2),AG26),\"\")","v":"• Identification of personnel"},"|","* Allowed key types and signature algorithms","Certificate profiles are documented","Guidance","2.2.1.GY",{"$f":"IF(AND(AM26<>\"\",LEFT(AM26,1)<>\"#\"),IF(LEFT(AM26,1)=\"-\",REPLACE(AM26,1,1,tech!$H$2),AM26),\"\")","v":"* Allowed key types and signature algorithms"},"|","- Deployment infrastructure description","Network and deployment infrastructure is documented","Guidance","2.3.1.GY",{"$f":"IF(AND(AS26<>\"\",LEFT(AS26,1)<>\"#\"),IF(LEFT(AS26,1)=\"-\",REPLACE(AS26,1,1,tech!$H$2),AS26),\"\")","v":"• Deployment infrastructure description"},"|","- Approach to change management and agility","The policy for change management and agility is documented","Guidance","2.4.1.GY",{"$f":"IF(AND(AY26<>\"\",LEFT(AY26,1)<>\"#\"),IF(LEFT(AY26,1)=\"-\",REPLACE(AY26,1,1,tech!$H$2),AY26),\"\")","v":"• Approach to change management and agility"},"|",null,"Risk assessment and business impact analysis","Assessment","3.1.1.AX",{"$f":"IF(AND(BE26<>\"\",LEFT(BE26,1)<>\"#\"),IF(LEFT(BE26,1)=\"-\",REPLACE(BE26,1,1,tech!$H$2),BE26),\"\")","v":""},"|","- Conditions for PKI components to be interoperable","Maintain PKI interoperability strategy","Guidance","3.2.1.GY",{"$f":"IF(AND(BK26<>\"\",LEFT(BK26,1)<>\"#\"),IF(LEFT(BK26,1)=\"-\",REPLACE(BK26,1,1,tech!$H$2),BK26),\"\")","v":"• Conditions for PKI components to be interoperable"},"|","- logs to be collected","Monitoring events and logging requirements are defined and documented","Guidance","3.3.1.GY",{"$f":"IF(AND(BQ26<>\"\",LEFT(BQ26,1)<>\"#\"),IF(LEFT(BQ26,1)=\"-\",REPLACE(BQ26,1,1,tech!$H$2),BQ26),\"\")","v":"• logs to be collected"},"|","- description of the automation process","Process automation description","Guidance","3.4.1.GY",{"$f":"IF(AND(BW26<>\"\",LEFT(BW26,1)<>\"#\"),IF(LEFT(BW26,1)=\"-\",REPLACE(BW26,1,1,tech!$H$2),BW26),\"\")","v":"• description of the automation process"},"|","- Resource management process","Resources are identified and documented","Assessment","4.1.1.AY",{"$f":"IF(AND(CC26<>\"\",LEFT(CC26,1)<>\"#\"),IF(LEFT(CC26,1)=\"-\",REPLACE(CC26,1,1,tech!$H$2),CC26),\"\")","v":"• Resource management process"},"|","- Training schedule","Establish training plan","Guidance","4.2.1.GY",{"$f":"IF(AND(CI26<>\"\",LEFT(CI26,1)<>\"#\"),IF(LEFT(CI26,1)=\"-\",REPLACE(CI26,1,1,tech!$H$2),CI26),\"\")","v":"• Training schedule"},"|","- Resolving communication issues and incidents","Establish and maintain awareness plan","Guidance","4.3.1.GY",{"$f":"IF(AND(CO26<>\"\",LEFT(CO26,1)<>\"#\"),IF(LEFT(CO26,1)=\"-\",REPLACE(CO26,1,1,tech!$H$2),CO26),\"\")","v":"• Resolving communication issues and incidents"},"|"]
[null,null,"- High probability of compromise","Initial","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D27,tech!$A$13:$B$17,2,0),LEFT(E27,1),IF(G27=\"\",\"X\",\"Y\"))","v":"1AY"},{"$f":"IF(IF(LEFT(C27,1)=\"-\",C27,\"\")=\"\",\"\",REPLACE(IF(LEFT(C27,1)=\"-\",C27,\"\"),1,1,tech!$H$2))","v":"• High probability of compromise"},"|","The following is sample evidence that can be used to assess the requirement:","Organizational sponsor and support","Assessment","1.1.1.AY",{"$f":"IF(AND(I27<>\"\",LEFT(I27,1)<>\"#\"),IF(LEFT(I27,1)=\"-\",REPLACE(I27,1,1,tech!$H$2),I27),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|","- List of policies with references, versions, etc.","The scope of policies is defined and documented","Guidance","1.2.1.GY",{"$f":"IF(AND(O27<>\"\",LEFT(O27,1)<>\"#\"),IF(LEFT(O27,1)=\"-\",REPLACE(O27,1,1,tech!$H$2),O27),\"\")","v":"• List of policies with references, versions, etc."},"|","The compliance policies typically include:","Compliance policies are defined, implemented, and communicated","Guidance","1.3.1.GY",{"$f":"IF(AND(U27<>\"\",LEFT(U27,1)<>\"#\"),IF(LEFT(U27,1)=\"-\",REPLACE(U27,1,1,tech!$H$2),U27),\"\")","v":"The compliance policies typically include:"},"|","#### Assessment","Scope of processes and procedure is aligned with policies","Assessment","1.4.1.AX",{"$f":"IF(AND(AA27<>\"\",LEFT(AA27,1)<>\"#\"),IF(LEFT(AA27,1)=\"-\",REPLACE(AA27,1,1,tech!$H$2),AA27),\"\")","v":""},"|","- Role to be assigned","Key management roles and responsibilities are documented and formally assigned","Guidance","2.1.1.GY",{"$f":"IF(AND(AG27<>\"\",LEFT(AG27,1)<>\"#\"),IF(LEFT(AG27,1)=\"-\",REPLACE(AG27,1,1,tech!$H$2),AG27),\"\")","v":"• Role to be assigned"},"|","* Revocation profiles, i.e. CRL and/or OCSP","Certificate profiles are documented","Guidance","2.2.1.GY",{"$f":"IF(AND(AM27<>\"\",LEFT(AM27,1)<>\"#\"),IF(LEFT(AM27,1)=\"-\",REPLACE(AM27,1,1,tech!$H$2),AM27),\"\")","v":"* Revocation profiles, i.e. CRL and/or OCSP"},"|","- Clustering and load balancing","Network and deployment infrastructure is documented","Guidance","2.3.1.GY",{"$f":"IF(AND(AS27<>\"\",LEFT(AS27,1)<>\"#\"),IF(LEFT(AS27,1)=\"-\",REPLACE(AS27,1,1,tech!$H$2),AS27),\"\")","v":"• Clustering and load balancing"},"|","- Principles and boundaries for change management and agility","The policy for change management and agility is documented","Guidance","2.4.1.GY",{"$f":"IF(AND(AY27<>\"\",LEFT(AY27,1)<>\"#\"),IF(LEFT(AY27,1)=\"-\",REPLACE(AY27,1,1,tech!$H$2),AY27),\"\")","v":"• Principles and boundaries for change management and agility"},"|","The following is sample evidence that can be used to assess the requirement:","Risk assessment and business impact analysis","Assessment","3.1.1.AY",{"$f":"IF(AND(BE27<>\"\",LEFT(BE27,1)<>\"#\"),IF(LEFT(BE27,1)=\"-\",REPLACE(BE27,1,1,tech!$H$2),BE27),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|","- Restrictions on the use of proprietary interfaces","Maintain PKI interoperability strategy","Guidance","3.2.1.GY",{"$f":"IF(AND(BK27<>\"\",LEFT(BK27,1)<>\"#\"),IF(LEFT(BK27,1)=\"-\",REPLACE(BK27,1,1,tech!$H$2),BK27),\"\")","v":"• Restrictions on the use of proprietary interfaces"},"|","- Retention period for logs","Monitoring events and logging requirements are defined and documented","Guidance","3.3.1.GY",{"$f":"IF(AND(BQ27<>\"\",LEFT(BQ27,1)<>\"#\"),IF(LEFT(BQ27,1)=\"-\",REPLACE(BQ27,1,1,tech!$H$2),BQ27),\"\")","v":"• Retention period for logs"},"|","- involved Tools and technologies","Process automation description","Guidance","3.4.1.GY",{"$f":"IF(AND(BW27<>\"\",LEFT(BW27,1)<>\"#\"),IF(LEFT(BW27,1)=\"-\",REPLACE(BW27,1,1,tech!$H$2),BW27),\"\")","v":"• involved Tools and technologies"},"|","- Documented requirements on the resources","Resources are identified and documented","Assessment","4.1.1.AY",{"$f":"IF(AND(CC27<>\"\",LEFT(CC27,1)<>\"#\"),IF(LEFT(CC27,1)=\"-\",REPLACE(CC27,1,1,tech!$H$2),CC27),\"\")","v":"• Documented requirements on the resources"},"|","- Training format and methods","Establish training plan","Guidance","4.2.1.GY",{"$f":"IF(AND(CI27<>\"\",LEFT(CI27,1)<>\"#\"),IF(LEFT(CI27,1)=\"-\",REPLACE(CI27,1,1,tech!$H$2),CI27),\"\")","v":"• Training format and methods"},"|",null,"Establish and maintain awareness plan","Guidance","4.3.1.GY",{"$f":"IF(AND(CO27<>\"\",LEFT(CO27,1)<>\"#\"),IF(LEFT(CO27,1)=\"-\",REPLACE(CO27,1,1,tech!$H$2),CO27),\"\")","v":""},"|"]
[null,null,"- High probability of operational issues","Initial","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D28,tech!$A$13:$B$17,2,0),LEFT(E28,1),IF(G28=\"\",\"X\",\"Y\"))","v":"1AY"},{"$f":"IF(IF(LEFT(C28,1)=\"-\",C28,\"\")=\"\",\"\",REPLACE(IF(LEFT(C28,1)=\"-\",C28,\"\"),1,1,tech!$H$2))","v":"• High probability of operational issues"},"|","- Interview with the top management","Organizational sponsor and support","Assessment","1.1.1.AY",{"$f":"IF(AND(I28<>\"\",LEFT(I28,1)<>\"#\"),IF(LEFT(I28,1)=\"-\",REPLACE(I28,1,1,tech!$H$2),I28),\"\")","v":"• Interview with the top management"},"|","- any other relevant information","The scope of policies is defined and documented","Guidance","1.2.1.GY",{"$f":"IF(AND(O28<>\"\",LEFT(O28,1)<>\"#\"),IF(LEFT(O28,1)=\"-\",REPLACE(O28,1,1,tech!$H$2),O28),\"\")","v":"• any other relevant information"},"|","- Laws, industry regulations and government legislation that apply to the organization business and PKI","Compliance policies are defined, implemented, and communicated","Guidance","1.3.1.GY",{"$f":"IF(AND(U28<>\"\",LEFT(U28,1)<>\"#\"),IF(LEFT(U28,1)=\"-\",REPLACE(U28,1,1,tech!$H$2),U28),\"\")","v":"• Laws, industry regulations and government legislation that apply to the organization business and PKI"},"|",null,"Scope of processes and procedure is aligned with policies","Assessment","1.4.1.AX",{"$f":"IF(AND(AA28<>\"\",LEFT(AA28,1)<>\"#\"),IF(LEFT(AA28,1)=\"-\",REPLACE(AA28,1,1,tech!$H$2),AA28),\"\")","v":""},"|","- Date of appointment","Key management roles and responsibilities are documented and formally assigned","Guidance","2.1.1.GY",{"$f":"IF(AND(AG28<>\"\",LEFT(AG28,1)<>\"#\"),IF(LEFT(AG28,1)=\"-\",REPLACE(AG28,1,1,tech!$H$2),AG28),\"\")","v":"• Date of appointment"},"|",null,"Certificate profiles are documented","Guidance","2.2.1.GX",{"$f":"IF(AND(AM28<>\"\",LEFT(AM28,1)<>\"#\"),IF(LEFT(AM28,1)=\"-\",REPLACE(AM28,1,1,tech!$H$2),AM28),\"\")","v":""},"|","- network topology and diagram","Network and deployment infrastructure is documented","Guidance","2.3.1.GY",{"$f":"IF(AND(AS28<>\"\",LEFT(AS28,1)<>\"#\"),IF(LEFT(AS28,1)=\"-\",REPLACE(AS28,1,1,tech!$H$2),AS28),\"\")","v":"• network topology and diagram"},"|","- roles and responsibilities","The policy for change management and agility is documented","Guidance","2.4.1.GY",{"$f":"IF(AND(AY28<>\"\",LEFT(AY28,1)<>\"#\"),IF(LEFT(AY28,1)=\"-\",REPLACE(AY28,1,1,tech!$H$2),AY28),\"\")","v":"• roles and responsibilities"},"|","- Risk management and assessment process","Risk assessment and business impact analysis","Assessment","3.1.1.AY",{"$f":"IF(AND(BE28<>\"\",LEFT(BE28,1)<>\"#\"),IF(LEFT(BE28,1)=\"-\",REPLACE(BE28,1,1,tech!$H$2),BE28),\"\")","v":"• Risk management and assessment process"},"|","- interoperability testing","Maintain PKI interoperability strategy","Guidance","3.2.1.GY",{"$f":"IF(AND(BK28<>\"\",LEFT(BK28,1)<>\"#\"),IF(LEFT(BK28,1)=\"-\",REPLACE(BK28,1,1,tech!$H$2),BK28),\"\")","v":"• interoperability testing"},"|","- Audit trail requirements","Monitoring events and logging requirements are defined and documented","Guidance","3.3.1.GY",{"$f":"IF(AND(BQ28<>\"\",LEFT(BQ28,1)<>\"#\"),IF(LEFT(BQ28,1)=\"-\",REPLACE(BQ28,1,1,tech!$H$2),BQ28),\"\")","v":"• Audit trail requirements"},"|","- Monitoring and auditing requirements","Process automation description","Guidance","3.4.1.GY",{"$f":"IF(AND(BW28<>\"\",LEFT(BW28,1)<>\"#\"),IF(LEFT(BW28,1)=\"-\",REPLACE(BW28,1,1,tech!$H$2),BW28),\"\")","v":"• Monitoring and auditing requirements"},"|","- Categorization of resources (an example can be people, processes, procedures, tools, technologies)","Resources are identified and documented","Assessment","4.1.1.AY",{"$f":"IF(AND(CC28<>\"\",LEFT(CC28,1)<>\"#\"),IF(LEFT(CC28,1)=\"-\",REPLACE(CC28,1,1,tech!$H$2),CC28),\"\")","v":"• Categorization of resources (an example can be people, processes, procedures, tools, technologies)"},"|","- requirements on Training reports and records","Establish training plan","Guidance","4.2.1.GY",{"$f":"IF(AND(CI28<>\"\",LEFT(CI28,1)<>\"#\"),IF(LEFT(CI28,1)=\"-\",REPLACE(CI28,1,1,tech!$H$2),CI28),\"\")","v":"• requirements on Training reports and records"},"|","Every PKI participant should receive information and relevant resource in a timely manner according to the awareness plan.","Establish and maintain awareness plan","Guidance","4.3.1.GY",{"$f":"IF(AND(CO28<>\"\",LEFT(CO28,1)<>\"#\"),IF(LEFT(CO28,1)=\"-\",REPLACE(CO28,1,1,tech!$H$2),CO28),\"\")","v":"Every PKI participant should receive information and relevant resource in a timely manner according to the awareness plan."},"|"]
[null,null,"- no trust","Initial","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D29,tech!$A$13:$B$17,2,0),LEFT(E29,1),IF(G29=\"\",\"X\",\"Y\"))","v":"1AY"},{"$f":"IF(IF(LEFT(C29,1)=\"-\",C29,\"\")=\"\",\"\",REPLACE(IF(LEFT(C29,1)=\"-\",C29,\"\"),1,1,tech!$H$2))","v":"• no trust"},"|","- Documented strategy and vision","Organizational sponsor and support","Assessment","1.1.1.AY",{"$f":"IF(AND(I29<>\"\",LEFT(I29,1)<>\"#\"),IF(LEFT(I29,1)=\"-\",REPLACE(I29,1,1,tech!$H$2),I29),\"\")","v":"• Documented strategy and vision"},"|",null,"The scope of policies is defined and documented","Guidance","1.2.1.GX",{"$f":"IF(AND(O29<>\"\",LEFT(O29,1)<>\"#\"),IF(LEFT(O29,1)=\"-\",REPLACE(O29,1,1,tech!$H$2),O29),\"\")","v":""},"|","- Roles and responsibilities","Compliance policies are defined, implemented, and communicated","Guidance","1.3.1.GY",{"$f":"IF(AND(U29<>\"\",LEFT(U29,1)<>\"#\"),IF(LEFT(U29,1)=\"-\",REPLACE(U29,1,1,tech!$H$2),U29),\"\")","v":"• Roles and responsibilities"},"|","The following is a sample evidence and information that can be collected during the assessment:","Scope of processes and procedure is aligned with policies","Assessment","1.4.1.AY",{"$f":"IF(AND(AA29<>\"\",LEFT(AA29,1)<>\"#\"),IF(LEFT(AA29,1)=\"-\",REPLACE(AA29,1,1,tech!$H$2),AA29),\"\")","v":"The following is a sample evidence and information that can be collected during the assessment:"},"|","- Confirmation of required skills","Key management roles and responsibilities are documented and formally assigned","Guidance","2.1.1.GY",{"$f":"IF(AND(AG29<>\"\",LEFT(AG29,1)<>\"#\"),IF(LEFT(AG29,1)=\"-\",REPLACE(AG29,1,1,tech!$H$2),AG29),\"\")","v":"• Confirmation of required skills"},"|","#### Assessment","Certificate profiles are documented","Assessment","2.2.1.AX",{"$f":"IF(AND(AM29<>\"\",LEFT(AM29,1)<>\"#\"),IF(LEFT(AM29,1)=\"-\",REPLACE(AM29,1,1,tech!$H$2),AM29),\"\")","v":""},"|","- Communication and open ports requirements","Network and deployment infrastructure is documented","Guidance","2.3.1.GY",{"$f":"IF(AND(AS29<>\"\",LEFT(AS29,1)<>\"#\"),IF(LEFT(AS29,1)=\"-\",REPLACE(AS29,1,1,tech!$H$2),AS29),\"\")","v":"• Communication and open ports requirements"},"|","- requirements for change management and agility","The policy for change management and agility is documented","Guidance","2.4.1.GY",{"$f":"IF(AND(AY29<>\"\",LEFT(AY29,1)<>\"#\"),IF(LEFT(AY29,1)=\"-\",REPLACE(AY29,1,1,tech!$H$2),AY29),\"\")","v":"• requirements for change management and agility"},"|","- Documented Risk assessment Results","Risk assessment and business impact analysis","Assessment","3.1.1.AY",{"$f":"IF(AND(BE29<>\"\",LEFT(BE29,1)<>\"#\"),IF(LEFT(BE29,1)=\"-\",REPLACE(BE29,1,1,tech!$H$2),BE29),\"\")","v":"• Documented Risk assessment Results"},"|","- requirements for migration to New technologies","Maintain PKI interoperability strategy","Guidance","3.2.1.GY",{"$f":"IF(AND(BK29<>\"\",LEFT(BK29,1)<>\"#\"),IF(LEFT(BK29,1)=\"-\",REPLACE(BK29,1,1,tech!$H$2),BK29),\"\")","v":"• requirements for migration to New technologies"},"|","- Audit log protection requirements","Monitoring events and logging requirements are defined and documented","Guidance","3.3.1.GY",{"$f":"IF(AND(BQ29<>\"\",LEFT(BQ29,1)<>\"#\"),IF(LEFT(BQ29,1)=\"-\",REPLACE(BQ29,1,1,tech!$H$2),BQ29),\"\")","v":"• Audit log protection requirements"},"|","- Potential measures and controls","Process automation description","Guidance","3.4.1.GY",{"$f":"IF(AND(BW29<>\"\",LEFT(BW29,1)<>\"#\"),IF(LEFT(BW29,1)=\"-\",REPLACE(BW29,1,1,tech!$H$2),BW29),\"\")","v":"• Potential measures and controls"},"|","- Alignment with the scope of the use-case","Resources are identified and documented","Assessment","4.1.1.AY",{"$f":"IF(AND(CC29<>\"\",LEFT(CC29,1)<>\"#\"),IF(LEFT(CC29,1)=\"-\",REPLACE(CC29,1,1,tech!$H$2),CC29),\"\")","v":"• Alignment with the scope of the use-case"},"|","- Training plan Review and update","Establish training plan","Guidance","4.2.1.GY",{"$f":"IF(AND(CI29<>\"\",LEFT(CI29,1)<>\"#\"),IF(LEFT(CI29,1)=\"-\",REPLACE(CI29,1,1,tech!$H$2),CI29),\"\")","v":"• Training plan Review and update"},"|",null,"Establish and maintain awareness plan","Guidance","4.3.1.GX",{"$f":"IF(AND(CO29<>\"\",LEFT(CO29,1)<>\"#\"),IF(LEFT(CO29,1)=\"-\",REPLACE(CO29,1,1,tech!$H$2),CO29),\"\")","v":""},"|"]
[{"$nulls":3},"Initial","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D30,tech!$A$13:$B$17,2,0),LEFT(E30,1),IF(G30=\"\",\"X\",\"Y\"))","v":"1AX"},{"$f":"IF(IF(LEFT(C30,1)=\"-\",C30,\"\")=\"\",\"\",REPLACE(IF(LEFT(C30,1)=\"-\",C30,\"\"),1,1,tech!$H$2))","v":""},"|","- Documented organizational goals and approach","Organizational sponsor and support","Assessment","1.1.1.AY",{"$f":"IF(AND(I30<>\"\",LEFT(I30,1)<>\"#\"),IF(LEFT(I30,1)=\"-\",REPLACE(I30,1,1,tech!$H$2),I30),\"\")","v":"• Documented organizational goals and approach"},"|","#### Assessment","The scope of policies is defined and documented","Assessment","1.2.1.AX",{"$f":"IF(AND(O30<>\"\",LEFT(O30,1)<>\"#\"),IF(LEFT(O30,1)=\"-\",REPLACE(O30,1,1,tech!$H$2),O30),\"\")","v":""},"|","- Compliance program management requirements","Compliance policies are defined, implemented, and communicated","Guidance","1.3.1.GY",{"$f":"IF(AND(U30<>\"\",LEFT(U30,1)<>\"#\"),IF(LEFT(U30,1)=\"-\",REPLACE(U30,1,1,tech!$H$2),U30),\"\")","v":"• Compliance program management requirements"},"|","- Documented scope of the processes and procedures","Scope of processes and procedure is aligned with policies","Assessment","1.4.1.AY",{"$f":"IF(AND(AA30<>\"\",LEFT(AA30,1)<>\"#\"),IF(LEFT(AA30,1)=\"-\",REPLACE(AA30,1,1,tech!$H$2),AA30),\"\")","v":"• Documented scope of the processes and procedures"},"|","- Acknowledgment of responsibilities","Key management roles and responsibilities are documented and formally assigned","Guidance","2.1.1.GY",{"$f":"IF(AND(AG30<>\"\",LEFT(AG30,1)<>\"#\"),IF(LEFT(AG30,1)=\"-\",REPLACE(AG30,1,1,tech!$H$2),AG30),\"\")","v":"• Acknowledgment of responsibilities"},"|",null,"Certificate profiles are documented","Assessment","2.2.1.AX",{"$f":"IF(AND(AM30<>\"\",LEFT(AM30,1)<>\"#\"),IF(LEFT(AM30,1)=\"-\",REPLACE(AM30,1,1,tech!$H$2),AM30),\"\")","v":""},"|","- Supporting cloud providers and services","Network and deployment infrastructure is documented","Guidance","2.3.1.GY",{"$f":"IF(AND(AS30<>\"\",LEFT(AS30,1)<>\"#\"),IF(LEFT(AS30,1)=\"-\",REPLACE(AS30,1,1,tech!$H$2),AS30),\"\")","v":"• Supporting cloud providers and services"},"|","- Tools and technologies used for change management","The policy for change management and agility is documented","Guidance","2.4.1.GY",{"$f":"IF(AND(AY30<>\"\",LEFT(AY30,1)<>\"#\"),IF(LEFT(AY30,1)=\"-\",REPLACE(AY30,1,1,tech!$H$2),AY30),\"\")","v":"• Tools and technologies used for change management"},"|","- Documented business impact analysis Results","Risk assessment and business impact analysis","Assessment","3.1.1.AY",{"$f":"IF(AND(BE30<>\"\",LEFT(BE30,1)<>\"#\"),IF(LEFT(BE30,1)=\"-\",REPLACE(BE30,1,1,tech!$H$2),BE30),\"\")","v":"• Documented business impact analysis Results"},"|","- requirements for vendors","Maintain PKI interoperability strategy","Guidance","3.2.1.GY",{"$f":"IF(AND(BK30<>\"\",LEFT(BK30,1)<>\"#\"),IF(LEFT(BK30,1)=\"-\",REPLACE(BK30,1,1,tech!$H$2),BK30),\"\")","v":"• requirements for vendors"},"|","- Formatting and interpretation of logs (syslog, JSON, XML, CEF, etc.)","Monitoring events and logging requirements are defined and documented","Guidance","3.3.1.GY",{"$f":"IF(AND(BQ30<>\"\",LEFT(BQ30,1)<>\"#\"),IF(LEFT(BQ30,1)=\"-\",REPLACE(BQ30,1,1,tech!$H$2),BQ30),\"\")","v":"• Formatting and interpretation of logs (syslog, JSON, XML, CEF, etc.)"},"|","- Exceptions","Process automation description","Guidance","3.4.1.GY",{"$f":"IF(AND(BW30<>\"\",LEFT(BW30,1)<>\"#\"),IF(LEFT(BW30,1)=\"-\",REPLACE(BW30,1,1,tech!$H$2),BW30),\"\")","v":"• Exceptions"},"|",null,"Resources are identified and documented","Assessment","4.1.1.AX",{"$f":"IF(AND(CC30<>\"\",LEFT(CC30,1)<>\"#\"),IF(LEFT(CC30,1)=\"-\",REPLACE(CC30,1,1,tech!$H$2),CC30),\"\")","v":""},"|",null,"Establish training plan","Guidance","4.2.1.GY",{"$f":"IF(AND(CI30<>\"\",LEFT(CI30,1)<>\"#\"),IF(LEFT(CI30,1)=\"-\",REPLACE(CI30,1,1,tech!$H$2),CI30),\"\")","v":""},"|","#### Assessment","Establish and maintain awareness plan","Assessment","4.3.1.AX",{"$f":"IF(AND(CO30<>\"\",LEFT(CO30,1)<>\"#\"),IF(LEFT(CO30,1)=\"-\",REPLACE(CO30,1,1,tech!$H$2),CO30),\"\")","v":""},"|"]
[null,null,"## Basic maturity level","Basic","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D31,tech!$A$13:$B$17,2,0),LEFT(E31,1),IF(G31=\"\",\"X\",\"Y\"))","v":"2AX"},{"$f":"IF(IF(LEFT(C31,1)=\"-\",C31,\"\")=\"\",\"\",REPLACE(IF(LEFT(C31,1)=\"-\",C31,\"\"),1,1,tech!$H$2))","v":""},"|","- Understanding of why the PKI is needed and what is the value for the organization","Organizational sponsor and support","Assessment","1.1.1.AY",{"$f":"IF(AND(I31<>\"\",LEFT(I31,1)<>\"#\"),IF(LEFT(I31,1)=\"-\",REPLACE(I31,1,1,tech!$H$2),I31),\"\")","v":"• Understanding of why the PKI is needed and what is the value for the organization"},"|",null,"The scope of policies is defined and documented","Assessment","1.2.1.AX",{"$f":"IF(AND(O31<>\"\",LEFT(O31,1)<>\"#\"),IF(LEFT(O31,1)=\"-\",REPLACE(O31,1,1,tech!$H$2),O31),\"\")","v":""},"|","- Reporting and auditing requirements","Compliance policies are defined, implemented, and communicated","Guidance","1.3.1.GY",{"$f":"IF(AND(U31<>\"\",LEFT(U31,1)<>\"#\"),IF(LEFT(U31,1)=\"-\",REPLACE(U31,1,1,tech!$H$2),U31),\"\")","v":"• Reporting and auditing requirements"},"|","- alignment with the PKI policies and statements","Scope of processes and procedure is aligned with policies","Assessment","1.4.1.AY",{"$f":"IF(AND(AA31<>\"\",LEFT(AA31,1)<>\"#\"),IF(LEFT(AA31,1)=\"-\",REPLACE(AA31,1,1,tech!$H$2),AA31),\"\")","v":"• alignment with the PKI policies and statements"},"|",null,"Key management roles and responsibilities are documented and formally assigned","Guidance","2.1.1.GX",{"$f":"IF(AND(AG31<>\"\",LEFT(AG31,1)<>\"#\"),IF(LEFT(AG31,1)=\"-\",REPLACE(AG31,1,1,tech!$H$2),AG31),\"\")","v":""},"|","* Documented scope of applicability","Certificate profiles are documented","Assessment","2.2.1.AY",{"$f":"IF(AND(AM31<>\"\",LEFT(AM31,1)<>\"#\"),IF(LEFT(AM31,1)=\"-\",REPLACE(AM31,1,1,tech!$H$2),AM31),\"\")","v":"* Documented scope of applicability"},"|","- Supporting systems and services (identity management, access control, logging, monitoring, etc.)","Network and deployment infrastructure is documented","Guidance","2.3.1.GY",{"$f":"IF(AND(AS31<>\"\",LEFT(AS31,1)<>\"#\"),IF(LEFT(AS31,1)=\"-\",REPLACE(AS31,1,1,tech!$H$2),AS31),\"\")","v":"• Supporting systems and services (identity management, access control, logging, monitoring, etc.)"},"|","- and other relevant information","The policy for change management and agility is documented","Guidance","2.4.1.GY",{"$f":"IF(AND(AY31<>\"\",LEFT(AY31,1)<>\"#\"),IF(LEFT(AY31,1)=\"-\",REPLACE(AY31,1,1,tech!$H$2),AY31),\"\")","v":"• and other relevant information"},"|","- Documented recovery strategies","Risk assessment and business impact analysis","Assessment","3.1.1.AY",{"$f":"IF(AND(BE31<>\"\",LEFT(BE31,1)<>\"#\"),IF(LEFT(BE31,1)=\"-\",REPLACE(BE31,1,1,tech!$H$2),BE31),\"\")","v":"• Documented recovery strategies"},"|","- other relevant information","Maintain PKI interoperability strategy","Guidance","3.2.1.GY",{"$f":"IF(AND(BK31<>\"\",LEFT(BK31,1)<>\"#\"),IF(LEFT(BK31,1)=\"-\",REPLACE(BK31,1,1,tech!$H$2),BK31),\"\")","v":"• other relevant information"},"|","- and other relevant requirements","Monitoring events and logging requirements are defined and documented","Guidance","3.3.1.GY",{"$f":"IF(AND(BQ31<>\"\",LEFT(BQ31,1)<>\"#\"),IF(LEFT(BQ31,1)=\"-\",REPLACE(BQ31,1,1,tech!$H$2),BQ31),\"\")","v":"• and other relevant requirements"},"|","- logging and reporting","Process automation description","Guidance","3.4.1.GY",{"$f":"IF(AND(BW31<>\"\",LEFT(BW31,1)<>\"#\"),IF(LEFT(BW31,1)=\"-\",REPLACE(BW31,1,1,tech!$H$2),BW31),\"\")","v":"• logging and reporting"},"|","#### References","Resources are identified and documented","References","4.1.1.RX",{"$f":"IF(AND(CC31<>\"\",LEFT(CC31,1)<>\"#\"),IF(LEFT(CC31,1)=\"-\",REPLACE(CC31,1,1,tech!$H$2),CC31),\"\")","v":""},"|","There can be different methods of training, depending on the needs and requirements:","Establish training plan","Guidance","4.2.1.GY",{"$f":"IF(AND(CI31<>\"\",LEFT(CI31,1)<>\"#\"),IF(LEFT(CI31,1)=\"-\",REPLACE(CI31,1,1,tech!$H$2),CI31),\"\")","v":"There can be different methods of training, depending on the needs and requirements:"},"|",null,"Establish and maintain awareness plan","Assessment","4.3.1.AX",{"$f":"IF(AND(CO31<>\"\",LEFT(CO31,1)<>\"#\"),IF(LEFT(CO31,1)=\"-\",REPLACE(CO31,1,1,tech!$H$2),CO31),\"\")","v":""},"|"]
[{"$nulls":3},"Basic","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D32,tech!$A$13:$B$17,2,0),LEFT(E32,1),IF(G32=\"\",\"X\",\"Y\"))","v":"2AX"},{"$f":"IF(IF(LEFT(C32,1)=\"-\",C32,\"\")=\"\",\"\",REPLACE(IF(LEFT(C32,1)=\"-\",C32,\"\"),1,1,tech!$H$2))","v":""},"|","- Support and sponsorship of the top management","Organizational sponsor and support","Assessment","1.1.1.AY",{"$f":"IF(AND(I32<>\"\",LEFT(I32,1)<>\"#\"),IF(LEFT(I32,1)=\"-\",REPLACE(I32,1,1,tech!$H$2),I32),\"\")","v":"• Support and sponsorship of the top management"},"|","- the scope of policies is defined and Documented","The scope of policies is defined and documented","Assessment","1.2.1.AY",{"$f":"IF(AND(O32<>\"\",LEFT(O32,1)<>\"#\"),IF(LEFT(O32,1)=\"-\",REPLACE(O32,1,1,tech!$H$2),O32),\"\")","v":"• the scope of policies is defined and Documented"},"|","- References to relevant documents (anti-trust, anti-fraud, anti-bribery, anti-money laundering, due diligence, etc.)","Compliance policies are defined, implemented, and communicated","Guidance","1.3.1.GY",{"$f":"IF(AND(U32<>\"\",LEFT(U32,1)<>\"#\"),IF(LEFT(U32,1)=\"-\",REPLACE(U32,1,1,tech!$H$2),U32),\"\")","v":"• References to relevant documents (anti-trust, anti-fraud, anti-bribery, anti-money laundering, due diligence, etc.)"},"|","- Interview with the PKI management","Scope of processes and procedure is aligned with policies","Assessment","1.4.1.AY",{"$f":"IF(AND(AA32<>\"\",LEFT(AA32,1)<>\"#\"),IF(LEFT(AA32,1)=\"-\",REPLACE(AA32,1,1,tech!$H$2),AA32),\"\")","v":"• Interview with the PKI management"},"|","#### Assessment","Key management roles and responsibilities are documented and formally assigned","Assessment","2.1.1.AX",{"$f":"IF(AND(AG32<>\"\",LEFT(AG32,1)<>\"#\"),IF(LEFT(AG32,1)=\"-\",REPLACE(AG32,1,1,tech!$H$2),AG32),\"\")","v":""},"|","* Documented and approved certificate profiles","Certificate profiles are documented","Assessment","2.2.1.AY",{"$f":"IF(AND(AM32<>\"\",LEFT(AM32,1)<>\"#\"),IF(LEFT(AM32,1)=\"-\",REPLACE(AM32,1,1,tech!$H$2),AM32),\"\")","v":"* Documented and approved certificate profiles"},"|",null,"Network and deployment infrastructure is documented","Guidance","2.3.1.GX",{"$f":"IF(AND(AS32<>\"\",LEFT(AS32,1)<>\"#\"),IF(LEFT(AS32,1)=\"-\",REPLACE(AS32,1,1,tech!$H$2),AS32),\"\")","v":""},"|",null,"The policy for change management and agility is documented","Guidance","2.4.1.GX",{"$f":"IF(AND(AY32<>\"\",LEFT(AY32,1)<>\"#\"),IF(LEFT(AY32,1)=\"-\",REPLACE(AY32,1,1,tech!$H$2),AY32),\"\")","v":""},"|","- Understanding of the resilience and Approval of the Results","Risk assessment and business impact analysis","Assessment","3.1.1.AY",{"$f":"IF(AND(BE32<>\"\",LEFT(BE32,1)<>\"#\"),IF(LEFT(BE32,1)=\"-\",REPLACE(BE32,1,1,tech!$H$2),BE32),\"\")","v":"• Understanding of the resilience and Approval of the Results"},"|",null,"Maintain PKI interoperability strategy","Guidance","3.2.1.GX",{"$f":"IF(AND(BK32<>\"\",LEFT(BK32,1)<>\"#\"),IF(LEFT(BK32,1)=\"-\",REPLACE(BK32,1,1,tech!$H$2),BK32),\"\")","v":""},"|",null,"Monitoring events and logging requirements are defined and documented","Guidance","3.3.1.GX",{"$f":"IF(AND(BQ32<>\"\",LEFT(BQ32,1)<>\"#\"),IF(LEFT(BQ32,1)=\"-\",REPLACE(BQ32,1,1,tech!$H$2),BQ32),\"\")","v":""},"|","- any other relevant information and requirements","Process automation description","Guidance","3.4.1.GY",{"$f":"IF(AND(BW32<>\"\",LEFT(BW32,1)<>\"#\"),IF(LEFT(BW32,1)=\"-\",REPLACE(BW32,1,1,tech!$H$2),BW32),\"\")","v":"• any other relevant information and requirements"},"|",null,"Resources are identified and documented","References","4.1.1.RX",{"$f":"IF(AND(CC32<>\"\",LEFT(CC32,1)<>\"#\"),IF(LEFT(CC32,1)=\"-\",REPLACE(CC32,1,1,tech!$H$2),CC32),\"\")","v":""},"|","- Instructor-led Training","Establish training plan","Guidance","4.2.1.GY",{"$f":"IF(AND(CI32<>\"\",LEFT(CI32,1)<>\"#\"),IF(LEFT(CI32,1)=\"-\",REPLACE(CI32,1,1,tech!$H$2),CI32),\"\")","v":"• Instructor-led Training"},"|","- Documented awareness plan","Establish and maintain awareness plan","Assessment","4.3.1.AY",{"$f":"IF(AND(CO32<>\"\",LEFT(CO32,1)<>\"#\"),IF(LEFT(CO32,1)=\"-\",REPLACE(CO32,1,1,tech!$H$2),CO32),\"\")","v":"• Documented awareness plan"},"|"]
[null,null,"### Indicators","Basic","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D33,tech!$A$13:$B$17,2,0),LEFT(E33,1),IF(G33=\"\",\"X\",\"Y\"))","v":"2IX"},{"$f":"IF(IF(LEFT(C33,1)=\"-\",C33,\"\")=\"\",\"\",REPLACE(IF(LEFT(C33,1)=\"-\",C33,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Organizational sponsor and support","Assessment","1.1.1.AX",{"$f":"IF(AND(I33<>\"\",LEFT(I33,1)<>\"#\"),IF(LEFT(I33,1)=\"-\",REPLACE(I33,1,1,tech!$H$2),I33),\"\")","v":""},"|","- the scope of policies is complete","The scope of policies is defined and documented","Assessment","1.2.1.AY",{"$f":"IF(AND(O33<>\"\",LEFT(O33,1)<>\"#\"),IF(LEFT(O33,1)=\"-\",REPLACE(O33,1,1,tech!$H$2),O33),\"\")","v":"• the scope of policies is complete"},"|","- Any other relevant information that rule Compliance","Compliance policies are defined, implemented, and communicated","Guidance","1.3.1.GY",{"$f":"IF(AND(U33<>\"\",LEFT(U33,1)<>\"#\"),IF(LEFT(U33,1)=\"-\",REPLACE(U33,1,1,tech!$H$2),U33),\"\")","v":"• Any other relevant information that rule Compliance"},"|",null,"Scope of processes and procedure is aligned with policies","Assessment","1.4.1.AX",{"$f":"IF(AND(AA33<>\"\",LEFT(AA33,1)<>\"#\"),IF(LEFT(AA33,1)=\"-\",REPLACE(AA33,1,1,tech!$H$2),AA33),\"\")","v":""},"|",null,"Key management roles and responsibilities are documented and formally assigned","Assessment","2.1.1.AX",{"$f":"IF(AND(AG33<>\"\",LEFT(AG33,1)<>\"#\"),IF(LEFT(AG33,1)=\"-\",REPLACE(AG33,1,1,tech!$H$2),AG33),\"\")","v":""},"|","* Content of the profiles is complete and unambiguous","Certificate profiles are documented","Assessment","2.2.1.AY",{"$f":"IF(AND(AM33<>\"\",LEFT(AM33,1)<>\"#\"),IF(LEFT(AM33,1)=\"-\",REPLACE(AM33,1,1,tech!$H$2),AM33),\"\")","v":"* Content of the profiles is complete and unambiguous"},"|","#### Assessment","Network and deployment infrastructure is documented","Assessment","2.3.1.AX",{"$f":"IF(AND(AS33<>\"\",LEFT(AS33,1)<>\"#\"),IF(LEFT(AS33,1)=\"-\",REPLACE(AS33,1,1,tech!$H$2),AS33),\"\")","v":""},"|","#### Assessment","The policy for change management and agility is documented","Assessment","2.4.1.AX",{"$f":"IF(AND(AY33<>\"\",LEFT(AY33,1)<>\"#\"),IF(LEFT(AY33,1)=\"-\",REPLACE(AY33,1,1,tech!$H$2),AY33),\"\")","v":""},"|","- Interview with the PKI management","Risk assessment and business impact analysis","Assessment","3.1.1.AY",{"$f":"IF(AND(BE33<>\"\",LEFT(BE33,1)<>\"#\"),IF(LEFT(BE33,1)=\"-\",REPLACE(BE33,1,1,tech!$H$2),BE33),\"\")","v":"• Interview with the PKI management"},"|","#### Assessment","Maintain PKI interoperability strategy","Assessment","3.2.1.AX",{"$f":"IF(AND(BK33<>\"\",LEFT(BK33,1)<>\"#\"),IF(LEFT(BK33,1)=\"-\",REPLACE(BK33,1,1,tech!$H$2),BK33),\"\")","v":""},"|","#### Assessment","Monitoring events and logging requirements are defined and documented","Assessment","3.3.1.AX",{"$f":"IF(AND(BQ33<>\"\",LEFT(BQ33,1)<>\"#\"),IF(LEFT(BQ33,1)=\"-\",REPLACE(BQ33,1,1,tech!$H$2),BQ33),\"\")","v":""},"|",null,"Process automation description","Guidance","3.4.1.GX",{"$f":"IF(AND(BW33<>\"\",LEFT(BW33,1)<>\"#\"),IF(LEFT(BW33,1)=\"-\",REPLACE(BW33,1,1,tech!$H$2),BW33),\"\")","v":""},"|","N/A","Resources are identified and documented","References","4.1.1.RY",{"$f":"IF(AND(CC33<>\"\",LEFT(CC33,1)<>\"#\"),IF(LEFT(CC33,1)=\"-\",REPLACE(CC33,1,1,tech!$H$2),CC33),\"\")","v":"N/A"},"|","- internal or external webinars","Establish training plan","Guidance","4.2.1.GY",{"$f":"IF(AND(CI33<>\"\",LEFT(CI33,1)<>\"#\"),IF(LEFT(CI33,1)=\"-\",REPLACE(CI33,1,1,tech!$H$2),CI33),\"\")","v":"• internal or external webinars"},"|","- awareness plan is up-to-date","Establish and maintain awareness plan","Assessment","4.3.1.AY",{"$f":"IF(AND(CO33<>\"\",LEFT(CO33,1)<>\"#\"),IF(LEFT(CO33,1)=\"-\",REPLACE(CO33,1,1,tech!$H$2),CO33),\"\")","v":"• awareness plan is up-to-date"},"|"]
[{"$nulls":3},"Basic","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D34,tech!$A$13:$B$17,2,0),LEFT(E34,1),IF(G34=\"\",\"X\",\"Y\"))","v":"2IX"},{"$f":"IF(IF(LEFT(C34,1)=\"-\",C34,\"\")=\"\",\"\",REPLACE(IF(LEFT(C34,1)=\"-\",C34,\"\"),1,1,tech!$H$2))","v":""},"|","#### References","Organizational sponsor and support","References","1.1.1.RX",{"$f":"IF(AND(I34<>\"\",LEFT(I34,1)<>\"#\"),IF(LEFT(I34,1)=\"-\",REPLACE(I34,1,1,tech!$H$2),I34),\"\")","v":""},"|","- Interview with the management and PKI responsible personnel to confirm the scope","The scope of policies is defined and documented","Assessment","1.2.1.AY",{"$f":"IF(AND(O34<>\"\",LEFT(O34,1)<>\"#\"),IF(LEFT(O34,1)=\"-\",REPLACE(O34,1,1,tech!$H$2),O34),\"\")","v":"• Interview with the management and PKI responsible personnel to confirm the scope"},"|",null,"Compliance policies are defined, implemented, and communicated","Guidance","1.3.1.GX",{"$f":"IF(AND(U34<>\"\",LEFT(U34,1)<>\"#\"),IF(LEFT(U34,1)=\"-\",REPLACE(U34,1,1,tech!$H$2),U34),\"\")","v":""},"|","#### References","Scope of processes and procedure is aligned with policies","References","1.4.1.RX",{"$f":"IF(AND(AA34<>\"\",LEFT(AA34,1)<>\"#\"),IF(LEFT(AA34,1)=\"-\",REPLACE(AA34,1,1,tech!$H$2),AA34),\"\")","v":""},"|","- Documented roles and responsibilities","Key management roles and responsibilities are documented and formally assigned","Assessment","2.1.1.AY",{"$f":"IF(AND(AG34<>\"\",LEFT(AG34,1)<>\"#\"),IF(LEFT(AG34,1)=\"-\",REPLACE(AG34,1,1,tech!$H$2),AG34),\"\")","v":"• Documented roles and responsibilities"},"|","* Certificate profiles are implemented in certificattion authority","Certificate profiles are documented","Assessment","2.2.1.AY",{"$f":"IF(AND(AM34<>\"\",LEFT(AM34,1)<>\"#\"),IF(LEFT(AM34,1)=\"-\",REPLACE(AM34,1,1,tech!$H$2),AM34),\"\")","v":"* Certificate profiles are implemented in certificattion authority"},"|",null,"Network and deployment infrastructure is documented","Assessment","2.3.1.AX",{"$f":"IF(AND(AS34<>\"\",LEFT(AS34,1)<>\"#\"),IF(LEFT(AS34,1)=\"-\",REPLACE(AS34,1,1,tech!$H$2),AS34),\"\")","v":""},"|",null,"The policy for change management and agility is documented","Assessment","2.4.1.AX",{"$f":"IF(AND(AY34<>\"\",LEFT(AY34,1)<>\"#\"),IF(LEFT(AY34,1)=\"-\",REPLACE(AY34,1,1,tech!$H$2),AY34),\"\")","v":""},"|",null,"Risk assessment and business impact analysis","Assessment","3.1.1.AX",{"$f":"IF(AND(BE34<>\"\",LEFT(BE34,1)<>\"#\"),IF(LEFT(BE34,1)=\"-\",REPLACE(BE34,1,1,tech!$H$2),BE34),\"\")","v":""},"|",null,"Maintain PKI interoperability strategy","Assessment","3.2.1.AX",{"$f":"IF(AND(BK34<>\"\",LEFT(BK34,1)<>\"#\"),IF(LEFT(BK34,1)=\"-\",REPLACE(BK34,1,1,tech!$H$2),BK34),\"\")","v":""},"|",null,"Monitoring events and logging requirements are defined and documented","Assessment","3.3.1.AX",{"$f":"IF(AND(BQ34<>\"\",LEFT(BQ34,1)<>\"#\"),IF(LEFT(BQ34,1)=\"-\",REPLACE(BQ34,1,1,tech!$H$2),BQ34),\"\")","v":""},"|","#### Assessment","Process automation description","Assessment","3.4.1.AX",{"$f":"IF(AND(BW34<>\"\",LEFT(BW34,1)<>\"#\"),IF(LEFT(BW34,1)=\"-\",REPLACE(BW34,1,1,tech!$H$2),BW34),\"\")","v":""},"|",null,"Resources are identified and documented","References","4.1.1.RX",{"$f":"IF(AND(CC34<>\"\",LEFT(CC34,1)<>\"#\"),IF(LEFT(CC34,1)=\"-\",REPLACE(CC34,1,1,tech!$H$2),CC34),\"\")","v":""},"|","- Coaching","Establish training plan","Guidance","4.2.1.GY",{"$f":"IF(AND(CI34<>\"\",LEFT(CI34,1)<>\"#\"),IF(LEFT(CI34,1)=\"-\",REPLACE(CI34,1,1,tech!$H$2),CI34),\"\")","v":"• Coaching"},"|","- Review awareness content to ensure that it is contains relevant information","Establish and maintain awareness plan","Assessment","4.3.1.AY",{"$f":"IF(AND(CO34<>\"\",LEFT(CO34,1)<>\"#\"),IF(LEFT(CO34,1)=\"-\",REPLACE(CO34,1,1,tech!$H$2),CO34),\"\")","v":"• Review awareness content to ensure that it is contains relevant information"},"|"]
[null,null,"- PKI is ad-hoc managed, often reactive","Basic","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D35,tech!$A$13:$B$17,2,0),LEFT(E35,1),IF(G35=\"\",\"X\",\"Y\"))","v":"2IY"},{"$f":"IF(IF(LEFT(C35,1)=\"-\",C35,\"\")=\"\",\"\",REPLACE(IF(LEFT(C35,1)=\"-\",C35,\"\"),1,1,tech!$H$2))","v":"• PKI is ad-hoc managed, often reactive"},"|",null,"Organizational sponsor and support","References","1.1.1.RX",{"$f":"IF(AND(I35<>\"\",LEFT(I35,1)<>\"#\"),IF(LEFT(I35,1)=\"-\",REPLACE(I35,1,1,tech!$H$2),I35),\"\")","v":""},"|",null,"The scope of policies is defined and documented","Assessment","1.2.1.AX",{"$f":"IF(AND(O35<>\"\",LEFT(O35,1)<>\"#\"),IF(LEFT(O35,1)=\"-\",REPLACE(O35,1,1,tech!$H$2),O35),\"\")","v":""},"|","#### Assessment","Compliance policies are defined, implemented, and communicated","Assessment","1.3.1.AX",{"$f":"IF(AND(U35<>\"\",LEFT(U35,1)<>\"#\"),IF(LEFT(U35,1)=\"-\",REPLACE(U35,1,1,tech!$H$2),U35),\"\")","v":""},"|",null,"Scope of processes and procedure is aligned with policies","References","1.4.1.RX",{"$f":"IF(AND(AA35<>\"\",LEFT(AA35,1)<>\"#\"),IF(LEFT(AA35,1)=\"-\",REPLACE(AA35,1,1,tech!$H$2),AA35),\"\")","v":""},"|","- Signed naming protocol of personnel to Role(s)","Key management roles and responsibilities are documented and formally assigned","Assessment","2.1.1.AY",{"$f":"IF(AND(AG35<>\"\",LEFT(AG35,1)<>\"#\"),IF(LEFT(AG35,1)=\"-\",REPLACE(AG35,1,1,tech!$H$2),AG35),\"\")","v":"• Signed naming protocol of personnel to Role(s)"},"|","* Certificate profiles are enforced by certification authority","Certificate profiles are documented","Assessment","2.2.1.AY",{"$f":"IF(AND(AM35<>\"\",LEFT(AM35,1)<>\"#\"),IF(LEFT(AM35,1)=\"-\",REPLACE(AM35,1,1,tech!$H$2),AM35),\"\")","v":"* Certificate profiles are enforced by certification authority"},"|","The following is sample evidence that can be used to assess the requirement:","Network and deployment infrastructure is documented","Assessment","2.3.1.AY",{"$f":"IF(AND(AS35<>\"\",LEFT(AS35,1)<>\"#\"),IF(LEFT(AS35,1)=\"-\",REPLACE(AS35,1,1,tech!$H$2),AS35),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|","The following is sample evidence that can be used to assess the requirement:","The policy for change management and agility is documented","Assessment","2.4.1.AY",{"$f":"IF(AND(AY35<>\"\",LEFT(AY35,1)<>\"#\"),IF(LEFT(AY35,1)=\"-\",REPLACE(AY35,1,1,tech!$H$2),AY35),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|","#### References","Risk assessment and business impact analysis","References","3.1.1.RX",{"$f":"IF(AND(BE35<>\"\",LEFT(BE35,1)<>\"#\"),IF(LEFT(BE35,1)=\"-\",REPLACE(BE35,1,1,tech!$H$2),BE35),\"\")","v":""},"|","The following evidence should be available for the assessment of the requirement:","Maintain PKI interoperability strategy","Assessment","3.2.1.AY",{"$f":"IF(AND(BK35<>\"\",LEFT(BK35,1)<>\"#\"),IF(LEFT(BK35,1)=\"-\",REPLACE(BK35,1,1,tech!$H$2),BK35),\"\")","v":"The following evidence should be available for the assessment of the requirement:"},"|","- Documented Monitoring and logging requirements","Monitoring events and logging requirements are defined and documented","Assessment","3.3.1.AY",{"$f":"IF(AND(BQ35<>\"\",LEFT(BQ35,1)<>\"#\"),IF(LEFT(BQ35,1)=\"-\",REPLACE(BQ35,1,1,tech!$H$2),BQ35),\"\")","v":"• Documented Monitoring and logging requirements"},"|",null,"Process automation description","Assessment","3.4.1.AX",{"$f":"IF(AND(BW35<>\"\",LEFT(BW35,1)<>\"#\"),IF(LEFT(BW35,1)=\"-\",REPLACE(BW35,1,1,tech!$H$2),BW35),\"\")","v":""},"|","### Resources are clearly defined","Resources are clearly defined","References","4.1.2.RX",{"$f":"IF(AND(CC35<>\"\",LEFT(CC35,1)<>\"#\"),IF(LEFT(CC35,1)=\"-\",REPLACE(CC35,1,1,tech!$H$2),CC35),\"\")","v":""},"|","- Self-paced Training","Establish training plan","Guidance","4.2.1.GY",{"$f":"IF(AND(CI35<>\"\",LEFT(CI35,1)<>\"#\"),IF(LEFT(CI35,1)=\"-\",REPLACE(CI35,1,1,tech!$H$2),CI35),\"\")","v":"• Self-paced Training"},"|","- awareness plan is approved and communicated to all PKI participants","Establish and maintain awareness plan","Assessment","4.3.1.AY",{"$f":"IF(AND(CO35<>\"\",LEFT(CO35,1)<>\"#\"),IF(LEFT(CO35,1)=\"-\",REPLACE(CO35,1,1,tech!$H$2),CO35),\"\")","v":"• awareness plan is approved and communicated to all PKI participants"},"|"]
[null,null,"- There are defined processes and procedures which are followed","Basic","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D36,tech!$A$13:$B$17,2,0),LEFT(E36,1),IF(G36=\"\",\"X\",\"Y\"))","v":"2IY"},{"$f":"IF(IF(LEFT(C36,1)=\"-\",C36,\"\")=\"\",\"\",REPLACE(IF(LEFT(C36,1)=\"-\",C36,\"\"),1,1,tech!$H$2))","v":"• There are defined processes and procedures which are followed"},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Organizational sponsor and support","References","1.1.1.RY",{"$f":"IF(AND(I36<>\"\",LEFT(I36,1)<>\"#\"),IF(LEFT(I36,1)=\"-\",REPLACE(I36,1,1,tech!$H$2),I36),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|","#### References","The scope of policies is defined and documented","References","1.2.1.RX",{"$f":"IF(AND(O36<>\"\",LEFT(O36,1)<>\"#\"),IF(LEFT(O36,1)=\"-\",REPLACE(O36,1,1,tech!$H$2),O36),\"\")","v":""},"|",null,"Compliance policies are defined, implemented, and communicated","Assessment","1.3.1.AX",{"$f":"IF(AND(U36<>\"\",LEFT(U36,1)<>\"#\"),IF(LEFT(U36,1)=\"-\",REPLACE(U36,1,1,tech!$H$2),U36),\"\")","v":""},"|","- [RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://tools.ietf.org/html/rfc3647)","Scope of processes and procedure is aligned with policies","References","1.4.1.RY",{"$f":"IF(AND(AA36<>\"\",LEFT(AA36,1)<>\"#\"),IF(LEFT(AA36,1)=\"-\",REPLACE(AA36,1,1,tech!$H$2),AA36),\"\")","v":"• [RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://tools.ietf.org/html/rfc3647)"},"|","- Roles and responsibilities matrix (that may be used to cross-check if there are any conflicting roles)","Key management roles and responsibilities are documented and formally assigned","Assessment","2.1.1.AY",{"$f":"IF(AND(AG36<>\"\",LEFT(AG36,1)<>\"#\"),IF(LEFT(AG36,1)=\"-\",REPLACE(AG36,1,1,tech!$H$2),AG36),\"\")","v":"• Roles and responsibilities matrix (that may be used to cross-check if there are any conflicting roles)"},"|","* Certificate profiles are compatible with RFC5280, or deviations are well documented","Certificate profiles are documented","Assessment","2.2.1.AY",{"$f":"IF(AND(AM36<>\"\",LEFT(AM36,1)<>\"#\"),IF(LEFT(AM36,1)=\"-\",REPLACE(AM36,1,1,tech!$H$2),AM36),\"\")","v":"* Certificate profiles are compatible with RFC5280, or deviations are well documented"},"|","- network topology and diagram","Network and deployment infrastructure is documented","Assessment","2.3.1.AY",{"$f":"IF(AND(AS36<>\"\",LEFT(AS36,1)<>\"#\"),IF(LEFT(AS36,1)=\"-\",REPLACE(AS36,1,1,tech!$H$2),AS36),\"\")","v":"• network topology and diagram"},"|","- Documented policy for change management and agility","The policy for change management and agility is documented","Assessment","2.4.1.AY",{"$f":"IF(AND(AY36<>\"\",LEFT(AY36,1)<>\"#\"),IF(LEFT(AY36,1)=\"-\",REPLACE(AY36,1,1,tech!$H$2),AY36),\"\")","v":"• Documented policy for change management and agility"},"|",null,"Risk assessment and business impact analysis","References","3.1.1.RX",{"$f":"IF(AND(BE36<>\"\",LEFT(BE36,1)<>\"#\"),IF(LEFT(BE36,1)=\"-\",REPLACE(BE36,1,1,tech!$H$2),BE36),\"\")","v":""},"|","- Documented and approved interoperability strategy","Maintain PKI interoperability strategy","Assessment","3.2.1.AY",{"$f":"IF(AND(BK36<>\"\",LEFT(BK36,1)<>\"#\"),IF(LEFT(BK36,1)=\"-\",REPLACE(BK36,1,1,tech!$H$2),BK36),\"\")","v":"• Documented and approved interoperability strategy"},"|","- Policies and procedures for Monitoring and logging","Monitoring events and logging requirements are defined and documented","Assessment","3.3.1.AY",{"$f":"IF(AND(BQ36<>\"\",LEFT(BQ36,1)<>\"#\"),IF(LEFT(BQ36,1)=\"-\",REPLACE(BQ36,1,1,tech!$H$2),BQ36),\"\")","v":"• Policies and procedures for Monitoring and logging"},"|","The following is sample evidence that can be used to assess the requirement:","Process automation description","Assessment","3.4.1.AY",{"$f":"IF(AND(BW36<>\"\",LEFT(BW36,1)<>\"#\"),IF(LEFT(BW36,1)=\"-\",REPLACE(BW36,1,1,tech!$H$2),BW36),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|",null,"Resources are clearly defined","References","4.1.2.RX",{"$f":"IF(AND(CC36<>\"\",LEFT(CC36,1)<>\"#\"),IF(LEFT(CC36,1)=\"-\",REPLACE(CC36,1,1,tech!$H$2),CC36),\"\")","v":""},"|","- Online resources","Establish training plan","Guidance","4.2.1.GY",{"$f":"IF(AND(CI36<>\"\",LEFT(CI36,1)<>\"#\"),IF(LEFT(CI36,1)=\"-\",REPLACE(CI36,1,1,tech!$H$2),CI36),\"\")","v":"• Online resources"},"|","- awareness plan is integrated in the organization","Establish and maintain awareness plan","Assessment","4.3.1.AY",{"$f":"IF(AND(CO36<>\"\",LEFT(CO36,1)<>\"#\"),IF(LEFT(CO36,1)=\"-\",REPLACE(CO36,1,1,tech!$H$2),CO36),\"\")","v":"• awareness plan is integrated in the organization"},"|"]
[null,null,"- PKI is not managed according to industry standards and regulations","Basic","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D37,tech!$A$13:$B$17,2,0),LEFT(E37,1),IF(G37=\"\",\"X\",\"Y\"))","v":"2IY"},{"$f":"IF(IF(LEFT(C37,1)=\"-\",C37,\"\")=\"\",\"\",REPLACE(IF(LEFT(C37,1)=\"-\",C37,\"\"),1,1,tech!$H$2))","v":"• PKI is not managed according to industry standards and regulations"},"|",null,"Organizational sponsor and support","References","1.1.1.RX",{"$f":"IF(AND(I37<>\"\",LEFT(I37,1)<>\"#\"),IF(LEFT(I37,1)=\"-\",REPLACE(I37,1,1,tech!$H$2),I37),\"\")","v":""},"|",null,"The scope of policies is defined and documented","References","1.2.1.RX",{"$f":"IF(AND(O37<>\"\",LEFT(O37,1)<>\"#\"),IF(LEFT(O37,1)=\"-\",REPLACE(O37,1,1,tech!$H$2),O37),\"\")","v":""},"|","- Documented audit and accountability policies","Compliance policies are defined, implemented, and communicated","Assessment","1.3.1.AY",{"$f":"IF(AND(U37<>\"\",LEFT(U37,1)<>\"#\"),IF(LEFT(U37,1)=\"-\",REPLACE(U37,1,1,tech!$H$2),U37),\"\")","v":"• Documented audit and accountability policies"},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Scope of processes and procedure is aligned with policies","References","1.4.1.RY",{"$f":"IF(AND(AA37<>\"\",LEFT(AA37,1)<>\"#\"),IF(LEFT(AA37,1)=\"-\",REPLACE(AA37,1,1,tech!$H$2),AA37),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|","- Validation of required knowledge and skills","Key management roles and responsibilities are documented and formally assigned","Assessment","2.1.1.AY",{"$f":"IF(AND(AG37<>\"\",LEFT(AG37,1)<>\"#\"),IF(LEFT(AG37,1)=\"-\",REPLACE(AG37,1,1,tech!$H$2),AG37),\"\")","v":"• Validation of required knowledge and skills"},"|","* Profiles for CRLs and/or OCSP usage, i.e. validity periods, issuance intervals, max revocation time delay, etc","Certificate profiles are documented","Assessment","2.2.1.AY",{"$f":"IF(AND(AM37<>\"\",LEFT(AM37,1)<>\"#\"),IF(LEFT(AM37,1)=\"-\",REPLACE(AM37,1,1,tech!$H$2),AM37),\"\")","v":"* Profiles for CRLs and/or OCSP usage, i.e. validity periods, issuance intervals, max revocation time delay, etc"},"|","- Deployment documentation","Network and deployment infrastructure is documented","Assessment","2.3.1.AY",{"$f":"IF(AND(AS37<>\"\",LEFT(AS37,1)<>\"#\"),IF(LEFT(AS37,1)=\"-\",REPLACE(AS37,1,1,tech!$H$2),AS37),\"\")","v":"• Deployment documentation"},"|","- Alignment with Organizational policy","The policy for change management and agility is documented","Assessment","2.4.1.AY",{"$f":"IF(AND(AY37<>\"\",LEFT(AY37,1)<>\"#\"),IF(LEFT(AY37,1)=\"-\",REPLACE(AY37,1,1,tech!$H$2),AY37),\"\")","v":"• Alignment with Organizational policy"},"|","- [ISO/IEC 27005 - Guidance on managing information security risks](https://www.iso.org/standard/80585.html)","Risk assessment and business impact analysis","References","3.1.1.RY",{"$f":"IF(AND(BE37<>\"\",LEFT(BE37,1)<>\"#\"),IF(LEFT(BE37,1)=\"-\",REPLACE(BE37,1,1,tech!$H$2),BE37),\"\")","v":"• [ISO/IEC 27005 - Guidance on managing information security risks](https://www.iso.org/standard/80585.html)"},"|","- interoperability strategy is integrated in the organization","Maintain PKI interoperability strategy","Assessment","3.2.1.AY",{"$f":"IF(AND(BK37<>\"\",LEFT(BK37,1)<>\"#\"),IF(LEFT(BK37,1)=\"-\",REPLACE(BK37,1,1,tech!$H$2),BK37),\"\")","v":"• interoperability strategy is integrated in the organization"},"|","- Review of records","Monitoring events and logging requirements are defined and documented","Assessment","3.3.1.AY",{"$f":"IF(AND(BQ37<>\"\",LEFT(BQ37,1)<>\"#\"),IF(LEFT(BQ37,1)=\"-\",REPLACE(BQ37,1,1,tech!$H$2),BQ37),\"\")","v":"• Review of records"},"|","- process automation description","Process automation description","Assessment","3.4.1.AY",{"$f":"IF(AND(BW37<>\"\",LEFT(BW37,1)<>\"#\"),IF(LEFT(BW37,1)=\"-\",REPLACE(BW37,1,1,tech!$H$2),BW37),\"\")","v":"• process automation description"},"|","#### Guidance","Resources are clearly defined","Guidance","4.1.2.GX",{"$f":"IF(AND(CC37<>\"\",LEFT(CC37,1)<>\"#\"),IF(LEFT(CC37,1)=\"-\",REPLACE(CC37,1,1,tech!$H$2),CC37),\"\")","v":""},"|","- Shadowing or reverse-Shadowing","Establish training plan","Guidance","4.2.1.GY",{"$f":"IF(AND(CI37<>\"\",LEFT(CI37,1)<>\"#\"),IF(LEFT(CI37,1)=\"-\",REPLACE(CI37,1,1,tech!$H$2),CI37),\"\")","v":"• Shadowing or reverse-Shadowing"},"|",null,"Establish and maintain awareness plan","Assessment","4.3.1.AX",{"$f":"IF(AND(CO37<>\"\",LEFT(CO37,1)<>\"#\"),IF(LEFT(CO37,1)=\"-\",REPLACE(CO37,1,1,tech!$H$2),CO37),\"\")","v":""},"|"]
[null,null,"- Insufficient knowledge","Basic","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D38,tech!$A$13:$B$17,2,0),LEFT(E38,1),IF(G38=\"\",\"X\",\"Y\"))","v":"2IY"},{"$f":"IF(IF(LEFT(C38,1)=\"-\",C38,\"\")=\"\",\"\",REPLACE(IF(LEFT(C38,1)=\"-\",C38,\"\"),1,1,tech!$H$2))","v":"• Insufficient knowledge"},"|","### Formal assignment of responsible leadership","Formal assignment of responsible leadership","References","1.1.2.RX",{"$f":"IF(AND(I38<>\"\",LEFT(I38,1)<>\"#\"),IF(LEFT(I38,1)=\"-\",REPLACE(I38,1,1,tech!$H$2),I38),\"\")","v":""},"|","- [RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://tools.ietf.org/html/rfc3647)","The scope of policies is defined and documented","References","1.2.1.RY",{"$f":"IF(AND(O38<>\"\",LEFT(O38,1)<>\"#\"),IF(LEFT(O38,1)=\"-\",REPLACE(O38,1,1,tech!$H$2),O38),\"\")","v":"• [RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://tools.ietf.org/html/rfc3647)"},"|","- Documented communication plan for informing stakeholders of the policies","Compliance policies are defined, implemented, and communicated","Assessment","1.3.1.AY",{"$f":"IF(AND(U38<>\"\",LEFT(U38,1)<>\"#\"),IF(LEFT(U38,1)=\"-\",REPLACE(U38,1,1,tech!$H$2),U38),\"\")","v":"• Documented communication plan for informing stakeholders of the policies"},"|",null,"Scope of processes and procedure is aligned with policies","References","1.4.1.RX",{"$f":"IF(AND(AA38<>\"\",LEFT(AA38,1)<>\"#\"),IF(LEFT(AA38,1)=\"-\",REPLACE(AA38,1,1,tech!$H$2),AA38),\"\")","v":""},"|","- Review according to the key management policy","Key management roles and responsibilities are documented and formally assigned","Assessment","2.1.1.AY",{"$f":"IF(AND(AG38<>\"\",LEFT(AG38,1)<>\"#\"),IF(LEFT(AG38,1)=\"-\",REPLACE(AG38,1,1,tech!$H$2),AG38),\"\")","v":"• Review according to the key management policy"},"|",null,"Certificate profiles are documented","Assessment","2.2.1.AX",{"$f":"IF(AND(AM38<>\"\",LEFT(AM38,1)<>\"#\"),IF(LEFT(AM38,1)=\"-\",REPLACE(AM38,1,1,tech!$H$2),AM38),\"\")","v":""},"|","- Sample configuration of network to compare with the documentation","Network and deployment infrastructure is documented","Assessment","2.3.1.AY",{"$f":"IF(AND(AS38<>\"\",LEFT(AS38,1)<>\"#\"),IF(LEFT(AS38,1)=\"-\",REPLACE(AS38,1,1,tech!$H$2),AS38),\"\")","v":"• Sample configuration of network to compare with the documentation"},"|","- Approval by the management","The policy for change management and agility is documented","Assessment","2.4.1.AY",{"$f":"IF(AND(AY38<>\"\",LEFT(AY38,1)<>\"#\"),IF(LEFT(AY38,1)=\"-\",REPLACE(AY38,1,1,tech!$H$2),AY38),\"\")","v":"• Approval by the management"},"|","- [NIST Risk Management Framework](https://csrc.nist.gov/Projects/risk-management)","Risk assessment and business impact analysis","References","3.1.1.RY",{"$f":"IF(AND(BE38<>\"\",LEFT(BE38,1)<>\"#\"),IF(LEFT(BE38,1)=\"-\",REPLACE(BE38,1,1,tech!$H$2),BE38),\"\")","v":"• [NIST Risk Management Framework](https://csrc.nist.gov/Projects/risk-management)"},"|","- Interview with the responsible person(s) to verify Understanding of the interoperability strategy","Maintain PKI interoperability strategy","Assessment","3.2.1.AY",{"$f":"IF(AND(BK38<>\"\",LEFT(BK38,1)<>\"#\"),IF(LEFT(BK38,1)=\"-\",REPLACE(BK38,1,1,tech!$H$2),BK38),\"\")","v":"• Interview with the responsible person(s) to verify Understanding of the interoperability strategy"},"|","- Interviews with personnel","Monitoring events and logging requirements are defined and documented","Assessment","3.3.1.AY",{"$f":"IF(AND(BQ38<>\"\",LEFT(BQ38,1)<>\"#\"),IF(LEFT(BQ38,1)=\"-\",REPLACE(BQ38,1,1,tech!$H$2),BQ38),\"\")","v":"• Interviews with personnel"},"|","- Interview with the process owner","Process automation description","Assessment","3.4.1.AY",{"$f":"IF(AND(BW38<>\"\",LEFT(BW38,1)<>\"#\"),IF(LEFT(BW38,1)=\"-\",REPLACE(BW38,1,1,tech!$H$2),BW38),\"\")","v":"• Interview with the process owner"},"|",null,"Resources are clearly defined","Guidance","4.1.2.GX",{"$f":"IF(AND(CC38<>\"\",LEFT(CC38,1)<>\"#\"),IF(LEFT(CC38,1)=\"-\",REPLACE(CC38,1,1,tech!$H$2),CC38),\"\")","v":""},"|",null,"Establish training plan","Guidance","4.2.1.GX",{"$f":"IF(AND(CI38<>\"\",LEFT(CI38,1)<>\"#\"),IF(LEFT(CI38,1)=\"-\",REPLACE(CI38,1,1,tech!$H$2),CI38),\"\")","v":""},"|","#### References","Establish and maintain awareness plan","References","4.3.1.RX",{"$f":"IF(AND(CO38<>\"\",LEFT(CO38,1)<>\"#\"),IF(LEFT(CO38,1)=\"-\",REPLACE(CO38,1,1,tech!$H$2),CO38),\"\")","v":""},"|"]
[{"$nulls":3},"Basic","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D39,tech!$A$13:$B$17,2,0),LEFT(E39,1),IF(G39=\"\",\"X\",\"Y\"))","v":"2IX"},{"$f":"IF(IF(LEFT(C39,1)=\"-\",C39,\"\")=\"\",\"\",REPLACE(IF(LEFT(C39,1)=\"-\",C39,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Formal assignment of responsible leadership","References","1.1.2.RX",{"$f":"IF(AND(I39<>\"\",LEFT(I39,1)<>\"#\"),IF(LEFT(I39,1)=\"-\",REPLACE(I39,1,1,tech!$H$2),I39),\"\")","v":""},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","The scope of policies is defined and documented","References","1.2.1.RY",{"$f":"IF(AND(O39<>\"\",LEFT(O39,1)<>\"#\"),IF(LEFT(O39,1)=\"-\",REPLACE(O39,1,1,tech!$H$2),O39),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|","- Formalized process for stakeholder acknowledgement upon receipt of the policies","Compliance policies are defined, implemented, and communicated","Assessment","1.3.1.AY",{"$f":"IF(AND(U39<>\"\",LEFT(U39,1)<>\"#\"),IF(LEFT(U39,1)=\"-\",REPLACE(U39,1,1,tech!$H$2),U39),\"\")","v":"• Formalized process for stakeholder acknowledgement upon receipt of the policies"},"|","### Processes and procedures are formally documented and followed","Processes and procedures are formally documented and followed","References","1.4.2.RX",{"$f":"IF(AND(AA39<>\"\",LEFT(AA39,1)<>\"#\"),IF(LEFT(AA39,1)=\"-\",REPLACE(AA39,1,1,tech!$H$2),AA39),\"\")","v":""},"|",null,"Key management roles and responsibilities are documented and formally assigned","Assessment","2.1.1.AX",{"$f":"IF(AND(AG39<>\"\",LEFT(AG39,1)<>\"#\"),IF(LEFT(AG39,1)=\"-\",REPLACE(AG39,1,1,tech!$H$2),AG39),\"\")","v":""},"|","#### References","Certificate profiles are documented","References","2.2.1.RX",{"$f":"IF(AND(AM39<>\"\",LEFT(AM39,1)<>\"#\"),IF(LEFT(AM39,1)=\"-\",REPLACE(AM39,1,1,tech!$H$2),AM39),\"\")","v":""},"|","- Integration with Supporting and other systems","Network and deployment infrastructure is documented","Assessment","2.3.1.AY",{"$f":"IF(AND(AS39<>\"\",LEFT(AS39,1)<>\"#\"),IF(LEFT(AS39,1)=\"-\",REPLACE(AS39,1,1,tech!$H$2),AS39),\"\")","v":"• Integration with Supporting and other systems"},"|","- Understanding of the policy by the PKI personnel","The policy for change management and agility is documented","Assessment","2.4.1.AY",{"$f":"IF(AND(AY39<>\"\",LEFT(AY39,1)<>\"#\"),IF(LEFT(AY39,1)=\"-\",REPLACE(AY39,1,1,tech!$H$2),AY39),\"\")","v":"• Understanding of the policy by the PKI personnel"},"|","- [ISO/TS 22317 - Guidelines for business impact analysis](https://www.iso.org/standard/79000.html)","Risk assessment and business impact analysis","References","3.1.1.RY",{"$f":"IF(AND(BE39<>\"\",LEFT(BE39,1)<>\"#\"),IF(LEFT(BE39,1)=\"-\",REPLACE(BE39,1,1,tech!$H$2),BE39),\"\")","v":"• [ISO/TS 22317 - Guidelines for business impact analysis](https://www.iso.org/standard/79000.html)"},"|","- Review documentation for PKI components to verify the requirements for interoperability","Maintain PKI interoperability strategy","Assessment","3.2.1.AY",{"$f":"IF(AND(BK39<>\"\",LEFT(BK39,1)<>\"#\"),IF(LEFT(BK39,1)=\"-\",REPLACE(BK39,1,1,tech!$H$2),BK39),\"\")","v":"• Review documentation for PKI components to verify the requirements for interoperability"},"|",null,"Monitoring events and logging requirements are defined and documented","Assessment","3.3.1.AX",{"$f":"IF(AND(BQ39<>\"\",LEFT(BQ39,1)<>\"#\"),IF(LEFT(BQ39,1)=\"-\",REPLACE(BQ39,1,1,tech!$H$2),BQ39),\"\")","v":""},"|","- Interview with administrators","Process automation description","Assessment","3.4.1.AY",{"$f":"IF(AND(BW39<>\"\",LEFT(BW39,1)<>\"#\"),IF(LEFT(BW39,1)=\"-\",REPLACE(BW39,1,1,tech!$H$2),BW39),\"\")","v":"• Interview with administrators"},"|","Identified resources should be properly defined and specified. The specification depends on the type of the resource and can include for example the following:","Resources are clearly defined","Guidance","4.1.2.GY",{"$f":"IF(AND(CC39<>\"\",LEFT(CC39,1)<>\"#\"),IF(LEFT(CC39,1)=\"-\",REPLACE(CC39,1,1,tech!$H$2),CC39),\"\")","v":"Identified resources should be properly defined and specified. The specification depends on the type of the resource and can include for example the following:"},"|","#### Assessment","Establish training plan","Assessment","4.2.1.AX",{"$f":"IF(AND(CI39<>\"\",LEFT(CI39,1)<>\"#\"),IF(LEFT(CI39,1)=\"-\",REPLACE(CI39,1,1,tech!$H$2),CI39),\"\")","v":""},"|",null,"Establish and maintain awareness plan","References","4.3.1.RX",{"$f":"IF(AND(CO39<>\"\",LEFT(CO39,1)<>\"#\"),IF(LEFT(CO39,1)=\"-\",REPLACE(CO39,1,1,tech!$H$2),CO39),\"\")","v":""},"|"]
[null,null,"### Associated risks","Basic","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D40,tech!$A$13:$B$17,2,0),LEFT(E40,1),IF(G40=\"\",\"X\",\"Y\"))","v":"2AX"},{"$f":"IF(IF(LEFT(C40,1)=\"-\",C40,\"\")=\"\",\"\",REPLACE(IF(LEFT(C40,1)=\"-\",C40,\"\"),1,1,tech!$H$2))","v":""},"|","#### Guidance","Formal assignment of responsible leadership","Guidance","1.1.2.GX",{"$f":"IF(AND(I40<>\"\",LEFT(I40,1)<>\"#\"),IF(LEFT(I40,1)=\"-\",REPLACE(I40,1,1,tech!$H$2),I40),\"\")","v":""},"|","- [ETSI EN 319 401 - General Policy Requirements for Trust Service Providers](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/02.03.01_60/en_319401v020301p.pdf)","The scope of policies is defined and documented","References","1.2.1.RY",{"$f":"IF(AND(O40<>\"\",LEFT(O40,1)<>\"#\"),IF(LEFT(O40,1)=\"-\",REPLACE(O40,1,1,tech!$H$2),O40),\"\")","v":"• [ETSI EN 319 401 - General Policy Requirements for Trust Service Providers](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/02.03.01_60/en_319401v020301p.pdf)"},"|",null,"Compliance policies are defined, implemented, and communicated","Assessment","1.3.1.AX",{"$f":"IF(AND(U40<>\"\",LEFT(U40,1)<>\"#\"),IF(LEFT(U40,1)=\"-\",REPLACE(U40,1,1,tech!$H$2),U40),\"\")","v":""},"|",null,"Processes and procedures are formally documented and followed","References","1.4.2.RX",{"$f":"IF(AND(AA40<>\"\",LEFT(AA40,1)<>\"#\"),IF(LEFT(AA40,1)=\"-\",REPLACE(AA40,1,1,tech!$H$2),AA40),\"\")","v":""},"|","#### References","Key management roles and responsibilities are documented and formally assigned","References","2.1.1.RX",{"$f":"IF(AND(AG40<>\"\",LEFT(AG40,1)<>\"#\"),IF(LEFT(AG40,1)=\"-\",REPLACE(AG40,1,1,tech!$H$2),AG40),\"\")","v":""},"|",null,"Certificate profiles are documented","References","2.2.1.RX",{"$f":"IF(AND(AM40<>\"\",LEFT(AM40,1)<>\"#\"),IF(LEFT(AM40,1)=\"-\",REPLACE(AM40,1,1,tech!$H$2),AM40),\"\")","v":""},"|","- Interview with the network administrators","Network and deployment infrastructure is documented","Assessment","2.3.1.AY",{"$f":"IF(AND(AS40<>\"\",LEFT(AS40,1)<>\"#\"),IF(LEFT(AS40,1)=\"-\",REPLACE(AS40,1,1,tech!$H$2),AS40),\"\")","v":"• Interview with the network administrators"},"|","- and other relevant evidence","The policy for change management and agility is documented","Assessment","2.4.1.AY",{"$f":"IF(AND(AY40<>\"\",LEFT(AY40,1)<>\"#\"),IF(LEFT(AY40,1)=\"-\",REPLACE(AY40,1,1,tech!$H$2),AY40),\"\")","v":"• and other relevant evidence"},"|",null,"Risk assessment and business impact analysis","References","3.1.1.RX",{"$f":"IF(AND(BE40<>\"\",LEFT(BE40,1)<>\"#\"),IF(LEFT(BE40,1)=\"-\",REPLACE(BE40,1,1,tech!$H$2),BE40),\"\")","v":""},"|",null,"Maintain PKI interoperability strategy","Assessment","3.2.1.AX",{"$f":"IF(AND(BK40<>\"\",LEFT(BK40,1)<>\"#\"),IF(LEFT(BK40,1)=\"-\",REPLACE(BK40,1,1,tech!$H$2),BK40),\"\")","v":""},"|","#### References","Monitoring events and logging requirements are defined and documented","References","3.3.1.RX",{"$f":"IF(AND(BQ40<>\"\",LEFT(BQ40,1)<>\"#\"),IF(LEFT(BQ40,1)=\"-\",REPLACE(BQ40,1,1,tech!$H$2),BQ40),\"\")","v":""},"|","- Sample of automated process logs","Process automation description","Assessment","3.4.1.AY",{"$f":"IF(AND(BW40<>\"\",LEFT(BW40,1)<>\"#\"),IF(LEFT(BW40,1)=\"-\",REPLACE(BW40,1,1,tech!$H$2),BW40),\"\")","v":"• Sample of automated process logs"},"|","- People: required skills to perform the tasks, roles, and responsibilities","Resources are clearly defined","Guidance","4.1.2.GY",{"$f":"IF(AND(CC40<>\"\",LEFT(CC40,1)<>\"#\"),IF(LEFT(CC40,1)=\"-\",REPLACE(CC40,1,1,tech!$H$2),CC40),\"\")","v":"• People: required skills to perform the tasks, roles, and responsibilities"},"|",null,"Establish training plan","Assessment","4.2.1.AX",{"$f":"IF(AND(CI40<>\"\",LEFT(CI40,1)<>\"#\"),IF(LEFT(CI40,1)=\"-\",REPLACE(CI40,1,1,tech!$H$2),CI40),\"\")","v":""},"|","- [RFC 3647 Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://datatracker.ietf.org/doc/html/rfc3647)","Establish and maintain awareness plan","References","4.3.1.RY",{"$f":"IF(AND(CO40<>\"\",LEFT(CO40,1)<>\"#\"),IF(LEFT(CO40,1)=\"-\",REPLACE(CO40,1,1,tech!$H$2),CO40),\"\")","v":"• [RFC 3647 Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://datatracker.ietf.org/doc/html/rfc3647)"},"|"]
[{"$nulls":3},"Basic","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D41,tech!$A$13:$B$17,2,0),LEFT(E41,1),IF(G41=\"\",\"X\",\"Y\"))","v":"2AX"},{"$f":"IF(IF(LEFT(C41,1)=\"-\",C41,\"\")=\"\",\"\",REPLACE(IF(LEFT(C41,1)=\"-\",C41,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Formal assignment of responsible leadership","Guidance","1.1.2.GX",{"$f":"IF(AND(I41<>\"\",LEFT(I41,1)<>\"#\"),IF(LEFT(I41,1)=\"-\",REPLACE(I41,1,1,tech!$H$2),I41),\"\")","v":""},"|",null,"The scope of policies is defined and documented","References","1.2.1.RX",{"$f":"IF(AND(O41<>\"\",LEFT(O41,1)<>\"#\"),IF(LEFT(O41,1)=\"-\",REPLACE(O41,1,1,tech!$H$2),O41),\"\")","v":""},"|","#### References","Compliance policies are defined, implemented, and communicated","References","1.3.1.RX",{"$f":"IF(AND(U41<>\"\",LEFT(U41,1)<>\"#\"),IF(LEFT(U41,1)=\"-\",REPLACE(U41,1,1,tech!$H$2),U41),\"\")","v":""},"|","#### Guidance","Processes and procedures are formally documented and followed","Guidance","1.4.2.GX",{"$f":"IF(AND(AA41<>\"\",LEFT(AA41,1)<>\"#\"),IF(LEFT(AA41,1)=\"-\",REPLACE(AA41,1,1,tech!$H$2),AA41),\"\")","v":""},"|",null,"Key management roles and responsibilities are documented and formally assigned","References","2.1.1.RX",{"$f":"IF(AND(AG41<>\"\",LEFT(AG41,1)<>\"#\"),IF(LEFT(AG41,1)=\"-\",REPLACE(AG41,1,1,tech!$H$2),AG41),\"\")","v":""},"|","Most certificate profiles aim for compatibility with RFC 5280 for maximum interoperability. Some examples of specific profiles are given below.","Certificate profiles are documented","References","2.2.1.RY",{"$f":"IF(AND(AM41<>\"\",LEFT(AM41,1)<>\"#\"),IF(LEFT(AM41,1)=\"-\",REPLACE(AM41,1,1,tech!$H$2),AM41),\"\")","v":"Most certificate profiles aim for compatibility with RFC 5280 for maximum interoperability. Some examples of specific profiles are given below."},"|",null,"Network and deployment infrastructure is documented","Assessment","2.3.1.AX",{"$f":"IF(AND(AS41<>\"\",LEFT(AS41,1)<>\"#\"),IF(LEFT(AS41,1)=\"-\",REPLACE(AS41,1,1,tech!$H$2),AS41),\"\")","v":""},"|",null,"The policy for change management and agility is documented","Assessment","2.4.1.AX",{"$f":"IF(AND(AY41<>\"\",LEFT(AY41,1)<>\"#\"),IF(LEFT(AY41,1)=\"-\",REPLACE(AY41,1,1,tech!$H$2),AY41),\"\")","v":""},"|","### Cyber-security management and incident planning","Cyber-security management and incident planning","References","3.1.2.RX",{"$f":"IF(AND(BE41<>\"\",LEFT(BE41,1)<>\"#\"),IF(LEFT(BE41,1)=\"-\",REPLACE(BE41,1,1,tech!$H$2),BE41),\"\")","v":""},"|","#### References","Maintain PKI interoperability strategy","References","3.2.1.RX",{"$f":"IF(AND(BK41<>\"\",LEFT(BK41,1)<>\"#\"),IF(LEFT(BK41,1)=\"-\",REPLACE(BK41,1,1,tech!$H$2),BK41),\"\")","v":""},"|",null,"Monitoring events and logging requirements are defined and documented","References","3.3.1.RX",{"$f":"IF(AND(BQ41<>\"\",LEFT(BQ41,1)<>\"#\"),IF(LEFT(BQ41,1)=\"-\",REPLACE(BQ41,1,1,tech!$H$2),BQ41),\"\")","v":""},"|",null,"Process automation description","Assessment","3.4.1.AX",{"$f":"IF(AND(BW41<>\"\",LEFT(BW41,1)<>\"#\"),IF(LEFT(BW41,1)=\"-\",REPLACE(BW41,1,1,tech!$H$2),BW41),\"\")","v":""},"|","- Tools: description, supported technologies","Resources are clearly defined","Guidance","4.1.2.GY",{"$f":"IF(AND(CC41<>\"\",LEFT(CC41,1)<>\"#\"),IF(LEFT(CC41,1)=\"-\",REPLACE(CC41,1,1,tech!$H$2),CC41),\"\")","v":"• Tools: description, supported technologies"},"|","- Documented Training plan","Establish training plan","Assessment","4.2.1.AY",{"$f":"IF(AND(CI41<>\"\",LEFT(CI41,1)<>\"#\"),IF(LEFT(CI41,1)=\"-\",REPLACE(CI41,1,1,tech!$H$2),CI41),\"\")","v":"• Documented Training plan"},"|","- [ETSI EN 319 401 - General Policy Requirements for Trust Service Providers](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/02.03.01_60/en_319401v020301p.pdf)","Establish and maintain awareness plan","References","4.3.1.RY",{"$f":"IF(AND(CO41<>\"\",LEFT(CO41,1)<>\"#\"),IF(LEFT(CO41,1)=\"-\",REPLACE(CO41,1,1,tech!$H$2),CO41),\"\")","v":"• [ETSI EN 319 401 - General Policy Requirements for Trust Service Providers](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/02.03.01_60/en_319401v020301p.pdf)"},"|"]
[null,null,"- High probability of operational issues","Basic","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D42,tech!$A$13:$B$17,2,0),LEFT(E42,1),IF(G42=\"\",\"X\",\"Y\"))","v":"2AY"},{"$f":"IF(IF(LEFT(C42,1)=\"-\",C42,\"\")=\"\",\"\",REPLACE(IF(LEFT(C42,1)=\"-\",C42,\"\"),1,1,tech!$H$2))","v":"• High probability of operational issues"},"|","Proper leadership and responsible person should be assigned by the management to fulfil the role for the establishment, maintenance, and development of the PKI according to the strategy and vision. The responsible person should be able to make decisions and take actions to ensure the PKI is aligned with the organizational goals and needs.","Formal assignment of responsible leadership","Guidance","1.1.2.GY",{"$f":"IF(AND(I42<>\"\",LEFT(I42,1)<>\"#\"),IF(LEFT(I42,1)=\"-\",REPLACE(I42,1,1,tech!$H$2),I42),\"\")","v":"Proper leadership and responsible person should be assigned by the management to fulfil the role for the establishment, maintenance, and development of the PKI according to the strategy and vision. The responsible person should be able to make decisions and take actions to ensure the PKI is aligned with the organizational goals and needs."},"|","### Certificate policy is documented and published","Certificate policy is documented and published","References","1.2.2.RX",{"$f":"IF(AND(O42<>\"\",LEFT(O42,1)<>\"#\"),IF(LEFT(O42,1)=\"-\",REPLACE(O42,1,1,tech!$H$2),O42),\"\")","v":""},"|",null,"Compliance policies are defined, implemented, and communicated","References","1.3.1.RX",{"$f":"IF(AND(U42<>\"\",LEFT(U42,1)<>\"#\"),IF(LEFT(U42,1)=\"-\",REPLACE(U42,1,1,tech!$H$2),U42),\"\")","v":""},"|",null,"Processes and procedures are formally documented and followed","Guidance","1.4.2.GX",{"$f":"IF(AND(AA42<>\"\",LEFT(AA42,1)<>\"#\"),IF(LEFT(AA42,1)=\"-\",REPLACE(AA42,1,1,tech!$H$2),AA42),\"\")","v":""},"|","- [ISO/IEC 27001 and related standards](https://www.iso.org/isoiec-27001-information-security.html)","Key management roles and responsibilities are documented and formally assigned","References","2.1.1.RY",{"$f":"IF(AND(AG42<>\"\",LEFT(AG42,1)<>\"#\"),IF(LEFT(AG42,1)=\"-\",REPLACE(AG42,1,1,tech!$H$2),AG42),\"\")","v":"• [ISO/IEC 27001 and related standards](https://www.iso.org/isoiec-27001-information-security.html)"},"|","* [RFC 5280 - Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile](https://datatracker.ietf.org/doc/html/rfc5280)","Certificate profiles are documented","References","2.2.1.RY",{"$f":"IF(AND(AM42<>\"\",LEFT(AM42,1)<>\"#\"),IF(LEFT(AM42,1)=\"-\",REPLACE(AM42,1,1,tech!$H$2),AM42),\"\")","v":"* [RFC 5280 - Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile](https://datatracker.ietf.org/doc/html/rfc5280)"},"|","#### References","Network and deployment infrastructure is documented","References","2.3.1.RX",{"$f":"IF(AND(AS42<>\"\",LEFT(AS42,1)<>\"#\"),IF(LEFT(AS42,1)=\"-\",REPLACE(AS42,1,1,tech!$H$2),AS42),\"\")","v":""},"|","#### References","The policy for change management and agility is documented","References","2.4.1.RX",{"$f":"IF(AND(AY42<>\"\",LEFT(AY42,1)<>\"#\"),IF(LEFT(AY42,1)=\"-\",REPLACE(AY42,1,1,tech!$H$2),AY42),\"\")","v":""},"|",null,"Cyber-security management and incident planning","References","3.1.2.RX",{"$f":"IF(AND(BE42<>\"\",LEFT(BE42,1)<>\"#\"),IF(LEFT(BE42,1)=\"-\",REPLACE(BE42,1,1,tech!$H$2),BE42),\"\")","v":""},"|",null,"Maintain PKI interoperability strategy","References","3.2.1.RX",{"$f":"IF(AND(BK42<>\"\",LEFT(BK42,1)<>\"#\"),IF(LEFT(BK42,1)=\"-\",REPLACE(BK42,1,1,tech!$H$2),BK42),\"\")","v":""},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Monitoring events and logging requirements are defined and documented","References","3.3.1.RY",{"$f":"IF(AND(BQ42<>\"\",LEFT(BQ42,1)<>\"#\"),IF(LEFT(BQ42,1)=\"-\",REPLACE(BQ42,1,1,tech!$H$2),BQ42),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|","#### References","Process automation description","References","3.4.1.RX",{"$f":"IF(AND(BW42<>\"\",LEFT(BW42,1)<>\"#\"),IF(LEFT(BW42,1)=\"-\",REPLACE(BW42,1,1,tech!$H$2),BW42),\"\")","v":""},"|","- Technologies: required functionality and performance","Resources are clearly defined","Guidance","4.1.2.GY",{"$f":"IF(AND(CC42<>\"\",LEFT(CC42,1)<>\"#\"),IF(LEFT(CC42,1)=\"-\",REPLACE(CC42,1,1,tech!$H$2),CC42),\"\")","v":"• Technologies: required functionality and performance"},"|","- Training plan is up-to-Date","Establish training plan","Assessment","4.2.1.AY",{"$f":"IF(AND(CI42<>\"\",LEFT(CI42,1)<>\"#\"),IF(LEFT(CI42,1)=\"-\",REPLACE(CI42,1,1,tech!$H$2),CI42),\"\")","v":"• Training plan is up-to-Date"},"|","- ","Establish and maintain awareness plan","References","4.3.1.RY",{"$f":"IF(AND(CO42<>\"\",LEFT(CO42,1)<>\"#\"),IF(LEFT(CO42,1)=\"-\",REPLACE(CO42,1,1,tech!$H$2),CO42),\"\")","v":"• "},"|"]
[null,null,"- Medium probability of compromise","Basic","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D43,tech!$A$13:$B$17,2,0),LEFT(E43,1),IF(G43=\"\",\"X\",\"Y\"))","v":"2AY"},{"$f":"IF(IF(LEFT(C43,1)=\"-\",C43,\"\")=\"\",\"\",REPLACE(IF(LEFT(C43,1)=\"-\",C43,\"\"),1,1,tech!$H$2))","v":"• Medium probability of compromise"},"|",null,"Formal assignment of responsible leadership","Guidance","1.1.2.GX",{"$f":"IF(AND(I43<>\"\",LEFT(I43,1)<>\"#\"),IF(LEFT(I43,1)=\"-\",REPLACE(I43,1,1,tech!$H$2),I43),\"\")","v":""},"|",null,"Certificate policy is documented and published","References","1.2.2.RX",{"$f":"IF(AND(O43<>\"\",LEFT(O43,1)<>\"#\"),IF(LEFT(O43,1)=\"-\",REPLACE(O43,1,1,tech!$H$2),O43),\"\")","v":""},"|","- [ISO 37301 - Compliance management systems and related standard](https://www.iso.org/standard/75080.html)","Compliance policies are defined, implemented, and communicated","References","1.3.1.RY",{"$f":"IF(AND(U43<>\"\",LEFT(U43,1)<>\"#\"),IF(LEFT(U43,1)=\"-\",REPLACE(U43,1,1,tech!$H$2),U43),\"\")","v":"• [ISO 37301 - Compliance management systems and related standard](https://www.iso.org/standard/75080.html)"},"|","Identified processes and procedures needs to be properly designed and documented with all relevant information like scope, purpose, inputs, outputs, roles and responsibilities, and other. The processes and procedures should be also reviewed and approved by the management.","Processes and procedures are formally documented and followed","Guidance","1.4.2.GY",{"$f":"IF(AND(AA43<>\"\",LEFT(AA43,1)<>\"#\"),IF(LEFT(AA43,1)=\"-\",REPLACE(AA43,1,1,tech!$H$2),AA43),\"\")","v":"Identified processes and procedures needs to be properly designed and documented with all relevant information like scope, purpose, inputs, outputs, roles and responsibilities, and other. The processes and procedures should be also reviewed and approved by the management."},"|",null,"Key management roles and responsibilities are documented and formally assigned","References","2.1.1.RX",{"$f":"IF(AND(AG43<>\"\",LEFT(AG43,1)<>\"#\"),IF(LEFT(AG43,1)=\"-\",REPLACE(AG43,1,1,tech!$H$2),AG43),\"\")","v":""},"|","* [CA/B Forum baseline requirements](https://cabforum.org/baseline-requirements/)","Certificate profiles are documented","References","2.2.1.RY",{"$f":"IF(AND(AM43<>\"\",LEFT(AM43,1)<>\"#\"),IF(LEFT(AM43,1)=\"-\",REPLACE(AM43,1,1,tech!$H$2),AM43),\"\")","v":"* [CA/B Forum baseline requirements](https://cabforum.org/baseline-requirements/)"},"|",null,"Network and deployment infrastructure is documented","References","2.3.1.RX",{"$f":"IF(AND(AS43<>\"\",LEFT(AS43,1)<>\"#\"),IF(LEFT(AS43,1)=\"-\",REPLACE(AS43,1,1,tech!$H$2),AS43),\"\")","v":""},"|",null,"The policy for change management and agility is documented","References","2.4.1.RX",{"$f":"IF(AND(AY43<>\"\",LEFT(AY43,1)<>\"#\"),IF(LEFT(AY43,1)=\"-\",REPLACE(AY43,1,1,tech!$H$2),AY43),\"\")","v":""},"|","#### Guidance","Cyber-security management and incident planning","Guidance","3.1.2.GX",{"$f":"IF(AND(BE43<>\"\",LEFT(BE43,1)<>\"#\"),IF(LEFT(BE43,1)=\"-\",REPLACE(BE43,1,1,tech!$H$2),BE43),\"\")","v":""},"|","- [The Open Group Architecture Framework (TOGAF)](https://www.opengroup.org/togaf)","Maintain PKI interoperability strategy","References","3.2.1.RY",{"$f":"IF(AND(BK43<>\"\",LEFT(BK43,1)<>\"#\"),IF(LEFT(BK43,1)=\"-\",REPLACE(BK43,1,1,tech!$H$2),BK43),\"\")","v":"• [The Open Group Architecture Framework (TOGAF)](https://www.opengroup.org/togaf)"},"|","- [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)","Monitoring events and logging requirements are defined and documented","References","3.3.1.RY",{"$f":"IF(AND(BQ43<>\"\",LEFT(BQ43,1)<>\"#\"),IF(LEFT(BQ43,1)=\"-\",REPLACE(BQ43,1,1,tech!$H$2),BQ43),\"\")","v":"• [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)"},"|",null,"Process automation description","References","3.4.1.RX",{"$f":"IF(AND(BW43<>\"\",LEFT(BW43,1)<>\"#\"),IF(LEFT(BW43,1)=\"-\",REPLACE(BW43,1,1,tech!$H$2),BW43),\"\")","v":""},"|","- Financial resources: required budget, funding sources","Resources are clearly defined","Guidance","4.1.2.GY",{"$f":"IF(AND(CC43<>\"\",LEFT(CC43,1)<>\"#\"),IF(LEFT(CC43,1)=\"-\",REPLACE(CC43,1,1,tech!$H$2),CC43),\"\")","v":"• Financial resources: required budget, funding sources"},"|","- Training plan is approved and communicated to all personnel","Establish training plan","Assessment","4.2.1.AY",{"$f":"IF(AND(CI43<>\"\",LEFT(CI43,1)<>\"#\"),IF(LEFT(CI43,1)=\"-\",REPLACE(CI43,1,1,tech!$H$2),CI43),\"\")","v":"• Training plan is approved and communicated to all personnel"},"|","### Disclose PKI information","Disclose PKI information","References","4.3.2.RX",{"$f":"IF(AND(CO43<>\"\",LEFT(CO43,1)<>\"#\"),IF(LEFT(CO43,1)=\"-\",REPLACE(CO43,1,1,tech!$H$2),CO43),\"\")","v":""},"|"]
[null,null,"- no trust","Basic","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D44,tech!$A$13:$B$17,2,0),LEFT(E44,1),IF(G44=\"\",\"X\",\"Y\"))","v":"2AY"},{"$f":"IF(IF(LEFT(C44,1)=\"-\",C44,\"\")=\"\",\"\",REPLACE(IF(LEFT(C44,1)=\"-\",C44,\"\"),1,1,tech!$H$2))","v":"• no trust"},"|","#### Assessment","Formal assignment of responsible leadership","Assessment","1.1.2.AX",{"$f":"IF(AND(I44<>\"\",LEFT(I44,1)<>\"#\"),IF(LEFT(I44,1)=\"-\",REPLACE(I44,1,1,tech!$H$2),I44),\"\")","v":""},"|","#### Guidance","Certificate policy is documented and published","Guidance","1.2.2.GX",{"$f":"IF(AND(O44<>\"\",LEFT(O44,1)<>\"#\"),IF(LEFT(O44,1)=\"-\",REPLACE(O44,1,1,tech!$H$2),O44),\"\")","v":""},"|","- [NIST Risk Management Framework](https://csrc.nist.gov/Projects/risk-management)","Compliance policies are defined, implemented, and communicated","References","1.3.1.RY",{"$f":"IF(AND(U44<>\"\",LEFT(U44,1)<>\"#\"),IF(LEFT(U44,1)=\"-\",REPLACE(U44,1,1,tech!$H$2),U44),\"\")","v":"• [NIST Risk Management Framework](https://csrc.nist.gov/Projects/risk-management)"},"|",null,"Processes and procedures are formally documented and followed","Guidance","1.4.2.GY",{"$f":"IF(AND(AA44<>\"\",LEFT(AA44,1)<>\"#\"),IF(LEFT(AA44,1)=\"-\",REPLACE(AA44,1,1,tech!$H$2),AA44),\"\")","v":""},"|","### Inventory of cryptographic keys is documented and maintained","Inventory of cryptographic keys is documented and maintained","References","2.1.2.RX",{"$f":"IF(AND(AG44<>\"\",LEFT(AG44,1)<>\"#\"),IF(LEFT(AG44,1)=\"-\",REPLACE(AG44,1,1,tech!$H$2),AG44),\"\")","v":""},"|","* [ETSI Qualified Certificate Profiles](https://portal.etsi.org/TB-SiteMap/ESI/Trust-Service-Providers)","Certificate profiles are documented","References","2.2.1.RY",{"$f":"IF(AND(AM44<>\"\",LEFT(AM44,1)<>\"#\"),IF(LEFT(AM44,1)=\"-\",REPLACE(AM44,1,1,tech!$H$2),AM44),\"\")","v":"* [ETSI Qualified Certificate Profiles](https://portal.etsi.org/TB-SiteMap/ESI/Trust-Service-Providers)"},"|","- [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)","Network and deployment infrastructure is documented","References","2.3.1.RY",{"$f":"IF(AND(AS44<>\"\",LEFT(AS44,1)<>\"#\"),IF(LEFT(AS44,1)=\"-\",REPLACE(AS44,1,1,tech!$H$2),AS44),\"\")","v":"• [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)"},"|","- [COBIT (Control Objectives for Information and Related Technologies)](https://www.isaca.org/resources/cobit)","The policy for change management and agility is documented","References","2.4.1.RY",{"$f":"IF(AND(AY44<>\"\",LEFT(AY44,1)<>\"#\"),IF(LEFT(AY44,1)=\"-\",REPLACE(AY44,1,1,tech!$H$2),AY44),\"\")","v":"• [COBIT (Control Objectives for Information and Related Technologies)](https://www.isaca.org/resources/cobit)"},"|",null,"Cyber-security management and incident planning","Guidance","3.1.2.GX",{"$f":"IF(AND(BE44<>\"\",LEFT(BE44,1)<>\"#\"),IF(LEFT(BE44,1)=\"-\",REPLACE(BE44,1,1,tech!$H$2),BE44),\"\")","v":""},"|",null,"Maintain PKI interoperability strategy","References","3.2.1.RX",{"$f":"IF(AND(BK44<>\"\",LEFT(BK44,1)<>\"#\"),IF(LEFT(BK44,1)=\"-\",REPLACE(BK44,1,1,tech!$H$2),BK44),\"\")","v":""},"|","- [ISO/IEC 27099 - Public key infrastructure](https://www.iso.org/standard/56590.html)","Monitoring events and logging requirements are defined and documented","References","3.3.1.RY",{"$f":"IF(AND(BQ44<>\"\",LEFT(BQ44,1)<>\"#\"),IF(LEFT(BQ44,1)=\"-\",REPLACE(BQ44,1,1,tech!$H$2),BQ44),\"\")","v":"• [ISO/IEC 27099 - Public key infrastructure](https://www.iso.org/standard/56590.html)"},"|","N/A","Process automation description","References","3.4.1.RY",{"$f":"IF(AND(BW44<>\"\",LEFT(BW44,1)<>\"#\"),IF(LEFT(BW44,1)=\"-\",REPLACE(BW44,1,1,tech!$H$2),BW44),\"\")","v":"N/A"},"|","- Management resources: processes and procedures, inputs, outputs","Resources are clearly defined","Guidance","4.1.2.GY",{"$f":"IF(AND(CC44<>\"\",LEFT(CC44,1)<>\"#\"),IF(LEFT(CC44,1)=\"-\",REPLACE(CC44,1,1,tech!$H$2),CC44),\"\")","v":"• Management resources: processes and procedures, inputs, outputs"},"|","- Training plan is integrated in organization","Establish training plan","Assessment","4.2.1.AY",{"$f":"IF(AND(CI44<>\"\",LEFT(CI44,1)<>\"#\"),IF(LEFT(CI44,1)=\"-\",REPLACE(CI44,1,1,tech!$H$2),CI44),\"\")","v":"• Training plan is integrated in organization"},"|",null,"Disclose PKI information","References","4.3.2.RX",{"$f":"IF(AND(CO44<>\"\",LEFT(CO44,1)<>\"#\"),IF(LEFT(CO44,1)=\"-\",REPLACE(CO44,1,1,tech!$H$2),CO44),\"\")","v":""},"|"]
[{"$nulls":3},"Basic","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D45,tech!$A$13:$B$17,2,0),LEFT(E45,1),IF(G45=\"\",\"X\",\"Y\"))","v":"2AX"},{"$f":"IF(IF(LEFT(C45,1)=\"-\",C45,\"\")=\"\",\"\",REPLACE(IF(LEFT(C45,1)=\"-\",C45,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Formal assignment of responsible leadership","Assessment","1.1.2.AX",{"$f":"IF(AND(I45<>\"\",LEFT(I45,1)<>\"#\"),IF(LEFT(I45,1)=\"-\",REPLACE(I45,1,1,tech!$H$2),I45),\"\")","v":""},"|",null,"Certificate policy is documented and published","Guidance","1.2.2.GX",{"$f":"IF(AND(O45<>\"\",LEFT(O45,1)<>\"#\"),IF(LEFT(O45,1)=\"-\",REPLACE(O45,1,1,tech!$H$2),O45),\"\")","v":""},"|",null,"Compliance policies are defined, implemented, and communicated","References","1.3.1.RX",{"$f":"IF(AND(U45<>\"\",LEFT(U45,1)<>\"#\"),IF(LEFT(U45,1)=\"-\",REPLACE(U45,1,1,tech!$H$2),U45),\"\")","v":""},"|","Once the processes and procedures are published, appropriate training is required to ensure they are followed by the PKI management and staff. Without following the processes and procedures, the PKI can be exposed to the risks and threats, and eventually lose any established trust.","Processes and procedures are formally documented and followed","Guidance","1.4.2.GY",{"$f":"IF(AND(AA45<>\"\",LEFT(AA45,1)<>\"#\"),IF(LEFT(AA45,1)=\"-\",REPLACE(AA45,1,1,tech!$H$2),AA45),\"\")","v":"Once the processes and procedures are published, appropriate training is required to ensure they are followed by the PKI management and staff. Without following the processes and procedures, the PKI can be exposed to the risks and threats, and eventually lose any established trust."},"|",null,"Inventory of cryptographic keys is documented and maintained","References","2.1.2.RX",{"$f":"IF(AND(AG45<>\"\",LEFT(AG45,1)<>\"#\"),IF(LEFT(AG45,1)=\"-\",REPLACE(AG45,1,1,tech!$H$2),AG45),\"\")","v":""},"|","* [ETSI 319-411-1](https://www.etsi.org/deliver/etsi_en/319400_319499/31941101/01.03.01_60/en_31941101v010301p.pdf)","Certificate profiles are documented","References","2.2.1.RY",{"$f":"IF(AND(AM45<>\"\",LEFT(AM45,1)<>\"#\"),IF(LEFT(AM45,1)=\"-\",REPLACE(AM45,1,1,tech!$H$2),AM45),\"\")","v":"* [ETSI 319-411-1](https://www.etsi.org/deliver/etsi_en/319400_319499/31941101/01.03.01_60/en_31941101v010301p.pdf)"},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Network and deployment infrastructure is documented","References","2.3.1.RY",{"$f":"IF(AND(AS45<>\"\",LEFT(AS45,1)<>\"#\"),IF(LEFT(AS45,1)=\"-\",REPLACE(AS45,1,1,tech!$H$2),AS45),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|","- [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)","The policy for change management and agility is documented","References","2.4.1.RY",{"$f":"IF(AND(AY45<>\"\",LEFT(AY45,1)<>\"#\"),IF(LEFT(AY45,1)=\"-\",REPLACE(AY45,1,1,tech!$H$2),AY45),\"\")","v":"• [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)"},"|","Cyber-security management covers activities to ensure that the PKI is protected against known and zero-day vulnerabilities, cyberattacks and other threats. The operational procedures and technologies are evolving and the PKI needs to be able to adapt to the changes. Without knowing the threats and vulnerabilities, it is not possible to plan for the resilience and properly plan for incident response.","Cyber-security management and incident planning","Guidance","3.1.2.GY",{"$f":"IF(AND(BE45<>\"\",LEFT(BE45,1)<>\"#\"),IF(LEFT(BE45,1)=\"-\",REPLACE(BE45,1,1,tech!$H$2),BE45),\"\")","v":"Cyber-security management covers activities to ensure that the PKI is protected against known and zero-day vulnerabilities, cyberattacks and other threats. The operational procedures and technologies are evolving and the PKI needs to be able to adapt to the changes. Without knowing the threats and vulnerabilities, it is not possible to plan for the resilience and properly plan for incident response."},"|","### Documented integration guidance","Documented integration guidance","References","3.2.2.RX",{"$f":"IF(AND(BK45<>\"\",LEFT(BK45,1)<>\"#\"),IF(LEFT(BK45,1)=\"-\",REPLACE(BK45,1,1,tech!$H$2),BK45),\"\")","v":""},"|",null,"Monitoring events and logging requirements are defined and documented","References","3.3.1.RX",{"$f":"IF(AND(BQ45<>\"\",LEFT(BQ45,1)<>\"#\"),IF(LEFT(BQ45,1)=\"-\",REPLACE(BQ45,1,1,tech!$H$2),BQ45),\"\")","v":""},"|",null,"Process automation description","References","3.4.1.RX",{"$f":"IF(AND(BW45<>\"\",LEFT(BW45,1)<>\"#\"),IF(LEFT(BW45,1)=\"-\",REPLACE(BW45,1,1,tech!$H$2),BW45),\"\")","v":""},"|","- Other resources: description, specification, requirements","Resources are clearly defined","Guidance","4.1.2.GY",{"$f":"IF(AND(CC45<>\"\",LEFT(CC45,1)<>\"#\"),IF(LEFT(CC45,1)=\"-\",REPLACE(CC45,1,1,tech!$H$2),CC45),\"\")","v":"• Other resources: description, specification, requirements"},"|",null,"Establish training plan","Assessment","4.2.1.AX",{"$f":"IF(AND(CI45<>\"\",LEFT(CI45,1)<>\"#\"),IF(LEFT(CI45,1)=\"-\",REPLACE(CI45,1,1,tech!$H$2),CI45),\"\")","v":""},"|","#### Guidance","Disclose PKI information","Guidance","4.3.2.GX",{"$f":"IF(AND(CO45<>\"\",LEFT(CO45,1)<>\"#\"),IF(LEFT(CO45,1)=\"-\",REPLACE(CO45,1,1,tech!$H$2),CO45),\"\")","v":""},"|"]
[null,null,"## Advanced maturity level","Advanced","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D46,tech!$A$13:$B$17,2,0),LEFT(E46,1),IF(G46=\"\",\"X\",\"Y\"))","v":"3AX"},{"$f":"IF(IF(LEFT(C46,1)=\"-\",C46,\"\")=\"\",\"\",REPLACE(IF(LEFT(C46,1)=\"-\",C46,\"\"),1,1,tech!$H$2))","v":""},"|","The formal assignment of the responsible person should be documented and approved by the management. Formal document should contains identification of the person and understanding of the role and responsibilities.","Formal assignment of responsible leadership","Assessment","1.1.2.AY",{"$f":"IF(AND(I46<>\"\",LEFT(I46,1)<>\"#\"),IF(LEFT(I46,1)=\"-\",REPLACE(I46,1,1,tech!$H$2),I46),\"\")","v":"The formal assignment of the responsible person should be documented and approved by the management. Formal document should contains identification of the person and understanding of the role and responsibilities."},"|","Certificate Policy (CP) is used to establish the controls of the issuing party and the roles and responsibilities of its entities for the specific PKI implementation and use case. It's used to provide assurance to partners and show the trustworthiness by the use of standards. It can be considered as a high level contract between the parties involved in the PKI and therefore should be published and available to all parties involved.","Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O46<>\"\",LEFT(O46,1)<>\"#\"),IF(LEFT(O46,1)=\"-\",REPLACE(O46,1,1,tech!$H$2),O46),\"\")","v":"Certificate Policy (CP) is used to establish the controls of the issuing party and the roles and responsibilities of its entities for the specific PKI implementation and use case. It's used to provide assurance to partners and show the trustworthiness by the use of standards. It can be considered as a high level contract between the parties involved in the PKI and therefore should be published and available to all parties involved."},"|","### A program to monitor compliance with the policies is established","A program to monitor compliance with the policies is established","References","1.3.2.RX",{"$f":"IF(AND(U46<>\"\",LEFT(U46,1)<>\"#\"),IF(LEFT(U46,1)=\"-\",REPLACE(U46,1,1,tech!$H$2),U46),\"\")","v":""},"|",null,"Processes and procedures are formally documented and followed","Guidance","1.4.2.GX",{"$f":"IF(AND(AA46<>\"\",LEFT(AA46,1)<>\"#\"),IF(LEFT(AA46,1)=\"-\",REPLACE(AA46,1,1,tech!$H$2),AA46),\"\")","v":""},"|","#### Guidance","Inventory of cryptographic keys is documented and maintained","Guidance","2.1.2.GX",{"$f":"IF(AND(AG46<>\"\",LEFT(AG46,1)<>\"#\"),IF(LEFT(AG46,1)=\"-\",REPLACE(AG46,1,1,tech!$H$2),AG46),\"\")","v":""},"|","* [ETSI 319-411-2](https://www.etsi.org/deliver/etsi_en/319400_319499/31941102/02.03.01_60/en_31941102v020301p.pdf)","Certificate profiles are documented","References","2.2.1.RY",{"$f":"IF(AND(AM46<>\"\",LEFT(AM46,1)<>\"#\"),IF(LEFT(AM46,1)=\"-\",REPLACE(AM46,1,1,tech!$H$2),AM46),\"\")","v":"* [ETSI 319-411-2](https://www.etsi.org/deliver/etsi_en/319400_319499/31941102/02.03.01_60/en_31941102v020301p.pdf)"},"|","- [Guidance for Containers and Container Orchestration Tools](https://docs-prv.pcisecuritystandards.org/Guidance%20Document/Containers%20and%20Container%20Orchestration%20Tools/Guidance-for-Containers-and-Container-Ochestration-Tools-v1_0.pdf)","Network and deployment infrastructure is documented","References","2.3.1.RY",{"$f":"IF(AND(AS46<>\"\",LEFT(AS46,1)<>\"#\"),IF(LEFT(AS46,1)=\"-\",REPLACE(AS46,1,1,tech!$H$2),AS46),\"\")","v":"• [Guidance for Containers and Container Orchestration Tools](https://docs-prv.pcisecuritystandards.org/Guidance%20Document/Containers%20and%20Container%20Orchestration%20Tools/Guidance-for-Containers-and-Container-Ochestration-Tools-v1_0.pdf)"},"|","- [The Information Technology Infrastructure Library (ITIL)](https://www.axelos.com/best-practice-solutions/itil)","The policy for change management and agility is documented","References","2.4.1.RY",{"$f":"IF(AND(AY46<>\"\",LEFT(AY46,1)<>\"#\"),IF(LEFT(AY46,1)=\"-\",REPLACE(AY46,1,1,tech!$H$2),AY46),\"\")","v":"• [The Information Technology Infrastructure Library (ITIL)](https://www.axelos.com/best-practice-solutions/itil)"},"|",null,"Cyber-security management and incident planning","Guidance","3.1.2.GY",{"$f":"IF(AND(BE46<>\"\",LEFT(BE46,1)<>\"#\"),IF(LEFT(BE46,1)=\"-\",REPLACE(BE46,1,1,tech!$H$2),BE46),\"\")","v":""},"|",null,"Documented integration guidance","References","3.2.2.RX",{"$f":"IF(AND(BK46<>\"\",LEFT(BK46,1)<>\"#\"),IF(LEFT(BK46,1)=\"-\",REPLACE(BK46,1,1,tech!$H$2),BK46),\"\")","v":""},"|","### Event logs from systems are collected","Event logs from systems are collected","References","3.3.2.RX",{"$f":"IF(AND(BQ46<>\"\",LEFT(BQ46,1)<>\"#\"),IF(LEFT(BQ46,1)=\"-\",REPLACE(BQ46,1,1,tech!$H$2),BQ46),\"\")","v":""},"|","### Monitoring and auditing of automated process","Monitoring and auditing of automated process","References","3.4.2.RX",{"$f":"IF(AND(BW46<>\"\",LEFT(BW46,1)<>\"#\"),IF(LEFT(BW46,1)=\"-\",REPLACE(BW46,1,1,tech!$H$2),BW46),\"\")","v":""},"|",null,"Resources are clearly defined","Guidance","4.1.2.GY",{"$f":"IF(AND(CC46<>\"\",LEFT(CC46,1)<>\"#\"),IF(LEFT(CC46,1)=\"-\",REPLACE(CC46,1,1,tech!$H$2),CC46),\"\")","v":""},"|","#### References","Establish training plan","References","4.2.1.RX",{"$f":"IF(AND(CI46<>\"\",LEFT(CI46,1)<>\"#\"),IF(LEFT(CI46,1)=\"-\",REPLACE(CI46,1,1,tech!$H$2),CI46),\"\")","v":""},"|",null,"Disclose PKI information","Guidance","4.3.2.GX",{"$f":"IF(AND(CO46<>\"\",LEFT(CO46,1)<>\"#\"),IF(LEFT(CO46,1)=\"-\",REPLACE(CO46,1,1,tech!$H$2),CO46),\"\")","v":""},"|"]
[{"$nulls":3},"Advanced","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D47,tech!$A$13:$B$17,2,0),LEFT(E47,1),IF(G47=\"\",\"X\",\"Y\"))","v":"3AX"},{"$f":"IF(IF(LEFT(C47,1)=\"-\",C47,\"\")=\"\",\"\",REPLACE(IF(LEFT(C47,1)=\"-\",C47,\"\"),1,1,tech!$H$2))","v":""},"|","Interview with the responsible person should confirm the understanding of the role and responsibilities, driving the PKI implementation according to the organizational strategy.","Formal assignment of responsible leadership","Assessment","1.1.2.AY",{"$f":"IF(AND(I47<>\"\",LEFT(I47,1)<>\"#\"),IF(LEFT(I47,1)=\"-\",REPLACE(I47,1,1,tech!$H$2),I47),\"\")","v":"Interview with the responsible person should confirm the understanding of the role and responsibilities, driving the PKI implementation according to the organizational strategy."},"|",null,"Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O47<>\"\",LEFT(O47,1)<>\"#\"),IF(LEFT(O47,1)=\"-\",REPLACE(O47,1,1,tech!$H$2),O47),\"\")","v":""},"|",null,"A program to monitor compliance with the policies is established","References","1.3.2.RX",{"$f":"IF(AND(U47<>\"\",LEFT(U47,1)<>\"#\"),IF(LEFT(U47,1)=\"-\",REPLACE(U47,1,1,tech!$H$2),U47),\"\")","v":""},"|","#### Assessment","Processes and procedures are formally documented and followed","Assessment","1.4.2.AX",{"$f":"IF(AND(AA47<>\"\",LEFT(AA47,1)<>\"#\"),IF(LEFT(AA47,1)=\"-\",REPLACE(AA47,1,1,tech!$H$2),AA47),\"\")","v":""},"|",null,"Inventory of cryptographic keys is documented and maintained","Guidance","2.1.2.GX",{"$f":"IF(AND(AG47<>\"\",LEFT(AG47,1)<>\"#\"),IF(LEFT(AG47,1)=\"-\",REPLACE(AG47,1,1,tech!$H$2),AG47),\"\")","v":""},"|","* [3GPP 33.310 - Network Domain Security (NDS); Authentication Framework (AF)](https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId2293)","Certificate profiles are documented","References","2.2.1.RY",{"$f":"IF(AND(AM47<>\"\",LEFT(AM47,1)<>\"#\"),IF(LEFT(AM47,1)=\"-\",REPLACE(AM47,1,1,tech!$H$2),AM47),\"\")","v":"* [3GPP 33.310 - Network Domain Security (NDS); Authentication Framework (AF)](https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId2293)"},"|",null,"Network and deployment infrastructure is documented","References","2.3.1.RX",{"$f":"IF(AND(AS47<>\"\",LEFT(AS47,1)<>\"#\"),IF(LEFT(AS47,1)=\"-\",REPLACE(AS47,1,1,tech!$H$2),AS47),\"\")","v":""},"|",null,"The policy for change management and agility is documented","References","2.4.1.RX",{"$f":"IF(AND(AY47<>\"\",LEFT(AY47,1)<>\"#\"),IF(LEFT(AY47,1)=\"-\",REPLACE(AY47,1,1,tech!$H$2),AY47),\"\")","v":""},"|","Incident response planning helps to ensure that the organization is able to respond to the suspected incidents. Incident response plans should be documented and tested regularly. The result of executed incident response plans should be documented and used to improve the plan, even if it was a false alarm.","Cyber-security management and incident planning","Guidance","3.1.2.GY",{"$f":"IF(AND(BE47<>\"\",LEFT(BE47,1)<>\"#\"),IF(LEFT(BE47,1)=\"-\",REPLACE(BE47,1,1,tech!$H$2),BE47),\"\")","v":"Incident response planning helps to ensure that the organization is able to respond to the suspected incidents. Incident response plans should be documented and tested regularly. The result of executed incident response plans should be documented and used to improve the plan, even if it was a false alarm."},"|","#### Guidance","Documented integration guidance","Guidance","3.2.2.GX",{"$f":"IF(AND(BK47<>\"\",LEFT(BK47,1)<>\"#\"),IF(LEFT(BK47,1)=\"-\",REPLACE(BK47,1,1,tech!$H$2),BK47),\"\")","v":""},"|",null,"Event logs from systems are collected","References","3.3.2.RX",{"$f":"IF(AND(BQ47<>\"\",LEFT(BQ47,1)<>\"#\"),IF(LEFT(BQ47,1)=\"-\",REPLACE(BQ47,1,1,tech!$H$2),BQ47),\"\")","v":""},"|",null,"Monitoring and auditing of automated process","References","3.4.2.RX",{"$f":"IF(AND(BW47<>\"\",LEFT(BW47,1)<>\"#\"),IF(LEFT(BW47,1)=\"-\",REPLACE(BW47,1,1,tech!$H$2),BW47),\"\")","v":""},"|","Without clearly defined resources, there could be misuse of the organization’s assets or inconsistent interaction with personnel and other parties, leading to insecure and untrusted implementation of the PKI.","Resources are clearly defined","Guidance","4.1.2.GY",{"$f":"IF(AND(CC47<>\"\",LEFT(CC47,1)<>\"#\"),IF(LEFT(CC47,1)=\"-\",REPLACE(CC47,1,1,tech!$H$2),CC47),\"\")","v":"Without clearly defined resources, there could be misuse of the organization’s assets or inconsistent interaction with personnel and other parties, leading to insecure and untrusted implementation of the PKI."},"|",null,"Establish training plan","References","4.2.1.RX",{"$f":"IF(AND(CI47<>\"\",LEFT(CI47,1)<>\"#\"),IF(LEFT(CI47,1)=\"-\",REPLACE(CI47,1,1,tech!$H$2),CI47),\"\")","v":""},"|","Information about the policies, processes, and procedures that are maintained by the PKI should be disclosed to the PKI participants. This information should be available on a timely basis and in a form that is understandable to the PKI participants.","Disclose PKI information","Guidance","4.3.2.GY",{"$f":"IF(AND(CO47<>\"\",LEFT(CO47,1)<>\"#\"),IF(LEFT(CO47,1)=\"-\",REPLACE(CO47,1,1,tech!$H$2),CO47),\"\")","v":"Information about the policies, processes, and procedures that are maintained by the PKI should be disclosed to the PKI participants. This information should be available on a timely basis and in a form that is understandable to the PKI participants."},"|"]
[null,null,"### Indicators","Advanced","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D48,tech!$A$13:$B$17,2,0),LEFT(E48,1),IF(G48=\"\",\"X\",\"Y\"))","v":"3IX"},{"$f":"IF(IF(LEFT(C48,1)=\"-\",C48,\"\")=\"\",\"\",REPLACE(IF(LEFT(C48,1)=\"-\",C48,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Formal assignment of responsible leadership","Assessment","1.1.2.AX",{"$f":"IF(AND(I48<>\"\",LEFT(I48,1)<>\"#\"),IF(LEFT(I48,1)=\"-\",REPLACE(I48,1,1,tech!$H$2),I48),\"\")","v":""},"|","CPs are described in a document form where the content may differ. Multiple policies can be part of a single document for different use cases. A CP contains a set of rules that indicates the applicability of a certificate to a particular community and/or class of applications with common security requirements or level of security (for instance certificates for the purpose of: persons, domains, organizations, authenticity and confidentiality, services). To uniquely identify the purpose of the certificates the CP contains unique numbers (Object Identifier, OID) which needs to be registered.","Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O48<>\"\",LEFT(O48,1)<>\"#\"),IF(LEFT(O48,1)=\"-\",REPLACE(O48,1,1,tech!$H$2),O48),\"\")","v":"CPs are described in a document form where the content may differ. Multiple policies can be part of a single document for different use cases. A CP contains a set of rules that indicates the applicability of a certificate to a particular community and/or class of applications with common security requirements or level of security (for instance certificates for the purpose of: persons, domains, organizations, authenticity and confidentiality, services). To uniquely identify the purpose of the certificates the CP contains unique numbers (Object Identifier, OID) which needs to be registered."},"|","#### Guidance","A program to monitor compliance with the policies is established","Guidance","1.3.2.GX",{"$f":"IF(AND(U48<>\"\",LEFT(U48,1)<>\"#\"),IF(LEFT(U48,1)=\"-\",REPLACE(U48,1,1,tech!$H$2),U48),\"\")","v":""},"|",null,"Processes and procedures are formally documented and followed","Assessment","1.4.2.AX",{"$f":"IF(AND(AA48<>\"\",LEFT(AA48,1)<>\"#\"),IF(LEFT(AA48,1)=\"-\",REPLACE(AA48,1,1,tech!$H$2),AA48),\"\")","v":""},"|","Inventory of cryptographic keys is important and a strategic database for organizations to:","Inventory of cryptographic keys is documented and maintained","Guidance","2.1.2.GY",{"$f":"IF(AND(AG48<>\"\",LEFT(AG48,1)<>\"#\"),IF(LEFT(AG48,1)=\"-\",REPLACE(AG48,1,1,tech!$H$2),AG48),\"\")","v":"Inventory of cryptographic keys is important and a strategic database for organizations to:"},"|","* [UNISIG SUBSET-137](https://www.era.europa.eu/system/files/2022-11/index083_-_subset-137_v100.pdf)","Certificate profiles are documented","References","2.2.1.RY",{"$f":"IF(AND(AM48<>\"\",LEFT(AM48,1)<>\"#\"),IF(LEFT(AM48,1)=\"-\",REPLACE(AM48,1,1,tech!$H$2),AM48),\"\")","v":"* [UNISIG SUBSET-137](https://www.era.europa.eu/system/files/2022-11/index083_-_subset-137_v100.pdf)"},"|","### Separation and segmentation principles are applied","Separation and segmentation principles are applied","References","2.3.2.RX",{"$f":"IF(AND(AS48<>\"\",LEFT(AS48,1)<>\"#\"),IF(LEFT(AS48,1)=\"-\",REPLACE(AS48,1,1,tech!$H$2),AS48),\"\")","v":""},"|","### Request for change structure is documented and followed","Request for change structure is documented and followed","References","2.4.2.RX",{"$f":"IF(AND(AY48<>\"\",LEFT(AY48,1)<>\"#\"),IF(LEFT(AY48,1)=\"-\",REPLACE(AY48,1,1,tech!$H$2),AY48),\"\")","v":""},"|",null,"Cyber-security management and incident planning","Guidance","3.1.2.GY",{"$f":"IF(AND(BE48<>\"\",LEFT(BE48,1)<>\"#\"),IF(LEFT(BE48,1)=\"-\",REPLACE(BE48,1,1,tech!$H$2),BE48),\"\")","v":""},"|",null,"Documented integration guidance","Guidance","3.2.2.GX",{"$f":"IF(AND(BK48<>\"\",LEFT(BK48,1)<>\"#\"),IF(LEFT(BK48,1)=\"-\",REPLACE(BK48,1,1,tech!$H$2),BK48),\"\")","v":""},"|","#### Guidance","Event logs from systems are collected","Guidance","3.3.2.GX",{"$f":"IF(AND(BQ48<>\"\",LEFT(BQ48,1)<>\"#\"),IF(LEFT(BQ48,1)=\"-\",REPLACE(BQ48,1,1,tech!$H$2),BQ48),\"\")","v":""},"|","#### Guidance","Monitoring and auditing of automated process","Guidance","3.4.2.GX",{"$f":"IF(AND(BW48<>\"\",LEFT(BW48,1)<>\"#\"),IF(LEFT(BW48,1)=\"-\",REPLACE(BW48,1,1,tech!$H$2),BW48),\"\")","v":""},"|",null,"Resources are clearly defined","Guidance","4.1.2.GX",{"$f":"IF(AND(CC48<>\"\",LEFT(CC48,1)<>\"#\"),IF(LEFT(CC48,1)=\"-\",REPLACE(CC48,1,1,tech!$H$2),CC48),\"\")","v":""},"|","- [NIST SP 800-16 Information Technology Security Training Requirements: a Role- and Performance-Based Model](https://csrc.nist.gov/publications/detail/sp/800-16/final)","Establish training plan","References","4.2.1.RY",{"$f":"IF(AND(CI48<>\"\",LEFT(CI48,1)<>\"#\"),IF(LEFT(CI48,1)=\"-\",REPLACE(CI48,1,1,tech!$H$2),CI48),\"\")","v":"• [NIST SP 800-16 Information Technology Security Training Requirements: a Role- and Performance-Based Model](https://csrc.nist.gov/publications/detail/sp/800-16/final)"},"|",null,"Disclose PKI information","Guidance","4.3.2.GY",{"$f":"IF(AND(CO48<>\"\",LEFT(CO48,1)<>\"#\"),IF(LEFT(CO48,1)=\"-\",REPLACE(CO48,1,1,tech!$H$2),CO48),\"\")","v":""},"|"]
[{"$nulls":3},"Advanced","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D49,tech!$A$13:$B$17,2,0),LEFT(E49,1),IF(G49=\"\",\"X\",\"Y\"))","v":"3IX"},{"$f":"IF(IF(LEFT(C49,1)=\"-\",C49,\"\")=\"\",\"\",REPLACE(IF(LEFT(C49,1)=\"-\",C49,\"\"),1,1,tech!$H$2))","v":""},"|","#### References","Formal assignment of responsible leadership","References","1.1.2.RX",{"$f":"IF(AND(I49<>\"\",LEFT(I49,1)<>\"#\"),IF(LEFT(I49,1)=\"-\",REPLACE(I49,1,1,tech!$H$2),I49),\"\")","v":""},"|",null,"Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O49<>\"\",LEFT(O49,1)<>\"#\"),IF(LEFT(O49,1)=\"-\",REPLACE(O49,1,1,tech!$H$2),O49),\"\")","v":""},"|",null,"A program to monitor compliance with the policies is established","Guidance","1.3.2.GX",{"$f":"IF(AND(U49<>\"\",LEFT(U49,1)<>\"#\"),IF(LEFT(U49,1)=\"-\",REPLACE(U49,1,1,tech!$H$2),U49),\"\")","v":""},"|","The following is sample evidence and information that can be collected during the assessment:","Processes and procedures are formally documented and followed","Assessment","1.4.2.AY",{"$f":"IF(AND(AA49<>\"\",LEFT(AA49,1)<>\"#\"),IF(LEFT(AA49,1)=\"-\",REPLACE(AA49,1,1,tech!$H$2),AA49),\"\")","v":"The following is sample evidence and information that can be collected during the assessment:"},"|","- Monitor cryptographic key status and compliance","Inventory of cryptographic keys is documented and maintained","Guidance","2.1.2.GY",{"$f":"IF(AND(AG49<>\"\",LEFT(AG49,1)<>\"#\"),IF(LEFT(AG49,1)=\"-\",REPLACE(AG49,1,1,tech!$H$2),AG49),\"\")","v":"• Monitor cryptographic key status and compliance"},"|",null,"Certificate profiles are documented","References","2.2.1.RX",{"$f":"IF(AND(AM49<>\"\",LEFT(AM49,1)<>\"#\"),IF(LEFT(AM49,1)=\"-\",REPLACE(AM49,1,1,tech!$H$2),AM49),\"\")","v":""},"|",null,"Separation and segmentation principles are applied","References","2.3.2.RX",{"$f":"IF(AND(AS49<>\"\",LEFT(AS49,1)<>\"#\"),IF(LEFT(AS49,1)=\"-\",REPLACE(AS49,1,1,tech!$H$2),AS49),\"\")","v":""},"|",null,"Request for change structure is documented and followed","References","2.4.2.RX",{"$f":"IF(AND(AY49<>\"\",LEFT(AY49,1)<>\"#\"),IF(LEFT(AY49,1)=\"-\",REPLACE(AY49,1,1,tech!$H$2),AY49),\"\")","v":""},"|","Cyber-security management and incident planning covers important aspects such as vulnerability management and security operations center (SOC) identification and response to potential incidents.","Cyber-security management and incident planning","Guidance","3.1.2.GY",{"$f":"IF(AND(BE49<>\"\",LEFT(BE49,1)<>\"#\"),IF(LEFT(BE49,1)=\"-\",REPLACE(BE49,1,1,tech!$H$2),BE49),\"\")","v":"Cyber-security management and incident planning covers important aspects such as vulnerability management and security operations center (SOC) identification and response to potential incidents."},"|","To have effective interoperability between PKI components, it is important to have a proper integration in place that serves the purpose and does not expose any potential risks. Available and documented integration guidance for the developers and administrators should be maintained and updated regularly.","Documented integration guidance","Guidance","3.2.2.GY",{"$f":"IF(AND(BK49<>\"\",LEFT(BK49,1)<>\"#\"),IF(LEFT(BK49,1)=\"-\",REPLACE(BK49,1,1,tech!$H$2),BK49),\"\")","v":"To have effective interoperability between PKI components, it is important to have a proper integration in place that serves the purpose and does not expose any potential risks. Available and documented integration guidance for the developers and administrators should be maintained and updated regularly."},"|",null,"Event logs from systems are collected","Guidance","3.3.2.GX",{"$f":"IF(AND(BQ49<>\"\",LEFT(BQ49,1)<>\"#\"),IF(LEFT(BQ49,1)=\"-\",REPLACE(BQ49,1,1,tech!$H$2),BQ49),\"\")","v":""},"|",null,"Monitoring and auditing of automated process","Guidance","3.4.2.GX",{"$f":"IF(AND(BW49<>\"\",LEFT(BW49,1)<>\"#\"),IF(LEFT(BW49,1)=\"-\",REPLACE(BW49,1,1,tech!$H$2),BW49),\"\")","v":""},"|","#### Assessment","Resources are clearly defined","Assessment","4.1.2.AX",{"$f":"IF(AND(CC49<>\"\",LEFT(CC49,1)<>\"#\"),IF(LEFT(CC49,1)=\"-\",REPLACE(CC49,1,1,tech!$H$2),CC49),\"\")","v":""},"|","- [NIST SP 800-50 Building an Information Technology Security Awareness and Training Program](https://csrc.nist.gov/publications/detail/sp/800-50/final)","Establish training plan","References","4.2.1.RY",{"$f":"IF(AND(CI49<>\"\",LEFT(CI49,1)<>\"#\"),IF(LEFT(CI49,1)=\"-\",REPLACE(CI49,1,1,tech!$H$2),CI49),\"\")","v":"• [NIST SP 800-50 Building an Information Technology Security Awareness and Training Program](https://csrc.nist.gov/publications/detail/sp/800-50/final)"},"|","Organization maintaining the PKI implementation should disclose the following information on a website or other appropriate media that can be reached by the PKI participants:","Disclose PKI information","Guidance","4.3.2.GY",{"$f":"IF(AND(CO49<>\"\",LEFT(CO49,1)<>\"#\"),IF(LEFT(CO49,1)=\"-\",REPLACE(CO49,1,1,tech!$H$2),CO49),\"\")","v":"Organization maintaining the PKI implementation should disclose the following information on a website or other appropriate media that can be reached by the PKI participants:"},"|"]
[null,null,"- certificate services are not consistently managed","Advanced","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D50,tech!$A$13:$B$17,2,0),LEFT(E50,1),IF(G50=\"\",\"X\",\"Y\"))","v":"3IY"},{"$f":"IF(IF(LEFT(C50,1)=\"-\",C50,\"\")=\"\",\"\",REPLACE(IF(LEFT(C50,1)=\"-\",C50,\"\"),1,1,tech!$H$2))","v":"• certificate services are not consistently managed"},"|",null,"Formal assignment of responsible leadership","References","1.1.2.RX",{"$f":"IF(AND(I50<>\"\",LEFT(I50,1)<>\"#\"),IF(LEFT(I50,1)=\"-\",REPLACE(I50,1,1,tech!$H$2),I50),\"\")","v":""},"|","In general a CP addresses the following items:","Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O50<>\"\",LEFT(O50,1)<>\"#\"),IF(LEFT(O50,1)=\"-\",REPLACE(O50,1,1,tech!$H$2),O50),\"\")","v":"In general a CP addresses the following items:"},"|","A PKI compliance monitoring program typically involves ongoing monitoring and testing of the controls and procedures to detect potential compliance violations associated with rules and regulations that govern the issuance, update, or revocation of certificates.","A program to monitor compliance with the policies is established","Guidance","1.3.2.GY",{"$f":"IF(AND(U50<>\"\",LEFT(U50,1)<>\"#\"),IF(LEFT(U50,1)=\"-\",REPLACE(U50,1,1,tech!$H$2),U50),\"\")","v":"A PKI compliance monitoring program typically involves ongoing monitoring and testing of the controls and procedures to detect potential compliance violations associated with rules and regulations that govern the issuance, update, or revocation of certificates."},"|","- Documented processes and procedures","Processes and procedures are formally documented and followed","Assessment","1.4.2.AY",{"$f":"IF(AND(AA50<>\"\",LEFT(AA50,1)<>\"#\"),IF(LEFT(AA50,1)=\"-\",REPLACE(AA50,1,1,tech!$H$2),AA50),\"\")","v":"• Documented processes and procedures"},"|","- Quickly react to changes and incidents (deprecation of algorithms, compromise, new attacks and vulnerabilities)","Inventory of cryptographic keys is documented and maintained","Guidance","2.1.2.GY",{"$f":"IF(AND(AG50<>\"\",LEFT(AG50,1)<>\"#\"),IF(LEFT(AG50,1)=\"-\",REPLACE(AG50,1,1,tech!$H$2),AG50),\"\")","v":"• Quickly react to changes and incidents (deprecation of algorithms, compromise, new attacks and vulnerabilities)"},"|","### Certificate cipher suites are documented","Certificate cipher suites are documented","References","2.2.2.RX",{"$f":"IF(AND(AM50<>\"\",LEFT(AM50,1)<>\"#\"),IF(LEFT(AM50,1)=\"-\",REPLACE(AM50,1,1,tech!$H$2),AM50),\"\")","v":""},"|","#### Guidance","Separation and segmentation principles are applied","Guidance","2.3.2.GX",{"$f":"IF(AND(AS50<>\"\",LEFT(AS50,1)<>\"#\"),IF(LEFT(AS50,1)=\"-\",REPLACE(AS50,1,1,tech!$H$2),AS50),\"\")","v":""},"|","#### Guidance","Request for change structure is documented and followed","Guidance","2.4.2.GX",{"$f":"IF(AND(AY50<>\"\",LEFT(AY50,1)<>\"#\"),IF(LEFT(AY50,1)=\"-\",REPLACE(AY50,1,1,tech!$H$2),AY50),\"\")","v":""},"|",null,"Cyber-security management and incident planning","Guidance","3.1.2.GX",{"$f":"IF(AND(BE50<>\"\",LEFT(BE50,1)<>\"#\"),IF(LEFT(BE50,1)=\"-\",REPLACE(BE50,1,1,tech!$H$2),BE50),\"\")","v":""},"|",null,"Documented integration guidance","Guidance","3.2.2.GY",{"$f":"IF(AND(BK50<>\"\",LEFT(BK50,1)<>\"#\"),IF(LEFT(BK50,1)=\"-\",REPLACE(BK50,1,1,tech!$H$2),BK50),\"\")","v":""},"|","The event logs from systems should be collected and available for analysis, including correlation with other records. Centralized logging is recommended to ensure that the logs are collected and stored consistently. Solution like security information and event management (SIEM) can be used to collect and analyze the logs.","Event logs from systems are collected","Guidance","3.3.2.GY",{"$f":"IF(AND(BQ50<>\"\",LEFT(BQ50,1)<>\"#\"),IF(LEFT(BQ50,1)=\"-\",REPLACE(BQ50,1,1,tech!$H$2),BQ50),\"\")","v":"The event logs from systems should be collected and available for analysis, including correlation with other records. Centralized logging is recommended to ensure that the logs are collected and stored consistently. Solution like security information and event management (SIEM) can be used to collect and analyze the logs."},"|","The automated process of certificate management can cause significant damage if misused or misconfigured. The monitoring and auditing of the automated process is essential to prevent the risk of misuse and to detect any potential issues, inefficiencies, or exceptions.","Monitoring and auditing of automated process","Guidance","3.4.2.GY",{"$f":"IF(AND(BW50<>\"\",LEFT(BW50,1)<>\"#\"),IF(LEFT(BW50,1)=\"-\",REPLACE(BW50,1,1,tech!$H$2),BW50),\"\")","v":"The automated process of certificate management can cause significant damage if misused or misconfigured. The monitoring and auditing of the automated process is essential to prevent the risk of misuse and to detect any potential issues, inefficiencies, or exceptions."},"|",null,"Resources are clearly defined","Assessment","4.1.2.AX",{"$f":"IF(AND(CC50<>\"\",LEFT(CC50,1)<>\"#\"),IF(LEFT(CC50,1)=\"-\",REPLACE(CC50,1,1,tech!$H$2),CC50),\"\")","v":""},"|","- [European Cybersecurity Skills Framework (ECSF)](https://www.enisa.europa.eu/topics/education/european-cybersecurity-skills-framework)","Establish training plan","References","4.2.1.RY",{"$f":"IF(AND(CI50<>\"\",LEFT(CI50,1)<>\"#\"),IF(LEFT(CI50,1)=\"-\",REPLACE(CI50,1,1,tech!$H$2),CI50),\"\")","v":"• [European Cybersecurity Skills Framework (ECSF)](https://www.enisa.europa.eu/topics/education/european-cybersecurity-skills-framework)"},"|","- Certificate Policy","Disclose PKI information","Guidance","4.3.2.GY",{"$f":"IF(AND(CO50<>\"\",LEFT(CO50,1)<>\"#\"),IF(LEFT(CO50,1)=\"-\",REPLACE(CO50,1,1,tech!$H$2),CO50),\"\")","v":"• Certificate Policy"},"|"]
[null,null,"- procedures are defined and followed","Advanced","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D51,tech!$A$13:$B$17,2,0),LEFT(E51,1),IF(G51=\"\",\"X\",\"Y\"))","v":"3IY"},{"$f":"IF(IF(LEFT(C51,1)=\"-\",C51,\"\")=\"\",\"\",REPLACE(IF(LEFT(C51,1)=\"-\",C51,\"\"),1,1,tech!$H$2))","v":"• procedures are defined and followed"},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Formal assignment of responsible leadership","References","1.1.2.RY",{"$f":"IF(AND(I51<>\"\",LEFT(I51,1)<>\"#\"),IF(LEFT(I51,1)=\"-\",REPLACE(I51,1,1,tech!$H$2),I51),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|","- types of certificates","Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O51<>\"\",LEFT(O51,1)<>\"#\"),IF(LEFT(O51,1)=\"-\",REPLACE(O51,1,1,tech!$H$2),O51),\"\")","v":"• types of certificates"},"|",null,"A program to monitor compliance with the policies is established","Guidance","1.3.2.GY",{"$f":"IF(AND(U51<>\"\",LEFT(U51,1)<>\"#\"),IF(LEFT(U51,1)=\"-\",REPLACE(U51,1,1,tech!$H$2),U51),\"\")","v":""},"|","- Completeness of the processes and procedures documentation","Processes and procedures are formally documented and followed","Assessment","1.4.2.AY",{"$f":"IF(AND(AA51<>\"\",LEFT(AA51,1)<>\"#\"),IF(LEFT(AA51,1)=\"-\",REPLACE(AA51,1,1,tech!$H$2),AA51),\"\")","v":"• Completeness of the processes and procedures documentation"},"|","- Understand impact of lifecycle changes, migration and use of keys","Inventory of cryptographic keys is documented and maintained","Guidance","2.1.2.GY",{"$f":"IF(AND(AG51<>\"\",LEFT(AG51,1)<>\"#\"),IF(LEFT(AG51,1)=\"-\",REPLACE(AG51,1,1,tech!$H$2),AG51),\"\")","v":"• Understand impact of lifecycle changes, migration and use of keys"},"|",null,"Certificate cipher suites are documented","References","2.2.2.RX",{"$f":"IF(AND(AM51<>\"\",LEFT(AM51,1)<>\"#\"),IF(LEFT(AM51,1)=\"-\",REPLACE(AM51,1,1,tech!$H$2),AM51),\"\")","v":""},"|",null,"Separation and segmentation principles are applied","Guidance","2.3.2.GX",{"$f":"IF(AND(AS51<>\"\",LEFT(AS51,1)<>\"#\"),IF(LEFT(AS51,1)=\"-\",REPLACE(AS51,1,1,tech!$H$2),AS51),\"\")","v":""},"|",null,"Request for change structure is documented and followed","Guidance","2.4.2.GX",{"$f":"IF(AND(AY51<>\"\",LEFT(AY51,1)<>\"#\"),IF(LEFT(AY51,1)=\"-\",REPLACE(AY51,1,1,tech!$H$2),AY51),\"\")","v":""},"|","#### Assessment","Cyber-security management and incident planning","Assessment","3.1.2.AX",{"$f":"IF(AND(BE51<>\"\",LEFT(BE51,1)<>\"#\"),IF(LEFT(BE51,1)=\"-\",REPLACE(BE51,1,1,tech!$H$2),BE51),\"\")","v":""},"|","The integration guidance should be available for all critical PKI components and should cover at least the following information:","Documented integration guidance","Guidance","3.2.2.GY",{"$f":"IF(AND(BK51<>\"\",LEFT(BK51,1)<>\"#\"),IF(LEFT(BK51,1)=\"-\",REPLACE(BK51,1,1,tech!$H$2),BK51),\"\")","v":"The integration guidance should be available for all critical PKI components and should cover at least the following information:"},"|",null,"Event logs from systems are collected","Guidance","3.3.2.GY",{"$f":"IF(AND(BQ51<>\"\",LEFT(BQ51,1)<>\"#\"),IF(LEFT(BQ51,1)=\"-\",REPLACE(BQ51,1,1,tech!$H$2),BQ51),\"\")","v":""},"|",null,"Monitoring and auditing of automated process","Guidance","3.4.2.GY",{"$f":"IF(AND(BW51<>\"\",LEFT(BW51,1)<>\"#\"),IF(LEFT(BW51,1)=\"-\",REPLACE(BW51,1,1,tech!$H$2),BW51),\"\")","v":""},"|","The following is a sample evidence that can be used to assess the requirement:","Resources are clearly defined","Assessment","4.1.2.AY",{"$f":"IF(AND(CC51<>\"\",LEFT(CC51,1)<>\"#\"),IF(LEFT(CC51,1)=\"-\",REPLACE(CC51,1,1,tech!$H$2),CC51),\"\")","v":"The following is a sample evidence that can be used to assess the requirement:"},"|",null,"Establish training plan","References","4.2.1.RX",{"$f":"IF(AND(CI51<>\"\",LEFT(CI51,1)<>\"#\"),IF(LEFT(CI51,1)=\"-\",REPLACE(CI51,1,1,tech!$H$2),CI51),\"\")","v":""},"|","- Certification Practice Statement","Disclose PKI information","Guidance","4.3.2.GY",{"$f":"IF(AND(CO51<>\"\",LEFT(CO51,1)<>\"#\"),IF(LEFT(CO51,1)=\"-\",REPLACE(CO51,1,1,tech!$H$2),CO51),\"\")","v":"• Certification Practice Statement"},"|"]
[null,null,"- CP and CPS partially exist but not followed","Advanced","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D52,tech!$A$13:$B$17,2,0),LEFT(E52,1),IF(G52=\"\",\"X\",\"Y\"))","v":"3IY"},{"$f":"IF(IF(LEFT(C52,1)=\"-\",C52,\"\")=\"\",\"\",REPLACE(IF(LEFT(C52,1)=\"-\",C52,\"\"),1,1,tech!$H$2))","v":"• CP and CPS partially exist but not followed"},"|",null,"Formal assignment of responsible leadership","References","1.1.2.RX",{"$f":"IF(AND(I52<>\"\",LEFT(I52,1)<>\"#\"),IF(LEFT(I52,1)=\"-\",REPLACE(I52,1,1,tech!$H$2),I52),\"\")","v":""},"|","- Document name and Identification","Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O52<>\"\",LEFT(O52,1)<>\"#\"),IF(LEFT(O52,1)=\"-\",REPLACE(O52,1,1,tech!$H$2),O52),\"\")","v":"• Document name and Identification"},"|","These programs often include a risk assessment to identify and assess potential risks that could lead to non-compliance, including regulatory changes, operational changes, or employee turnover.","A program to monitor compliance with the policies is established","Guidance","1.3.2.GY",{"$f":"IF(AND(U52<>\"\",LEFT(U52,1)<>\"#\"),IF(LEFT(U52,1)=\"-\",REPLACE(U52,1,1,tech!$H$2),U52),\"\")","v":"These programs often include a risk assessment to identify and assess potential risks that could lead to non-compliance, including regulatory changes, operational changes, or employee turnover."},"|","- Evidence of the processes and procedures usage","Processes and procedures are formally documented and followed","Assessment","1.4.2.AY",{"$f":"IF(AND(AA52<>\"\",LEFT(AA52,1)<>\"#\"),IF(LEFT(AA52,1)=\"-\",REPLACE(AA52,1,1,tech!$H$2),AA52),\"\")","v":"• Evidence of the processes and procedures usage"},"|",null,"Inventory of cryptographic keys is documented and maintained","Guidance","2.1.2.GY",{"$f":"IF(AND(AG52<>\"\",LEFT(AG52,1)<>\"#\"),IF(LEFT(AG52,1)=\"-\",REPLACE(AG52,1,1,tech!$H$2),AG52),\"\")","v":""},"|","#### Guidance","Certificate cipher suites are documented","Guidance","2.2.2.GX",{"$f":"IF(AND(AM52<>\"\",LEFT(AM52,1)<>\"#\"),IF(LEFT(AM52,1)=\"-\",REPLACE(AM52,1,1,tech!$H$2),AM52),\"\")","v":""},"|","The PKI environment should be properly separated and segmented from other environments and systems. The separation and segmentation should be applied on all levels, including network, infrastructure, and application. The separation and segmentation should be applied based on the security requirements and risk assessment.","Separation and segmentation principles are applied","Guidance","2.3.2.GY",{"$f":"IF(AND(AS52<>\"\",LEFT(AS52,1)<>\"#\"),IF(LEFT(AS52,1)=\"-\",REPLACE(AS52,1,1,tech!$H$2),AS52),\"\")","v":"The PKI environment should be properly separated and segmented from other environments and systems. The separation and segmentation should be applied on all levels, including network, infrastructure, and application. The separation and segmentation should be applied based on the security requirements and risk assessment."},"|","The request for change structure is the basic stone of each change management process. It provides information about a change, its scope, and other relevant data. The request for change structure should be formally documented and followed by all stakeholders involved.","Request for change structure is documented and followed","Guidance","2.4.2.GY",{"$f":"IF(AND(AY52<>\"\",LEFT(AY52,1)<>\"#\"),IF(LEFT(AY52,1)=\"-\",REPLACE(AY52,1,1,tech!$H$2),AY52),\"\")","v":"The request for change structure is the basic stone of each change management process. It provides information about a change, its scope, and other relevant data. The request for change structure should be formally documented and followed by all stakeholders involved."},"|",null,"Cyber-security management and incident planning","Assessment","3.1.2.AX",{"$f":"IF(AND(BE52<>\"\",LEFT(BE52,1)<>\"#\"),IF(LEFT(BE52,1)=\"-\",REPLACE(BE52,1,1,tech!$H$2),BE52),\"\")","v":""},"|","- Integration requirements and Prerequisites","Documented integration guidance","Guidance","3.2.2.GY",{"$f":"IF(AND(BK52<>\"\",LEFT(BK52,1)<>\"#\"),IF(LEFT(BK52,1)=\"-\",REPLACE(BK52,1,1,tech!$H$2),BK52),\"\")","v":"• Integration requirements and Prerequisites"},"|","The availability of records for analysis depends on understanding logging format and interpretation of the information, therefore each system should provide logs in a consistent format that can be further processed and analyzed (or automated).","Event logs from systems are collected","Guidance","3.3.2.GY",{"$f":"IF(AND(BQ52<>\"\",LEFT(BQ52,1)<>\"#\"),IF(LEFT(BQ52,1)=\"-\",REPLACE(BQ52,1,1,tech!$H$2),BQ52),\"\")","v":"The availability of records for analysis depends on understanding logging format and interpretation of the information, therefore each system should provide logs in a consistent format that can be further processed and analyzed (or automated)."},"|","The monitoring and auditing should be performed on a regular basis and should be aligned with the overall monitoring and auditing strategy of the organization.","Monitoring and auditing of automated process","Guidance","3.4.2.GY",{"$f":"IF(AND(BW52<>\"\",LEFT(BW52,1)<>\"#\"),IF(LEFT(BW52,1)=\"-\",REPLACE(BW52,1,1,tech!$H$2),BW52),\"\")","v":"The monitoring and auditing should be performed on a regular basis and should be aligned with the overall monitoring and auditing strategy of the organization."},"|","- Resource management process","Resources are clearly defined","Assessment","4.1.2.AY",{"$f":"IF(AND(CC52<>\"\",LEFT(CC52,1)<>\"#\"),IF(LEFT(CC52,1)=\"-\",REPLACE(CC52,1,1,tech!$H$2),CC52),\"\")","v":"• Resource management process"},"|","### Responsible personnel receive training","Responsible personnel receive training","References","4.2.2.RX",{"$f":"IF(AND(CI52<>\"\",LEFT(CI52,1)<>\"#\"),IF(LEFT(CI52,1)=\"-\",REPLACE(CI52,1,1,tech!$H$2),CI52),\"\")","v":""},"|","- Revocation information","Disclose PKI information","Guidance","4.3.2.GY",{"$f":"IF(AND(CO52<>\"\",LEFT(CO52,1)<>\"#\"),IF(LEFT(CO52,1)=\"-\",REPLACE(CO52,1,1,tech!$H$2),CO52),\"\")","v":"• Revocation information"},"|"]
[null,null,"- partially available resources and knowledge","Advanced","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D53,tech!$A$13:$B$17,2,0),LEFT(E53,1),IF(G53=\"\",\"X\",\"Y\"))","v":"3IY"},{"$f":"IF(IF(LEFT(C53,1)=\"-\",C53,\"\")=\"\",\"\",REPLACE(IF(LEFT(C53,1)=\"-\",C53,\"\"),1,1,tech!$H$2))","v":"• partially available resources and knowledge"},"|","### Scope and business drivers for PKI","Scope and business drivers for PKI","References","1.1.3.RX",{"$f":"IF(AND(I53<>\"\",LEFT(I53,1)<>\"#\"),IF(LEFT(I53,1)=\"-\",REPLACE(I53,1,1,tech!$H$2),I53),\"\")","v":""},"|","- PKI participants","Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O53<>\"\",LEFT(O53,1)<>\"#\"),IF(LEFT(O53,1)=\"-\",REPLACE(O53,1,1,tech!$H$2),O53),\"\")","v":"• PKI participants"},"|",null,"A program to monitor compliance with the policies is established","Guidance","1.3.2.GY",{"$f":"IF(AND(U53<>\"\",LEFT(U53,1)<>\"#\"),IF(LEFT(U53,1)=\"-\",REPLACE(U53,1,1,tech!$H$2),U53),\"\")","v":""},"|","- Interview with the PKI management and staff","Processes and procedures are formally documented and followed","Assessment","1.4.2.AY",{"$f":"IF(AND(AA53<>\"\",LEFT(AA53,1)<>\"#\"),IF(LEFT(AA53,1)=\"-\",REPLACE(AA53,1,1,tech!$H$2),AA53),\"\")","v":"• Interview with the PKI management and staff"},"|","Although the cryptographic key inventory may be implemented and maintained using various tools and approaches, it should serve the purpose of having a consistent and accurate map of all cryptographic keys deployed in the organization with details like algorithm, key length, usage, storage, location, generation and distribution method, backup and recovery, key check value, fingerprint, number of share or components, owner or responsible person, uniqueness, crypto-periods, or any other applicable attributes and properties of the key.","Inventory of cryptographic keys is documented and maintained","Guidance","2.1.2.GY",{"$f":"IF(AND(AG53<>\"\",LEFT(AG53,1)<>\"#\"),IF(LEFT(AG53,1)=\"-\",REPLACE(AG53,1,1,tech!$H$2),AG53),\"\")","v":"Although the cryptographic key inventory may be implemented and maintained using various tools and approaches, it should serve the purpose of having a consistent and accurate map of all cryptographic keys deployed in the organization with details like algorithm, key length, usage, storage, location, generation and distribution method, backup and recovery, key check value, fingerprint, number of share or components, owner or responsible person, uniqueness, crypto-periods, or any other applicable attributes and properties of the key."},"|",null,"Certificate cipher suites are documented","Guidance","2.2.2.GX",{"$f":"IF(AND(AM53<>\"\",LEFT(AM53,1)<>\"#\"),IF(LEFT(AM53,1)=\"-\",REPLACE(AM53,1,1,tech!$H$2),AM53),\"\")","v":""},"|",null,"Separation and segmentation principles are applied","Guidance","2.3.2.GY",{"$f":"IF(AND(AS53<>\"\",LEFT(AS53,1)<>\"#\"),IF(LEFT(AS53,1)=\"-\",REPLACE(AS53,1,1,tech!$H$2),AS53),\"\")","v":""},"|",null,"Request for change structure is documented and followed","Guidance","2.4.2.GY",{"$f":"IF(AND(AY53<>\"\",LEFT(AY53,1)<>\"#\"),IF(LEFT(AY53,1)=\"-\",REPLACE(AY53,1,1,tech!$H$2),AY53),\"\")","v":""},"|","The following is sample evidence that can be used to assess the requirement:","Cyber-security management and incident planning","Assessment","3.1.2.AY",{"$f":"IF(AND(BE53<>\"\",LEFT(BE53,1)<>\"#\"),IF(LEFT(BE53,1)=\"-\",REPLACE(BE53,1,1,tech!$H$2),BE53),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|","- applicable standards and protocols","Documented integration guidance","Guidance","3.2.2.GY",{"$f":"IF(AND(BK53<>\"\",LEFT(BK53,1)<>\"#\"),IF(LEFT(BK53,1)=\"-\",REPLACE(BK53,1,1,tech!$H$2),BK53),\"\")","v":"• applicable standards and protocols"},"|",null,"Event logs from systems are collected","Guidance","3.3.2.GY",{"$f":"IF(AND(BQ53<>\"\",LEFT(BQ53,1)<>\"#\"),IF(LEFT(BQ53,1)=\"-\",REPLACE(BQ53,1,1,tech!$H$2),BQ53),\"\")","v":""},"|","It should provide sufficient information to detect any potential issues with the automated process. For successful detection or identification of issues, proper expectations should be based on the description of the automated process.","Monitoring and auditing of automated process","Guidance","3.4.2.GY",{"$f":"IF(AND(BW53<>\"\",LEFT(BW53,1)<>\"#\"),IF(LEFT(BW53,1)=\"-\",REPLACE(BW53,1,1,tech!$H$2),BW53),\"\")","v":"It should provide sufficient information to detect any potential issues with the automated process. For successful detection or identification of issues, proper expectations should be based on the description of the automated process."},"|","- Documented requirements on the resources","Resources are clearly defined","Assessment","4.1.2.AY",{"$f":"IF(AND(CC53<>\"\",LEFT(CC53,1)<>\"#\"),IF(LEFT(CC53,1)=\"-\",REPLACE(CC53,1,1,tech!$H$2),CC53),\"\")","v":"• Documented requirements on the resources"},"|",null,"Responsible personnel receive training","References","4.2.2.RX",{"$f":"IF(AND(CI53<>\"\",LEFT(CI53,1)<>\"#\"),IF(LEFT(CI53,1)=\"-\",REPLACE(CI53,1,1,tech!$H$2),CI53),\"\")","v":""},"|","- Valid CA certificates","Disclose PKI information","Guidance","4.3.2.GY",{"$f":"IF(AND(CO53<>\"\",LEFT(CO53,1)<>\"#\"),IF(LEFT(CO53,1)=\"-\",REPLACE(CO53,1,1,tech!$H$2),CO53),\"\")","v":"• Valid CA certificates"},"|"]
[{"$nulls":3},"Advanced","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D54,tech!$A$13:$B$17,2,0),LEFT(E54,1),IF(G54=\"\",\"X\",\"Y\"))","v":"3IX"},{"$f":"IF(IF(LEFT(C54,1)=\"-\",C54,\"\")=\"\",\"\",REPLACE(IF(LEFT(C54,1)=\"-\",C54,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Scope and business drivers for PKI","References","1.1.3.RX",{"$f":"IF(AND(I54<>\"\",LEFT(I54,1)<>\"#\"),IF(LEFT(I54,1)=\"-\",REPLACE(I54,1,1,tech!$H$2),I54),\"\")","v":""},"|","- certificate usage","Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O54<>\"\",LEFT(O54,1)<>\"#\"),IF(LEFT(O54,1)=\"-\",REPLACE(O54,1,1,tech!$H$2),O54),\"\")","v":"• certificate usage"},"|","The monitoring process may include reviewing documentation, conducting interviews with key stakeholders, and reporting any issues or compliance violations.  Reporting from compliance monitoring should be communicated to those stakeholders who committed the violation(s) and those stakeholders who are empowered to take corrective action to address the violations observed.","A program to monitor compliance with the policies is established","Guidance","1.3.2.GY",{"$f":"IF(AND(U54<>\"\",LEFT(U54,1)<>\"#\"),IF(LEFT(U54,1)=\"-\",REPLACE(U54,1,1,tech!$H$2),U54),\"\")","v":"The monitoring process may include reviewing documentation, conducting interviews with key stakeholders, and reporting any issues or compliance violations.  Reporting from compliance monitoring should be communicated to those stakeholders who committed the violation(s) and those stakeholders who are empowered to take corrective action to address the violations observed."},"|","- Training materials covering the processes and procedures","Processes and procedures are formally documented and followed","Assessment","1.4.2.AY",{"$f":"IF(AND(AA54<>\"\",LEFT(AA54,1)<>\"#\"),IF(LEFT(AA54,1)=\"-\",REPLACE(AA54,1,1,tech!$H$2),AA54),\"\")","v":"• Training materials covering the processes and procedures"},"|",null,"Inventory of cryptographic keys is documented and maintained","Guidance","2.1.2.GY",{"$f":"IF(AND(AG54<>\"\",LEFT(AG54,1)<>\"#\"),IF(LEFT(AG54,1)=\"-\",REPLACE(AG54,1,1,tech!$H$2),AG54),\"\")","v":""},"|","Cipher suites, for certificates specifically defining key algorithms, key security levels and signature algorithms are important to be crypto agile. For example, the change of the cipher suites can be required when the cryptographic algorithm becomes broken, or deprecated. An organization should have a clear rationale to the usage of specific algorithms, and how long they will be valid and what may replace them in the future.","Certificate cipher suites are documented","Guidance","2.2.2.GY",{"$f":"IF(AND(AM54<>\"\",LEFT(AM54,1)<>\"#\"),IF(LEFT(AM54,1)=\"-\",REPLACE(AM54,1,1,tech!$H$2),AM54),\"\")","v":"Cipher suites, for certificates specifically defining key algorithms, key security levels and signature algorithms are important to be crypto agile. For example, the change of the cipher suites can be required when the cryptographic algorithm becomes broken, or deprecated. An organization should have a clear rationale to the usage of specific algorithms, and how long they will be valid and what may replace them in the future."},"|","Segmentation isolates the PKI environment from the remaining environment and reduces the risk of unauthorized access and data leakage. It also helps to reduce the impact of a potential compromise of the PKI environment from other systems and environments. Segmentation can be achieved using a number of physical or logical methods, such as:","Separation and segmentation principles are applied","Guidance","2.3.2.GY",{"$f":"IF(AND(AS54<>\"\",LEFT(AS54,1)<>\"#\"),IF(LEFT(AS54,1)=\"-\",REPLACE(AS54,1,1,tech!$H$2),AS54),\"\")","v":"Segmentation isolates the PKI environment from the remaining environment and reduces the risk of unauthorized access and data leakage. It also helps to reduce the impact of a potential compromise of the PKI environment from other systems and environments. Segmentation can be achieved using a number of physical or logical methods, such as:"},"|","Request for change can contain any change that can affect the PKI implementation, including:","Request for change structure is documented and followed","Guidance","2.4.2.GY",{"$f":"IF(AND(AY54<>\"\",LEFT(AY54,1)<>\"#\"),IF(LEFT(AY54,1)=\"-\",REPLACE(AY54,1,1,tech!$H$2),AY54),\"\")","v":"Request for change can contain any change that can affect the PKI implementation, including:"},"|","- Documented vulnerability management","Cyber-security management and incident planning","Assessment","3.1.2.AY",{"$f":"IF(AND(BE54<>\"\",LEFT(BE54,1)<>\"#\"),IF(LEFT(BE54,1)=\"-\",REPLACE(BE54,1,1,tech!$H$2),BE54),\"\")","v":"• Documented vulnerability management"},"|","- Integration architecture","Documented integration guidance","Guidance","3.2.2.GY",{"$f":"IF(AND(BK54<>\"\",LEFT(BK54,1)<>\"#\"),IF(LEFT(BK54,1)=\"-\",REPLACE(BK54,1,1,tech!$H$2),BK54),\"\")","v":"• Integration architecture"},"|","Logs and events should be collected from all systems that are relevant for the PKI implementation, such as key life cycle management events.","Event logs from systems are collected","Guidance","3.3.2.GY",{"$f":"IF(AND(BQ54<>\"\",LEFT(BQ54,1)<>\"#\"),IF(LEFT(BQ54,1)=\"-\",REPLACE(BQ54,1,1,tech!$H$2),BQ54),\"\")","v":"Logs and events should be collected from all systems that are relevant for the PKI implementation, such as key life cycle management events."},"|",null,"Monitoring and auditing of automated process","Guidance","3.4.2.GX",{"$f":"IF(AND(BW54<>\"\",LEFT(BW54,1)<>\"#\"),IF(LEFT(BW54,1)=\"-\",REPLACE(BW54,1,1,tech!$H$2),BW54),\"\")","v":""},"|","- Categorization of resources (an example can be: people, processes, procedures, tools, technologies)","Resources are clearly defined","Assessment","4.1.2.AY",{"$f":"IF(AND(CC54<>\"\",LEFT(CC54,1)<>\"#\"),IF(LEFT(CC54,1)=\"-\",REPLACE(CC54,1,1,tech!$H$2),CC54),\"\")","v":"• Categorization of resources (an example can be: people, processes, procedures, tools, technologies)"},"|","#### Guidance","Responsible personnel receive training","Guidance","4.2.2.GX",{"$f":"IF(AND(CI54<>\"\",LEFT(CI54,1)<>\"#\"),IF(LEFT(CI54,1)=\"-\",REPLACE(CI54,1,1,tech!$H$2),CI54),\"\")","v":""},"|","- Vulnerability reports","Disclose PKI information","Guidance","4.3.2.GY",{"$f":"IF(AND(CO54<>\"\",LEFT(CO54,1)<>\"#\"),IF(LEFT(CO54,1)=\"-\",REPLACE(CO54,1,1,tech!$H$2),CO54),\"\")","v":"• Vulnerability reports"},"|"]
[null,null,"### Associated risks","Advanced","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D55,tech!$A$13:$B$17,2,0),LEFT(E55,1),IF(G55=\"\",\"X\",\"Y\"))","v":"3AX"},{"$f":"IF(IF(LEFT(C55,1)=\"-\",C55,\"\")=\"\",\"\",REPLACE(IF(LEFT(C55,1)=\"-\",C55,\"\"),1,1,tech!$H$2))","v":""},"|","#### Guidance","Scope and business drivers for PKI","Guidance","1.1.3.GX",{"$f":"IF(AND(I55<>\"\",LEFT(I55,1)<>\"#\"),IF(LEFT(I55,1)=\"-\",REPLACE(I55,1,1,tech!$H$2),I55),\"\")","v":""},"|","- policy administration","Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O55<>\"\",LEFT(O55,1)<>\"#\"),IF(LEFT(O55,1)=\"-\",REPLACE(O55,1,1,tech!$H$2),O55),\"\")","v":"• policy administration"},"|",null,"A program to monitor compliance with the policies is established","Guidance","1.3.2.GX",{"$f":"IF(AND(U55<>\"\",LEFT(U55,1)<>\"#\"),IF(LEFT(U55,1)=\"-\",REPLACE(U55,1,1,tech!$H$2),U55),\"\")","v":""},"|",null,"Processes and procedures are formally documented and followed","Assessment","1.4.2.AX",{"$f":"IF(AND(AA55<>\"\",LEFT(AA55,1)<>\"#\"),IF(LEFT(AA55,1)=\"-\",REPLACE(AA55,1,1,tech!$H$2),AA55),\"\")","v":""},"|","Inventory should follow procedures and business as usual activities to keep it accurate and updated in time.","Inventory of cryptographic keys is documented and maintained","Guidance","2.1.2.GY",{"$f":"IF(AND(AG55<>\"\",LEFT(AG55,1)<>\"#\"),IF(LEFT(AG55,1)=\"-\",REPLACE(AG55,1,1,tech!$H$2),AG55),\"\")","v":"Inventory should follow procedures and business as usual activities to keep it accurate and updated in time."},"|",null,"Certificate cipher suites are documented","Guidance","2.2.2.GX",{"$f":"IF(AND(AM55<>\"\",LEFT(AM55,1)<>\"#\"),IF(LEFT(AM55,1)=\"-\",REPLACE(AM55,1,1,tech!$H$2),AM55),\"\")","v":""},"|","- Properly configured internal network Security controls","Separation and segmentation principles are applied","Guidance","2.3.2.GY",{"$f":"IF(AND(AS55<>\"\",LEFT(AS55,1)<>\"#\"),IF(LEFT(AS55,1)=\"-\",REPLACE(AS55,1,1,tech!$H$2),AS55),\"\")","v":"• Properly configured internal network Security controls"},"|","- PKI upgrades, updates, and patches","Request for change structure is documented and followed","Guidance","2.4.2.GY",{"$f":"IF(AND(AY55<>\"\",LEFT(AY55,1)<>\"#\"),IF(LEFT(AY55,1)=\"-\",REPLACE(AY55,1,1,tech!$H$2),AY55),\"\")","v":"• PKI upgrades, updates, and patches"},"|","- vulnerability scanning Results","Cyber-security management and incident planning","Assessment","3.1.2.AY",{"$f":"IF(AND(BE55<>\"\",LEFT(BE55,1)<>\"#\"),IF(LEFT(BE55,1)=\"-\",REPLACE(BE55,1,1,tech!$H$2),BE55),\"\")","v":"• vulnerability scanning Results"},"|","- Integration testing","Documented integration guidance","Guidance","3.2.2.GY",{"$f":"IF(AND(BK55<>\"\",LEFT(BK55,1)<>\"#\"),IF(LEFT(BK55,1)=\"-\",REPLACE(BK55,1,1,tech!$H$2),BK55),\"\")","v":"• Integration testing"},"|",null,"Event logs from systems are collected","Guidance","3.3.2.GY",{"$f":"IF(AND(BQ55<>\"\",LEFT(BQ55,1)<>\"#\"),IF(LEFT(BQ55,1)=\"-\",REPLACE(BQ55,1,1,tech!$H$2),BQ55),\"\")","v":""},"|","#### Assessment","Monitoring and auditing of automated process","Assessment","3.4.2.AX",{"$f":"IF(AND(BW55<>\"\",LEFT(BW55,1)<>\"#\"),IF(LEFT(BW55,1)=\"-\",REPLACE(BW55,1,1,tech!$H$2),BW55),\"\")","v":""},"|","- Alignment with the scope of the use-case","Resources are clearly defined","Assessment","4.1.2.AY",{"$f":"IF(AND(CC55<>\"\",LEFT(CC55,1)<>\"#\"),IF(LEFT(CC55,1)=\"-\",REPLACE(CC55,1,1,tech!$H$2),CC55),\"\")","v":"• Alignment with the scope of the use-case"},"|",null,"Responsible personnel receive training","Guidance","4.2.2.GX",{"$f":"IF(AND(CI55<>\"\",LEFT(CI55,1)<>\"#\"),IF(LEFT(CI55,1)=\"-\",REPLACE(CI55,1,1,tech!$H$2),CI55),\"\")","v":""},"|","- Audit reports","Disclose PKI information","Guidance","4.3.2.GY",{"$f":"IF(AND(CO55<>\"\",LEFT(CO55,1)<>\"#\"),IF(LEFT(CO55,1)=\"-\",REPLACE(CO55,1,1,tech!$H$2),CO55),\"\")","v":"• Audit reports"},"|"]
[{"$nulls":3},"Advanced","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D56,tech!$A$13:$B$17,2,0),LEFT(E56,1),IF(G56=\"\",\"X\",\"Y\"))","v":"3AX"},{"$f":"IF(IF(LEFT(C56,1)=\"-\",C56,\"\")=\"\",\"\",REPLACE(IF(LEFT(C56,1)=\"-\",C56,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Scope and business drivers for PKI","Guidance","1.1.3.GX",{"$f":"IF(AND(I56<>\"\",LEFT(I56,1)<>\"#\"),IF(LEFT(I56,1)=\"-\",REPLACE(I56,1,1,tech!$H$2),I56),\"\")","v":""},"|","- Definitions","Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O56<>\"\",LEFT(O56,1)<>\"#\"),IF(LEFT(O56,1)=\"-\",REPLACE(O56,1,1,tech!$H$2),O56),\"\")","v":"• Definitions"},"|","#### Assessment","A program to monitor compliance with the policies is established","Assessment","1.3.2.AX",{"$f":"IF(AND(U56<>\"\",LEFT(U56,1)<>\"#\"),IF(LEFT(U56,1)=\"-\",REPLACE(U56,1,1,tech!$H$2),U56),\"\")","v":""},"|","#### References","Processes and procedures are formally documented and followed","References","1.4.2.RX",{"$f":"IF(AND(AA56<>\"\",LEFT(AA56,1)<>\"#\"),IF(LEFT(AA56,1)=\"-\",REPLACE(AA56,1,1,tech!$H$2),AA56),\"\")","v":""},"|",null,"Inventory of cryptographic keys is documented and maintained","Guidance","2.1.2.GX",{"$f":"IF(AND(AG56<>\"\",LEFT(AG56,1)<>\"#\"),IF(LEFT(AG56,1)=\"-\",REPLACE(AG56,1,1,tech!$H$2),AG56),\"\")","v":""},"|","#### Assessment","Certificate cipher suites are documented","Assessment","2.2.2.AX",{"$f":"IF(AND(AM56<>\"\",LEFT(AM56,1)<>\"#\"),IF(LEFT(AM56,1)=\"-\",REPLACE(AM56,1,1,tech!$H$2),AM56),\"\")","v":""},"|","- Routers with strong access control lists","Separation and segmentation principles are applied","Guidance","2.3.2.GY",{"$f":"IF(AND(AS56<>\"\",LEFT(AS56,1)<>\"#\"),IF(LEFT(AS56,1)=\"-\",REPLACE(AS56,1,1,tech!$H$2),AS56),\"\")","v":"• Routers with strong access control lists"},"|","- New components or functionalities","Request for change structure is documented and followed","Guidance","2.4.2.GY",{"$f":"IF(AND(AY56<>\"\",LEFT(AY56,1)<>\"#\"),IF(LEFT(AY56,1)=\"-\",REPLACE(AY56,1,1,tech!$H$2),AY56),\"\")","v":"• New components or functionalities"},"|","- Documented incident response plans","Cyber-security management and incident planning","Assessment","3.1.2.AY",{"$f":"IF(AND(BE56<>\"\",LEFT(BE56,1)<>\"#\"),IF(LEFT(BE56,1)=\"-\",REPLACE(BE56,1,1,tech!$H$2),BE56),\"\")","v":"• Documented incident response plans"},"|",null,"Documented integration guidance","Guidance","3.2.2.GX",{"$f":"IF(AND(BK56<>\"\",LEFT(BK56,1)<>\"#\"),IF(LEFT(BK56,1)=\"-\",REPLACE(BK56,1,1,tech!$H$2),BK56),\"\")","v":""},"|","The event should contain sufficient information to identify the event, including:","Event logs from systems are collected","Guidance","3.3.2.GY",{"$f":"IF(AND(BQ56<>\"\",LEFT(BQ56,1)<>\"#\"),IF(LEFT(BQ56,1)=\"-\",REPLACE(BQ56,1,1,tech!$H$2),BQ56),\"\")","v":"The event should contain sufficient information to identify the event, including:"},"|",null,"Monitoring and auditing of automated process","Assessment","3.4.2.AX",{"$f":"IF(AND(BW56<>\"\",LEFT(BW56,1)<>\"#\"),IF(LEFT(BW56,1)=\"-\",REPLACE(BW56,1,1,tech!$H$2),BW56),\"\")","v":""},"|","- Interview personnel in various roles","Resources are clearly defined","Assessment","4.1.2.AY",{"$f":"IF(AND(CC56<>\"\",LEFT(CC56,1)<>\"#\"),IF(LEFT(CC56,1)=\"-\",REPLACE(CC56,1,1,tech!$H$2),CC56),\"\")","v":"• Interview personnel in various roles"},"|","The responsible personnel should be aware of the current policies and procedures that are related to the context of the PKI implementation. Training should be provided to personnel that are responsible for the management, operation, and administration of the PKI.","Responsible personnel receive training","Guidance","4.2.2.GY",{"$f":"IF(AND(CI56<>\"\",LEFT(CI56,1)<>\"#\"),IF(LEFT(CI56,1)=\"-\",REPLACE(CI56,1,1,tech!$H$2),CI56),\"\")","v":"The responsible personnel should be aware of the current policies and procedures that are related to the context of the PKI implementation. Training should be provided to personnel that are responsible for the management, operation, and administration of the PKI."},"|","- Contact information","Disclose PKI information","Guidance","4.3.2.GY",{"$f":"IF(AND(CO56<>\"\",LEFT(CO56,1)<>\"#\"),IF(LEFT(CO56,1)=\"-\",REPLACE(CO56,1,1,tech!$H$2),CO56),\"\")","v":"• Contact information"},"|"]
[null,null,"- Medium probability of operational issues","Advanced","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D57,tech!$A$13:$B$17,2,0),LEFT(E57,1),IF(G57=\"\",\"X\",\"Y\"))","v":"3AY"},{"$f":"IF(IF(LEFT(C57,1)=\"-\",C57,\"\")=\"\",\"\",REPLACE(IF(LEFT(C57,1)=\"-\",C57,\"\"),1,1,tech!$H$2))","v":"• Medium probability of operational issues"},"|","The scope of the PKI should be clearly defined and documented. The scope should be defined in terms of the use-cases that the PKI is going to support. Each use-case can have a different requirements and therefore different strategy. The use-cases should be defined in terms of the business drivers that are going to be supported by the PKI. Business drivers helps to document alignment with the overall organizational goals.","Scope and business drivers for PKI","Guidance","1.1.3.GY",{"$f":"IF(AND(I57<>\"\",LEFT(I57,1)<>\"#\"),IF(LEFT(I57,1)=\"-\",REPLACE(I57,1,1,tech!$H$2),I57),\"\")","v":"The scope of the PKI should be clearly defined and documented. The scope should be defined in terms of the use-cases that the PKI is going to support. Each use-case can have a different requirements and therefore different strategy. The use-cases should be defined in terms of the business drivers that are going to be supported by the PKI. Business drivers helps to document alignment with the overall organizational goals."},"|","- Publication and repository responsibilities","Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O57<>\"\",LEFT(O57,1)<>\"#\"),IF(LEFT(O57,1)=\"-\",REPLACE(O57,1,1,tech!$H$2),O57),\"\")","v":"• Publication and repository responsibilities"},"|",null,"A program to monitor compliance with the policies is established","Assessment","1.3.2.AX",{"$f":"IF(AND(U57<>\"\",LEFT(U57,1)<>\"#\"),IF(LEFT(U57,1)=\"-\",REPLACE(U57,1,1,tech!$H$2),U57),\"\")","v":""},"|",null,"Processes and procedures are formally documented and followed","References","1.4.2.RX",{"$f":"IF(AND(AA57<>\"\",LEFT(AA57,1)<>\"#\"),IF(LEFT(AA57,1)=\"-\",REPLACE(AA57,1,1,tech!$H$2),AA57),\"\")","v":""},"|","#### Assessment","Inventory of cryptographic keys is documented and maintained","Assessment","2.1.2.AX",{"$f":"IF(AND(AG57<>\"\",LEFT(AG57,1)<>\"#\"),IF(LEFT(AG57,1)=\"-\",REPLACE(AG57,1,1,tech!$H$2),AG57),\"\")","v":""},"|",null,"Certificate cipher suites are documented","Assessment","2.2.2.AX",{"$f":"IF(AND(AM57<>\"\",LEFT(AM57,1)<>\"#\"),IF(LEFT(AM57,1)=\"-\",REPLACE(AM57,1,1,tech!$H$2),AM57),\"\")","v":""},"|","- other technologies that restrict access to a particular segment of a network","Separation and segmentation principles are applied","Guidance","2.3.2.GY",{"$f":"IF(AND(AS57<>\"\",LEFT(AS57,1)<>\"#\"),IF(LEFT(AS57,1)=\"-\",REPLACE(AS57,1,1,tech!$H$2),AS57),\"\")","v":"• other technologies that restrict access to a particular segment of a network"},"|","- changes in the configuration of the PKI","Request for change structure is documented and followed","Guidance","2.4.2.GY",{"$f":"IF(AND(AY57<>\"\",LEFT(AY57,1)<>\"#\"),IF(LEFT(AY57,1)=\"-\",REPLACE(AY57,1,1,tech!$H$2),AY57),\"\")","v":"• changes in the configuration of the PKI"},"|","- Documented incident response test Results","Cyber-security management and incident planning","Assessment","3.1.2.AY",{"$f":"IF(AND(BE57<>\"\",LEFT(BE57,1)<>\"#\"),IF(LEFT(BE57,1)=\"-\",REPLACE(BE57,1,1,tech!$H$2),BE57),\"\")","v":"• Documented incident response test Results"},"|","#### Assessment","Documented integration guidance","Assessment","3.2.2.AX",{"$f":"IF(AND(BK57<>\"\",LEFT(BK57,1)<>\"#\"),IF(LEFT(BK57,1)=\"-\",REPLACE(BK57,1,1,tech!$H$2),BK57),\"\")","v":""},"|","- User Identification","Event logs from systems are collected","Guidance","3.3.2.GY",{"$f":"IF(AND(BQ57<>\"\",LEFT(BQ57,1)<>\"#\"),IF(LEFT(BQ57,1)=\"-\",REPLACE(BQ57,1,1,tech!$H$2),BQ57),\"\")","v":"• User Identification"},"|","Monitoring of automated processes should be supported by monitoring tools and technologies that can provide the necessary overview, reporting, and potential alerting in case of issues.","Monitoring and auditing of automated process","Assessment","3.4.2.AY",{"$f":"IF(AND(BW57<>\"\",LEFT(BW57,1)<>\"#\"),IF(LEFT(BW57,1)=\"-\",REPLACE(BW57,1,1,tech!$H$2),BW57),\"\")","v":"Monitoring of automated processes should be supported by monitoring tools and technologies that can provide the necessary overview, reporting, and potential alerting in case of issues."},"|",null,"Resources are clearly defined","Assessment","4.1.2.AX",{"$f":"IF(AND(CC57<>\"\",LEFT(CC57,1)<>\"#\"),IF(LEFT(CC57,1)=\"-\",REPLACE(CC57,1,1,tech!$H$2),CC57),\"\")","v":""},"|",null,"Responsible personnel receive training","Guidance","4.2.2.GY",{"$f":"IF(AND(CI57<>\"\",LEFT(CI57,1)<>\"#\"),IF(LEFT(CI57,1)=\"-\",REPLACE(CI57,1,1,tech!$H$2),CI57),\"\")","v":""},"|","- Obligations of the PKI participants","Disclose PKI information","Guidance","4.3.2.GY",{"$f":"IF(AND(CO57<>\"\",LEFT(CO57,1)<>\"#\"),IF(LEFT(CO57,1)=\"-\",REPLACE(CO57,1,1,tech!$H$2),CO57),\"\")","v":"• Obligations of the PKI participants"},"|"]
[null,null,"- Low probability of compromise",{"$f":"IF(AND(LEFT(C58,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(C58,\" \"))=2,0)),_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(C58,\" \"),\" \"),D57)","v":"Advanced"},"Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D58,tech!$A$13:$B$17,2,0),LEFT(E58,1),IF(G58=\"\",\"X\",\"Y\"))","v":"3AY"},{"$f":"IF(IF(LEFT(C58,1)=\"-\",C58,\"\")=\"\",\"\",REPLACE(IF(LEFT(C58,1)=\"-\",C58,\"\"),1,1,tech!$H$2))","v":"• Low probability of compromise"},"|",null,"Scope and business drivers for PKI","Guidance","1.1.3.GY",{"$f":"IF(AND(I58<>\"\",LEFT(I58,1)<>\"#\"),IF(LEFT(I58,1)=\"-\",REPLACE(I58,1,1,tech!$H$2),I58),\"\")","v":""},"|","- Identification and authentication","Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O58<>\"\",LEFT(O58,1)<>\"#\"),IF(LEFT(O58,1)=\"-\",REPLACE(O58,1,1,tech!$H$2),O58),\"\")","v":"• Identification and authentication"},"|","- Documented practices regarding periodic and aperiodic compliance assessments","A program to monitor compliance with the policies is established","Assessment","1.3.2.AY",{"$f":"IF(AND(U58<>\"\",LEFT(U58,1)<>\"#\"),IF(LEFT(U58,1)=\"-\",REPLACE(U58,1,1,tech!$H$2),U58),\"\")","v":"• Documented practices regarding periodic and aperiodic compliance assessments"},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Processes and procedures are formally documented and followed","References","1.4.2.RY",{"$f":"IF(AND(AA58<>\"\",LEFT(AA58,1)<>\"#\"),IF(LEFT(AA58,1)=\"-\",REPLACE(AA58,1,1,tech!$H$2),AA58),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|",null,"Inventory of cryptographic keys is documented and maintained","Assessment","2.1.2.AX",{"$f":"IF(AND(AG58<>\"\",LEFT(AG58,1)<>\"#\"),IF(LEFT(AG58,1)=\"-\",REPLACE(AG58,1,1,tech!$H$2),AG58),\"\")","v":""},"|","* Determine the scope of applicability","Certificate cipher suites are documented","Assessment","2.2.2.AY",{"$f":"IF(AND(AM58<>\"\",LEFT(AM58,1)<>\"#\"),IF(LEFT(AM58,1)=\"-\",REPLACE(AM58,1,1,tech!$H$2),AM58),\"\")","v":"* Determine the scope of applicability"},"|",null,"Separation and segmentation principles are applied","Guidance","2.3.2.GY",{"$f":"IF(AND(AS58<>\"\",LEFT(AS58,1)<>\"#\"),IF(LEFT(AS58,1)=\"-\",REPLACE(AS58,1,1,tech!$H$2),AS58),\"\")","v":""},"|","- changes in the algorithms and protocols","Request for change structure is documented and followed","Guidance","2.4.2.GY",{"$f":"IF(AND(AY58<>\"\",LEFT(AY58,1)<>\"#\"),IF(LEFT(AY58,1)=\"-\",REPLACE(AY58,1,1,tech!$H$2),AY58),\"\")","v":"• changes in the algorithms and protocols"},"|","- Monitoring of cyber-Security threats","Cyber-security management and incident planning","Assessment","3.1.2.AY",{"$f":"IF(AND(BE58<>\"\",LEFT(BE58,1)<>\"#\"),IF(LEFT(BE58,1)=\"-\",REPLACE(BE58,1,1,tech!$H$2),BE58),\"\")","v":"• Monitoring of cyber-Security threats"},"|",null,"Documented integration guidance","Assessment","3.2.2.AX",{"$f":"IF(AND(BK58<>\"\",LEFT(BK58,1)<>\"#\"),IF(LEFT(BK58,1)=\"-\",REPLACE(BK58,1,1,tech!$H$2),BK58),\"\")","v":""},"|","- Type of event","Event logs from systems are collected","Guidance","3.3.2.GY",{"$f":"IF(AND(BQ58<>\"\",LEFT(BQ58,1)<>\"#\"),IF(LEFT(BQ58,1)=\"-\",REPLACE(BQ58,1,1,tech!$H$2),BQ58),\"\")","v":"• Type of event"},"|","The following is sample evidence that can be used to assess the requirement:","Monitoring and auditing of automated process","Assessment","3.4.2.AY",{"$f":"IF(AND(BW58<>\"\",LEFT(BW58,1)<>\"#\"),IF(LEFT(BW58,1)=\"-\",REPLACE(BW58,1,1,tech!$H$2),BW58),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|","#### References","Resources are clearly defined","References","4.1.2.RX",{"$f":"IF(AND(CC58<>\"\",LEFT(CC58,1)<>\"#\"),IF(LEFT(CC58,1)=\"-\",REPLACE(CC58,1,1,tech!$H$2),CC58),\"\")","v":""},"|","Training is provided in accordance with the current and approved training plan.","Responsible personnel receive training","Guidance","4.2.2.GY",{"$f":"IF(AND(CI58<>\"\",LEFT(CI58,1)<>\"#\"),IF(LEFT(CI58,1)=\"-\",REPLACE(CI58,1,1,tech!$H$2),CI58),\"\")","v":"Training is provided in accordance with the current and approved training plan."},"|","- Legal liability of the PKI participants","Disclose PKI information","Guidance","4.3.2.GY",{"$f":"IF(AND(CO58<>\"\",LEFT(CO58,1)<>\"#\"),IF(LEFT(CO58,1)=\"-\",REPLACE(CO58,1,1,tech!$H$2),CO58),\"\")","v":"• Legal liability of the PKI participants"},"|"]
[{"$nulls":3},"Advanced","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D59,tech!$A$13:$B$17,2,0),LEFT(E59,1),IF(G59=\"\",\"X\",\"Y\"))","v":"3AX"},{"$f":"IF(IF(LEFT(C59,1)=\"-\",C59,\"\")=\"\",\"\",REPLACE(IF(LEFT(C59,1)=\"-\",C59,\"\"),1,1,tech!$H$2))","v":""},"|","The scope and business drivers can be considered as a formal high-level overview of the PKI strategy and vision.","Scope and business drivers for PKI","Guidance","1.1.3.GY",{"$f":"IF(AND(I59<>\"\",LEFT(I59,1)<>\"#\"),IF(LEFT(I59,1)=\"-\",REPLACE(I59,1,1,tech!$H$2),I59),\"\")","v":"The scope and business drivers can be considered as a formal high-level overview of the PKI strategy and vision."},"|","- certificate life-cycle operational requirements","Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O59<>\"\",LEFT(O59,1)<>\"#\"),IF(LEFT(O59,1)=\"-\",REPLACE(O59,1,1,tech!$H$2),O59),\"\")","v":"• certificate life-cycle operational requirements"},"|","- Documented practices for regularly review and reporting of security issues","A program to monitor compliance with the policies is established","Assessment","1.3.2.AY",{"$f":"IF(AND(U59<>\"\",LEFT(U59,1)<>\"#\"),IF(LEFT(U59,1)=\"-\",REPLACE(U59,1,1,tech!$H$2),U59),\"\")","v":"• Documented practices for regularly review and reporting of security issues"},"|","- [ENISA Publications](https://www.enisa.europa.eu/publications)","Processes and procedures are formally documented and followed","References","1.4.2.RY",{"$f":"IF(AND(AA59<>\"\",LEFT(AA59,1)<>\"#\"),IF(LEFT(AA59,1)=\"-\",REPLACE(AA59,1,1,tech!$H$2),AA59),\"\")","v":"• [ENISA Publications](https://www.enisa.europa.eu/publications)"},"|","- Documented inventory of cryptographic keys","Inventory of cryptographic keys is documented and maintained","Assessment","2.1.2.AY",{"$f":"IF(AND(AG59<>\"\",LEFT(AG59,1)<>\"#\"),IF(LEFT(AG59,1)=\"-\",REPLACE(AG59,1,1,tech!$H$2),AG59),\"\")","v":"• Documented inventory of cryptographic keys"},"|","* Documented and approved cipher suites with rationale for inclusion of algorithms","Certificate cipher suites are documented","Assessment","2.2.2.AY",{"$f":"IF(AND(AM59<>\"\",LEFT(AM59,1)<>\"#\"),IF(LEFT(AM59,1)=\"-\",REPLACE(AM59,1,1,tech!$H$2),AM59),\"\")","v":"* Documented and approved cipher suites with rationale for inclusion of algorithms"},"|","For the proper maintenance of the infrastructure and deployed PKI components, the staging/testing environment should be available in the same configuration as the production environment. If needed, development environments can be used for testing and development purposes.","Separation and segmentation principles are applied","Guidance","2.3.2.GY",{"$f":"IF(AND(AS59<>\"\",LEFT(AS59,1)<>\"#\"),IF(LEFT(AS59,1)=\"-\",REPLACE(AS59,1,1,tech!$H$2),AS59),\"\")","v":"For the proper maintenance of the infrastructure and deployed PKI components, the staging/testing environment should be available in the same configuration as the production environment. If needed, development environments can be used for testing and development purposes."},"|",null,"Request for change structure is documented and followed","Guidance","2.4.2.GY",{"$f":"IF(AND(AY59<>\"\",LEFT(AY59,1)<>\"#\"),IF(LEFT(AY59,1)=\"-\",REPLACE(AY59,1,1,tech!$H$2),AY59),\"\")","v":""},"|","- Interview with the Security operations team","Cyber-security management and incident planning","Assessment","3.1.2.AY",{"$f":"IF(AND(BE59<>\"\",LEFT(BE59,1)<>\"#\"),IF(LEFT(BE59,1)=\"-\",REPLACE(BE59,1,1,tech!$H$2),BE59),\"\")","v":"• Interview with the Security operations team"},"|","The following evidence should be available for the assessment of the requirement:","Documented integration guidance","Assessment","3.2.2.AY",{"$f":"IF(AND(BK59<>\"\",LEFT(BK59,1)<>\"#\"),IF(LEFT(BK59,1)=\"-\",REPLACE(BK59,1,1,tech!$H$2),BK59),\"\")","v":"The following evidence should be available for the assessment of the requirement:"},"|","- Date and time","Event logs from systems are collected","Guidance","3.3.2.GY",{"$f":"IF(AND(BQ59<>\"\",LEFT(BQ59,1)<>\"#\"),IF(LEFT(BQ59,1)=\"-\",REPLACE(BQ59,1,1,tech!$H$2),BQ59),\"\")","v":"• Date and time"},"|","- Documented Monitoring and auditing measures","Monitoring and auditing of automated process","Assessment","3.4.2.AY",{"$f":"IF(AND(BW59<>\"\",LEFT(BW59,1)<>\"#\"),IF(LEFT(BW59,1)=\"-\",REPLACE(BW59,1,1,tech!$H$2),BW59),\"\")","v":"• Documented Monitoring and auditing measures"},"|",null,"Resources are clearly defined","References","4.1.2.RX",{"$f":"IF(AND(CC59<>\"\",LEFT(CC59,1)<>\"#\"),IF(LEFT(CC59,1)=\"-\",REPLACE(CC59,1,1,tech!$H$2),CC59),\"\")","v":""},"|",null,"Responsible personnel receive training","Guidance","4.2.2.GY",{"$f":"IF(AND(CI59<>\"\",LEFT(CI59,1)<>\"#\"),IF(LEFT(CI59,1)=\"-\",REPLACE(CI59,1,1,tech!$H$2),CI59),\"\")","v":""},"|","- Warranty information","Disclose PKI information","Guidance","4.3.2.GY",{"$f":"IF(AND(CO59<>\"\",LEFT(CO59,1)<>\"#\"),IF(LEFT(CO59,1)=\"-\",REPLACE(CO59,1,1,tech!$H$2),CO59),\"\")","v":"• Warranty information"},"|"]
[null,null,"## Managed maturity level","Managed",{"$f":"IF(AND(LEFT(C60,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(C60,\" \"))=3,0)),_xlfn.TEXTAFTER(C60,\" \"),E59)","v":"Associated risks"},{"$f":"_xlfn.CONCAT(VLOOKUP(D60,tech!$A$13:$B$17,2,0),LEFT(E60,1),IF(G60=\"\",\"X\",\"Y\"))","v":"4AX"},{"$f":"IF(IF(LEFT(C60,1)=\"-\",C60,\"\")=\"\",\"\",REPLACE(IF(LEFT(C60,1)=\"-\",C60,\"\"),1,1,tech!$H$2))","v":""},"|","Its purpose is also to create a common understanding of the organizational PKI and to provide direction for the detailed design and implementation.","Scope and business drivers for PKI","Guidance","1.1.3.GY",{"$f":"IF(AND(I60<>\"\",LEFT(I60,1)<>\"#\"),IF(LEFT(I60,1)=\"-\",REPLACE(I60,1,1,tech!$H$2),I60),\"\")","v":"Its purpose is also to create a common understanding of the organizational PKI and to provide direction for the detailed design and implementation."},"|","- Facility management and operational controls","Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O60<>\"\",LEFT(O60,1)<>\"#\"),IF(LEFT(O60,1)=\"-\",REPLACE(O60,1,1,tech!$H$2),O60),\"\")","v":"• Facility management and operational controls"},"|","- Documented and implemented processes for investigation and response to suspicious activities","A program to monitor compliance with the policies is established","Assessment","1.3.2.AY",{"$f":"IF(AND(U60<>\"\",LEFT(U60,1)<>\"#\"),IF(LEFT(U60,1)=\"-\",REPLACE(U60,1,1,tech!$H$2),U60),\"\")","v":"• Documented and implemented processes for investigation and response to suspicious activities"},"|",null,"Processes and procedures are formally documented and followed","References","1.4.2.RX",{"$f":"IF(AND(AA60<>\"\",LEFT(AA60,1)<>\"#\"),IF(LEFT(AA60,1)=\"-\",REPLACE(AA60,1,1,tech!$H$2),AA60),\"\")","v":""},"|","- Accuracy and consistency","Inventory of cryptographic keys is documented and maintained","Assessment","2.1.2.AY",{"$f":"IF(AND(AG60<>\"\",LEFT(AG60,1)<>\"#\"),IF(LEFT(AG60,1)=\"-\",REPLACE(AG60,1,1,tech!$H$2),AG60),\"\")","v":"• Accuracy and consistency"},"|","* Documented agile path for migration to other algorithms when needed","Certificate cipher suites are documented","Assessment","2.2.2.AY",{"$f":"IF(AND(AM60<>\"\",LEFT(AM60,1)<>\"#\"),IF(LEFT(AM60,1)=\"-\",REPLACE(AM60,1,1,tech!$H$2),AM60),\"\")","v":"* Documented agile path for migration to other algorithms when needed"},"|","Production, staging, and development environments should be logically separated and isolated from each other, including the data that is used in the environments.","Separation and segmentation principles are applied","Guidance","2.3.2.GY",{"$f":"IF(AND(AS60<>\"\",LEFT(AS60,1)<>\"#\"),IF(LEFT(AS60,1)=\"-\",REPLACE(AS60,1,1,tech!$H$2),AS60),\"\")","v":"Production, staging, and development environments should be logically separated and isolated from each other, including the data that is used in the environments."},"|","Request for change structure should cover the following information:","Request for change structure is documented and followed","Guidance","2.4.2.GY",{"$f":"IF(AND(AY60<>\"\",LEFT(AY60,1)<>\"#\"),IF(LEFT(AY60,1)=\"-\",REPLACE(AY60,1,1,tech!$H$2),AY60),\"\")","v":"Request for change structure should cover the following information:"},"|",null,"Cyber-security management and incident planning","Assessment","3.1.2.AX",{"$f":"IF(AND(BE60<>\"\",LEFT(BE60,1)<>\"#\"),IF(LEFT(BE60,1)=\"-\",REPLACE(BE60,1,1,tech!$H$2),BE60),\"\")","v":""},"|","- Documented Integration guidance for all critical PKI components","Documented integration guidance","Assessment","3.2.2.AY",{"$f":"IF(AND(BK60<>\"\",LEFT(BK60,1)<>\"#\"),IF(LEFT(BK60,1)=\"-\",REPLACE(BK60,1,1,tech!$H$2),BK60),\"\")","v":"• Documented Integration guidance for all critical PKI components"},"|","- Success or failure indication","Event logs from systems are collected","Guidance","3.3.2.GY",{"$f":"IF(AND(BQ60<>\"\",LEFT(BQ60,1)<>\"#\"),IF(LEFT(BQ60,1)=\"-\",REPLACE(BQ60,1,1,tech!$H$2),BQ60),\"\")","v":"• Success or failure indication"},"|","- Monitoring and auditing Tools and technologies applied","Monitoring and auditing of automated process","Assessment","3.4.2.AY",{"$f":"IF(AND(BW60<>\"\",LEFT(BW60,1)<>\"#\"),IF(LEFT(BW60,1)=\"-\",REPLACE(BW60,1,1,tech!$H$2),BW60),\"\")","v":"• Monitoring and auditing Tools and technologies applied"},"|","- [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)","Resources are clearly defined","References","4.1.2.RY",{"$f":"IF(AND(CC60<>\"\",LEFT(CC60,1)<>\"#\"),IF(LEFT(CC60,1)=\"-\",REPLACE(CC60,1,1,tech!$H$2),CC60),\"\")","v":"• [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)"},"|","Methods and training content can vary, depending on personnel roles and covers:","Responsible personnel receive training","Guidance","4.2.2.GY",{"$f":"IF(AND(CI60<>\"\",LEFT(CI60,1)<>\"#\"),IF(LEFT(CI60,1)=\"-\",REPLACE(CI60,1,1,tech!$H$2),CI60),\"\")","v":"Methods and training content can vary, depending on personnel roles and covers:"},"|","- Disclaimer information","Disclose PKI information","Guidance","4.3.2.GY",{"$f":"IF(AND(CO60<>\"\",LEFT(CO60,1)<>\"#\"),IF(LEFT(CO60,1)=\"-\",REPLACE(CO60,1,1,tech!$H$2),CO60),\"\")","v":"• Disclaimer information"},"|"]
[{"$nulls":3},"Managed","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D61,tech!$A$13:$B$17,2,0),LEFT(E61,1),IF(G61=\"\",\"X\",\"Y\"))","v":"4AX"},{"$f":"IF(IF(LEFT(C61,1)=\"-\",C61,\"\")=\"\",\"\",REPLACE(IF(LEFT(C61,1)=\"-\",C61,\"\"),1,1,tech!$H$2))","v":""},"|","The target audience consists typically of architects, experts, advisors, management, and sponsors.","Scope and business drivers for PKI","Guidance","1.1.3.GY",{"$f":"IF(AND(I61<>\"\",LEFT(I61,1)<>\"#\"),IF(LEFT(I61,1)=\"-\",REPLACE(I61,1,1,tech!$H$2),I61),\"\")","v":"The target audience consists typically of architects, experts, advisors, management, and sponsors."},"|","- technical Security controls","Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O61<>\"\",LEFT(O61,1)<>\"#\"),IF(LEFT(O61,1)=\"-\",REPLACE(O61,1,1,tech!$H$2),O61),\"\")","v":"• technical Security controls"},"|",null,"A program to monitor compliance with the policies is established","Assessment","1.3.2.AX",{"$f":"IF(AND(U61<>\"\",LEFT(U61,1)<>\"#\"),IF(LEFT(U61,1)=\"-\",REPLACE(U61,1,1,tech!$H$2),U61),\"\")","v":""},"|","### Recurring activities are executed on time","Recurring activities are executed on time","References","1.4.3.RX",{"$f":"IF(AND(AA61<>\"\",LEFT(AA61,1)<>\"#\"),IF(LEFT(AA61,1)=\"-\",REPLACE(AA61,1,1,tech!$H$2),AA61),\"\")","v":""},"|","- Completeness of inventory","Inventory of cryptographic keys is documented and maintained","Assessment","2.1.2.AY",{"$f":"IF(AND(AG61<>\"\",LEFT(AG61,1)<>\"#\"),IF(LEFT(AG61,1)=\"-\",REPLACE(AG61,1,1,tech!$H$2),AG61),\"\")","v":"• Completeness of inventory"},"|","* Cipher suites are enforced by certification authority","Certificate cipher suites are documented","Assessment","2.2.2.AY",{"$f":"IF(AND(AM61<>\"\",LEFT(AM61,1)<>\"#\"),IF(LEFT(AM61,1)=\"-\",REPLACE(AM61,1,1,tech!$H$2),AM61),\"\")","v":"* Cipher suites are enforced by certification authority"},"|",null,"Separation and segmentation principles are applied","Guidance","2.3.2.GX",{"$f":"IF(AND(AS61<>\"\",LEFT(AS61,1)<>\"#\"),IF(LEFT(AS61,1)=\"-\",REPLACE(AS61,1,1,tech!$H$2),AS61),\"\")","v":""},"|","- description of the change","Request for change structure is documented and followed","Guidance","2.4.2.GY",{"$f":"IF(AND(AY61<>\"\",LEFT(AY61,1)<>\"#\"),IF(LEFT(AY61,1)=\"-\",REPLACE(AY61,1,1,tech!$H$2),AY61),\"\")","v":"• description of the change"},"|","#### References","Cyber-security management and incident planning","References","3.1.2.RX",{"$f":"IF(AND(BE61<>\"\",LEFT(BE61,1)<>\"#\"),IF(LEFT(BE61,1)=\"-\",REPLACE(BE61,1,1,tech!$H$2),BE61),\"\")","v":""},"|","- Interview with the system administrators and developers","Documented integration guidance","Assessment","3.2.2.AY",{"$f":"IF(AND(BK61<>\"\",LEFT(BK61,1)<>\"#\"),IF(LEFT(BK61,1)=\"-\",REPLACE(BK61,1,1,tech!$H$2),BK61),\"\")","v":"• Interview with the system administrators and developers"},"|","- Origination of event","Event logs from systems are collected","Guidance","3.3.2.GY",{"$f":"IF(AND(BQ61<>\"\",LEFT(BQ61,1)<>\"#\"),IF(LEFT(BQ61,1)=\"-\",REPLACE(BQ61,1,1,tech!$H$2),BQ61),\"\")","v":"• Origination of event"},"|","- Sample report or dashboard from Monitoring","Monitoring and auditing of automated process","Assessment","3.4.2.AY",{"$f":"IF(AND(BW61<>\"\",LEFT(BW61,1)<>\"#\"),IF(LEFT(BW61,1)=\"-\",REPLACE(BW61,1,1,tech!$H$2),BW61),\"\")","v":"• Sample report or dashboard from Monitoring"},"|",null,"Resources are clearly defined","References","4.1.2.RX",{"$f":"IF(AND(CC61<>\"\",LEFT(CC61,1)<>\"#\"),IF(LEFT(CC61,1)=\"-\",REPLACE(CC61,1,1,tech!$H$2),CC61),\"\")","v":""},"|","- New hires as part of the Onboarding process","Responsible personnel receive training","Guidance","4.2.2.GY",{"$f":"IF(AND(CI61<>\"\",LEFT(CI61,1)<>\"#\"),IF(LEFT(CI61,1)=\"-\",REPLACE(CI61,1,1,tech!$H$2),CI61),\"\")","v":"• New hires as part of the Onboarding process"},"|","- Privacy and data protection information","Disclose PKI information","Guidance","4.3.2.GY",{"$f":"IF(AND(CO61<>\"\",LEFT(CO61,1)<>\"#\"),IF(LEFT(CO61,1)=\"-\",REPLACE(CO61,1,1,tech!$H$2),CO61),\"\")","v":"• Privacy and data protection information"},"|"]
[null,null,"### Indicators","Managed","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D62,tech!$A$13:$B$17,2,0),LEFT(E62,1),IF(G62=\"\",\"X\",\"Y\"))","v":"4IX"},{"$f":"IF(IF(LEFT(C62,1)=\"-\",C62,\"\")=\"\",\"\",REPLACE(IF(LEFT(C62,1)=\"-\",C62,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Scope and business drivers for PKI","Guidance","1.1.3.GX",{"$f":"IF(AND(I62<>\"\",LEFT(I62,1)<>\"#\"),IF(LEFT(I62,1)=\"-\",REPLACE(I62,1,1,tech!$H$2),I62),\"\")","v":""},"|","- Certificate, CRL, and OCSP profiles","Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O62<>\"\",LEFT(O62,1)<>\"#\"),IF(LEFT(O62,1)=\"-\",REPLACE(O62,1,1,tech!$H$2),O62),\"\")","v":"• Certificate, CRL, and OCSP profiles"},"|","#### References","A program to monitor compliance with the policies is established","References","1.3.2.RX",{"$f":"IF(AND(U62<>\"\",LEFT(U62,1)<>\"#\"),IF(LEFT(U62,1)=\"-\",REPLACE(U62,1,1,tech!$H$2),U62),\"\")","v":""},"|",null,"Recurring activities are executed on time","References","1.4.3.RX",{"$f":"IF(AND(AA62<>\"\",LEFT(AA62,1)<>\"#\"),IF(LEFT(AA62,1)=\"-\",REPLACE(AA62,1,1,tech!$H$2),AA62),\"\")","v":""},"|","- Validation of cryptographic key records","Inventory of cryptographic keys is documented and maintained","Assessment","2.1.2.AY",{"$f":"IF(AND(AG62<>\"\",LEFT(AG62,1)<>\"#\"),IF(LEFT(AG62,1)=\"-\",REPLACE(AG62,1,1,tech!$H$2),AG62),\"\")","v":"• Validation of cryptographic key records"},"|",null,"Certificate cipher suites are documented","Assessment","2.2.2.AX",{"$f":"IF(AND(AM62<>\"\",LEFT(AM62,1)<>\"#\"),IF(LEFT(AM62,1)=\"-\",REPLACE(AM62,1,1,tech!$H$2),AM62),\"\")","v":""},"|","#### Assessment","Separation and segmentation principles are applied","Assessment","2.3.2.AX",{"$f":"IF(AND(AS62<>\"\",LEFT(AS62,1)<>\"#\"),IF(LEFT(AS62,1)=\"-\",REPLACE(AS62,1,1,tech!$H$2),AS62),\"\")","v":""},"|","- Scope of the change","Request for change structure is documented and followed","Guidance","2.4.2.GY",{"$f":"IF(AND(AY62<>\"\",LEFT(AY62,1)<>\"#\"),IF(LEFT(AY62,1)=\"-\",REPLACE(AY62,1,1,tech!$H$2),AY62),\"\")","v":"• Scope of the change"},"|",null,"Cyber-security management and incident planning","References","3.1.2.RX",{"$f":"IF(AND(BE62<>\"\",LEFT(BE62,1)<>\"#\"),IF(LEFT(BE62,1)=\"-\",REPLACE(BE62,1,1,tech!$H$2),BE62),\"\")","v":""},"|","- Review of the Integration guidance","Documented integration guidance","Assessment","3.2.2.AY",{"$f":"IF(AND(BK62<>\"\",LEFT(BK62,1)<>\"#\"),IF(LEFT(BK62,1)=\"-\",REPLACE(BK62,1,1,tech!$H$2),BK62),\"\")","v":"• Review of the Integration guidance"},"|","- Identity or name of affected data, system component, or resource","Event logs from systems are collected","Guidance","3.3.2.GY",{"$f":"IF(AND(BQ62<>\"\",LEFT(BQ62,1)<>\"#\"),IF(LEFT(BQ62,1)=\"-\",REPLACE(BQ62,1,1,tech!$H$2),BQ62),\"\")","v":"• Identity or name of affected data, system component, or resource"},"|","- Interview with responsible personnel","Monitoring and auditing of automated process","Assessment","3.4.2.AY",{"$f":"IF(AND(BW62<>\"\",LEFT(BW62,1)<>\"#\"),IF(LEFT(BW62,1)=\"-\",REPLACE(BW62,1,1,tech!$H$2),BW62),\"\")","v":"• Interview with responsible personnel"},"|","### Availability of resources","Availability of resources","References","4.1.3.RX",{"$f":"IF(AND(CC62<>\"\",LEFT(CC62,1)<>\"#\"),IF(LEFT(CC62,1)=\"-\",REPLACE(CC62,1,1,tech!$H$2),CC62),\"\")","v":""},"|","- Periodic Training for all personnel (the frequency of the Training depends on the Role and responsibilities)","Responsible personnel receive training","Guidance","4.2.2.GY",{"$f":"IF(AND(CI62<>\"\",LEFT(CI62,1)<>\"#\"),IF(LEFT(CI62,1)=\"-\",REPLACE(CI62,1,1,tech!$H$2),CI62),\"\")","v":"• Periodic Training for all personnel (the frequency of the Training depends on the Role and responsibilities)"},"|","- Other relevant information","Disclose PKI information","Guidance","4.3.2.GY",{"$f":"IF(AND(CO62<>\"\",LEFT(CO62,1)<>\"#\"),IF(LEFT(CO62,1)=\"-\",REPLACE(CO62,1,1,tech!$H$2),CO62),\"\")","v":"• Other relevant information"},"|"]
[{"$nulls":3},"Managed","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D63,tech!$A$13:$B$17,2,0),LEFT(E63,1),IF(G63=\"\",\"X\",\"Y\"))","v":"4IX"},{"$f":"IF(IF(LEFT(C63,1)=\"-\",C63,\"\")=\"\",\"\",REPLACE(IF(LEFT(C63,1)=\"-\",C63,\"\"),1,1,tech!$H$2))","v":""},"|","#### Assessment","Scope and business drivers for PKI","Assessment","1.1.3.AX",{"$f":"IF(AND(I63<>\"\",LEFT(I63,1)<>\"#\"),IF(LEFT(I63,1)=\"-\",REPLACE(I63,1,1,tech!$H$2),I63),\"\")","v":""},"|","- compliance audit and other assessments","Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O63<>\"\",LEFT(O63,1)<>\"#\"),IF(LEFT(O63,1)=\"-\",REPLACE(O63,1,1,tech!$H$2),O63),\"\")","v":"• compliance audit and other assessments"},"|",null,"A program to monitor compliance with the policies is established","References","1.3.2.RX",{"$f":"IF(AND(U63<>\"\",LEFT(U63,1)<>\"#\"),IF(LEFT(U63,1)=\"-\",REPLACE(U63,1,1,tech!$H$2),U63),\"\")","v":""},"|","#### Guidance","Recurring activities are executed on time","Guidance","1.4.3.GX",{"$f":"IF(AND(AA63<>\"\",LEFT(AA63,1)<>\"#\"),IF(LEFT(AA63,1)=\"-\",REPLACE(AA63,1,1,tech!$H$2),AA63),\"\")","v":""},"|",null,"Inventory of cryptographic keys is documented and maintained","Assessment","2.1.2.AX",{"$f":"IF(AND(AG63<>\"\",LEFT(AG63,1)<>\"#\"),IF(LEFT(AG63,1)=\"-\",REPLACE(AG63,1,1,tech!$H$2),AG63),\"\")","v":""},"|","#### References","Certificate cipher suites are documented","References","2.2.2.RX",{"$f":"IF(AND(AM63<>\"\",LEFT(AM63,1)<>\"#\"),IF(LEFT(AM63,1)=\"-\",REPLACE(AM63,1,1,tech!$H$2),AM63),\"\")","v":""},"|",null,"Separation and segmentation principles are applied","Assessment","2.3.2.AX",{"$f":"IF(AND(AS63<>\"\",LEFT(AS63,1)<>\"#\"),IF(LEFT(AS63,1)=\"-\",REPLACE(AS63,1,1,tech!$H$2),AS63),\"\")","v":""},"|","- Category of the change","Request for change structure is documented and followed","Guidance","2.4.2.GY",{"$f":"IF(AND(AY63<>\"\",LEFT(AY63,1)<>\"#\"),IF(LEFT(AY63,1)=\"-\",REPLACE(AY63,1,1,tech!$H$2),AY63),\"\")","v":"• Category of the change"},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Cyber-security management and incident planning","References","3.1.2.RY",{"$f":"IF(AND(BE63<>\"\",LEFT(BE63,1)<>\"#\"),IF(LEFT(BE63,1)=\"-\",REPLACE(BE63,1,1,tech!$H$2),BE63),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|","- system configuration Review","Documented integration guidance","Assessment","3.2.2.AY",{"$f":"IF(AND(BK63<>\"\",LEFT(BK63,1)<>\"#\"),IF(LEFT(BK63,1)=\"-\",REPLACE(BK63,1,1,tech!$H$2),BK63),\"\")","v":"• system configuration Review"},"|","- Additional details","Event logs from systems are collected","Guidance","3.3.2.GY",{"$f":"IF(AND(BQ63<>\"\",LEFT(BQ63,1)<>\"#\"),IF(LEFT(BQ63,1)=\"-\",REPLACE(BQ63,1,1,tech!$H$2),BQ63),\"\")","v":"• Additional details"},"|","- Simulate failure of the automated certificate management process and verify that the failure is detected and reported","Monitoring and auditing of automated process","Assessment","3.4.2.AY",{"$f":"IF(AND(BW63<>\"\",LEFT(BW63,1)<>\"#\"),IF(LEFT(BW63,1)=\"-\",REPLACE(BW63,1,1,tech!$H$2),BW63),\"\")","v":"• Simulate failure of the automated certificate management process and verify that the failure is detected and reported"},"|",null,"Availability of resources","References","4.1.3.RX",{"$f":"IF(AND(CC63<>\"\",LEFT(CC63,1)<>\"#\"),IF(LEFT(CC63,1)=\"-\",REPLACE(CC63,1,1,tech!$H$2),CC63),\"\")","v":""},"|",null,"Responsible personnel receive training","Guidance","4.2.2.GY",{"$f":"IF(AND(CI63<>\"\",LEFT(CI63,1)<>\"#\"),IF(LEFT(CI63,1)=\"-\",REPLACE(CI63,1,1,tech!$H$2),CI63),\"\")","v":""},"|",null,"Disclose PKI information","Guidance","4.3.2.GX",{"$f":"IF(AND(CO63<>\"\",LEFT(CO63,1)<>\"#\"),IF(LEFT(CO63,1)=\"-\",REPLACE(CO63,1,1,tech!$H$2),CO63),\"\")","v":""},"|"]
[null,null,"- PKI is consistently managed","Managed","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D64,tech!$A$13:$B$17,2,0),LEFT(E64,1),IF(G64=\"\",\"X\",\"Y\"))","v":"4IY"},{"$f":"IF(IF(LEFT(C64,1)=\"-\",C64,\"\")=\"\",\"\",REPLACE(IF(LEFT(C64,1)=\"-\",C64,\"\"),1,1,tech!$H$2))","v":"• PKI is consistently managed"},"|",null,"Scope and business drivers for PKI","Assessment","1.1.3.AX",{"$f":"IF(AND(I64<>\"\",LEFT(I64,1)<>\"#\"),IF(LEFT(I64,1)=\"-\",REPLACE(I64,1,1,tech!$H$2),I64),\"\")","v":""},"|","- other business and legal matters","Certificate policy is documented and published","Guidance","1.2.2.GY",{"$f":"IF(AND(O64<>\"\",LEFT(O64,1)<>\"#\"),IF(LEFT(O64,1)=\"-\",REPLACE(O64,1,1,tech!$H$2),O64),\"\")","v":"• other business and legal matters"},"|","- [ISO 37301 - Compliance management systems and related standard](https://www.iso.org/standard/75080.html)","A program to monitor compliance with the policies is established","References","1.3.2.RY",{"$f":"IF(AND(U64<>\"\",LEFT(U64,1)<>\"#\"),IF(LEFT(U64,1)=\"-\",REPLACE(U64,1,1,tech!$H$2),U64),\"\")","v":"• [ISO 37301 - Compliance management systems and related standard](https://www.iso.org/standard/75080.html)"},"|",null,"Recurring activities are executed on time","Guidance","1.4.3.GX",{"$f":"IF(AND(AA64<>\"\",LEFT(AA64,1)<>\"#\"),IF(LEFT(AA64,1)=\"-\",REPLACE(AA64,1,1,tech!$H$2),AA64),\"\")","v":""},"|","#### References","Inventory of cryptographic keys is documented and maintained","References","2.1.2.RX",{"$f":"IF(AND(AG64<>\"\",LEFT(AG64,1)<>\"#\"),IF(LEFT(AG64,1)=\"-\",REPLACE(AG64,1,1,tech!$H$2),AG64),\"\")","v":""},"|",null,"Certificate cipher suites are documented","References","2.2.2.RX",{"$f":"IF(AND(AM64<>\"\",LEFT(AM64,1)<>\"#\"),IF(LEFT(AM64,1)=\"-\",REPLACE(AM64,1,1,tech!$H$2),AM64),\"\")","v":""},"|","The following is sample evidence that can be used to assess the requirement:","Separation and segmentation principles are applied","Assessment","2.3.2.AY",{"$f":"IF(AND(AS64<>\"\",LEFT(AS64,1)<>\"#\"),IF(LEFT(AS64,1)=\"-\",REPLACE(AS64,1,1,tech!$H$2),AS64),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|","- Impacted systems and services","Request for change structure is documented and followed","Guidance","2.4.2.GY",{"$f":"IF(AND(AY64<>\"\",LEFT(AY64,1)<>\"#\"),IF(LEFT(AY64,1)=\"-\",REPLACE(AY64,1,1,tech!$H$2),AY64),\"\")","v":"• Impacted systems and services"},"|","- [Common Vulnerabilities and Exposures (CVE) Program](https://www.cve.org/About/Overview)","Cyber-security management and incident planning","References","3.1.2.RY",{"$f":"IF(AND(BE64<>\"\",LEFT(BE64,1)<>\"#\"),IF(LEFT(BE64,1)=\"-\",REPLACE(BE64,1,1,tech!$H$2),BE64),\"\")","v":"• [Common Vulnerabilities and Exposures (CVE) Program](https://www.cve.org/About/Overview)"},"|",null,"Documented integration guidance","Assessment","3.2.2.AX",{"$f":"IF(AND(BK64<>\"\",LEFT(BK64,1)<>\"#\"),IF(LEFT(BK64,1)=\"-\",REPLACE(BK64,1,1,tech!$H$2),BK64),\"\")","v":""},"|",null,"Event logs from systems are collected","Guidance","3.3.2.GX",{"$f":"IF(AND(BQ64<>\"\",LEFT(BQ64,1)<>\"#\"),IF(LEFT(BQ64,1)=\"-\",REPLACE(BQ64,1,1,tech!$H$2),BQ64),\"\")","v":""},"|",null,"Monitoring and auditing of automated process","Assessment","3.4.2.AX",{"$f":"IF(AND(BW64<>\"\",LEFT(BW64,1)<>\"#\"),IF(LEFT(BW64,1)=\"-\",REPLACE(BW64,1,1,tech!$H$2),BW64),\"\")","v":""},"|","#### Guidance","Availability of resources","Guidance","4.1.3.GX",{"$f":"IF(AND(CC64<>\"\",LEFT(CC64,1)<>\"#\"),IF(LEFT(CC64,1)=\"-\",REPLACE(CC64,1,1,tech!$H$2),CC64),\"\")","v":""},"|","For each training, attendance should be recorded and documented, and in case the training is not completed, the reason should be documented.","Responsible personnel receive training","Guidance","4.2.2.GY",{"$f":"IF(AND(CI64<>\"\",LEFT(CI64,1)<>\"#\"),IF(LEFT(CI64,1)=\"-\",REPLACE(CI64,1,1,tech!$H$2),CI64),\"\")","v":"For each training, attendance should be recorded and documented, and in case the training is not completed, the reason should be documented."},"|","#### Assessment","Disclose PKI information","Assessment","4.3.2.AX",{"$f":"IF(AND(CO64<>\"\",LEFT(CO64,1)<>\"#\"),IF(LEFT(CO64,1)=\"-\",REPLACE(CO64,1,1,tech!$H$2),CO64),\"\")","v":""},"|"]
[null,null,"- Well defined CP and CPS for provided services","Managed","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D65,tech!$A$13:$B$17,2,0),LEFT(E65,1),IF(G65=\"\",\"X\",\"Y\"))","v":"4IY"},{"$f":"IF(IF(LEFT(C65,1)=\"-\",C65,\"\")=\"\",\"\",REPLACE(IF(LEFT(C65,1)=\"-\",C65,\"\"),1,1,tech!$H$2))","v":"• Well defined CP and CPS for provided services"},"|","The following is sample evidence that can be used to assess the requirement:","Scope and business drivers for PKI","Assessment","1.1.3.AY",{"$f":"IF(AND(I65<>\"\",LEFT(I65,1)<>\"#\"),IF(LEFT(I65,1)=\"-\",REPLACE(I65,1,1,tech!$H$2),I65),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|",null,"Certificate policy is documented and published","Guidance","1.2.2.GX",{"$f":"IF(AND(O65<>\"\",LEFT(O65,1)<>\"#\"),IF(LEFT(O65,1)=\"-\",REPLACE(O65,1,1,tech!$H$2),O65),\"\")","v":""},"|","- [NIST Risk Management Framework](https://csrc.nist.gov/Projects/risk-management)","A program to monitor compliance with the policies is established","References","1.3.2.RY",{"$f":"IF(AND(U65<>\"\",LEFT(U65,1)<>\"#\"),IF(LEFT(U65,1)=\"-\",REPLACE(U65,1,1,tech!$H$2),U65),\"\")","v":"• [NIST Risk Management Framework](https://csrc.nist.gov/Projects/risk-management)"},"|","Recurring activities are the activities that are performed on a regular basis, such as certificate management operations, backup procedures, security reviews, risk assessment, reviews of logs and security events, and other.","Recurring activities are executed on time","Guidance","1.4.3.GY",{"$f":"IF(AND(AA65<>\"\",LEFT(AA65,1)<>\"#\"),IF(LEFT(AA65,1)=\"-\",REPLACE(AA65,1,1,tech!$H$2),AA65),\"\")","v":"Recurring activities are the activities that are performed on a regular basis, such as certificate management operations, backup procedures, security reviews, risk assessment, reviews of logs and security events, and other."},"|",null,"Inventory of cryptographic keys is documented and maintained","References","2.1.2.RX",{"$f":"IF(AND(AG65<>\"\",LEFT(AG65,1)<>\"#\"),IF(LEFT(AG65,1)=\"-\",REPLACE(AG65,1,1,tech!$H$2),AG65),\"\")","v":""},"|","* [RFC 5280 - Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile](https://datatracker.ietf.org/doc/html/rfc5280)","Certificate cipher suites are documented","References","2.2.2.RY",{"$f":"IF(AND(AM65<>\"\",LEFT(AM65,1)<>\"#\"),IF(LEFT(AM65,1)=\"-\",REPLACE(AM65,1,1,tech!$H$2),AM65),\"\")","v":"* [RFC 5280 - Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile](https://datatracker.ietf.org/doc/html/rfc5280)"},"|","- network topology and diagram","Separation and segmentation principles are applied","Assessment","2.3.2.AY",{"$f":"IF(AND(AS65<>\"\",LEFT(AS65,1)<>\"#\"),IF(LEFT(AS65,1)=\"-\",REPLACE(AS65,1,1,tech!$H$2),AS65),\"\")","v":"• network topology and diagram"},"|","- Back-out Procedure in case of failure","Request for change structure is documented and followed","Guidance","2.4.2.GY",{"$f":"IF(AND(AY65<>\"\",LEFT(AY65,1)<>\"#\"),IF(LEFT(AY65,1)=\"-\",REPLACE(AY65,1,1,tech!$H$2),AY65),\"\")","v":"• Back-out Procedure in case of failure"},"|","- [NIST Special Publication 800-61 Revision 2 - Computer Security Incident Handling Guide](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final)","Cyber-security management and incident planning","References","3.1.2.RY",{"$f":"IF(AND(BE65<>\"\",LEFT(BE65,1)<>\"#\"),IF(LEFT(BE65,1)=\"-\",REPLACE(BE65,1,1,tech!$H$2),BE65),\"\")","v":"• [NIST Special Publication 800-61 Revision 2 - Computer Security Incident Handling Guide](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final)"},"|","#### References","Documented integration guidance","References","3.2.2.RX",{"$f":"IF(AND(BK65<>\"\",LEFT(BK65,1)<>\"#\"),IF(LEFT(BK65,1)=\"-\",REPLACE(BK65,1,1,tech!$H$2),BK65),\"\")","v":""},"|","#### Assessment","Event logs from systems are collected","Assessment","3.3.2.AX",{"$f":"IF(AND(BQ65<>\"\",LEFT(BQ65,1)<>\"#\"),IF(LEFT(BQ65,1)=\"-\",REPLACE(BQ65,1,1,tech!$H$2),BQ65),\"\")","v":""},"|","#### References","Monitoring and auditing of automated process","References","3.4.2.RX",{"$f":"IF(AND(BW65<>\"\",LEFT(BW65,1)<>\"#\"),IF(LEFT(BW65,1)=\"-\",REPLACE(BW65,1,1,tech!$H$2),BW65),\"\")","v":""},"|",null,"Availability of resources","Guidance","4.1.3.GX",{"$f":"IF(AND(CC65<>\"\",LEFT(CC65,1)<>\"#\"),IF(LEFT(CC65,1)=\"-\",REPLACE(CC65,1,1,tech!$H$2),CC65),\"\")","v":""},"|","In case there are requirements for score or threshold to be achieved, the results should be documented.","Responsible personnel receive training","Guidance","4.2.2.GY",{"$f":"IF(AND(CI65<>\"\",LEFT(CI65,1)<>\"#\"),IF(LEFT(CI65,1)=\"-\",REPLACE(CI65,1,1,tech!$H$2),CI65),\"\")","v":"In case there are requirements for score or threshold to be achieved, the results should be documented."},"|",null,"Disclose PKI information","Assessment","4.3.2.AX",{"$f":"IF(AND(CO65<>\"\",LEFT(CO65,1)<>\"#\"),IF(LEFT(CO65,1)=\"-\",REPLACE(CO65,1,1,tech!$H$2),CO65),\"\")","v":""},"|"]
[null,null,"- available skilled resources","Managed","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D66,tech!$A$13:$B$17,2,0),LEFT(E66,1),IF(G66=\"\",\"X\",\"Y\"))","v":"4IY"},{"$f":"IF(IF(LEFT(C66,1)=\"-\",C66,\"\")=\"\",\"\",REPLACE(IF(LEFT(C66,1)=\"-\",C66,\"\"),1,1,tech!$H$2))","v":"• available skilled resources"},"|","- Documented scope of the PKI","Scope and business drivers for PKI","Assessment","1.1.3.AY",{"$f":"IF(AND(I66<>\"\",LEFT(I66,1)<>\"#\"),IF(LEFT(I66,1)=\"-\",REPLACE(I66,1,1,tech!$H$2),I66),\"\")","v":"• Documented scope of the PKI"},"|","#### Assessment","Certificate policy is documented and published","Assessment","1.2.2.AX",{"$f":"IF(AND(O66<>\"\",LEFT(O66,1)<>\"#\"),IF(LEFT(O66,1)=\"-\",REPLACE(O66,1,1,tech!$H$2),O66),\"\")","v":""},"|",null,"A program to monitor compliance with the policies is established","References","1.3.2.RX",{"$f":"IF(AND(U66<>\"\",LEFT(U66,1)<>\"#\"),IF(LEFT(U66,1)=\"-\",REPLACE(U66,1,1,tech!$H$2),U66),\"\")","v":""},"|",null,"Recurring activities are executed on time","Guidance","1.4.3.GY",{"$f":"IF(AND(AA66<>\"\",LEFT(AA66,1)<>\"#\"),IF(LEFT(AA66,1)=\"-\",REPLACE(AA66,1,1,tech!$H$2),AA66),\"\")","v":""},"|","- [NIST SP 800-57 Recommendation for Key Management](https://csrc.nist.gov/projects/key-management/key-management-guidelines)","Inventory of cryptographic keys is documented and maintained","References","2.1.2.RY",{"$f":"IF(AND(AG66<>\"\",LEFT(AG66,1)<>\"#\"),IF(LEFT(AG66,1)=\"-\",REPLACE(AG66,1,1,tech!$H$2),AG66),\"\")","v":"• [NIST SP 800-57 Recommendation for Key Management](https://csrc.nist.gov/projects/key-management/key-management-guidelines)"},"|","* [SOG-IS crypto algorithms](https://www.sogis.eu/uk/supporting_doc_en.html)","Certificate cipher suites are documented","References","2.2.2.RY",{"$f":"IF(AND(AM66<>\"\",LEFT(AM66,1)<>\"#\"),IF(LEFT(AM66,1)=\"-\",REPLACE(AM66,1,1,tech!$H$2),AM66),\"\")","v":"* [SOG-IS crypto algorithms](https://www.sogis.eu/uk/supporting_doc_en.html)"},"|","- implementation of network isolation","Separation and segmentation principles are applied","Assessment","2.3.2.AY",{"$f":"IF(AND(AS66<>\"\",LEFT(AS66,1)<>\"#\"),IF(LEFT(AS66,1)=\"-\",REPLACE(AS66,1,1,tech!$H$2),AS66),\"\")","v":"• implementation of network isolation"},"|","- testing requirements","Request for change structure is documented and followed","Guidance","2.4.2.GY",{"$f":"IF(AND(AY66<>\"\",LEFT(AY66,1)<>\"#\"),IF(LEFT(AY66,1)=\"-\",REPLACE(AY66,1,1,tech!$H$2),AY66),\"\")","v":"• testing requirements"},"|","- [SANS Guide to Security Operations](https://www.sans.org/posters/guide-to-security-operations/)","Cyber-security management and incident planning","References","3.1.2.RY",{"$f":"IF(AND(BE66<>\"\",LEFT(BE66,1)<>\"#\"),IF(LEFT(BE66,1)=\"-\",REPLACE(BE66,1,1,tech!$H$2),BE66),\"\")","v":"• [SANS Guide to Security Operations](https://www.sans.org/posters/guide-to-security-operations/)"},"|",null,"Documented integration guidance","References","3.2.2.RX",{"$f":"IF(AND(BK66<>\"\",LEFT(BK66,1)<>\"#\"),IF(LEFT(BK66,1)=\"-\",REPLACE(BK66,1,1,tech!$H$2),BK66),\"\")","v":""},"|",null,"Event logs from systems are collected","Assessment","3.3.2.AX",{"$f":"IF(AND(BQ66<>\"\",LEFT(BQ66,1)<>\"#\"),IF(LEFT(BQ66,1)=\"-\",REPLACE(BQ66,1,1,tech!$H$2),BQ66),\"\")","v":""},"|",null,"Monitoring and auditing of automated process","References","3.4.2.RX",{"$f":"IF(AND(BW66<>\"\",LEFT(BW66,1)<>\"#\"),IF(LEFT(BW66,1)=\"-\",REPLACE(BW66,1,1,tech!$H$2),BW66),\"\")","v":""},"|","Identified and defined resources should be available at the required capacity. The availability of the resources should be aligned with the overall strategy of the organization and scope of the PKI. The availability of the resources should be controlled to ensure that the resources are available when needed.","Availability of resources","Guidance","4.1.3.GY",{"$f":"IF(AND(CC66<>\"\",LEFT(CC66,1)<>\"#\"),IF(LEFT(CC66,1)=\"-\",REPLACE(CC66,1,1,tech!$H$2),CC66),\"\")","v":"Identified and defined resources should be available at the required capacity. The availability of the resources should be aligned with the overall strategy of the organization and scope of the PKI. The availability of the resources should be controlled to ensure that the resources are available when needed."},"|",null,"Responsible personnel receive training","Guidance","4.2.2.GX",{"$f":"IF(AND(CI66<>\"\",LEFT(CI66,1)<>\"#\"),IF(LEFT(CI66,1)=\"-\",REPLACE(CI66,1,1,tech!$H$2),CI66),\"\")","v":""},"|","- Review disclosure Statement content to ensure that it is contains relevant information","Disclose PKI information","Assessment","4.3.2.AY",{"$f":"IF(AND(CO66<>\"\",LEFT(CO66,1)<>\"#\"),IF(LEFT(CO66,1)=\"-\",REPLACE(CO66,1,1,tech!$H$2),CO66),\"\")","v":"• Review disclosure Statement content to ensure that it is contains relevant information"},"|"]
[null,null,"- Documented processes and procedures to manage certificates and related keys","Managed","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D67,tech!$A$13:$B$17,2,0),LEFT(E67,1),IF(G67=\"\",\"X\",\"Y\"))","v":"4IY"},{"$f":"IF(IF(LEFT(C67,1)=\"-\",C67,\"\")=\"\",\"\",REPLACE(IF(LEFT(C67,1)=\"-\",C67,\"\"),1,1,tech!$H$2))","v":"• Documented processes and procedures to manage certificates and related keys"},"|","- Documented business drivers","Scope and business drivers for PKI","Assessment","1.1.3.AY",{"$f":"IF(AND(I67<>\"\",LEFT(I67,1)<>\"#\"),IF(LEFT(I67,1)=\"-\",REPLACE(I67,1,1,tech!$H$2),I67),\"\")","v":"• Documented business drivers"},"|",null,"Certificate policy is documented and published","Assessment","1.2.2.AX",{"$f":"IF(AND(O67<>\"\",LEFT(O67,1)<>\"#\"),IF(LEFT(O67,1)=\"-\",REPLACE(O67,1,1,tech!$H$2),O67),\"\")","v":""},"|","### Responsibilities for the compliance are formally defined and assigned","Responsibilities for the compliance are formally defined and assigned","References","1.3.3.RX",{"$f":"IF(AND(U67<>\"\",LEFT(U67,1)<>\"#\"),IF(LEFT(U67,1)=\"-\",REPLACE(U67,1,1,tech!$H$2),U67),\"\")","v":""},"|","Each activity should be tracked and have a frequency defined, for example, some activities may be performed daily, weekly, monthly, quarterly, or yearly. The activities should be performed on time, and any delays should be properly tracked and reported.","Recurring activities are executed on time","Guidance","1.4.3.GY",{"$f":"IF(AND(AA67<>\"\",LEFT(AA67,1)<>\"#\"),IF(LEFT(AA67,1)=\"-\",REPLACE(AA67,1,1,tech!$H$2),AA67),\"\")","v":"Each activity should be tracked and have a frequency defined, for example, some activities may be performed daily, weekly, monthly, quarterly, or yearly. The activities should be performed on time, and any delays should be properly tracked and reported."},"|","- [ISO/IEC 11770 Key Management](https://www.iso.org/standard/53456.html)","Inventory of cryptographic keys is documented and maintained","References","2.1.2.RY",{"$f":"IF(AND(AG67<>\"\",LEFT(AG67,1)<>\"#\"),IF(LEFT(AG67,1)=\"-\",REPLACE(AG67,1,1,tech!$H$2),AG67),\"\")","v":"• [ISO/IEC 11770 Key Management](https://www.iso.org/standard/53456.html)"},"|","* NIST [Suite B](https://apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa-suite.cfm)","Certificate cipher suites are documented","References","2.2.2.RY",{"$f":"IF(AND(AM67<>\"\",LEFT(AM67,1)<>\"#\"),IF(LEFT(AM67,1)=\"-\",REPLACE(AM67,1,1,tech!$H$2),AM67),\"\")","v":"* NIST [Suite B](https://apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa-suite.cfm)"},"|","- Separation of production and testing environments","Separation and segmentation principles are applied","Assessment","2.3.2.AY",{"$f":"IF(AND(AS67<>\"\",LEFT(AS67,1)<>\"#\"),IF(LEFT(AS67,1)=\"-\",REPLACE(AS67,1,1,tech!$H$2),AS67),\"\")","v":"• Separation of production and testing environments"},"|","- and other relevant information","Request for change structure is documented and followed","Guidance","2.4.2.GY",{"$f":"IF(AND(AY67<>\"\",LEFT(AY67,1)<>\"#\"),IF(LEFT(AY67,1)=\"-\",REPLACE(AY67,1,1,tech!$H$2),AY67),\"\")","v":"• and other relevant information"},"|",null,"Cyber-security management and incident planning","References","3.1.2.RX",{"$f":"IF(AND(BE67<>\"\",LEFT(BE67,1)<>\"#\"),IF(LEFT(BE67,1)=\"-\",REPLACE(BE67,1,1,tech!$H$2),BE67),\"\")","v":""},"|","- [The Open Group Architecture Framework (TOGAF)](https://www.opengroup.org/togaf)","Documented integration guidance","References","3.2.2.RY",{"$f":"IF(AND(BK67<>\"\",LEFT(BK67,1)<>\"#\"),IF(LEFT(BK67,1)=\"-\",REPLACE(BK67,1,1,tech!$H$2),BK67),\"\")","v":"• [The Open Group Architecture Framework (TOGAF)](https://www.opengroup.org/togaf)"},"|","- logs are collected from systems","Event logs from systems are collected","Assessment","3.3.2.AY",{"$f":"IF(AND(BQ67<>\"\",LEFT(BQ67,1)<>\"#\"),IF(LEFT(BQ67,1)=\"-\",REPLACE(BQ67,1,1,tech!$H$2),BQ67),\"\")","v":"• logs are collected from systems"},"|","N/A","Monitoring and auditing of automated process","References","3.4.2.RY",{"$f":"IF(AND(BW67<>\"\",LEFT(BW67,1)<>\"#\"),IF(LEFT(BW67,1)=\"-\",REPLACE(BW67,1,1,tech!$H$2),BW67),\"\")","v":"N/A"},"|",null,"Availability of resources","Guidance","4.1.3.GX",{"$f":"IF(AND(CC67<>\"\",LEFT(CC67,1)<>\"#\"),IF(LEFT(CC67,1)=\"-\",REPLACE(CC67,1,1,tech!$H$2),CC67),\"\")","v":""},"|","#### Assessment","Responsible personnel receive training","Assessment","4.2.2.AX",{"$f":"IF(AND(CI67<>\"\",LEFT(CI67,1)<>\"#\"),IF(LEFT(CI67,1)=\"-\",REPLACE(CI67,1,1,tech!$H$2),CI67),\"\")","v":""},"|","- disclosure Statement is approved and communicated to all PKI participants","Disclose PKI information","Assessment","4.3.2.AY",{"$f":"IF(AND(CO67<>\"\",LEFT(CO67,1)<>\"#\"),IF(LEFT(CO67,1)=\"-\",REPLACE(CO67,1,1,tech!$H$2),CO67),\"\")","v":"• disclosure Statement is approved and communicated to all PKI participants"},"|"]
[null,null,"- Inconsistent approach to certificate related activities","Managed","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D68,tech!$A$13:$B$17,2,0),LEFT(E68,1),IF(G68=\"\",\"X\",\"Y\"))","v":"4IY"},{"$f":"IF(IF(LEFT(C68,1)=\"-\",C68,\"\")=\"\",\"\",REPLACE(IF(LEFT(C68,1)=\"-\",C68,\"\"),1,1,tech!$H$2))","v":"• Inconsistent approach to certificate related activities"},"|","- Documented use-cases","Scope and business drivers for PKI","Assessment","1.1.3.AY",{"$f":"IF(AND(I68<>\"\",LEFT(I68,1)<>\"#\"),IF(LEFT(I68,1)=\"-\",REPLACE(I68,1,1,tech!$H$2),I68),\"\")","v":"• Documented use-cases"},"|","- the CP is properly Documented in its full scope","Certificate policy is documented and published","Assessment","1.2.2.AY",{"$f":"IF(AND(O68<>\"\",LEFT(O68,1)<>\"#\"),IF(LEFT(O68,1)=\"-\",REPLACE(O68,1,1,tech!$H$2),O68),\"\")","v":"• the CP is properly Documented in its full scope"},"|",null,"Responsibilities for the compliance are formally defined and assigned","References","1.3.3.RX",{"$f":"IF(AND(U68<>\"\",LEFT(U68,1)<>\"#\"),IF(LEFT(U68,1)=\"-\",REPLACE(U68,1,1,tech!$H$2),U68),\"\")","v":""},"|",null,"Recurring activities are executed on time","Guidance","1.4.3.GY",{"$f":"IF(AND(AA68<>\"\",LEFT(AA68,1)<>\"#\"),IF(LEFT(AA68,1)=\"-\",REPLACE(AA68,1,1,tech!$H$2),AA68),\"\")","v":""},"|",null,"Inventory of cryptographic keys is documented and maintained","References","2.1.2.RX",{"$f":"IF(AND(AG68<>\"\",LEFT(AG68,1)<>\"#\"),IF(LEFT(AG68,1)=\"-\",REPLACE(AG68,1,1,tech!$H$2),AG68),\"\")","v":""},"|","* NIST approved algorithms [CNSA 2.0](https://media.defense.gov/2022/Sep/07/2003071834/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS_.PDF)","Certificate cipher suites are documented","References","2.2.2.RY",{"$f":"IF(AND(AM68<>\"\",LEFT(AM68,1)<>\"#\"),IF(LEFT(AM68,1)=\"-\",REPLACE(AM68,1,1,tech!$H$2),AM68),\"\")","v":"* NIST approved algorithms [CNSA 2.0](https://media.defense.gov/2022/Sep/07/2003071834/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS_.PDF)"},"|","- Sample data","Separation and segmentation principles are applied","Assessment","2.3.2.AY",{"$f":"IF(AND(AS68<>\"\",LEFT(AS68,1)<>\"#\"),IF(LEFT(AS68,1)=\"-\",REPLACE(AS68,1,1,tech!$H$2),AS68),\"\")","v":"• Sample data"},"|",null,"Request for change structure is documented and followed","Guidance","2.4.2.GX",{"$f":"IF(AND(AY68<>\"\",LEFT(AY68,1)<>\"#\"),IF(LEFT(AY68,1)=\"-\",REPLACE(AY68,1,1,tech!$H$2),AY68),\"\")","v":""},"|","### Business continuity planning and disaster recovery","Business continuity planning and disaster recovery","References","3.1.3.RX",{"$f":"IF(AND(BE68<>\"\",LEFT(BE68,1)<>\"#\"),IF(LEFT(BE68,1)=\"-\",REPLACE(BE68,1,1,tech!$H$2),BE68),\"\")","v":""},"|","- Integration instructions provided by the vendors","Documented integration guidance","References","3.2.2.RY",{"$f":"IF(AND(BK68<>\"\",LEFT(BK68,1)<>\"#\"),IF(LEFT(BK68,1)=\"-\",REPLACE(BK68,1,1,tech!$H$2),BK68),\"\")","v":"• Integration instructions provided by the vendors"},"|","- logs have a consistent format and can be further processed and analyzed","Event logs from systems are collected","Assessment","3.3.2.AY",{"$f":"IF(AND(BQ68<>\"\",LEFT(BQ68,1)<>\"#\"),IF(LEFT(BQ68,1)=\"-\",REPLACE(BQ68,1,1,tech!$H$2),BQ68),\"\")","v":"• logs have a consistent format and can be further processed and analyzed"},"|",null,"Monitoring and auditing of automated process","References","3.4.2.RX",{"$f":"IF(AND(BW68<>\"\",LEFT(BW68,1)<>\"#\"),IF(LEFT(BW68,1)=\"-\",REPLACE(BW68,1,1,tech!$H$2),BW68),\"\")","v":""},"|","#### Assessment","Availability of resources","Assessment","4.1.3.AX",{"$f":"IF(AND(CC68<>\"\",LEFT(CC68,1)<>\"#\"),IF(LEFT(CC68,1)=\"-\",REPLACE(CC68,1,1,tech!$H$2),CC68),\"\")","v":""},"|",null,"Responsible personnel receive training","Assessment","4.2.2.AX",{"$f":"IF(AND(CI68<>\"\",LEFT(CI68,1)<>\"#\"),IF(LEFT(CI68,1)=\"-\",REPLACE(CI68,1,1,tech!$H$2),CI68),\"\")","v":""},"|","- information is available to all PKI participants","Disclose PKI information","Assessment","4.3.2.AY",{"$f":"IF(AND(CO68<>\"\",LEFT(CO68,1)<>\"#\"),IF(LEFT(CO68,1)=\"-\",REPLACE(CO68,1,1,tech!$H$2),CO68),\"\")","v":"• information is available to all PKI participants"},"|"]
[{"$nulls":3},"Managed","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D69,tech!$A$13:$B$17,2,0),LEFT(E69,1),IF(G69=\"\",\"X\",\"Y\"))","v":"4IX"},{"$f":"IF(IF(LEFT(C69,1)=\"-\",C69,\"\")=\"\",\"\",REPLACE(IF(LEFT(C69,1)=\"-\",C69,\"\"),1,1,tech!$H$2))","v":""},"|","- Documented alignment with the organizational goals","Scope and business drivers for PKI","Assessment","1.1.3.AY",{"$f":"IF(AND(I69<>\"\",LEFT(I69,1)<>\"#\"),IF(LEFT(I69,1)=\"-\",REPLACE(I69,1,1,tech!$H$2),I69),\"\")","v":"• Documented alignment with the organizational goals"},"|","- The CP clearly defines the scope of the policy, such as the purpose of the security and assurance levels, the type and use of its certificates and parties involved","Certificate policy is documented and published","Assessment","1.2.2.AY",{"$f":"IF(AND(O69<>\"\",LEFT(O69,1)<>\"#\"),IF(LEFT(O69,1)=\"-\",REPLACE(O69,1,1,tech!$H$2),O69),\"\")","v":"• The CP clearly defines the scope of the policy, such as the purpose of the security and assurance levels, the type and use of its certificates and parties involved"},"|","#### Guidance","Responsibilities for the compliance are formally defined and assigned","Guidance","1.3.3.GX",{"$f":"IF(AND(U69<>\"\",LEFT(U69,1)<>\"#\"),IF(LEFT(U69,1)=\"-\",REPLACE(U69,1,1,tech!$H$2),U69),\"\")","v":""},"|","Recurring activities needs to be incorporated into the processes and procedures to support the PKI implementation.","Recurring activities are executed on time","Guidance","1.4.3.GY",{"$f":"IF(AND(AA69<>\"\",LEFT(AA69,1)<>\"#\"),IF(LEFT(AA69,1)=\"-\",REPLACE(AA69,1,1,tech!$H$2),AA69),\"\")","v":"Recurring activities needs to be incorporated into the processes and procedures to support the PKI implementation."},"|","### Inventory of cryptographic devices is documented and maintained","Inventory of cryptographic devices is documented and maintained","References","2.1.3.RX",{"$f":"IF(AND(AG69<>\"\",LEFT(AG69,1)<>\"#\"),IF(LEFT(AG69,1)=\"-\",REPLACE(AG69,1,1,tech!$H$2),AG69),\"\")","v":""},"|","* [NIST SP 800-208 - Recommendation for Stateful Hash-Based Signature Schemes](https://csrc.nist.gov/publications/detail/sp/800-208/final)","Certificate cipher suites are documented","References","2.2.2.RY",{"$f":"IF(AND(AM69<>\"\",LEFT(AM69,1)<>\"#\"),IF(LEFT(AM69,1)=\"-\",REPLACE(AM69,1,1,tech!$H$2),AM69),\"\")","v":"* [NIST SP 800-208 - Recommendation for Stateful Hash-Based Signature Schemes](https://csrc.nist.gov/publications/detail/sp/800-208/final)"},"|","- Interview with the network administrators","Separation and segmentation principles are applied","Assessment","2.3.2.AY",{"$f":"IF(AND(AS69<>\"\",LEFT(AS69,1)<>\"#\"),IF(LEFT(AS69,1)=\"-\",REPLACE(AS69,1,1,tech!$H$2),AS69),\"\")","v":"• Interview with the network administrators"},"|","#### Assessment","Request for change structure is documented and followed","Assessment","2.4.2.AX",{"$f":"IF(AND(AY69<>\"\",LEFT(AY69,1)<>\"#\"),IF(LEFT(AY69,1)=\"-\",REPLACE(AY69,1,1,tech!$H$2),AY69),\"\")","v":""},"|",null,"Business continuity planning and disaster recovery","References","3.1.3.RX",{"$f":"IF(AND(BE69<>\"\",LEFT(BE69,1)<>\"#\"),IF(LEFT(BE69,1)=\"-\",REPLACE(BE69,1,1,tech!$H$2),BE69),\"\")","v":""},"|",null,"Documented integration guidance","References","3.2.2.RX",{"$f":"IF(AND(BK69<>\"\",LEFT(BK69,1)<>\"#\"),IF(LEFT(BK69,1)=\"-\",REPLACE(BK69,1,1,tech!$H$2),BK69),\"\")","v":""},"|","- Review of records and their Formatting","Event logs from systems are collected","Assessment","3.3.2.AY",{"$f":"IF(AND(BQ69<>\"\",LEFT(BQ69,1)<>\"#\"),IF(LEFT(BQ69,1)=\"-\",REPLACE(BQ69,1,1,tech!$H$2),BQ69),\"\")","v":"• Review of records and their Formatting"},"|","### Incidents and exceptions handling","Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW69<>\"\",LEFT(BW69,1)<>\"#\"),IF(LEFT(BW69,1)=\"-\",REPLACE(BW69,1,1,tech!$H$2),BW69),\"\")","v":""},"|",null,"Availability of resources","Assessment","4.1.3.AX",{"$f":"IF(AND(CC69<>\"\",LEFT(CC69,1)<>\"#\"),IF(LEFT(CC69,1)=\"-\",REPLACE(CC69,1,1,tech!$H$2),CC69),\"\")","v":""},"|","- Review Training matrix","Responsible personnel receive training","Assessment","4.2.2.AY",{"$f":"IF(AND(CI69<>\"\",LEFT(CI69,1)<>\"#\"),IF(LEFT(CI69,1)=\"-\",REPLACE(CI69,1,1,tech!$H$2),CI69),\"\")","v":"• Review Training matrix"},"|","- information is up-to-date","Disclose PKI information","Assessment","4.3.2.AY",{"$f":"IF(AND(CO69<>\"\",LEFT(CO69,1)<>\"#\"),IF(LEFT(CO69,1)=\"-\",REPLACE(CO69,1,1,tech!$H$2),CO69),\"\")","v":"• information is up-to-date"},"|"]
[null,null,"### Associated risks","Managed","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D70,tech!$A$13:$B$17,2,0),LEFT(E70,1),IF(G70=\"\",\"X\",\"Y\"))","v":"4AX"},{"$f":"IF(IF(LEFT(C70,1)=\"-\",C70,\"\")=\"\",\"\",REPLACE(IF(LEFT(C70,1)=\"-\",C70,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Scope and business drivers for PKI","Assessment","1.1.3.AX",{"$f":"IF(AND(I70<>\"\",LEFT(I70,1)<>\"#\"),IF(LEFT(I70,1)=\"-\",REPLACE(I70,1,1,tech!$H$2),I70),\"\")","v":""},"|","- the legal rights and responsibilities of parties are described in the CP","Certificate policy is documented and published","Assessment","1.2.2.AY",{"$f":"IF(AND(O70<>\"\",LEFT(O70,1)<>\"#\"),IF(LEFT(O70,1)=\"-\",REPLACE(O70,1,1,tech!$H$2),O70),\"\")","v":"• the legal rights and responsibilities of parties are described in the CP"},"|",null,"Responsibilities for the compliance are formally defined and assigned","Guidance","1.3.3.GX",{"$f":"IF(AND(U70<>\"\",LEFT(U70,1)<>\"#\"),IF(LEFT(U70,1)=\"-\",REPLACE(U70,1,1,tech!$H$2),U70),\"\")","v":""},"|",null,"Recurring activities are executed on time","Guidance","1.4.3.GX",{"$f":"IF(AND(AA70<>\"\",LEFT(AA70,1)<>\"#\"),IF(LEFT(AA70,1)=\"-\",REPLACE(AA70,1,1,tech!$H$2),AA70),\"\")","v":""},"|",null,"Inventory of cryptographic devices is documented and maintained","References","2.1.3.RX",{"$f":"IF(AND(AG70<>\"\",LEFT(AG70,1)<>\"#\"),IF(LEFT(AG70,1)=\"-\",REPLACE(AG70,1,1,tech!$H$2),AG70),\"\")","v":""},"|",null,"Certificate cipher suites are documented","References","2.2.2.RX",{"$f":"IF(AND(AM70<>\"\",LEFT(AM70,1)<>\"#\"),IF(LEFT(AM70,1)=\"-\",REPLACE(AM70,1,1,tech!$H$2),AM70),\"\")","v":""},"|",null,"Separation and segmentation principles are applied","Assessment","2.3.2.AX",{"$f":"IF(AND(AS70<>\"\",LEFT(AS70,1)<>\"#\"),IF(LEFT(AS70,1)=\"-\",REPLACE(AS70,1,1,tech!$H$2),AS70),\"\")","v":""},"|",null,"Request for change structure is documented and followed","Assessment","2.4.2.AX",{"$f":"IF(AND(AY70<>\"\",LEFT(AY70,1)<>\"#\"),IF(LEFT(AY70,1)=\"-\",REPLACE(AY70,1,1,tech!$H$2),AY70),\"\")","v":""},"|","#### Guidance","Business continuity planning and disaster recovery","Guidance","3.1.3.GX",{"$f":"IF(AND(BE70<>\"\",LEFT(BE70,1)<>\"#\"),IF(LEFT(BE70,1)=\"-\",REPLACE(BE70,1,1,tech!$H$2),BE70),\"\")","v":""},"|","### Adoption and application of open standards","Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK70<>\"\",LEFT(BK70,1)<>\"#\"),IF(LEFT(BK70,1)=\"-\",REPLACE(BK70,1,1,tech!$H$2),BK70),\"\")","v":""},"|","- Review of configuration standards for logging","Event logs from systems are collected","Assessment","3.3.2.AY",{"$f":"IF(AND(BQ70<>\"\",LEFT(BQ70,1)<>\"#\"),IF(LEFT(BQ70,1)=\"-\",REPLACE(BQ70,1,1,tech!$H$2),BQ70),\"\")","v":"• Review of configuration standards for logging"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW70<>\"\",LEFT(BW70,1)<>\"#\"),IF(LEFT(BW70,1)=\"-\",REPLACE(BW70,1,1,tech!$H$2),BW70),\"\")","v":""},"|","- Review of the Resource management process","Availability of resources","Assessment","4.1.3.AY",{"$f":"IF(AND(CC70<>\"\",LEFT(CC70,1)<>\"#\"),IF(LEFT(CC70,1)=\"-\",REPLACE(CC70,1,1,tech!$H$2),CC70),\"\")","v":"• Review of the Resource management process"},"|","- Review Documented Training Results","Responsible personnel receive training","Assessment","4.2.2.AY",{"$f":"IF(AND(CI70<>\"\",LEFT(CI70,1)<>\"#\"),IF(LEFT(CI70,1)=\"-\",REPLACE(CI70,1,1,tech!$H$2),CI70),\"\")","v":"• Review Documented Training Results"},"|",null,"Disclose PKI information","Assessment","4.3.2.AX",{"$f":"IF(AND(CO70<>\"\",LEFT(CO70,1)<>\"#\"),IF(LEFT(CO70,1)=\"-\",REPLACE(CO70,1,1,tech!$H$2),CO70),\"\")","v":""},"|"]
[{"$nulls":3},"Managed","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D71,tech!$A$13:$B$17,2,0),LEFT(E71,1),IF(G71=\"\",\"X\",\"Y\"))","v":"4AX"},{"$f":"IF(IF(LEFT(C71,1)=\"-\",C71,\"\")=\"\",\"\",REPLACE(IF(LEFT(C71,1)=\"-\",C71,\"\"),1,1,tech!$H$2))","v":""},"|","#### References","Scope and business drivers for PKI","References","1.1.3.RX",{"$f":"IF(AND(I71<>\"\",LEFT(I71,1)<>\"#\"),IF(LEFT(I71,1)=\"-\",REPLACE(I71,1,1,tech!$H$2),I71),\"\")","v":""},"|","- CP has listed correct object identifiers for the purpose it's used for","Certificate policy is documented and published","Assessment","1.2.2.AY",{"$f":"IF(AND(O71<>\"\",LEFT(O71,1)<>\"#\"),IF(LEFT(O71,1)=\"-\",REPLACE(O71,1,1,tech!$H$2),O71),\"\")","v":"• CP has listed correct object identifiers for the purpose it's used for"},"|","Within the organization, there should exist clear and well documented guidelines outlining which individual, group or team is responsible for ensuring that PKI policies are being followed. This applies to governance and oversight in addition to operational policies and procedures.","Responsibilities for the compliance are formally defined and assigned","Guidance","1.3.3.GY",{"$f":"IF(AND(U71<>\"\",LEFT(U71,1)<>\"#\"),IF(LEFT(U71,1)=\"-\",REPLACE(U71,1,1,tech!$H$2),U71),\"\")","v":"Within the organization, there should exist clear and well documented guidelines outlining which individual, group or team is responsible for ensuring that PKI policies are being followed. This applies to governance and oversight in addition to operational policies and procedures."},"|","#### Assessment","Recurring activities are executed on time","Assessment","1.4.3.AX",{"$f":"IF(AND(AA71<>\"\",LEFT(AA71,1)<>\"#\"),IF(LEFT(AA71,1)=\"-\",REPLACE(AA71,1,1,tech!$H$2),AA71),\"\")","v":""},"|","#### Guidance","Inventory of cryptographic devices is documented and maintained","Guidance","2.1.3.GX",{"$f":"IF(AND(AG71<>\"\",LEFT(AG71,1)<>\"#\"),IF(LEFT(AG71,1)=\"-\",REPLACE(AG71,1,1,tech!$H$2),AG71),\"\")","v":""},"|","### Certificate lifecycle management is documented","Certificate lifecycle management is documented","References","2.2.3.RX",{"$f":"IF(AND(AM71<>\"\",LEFT(AM71,1)<>\"#\"),IF(LEFT(AM71,1)=\"-\",REPLACE(AM71,1,1,tech!$H$2),AM71),\"\")","v":""},"|","#### References","Separation and segmentation principles are applied","References","2.3.2.RX",{"$f":"IF(AND(AS71<>\"\",LEFT(AS71,1)<>\"#\"),IF(LEFT(AS71,1)=\"-\",REPLACE(AS71,1,1,tech!$H$2),AS71),\"\")","v":""},"|","The following is sample evidence that can be used to assess the requirement:","Request for change structure is documented and followed","Assessment","2.4.2.AY",{"$f":"IF(AND(AY71<>\"\",LEFT(AY71,1)<>\"#\"),IF(LEFT(AY71,1)=\"-\",REPLACE(AY71,1,1,tech!$H$2),AY71),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|",null,"Business continuity planning and disaster recovery","Guidance","3.1.3.GX",{"$f":"IF(AND(BE71<>\"\",LEFT(BE71,1)<>\"#\"),IF(LEFT(BE71,1)=\"-\",REPLACE(BE71,1,1,tech!$H$2),BE71),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK71<>\"\",LEFT(BK71,1)<>\"#\"),IF(LEFT(BK71,1)=\"-\",REPLACE(BK71,1,1,tech!$H$2),BK71),\"\")","v":""},"|","- Interviews with personnel to check the Understanding of logging format and interpretation of the information","Event logs from systems are collected","Assessment","3.3.2.AY",{"$f":"IF(AND(BQ71<>\"\",LEFT(BQ71,1)<>\"#\"),IF(LEFT(BQ71,1)=\"-\",REPLACE(BQ71,1,1,tech!$H$2),BQ71),\"\")","v":"• Interviews with personnel to check the Understanding of logging format and interpretation of the information"},"|","#### Guidance","Incidents and exceptions handling","Guidance","3.4.3.GX",{"$f":"IF(AND(BW71<>\"\",LEFT(BW71,1)<>\"#\"),IF(LEFT(BW71,1)=\"-\",REPLACE(BW71,1,1,tech!$H$2),BW71),\"\")","v":""},"|","- Review of the capacity or demand management process","Availability of resources","Assessment","4.1.3.AY",{"$f":"IF(AND(CC71<>\"\",LEFT(CC71,1)<>\"#\"),IF(LEFT(CC71,1)=\"-\",REPLACE(CC71,1,1,tech!$H$2),CC71),\"\")","v":"• Review of the capacity or demand management process"},"|","- Review Training records","Responsible personnel receive training","Assessment","4.2.2.AY",{"$f":"IF(AND(CI71<>\"\",LEFT(CI71,1)<>\"#\"),IF(LEFT(CI71,1)=\"-\",REPLACE(CI71,1,1,tech!$H$2),CI71),\"\")","v":"• Review Training records"},"|","#### References","Disclose PKI information","References","4.3.2.RX",{"$f":"IF(AND(CO71<>\"\",LEFT(CO71,1)<>\"#\"),IF(LEFT(CO71,1)=\"-\",REPLACE(CO71,1,1,tech!$H$2),CO71),\"\")","v":""},"|"]
[null,null,"- Low probability of operational issues","Managed","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D72,tech!$A$13:$B$17,2,0),LEFT(E72,1),IF(G72=\"\",\"X\",\"Y\"))","v":"4AY"},{"$f":"IF(IF(LEFT(C72,1)=\"-\",C72,\"\")=\"\",\"\",REPLACE(IF(LEFT(C72,1)=\"-\",C72,\"\"),1,1,tech!$H$2))","v":"• Low probability of operational issues"},"|",null,"Scope and business drivers for PKI","References","1.1.3.RX",{"$f":"IF(AND(I72<>\"\",LEFT(I72,1)<>\"#\"),IF(LEFT(I72,1)=\"-\",REPLACE(I72,1,1,tech!$H$2),I72),\"\")","v":""},"|","- Verify that the CP is published and available to all parties involved","Certificate policy is documented and published","Assessment","1.2.2.AY",{"$f":"IF(AND(O72<>\"\",LEFT(O72,1)<>\"#\"),IF(LEFT(O72,1)=\"-\",REPLACE(O72,1,1,tech!$H$2),O72),\"\")","v":"• Verify that the CP is published and available to all parties involved"},"|",null,"Responsibilities for the compliance are formally defined and assigned","Guidance","1.3.3.GY",{"$f":"IF(AND(U72<>\"\",LEFT(U72,1)<>\"#\"),IF(LEFT(U72,1)=\"-\",REPLACE(U72,1,1,tech!$H$2),U72),\"\")","v":""},"|",null,"Recurring activities are executed on time","Assessment","1.4.3.AX",{"$f":"IF(AND(AA72<>\"\",LEFT(AA72,1)<>\"#\"),IF(LEFT(AA72,1)=\"-\",REPLACE(AA72,1,1,tech!$H$2),AA72),\"\")","v":""},"|",null,"Inventory of cryptographic devices is documented and maintained","Guidance","2.1.3.GX",{"$f":"IF(AND(AG72<>\"\",LEFT(AG72,1)<>\"#\"),IF(LEFT(AG72,1)=\"-\",REPLACE(AG72,1,1,tech!$H$2),AG72),\"\")","v":""},"|",null,"Certificate lifecycle management is documented","References","2.2.3.RX",{"$f":"IF(AND(AM72<>\"\",LEFT(AM72,1)<>\"#\"),IF(LEFT(AM72,1)=\"-\",REPLACE(AM72,1,1,tech!$H$2),AM72),\"\")","v":""},"|",null,"Separation and segmentation principles are applied","References","2.3.2.RX",{"$f":"IF(AND(AS72<>\"\",LEFT(AS72,1)<>\"#\"),IF(LEFT(AS72,1)=\"-\",REPLACE(AS72,1,1,tech!$H$2),AS72),\"\")","v":""},"|","- Documented request for change structure","Request for change structure is documented and followed","Assessment","2.4.2.AY",{"$f":"IF(AND(AY72<>\"\",LEFT(AY72,1)<>\"#\"),IF(LEFT(AY72,1)=\"-\",REPLACE(AY72,1,1,tech!$H$2),AY72),\"\")","v":"• Documented request for change structure"},"|","The business continuity planning and disaster recovery are the key activities to ensure availability of the PKI operations. The business continuity planning is used to define the recovery time objectives (RTO) and recovery point objectives (RPO) for the PKI. The RTO and RPO are used to define the required resources and their availability.","Business continuity planning and disaster recovery","Guidance","3.1.3.GY",{"$f":"IF(AND(BE72<>\"\",LEFT(BE72,1)<>\"#\"),IF(LEFT(BE72,1)=\"-\",REPLACE(BE72,1,1,tech!$H$2),BE72),\"\")","v":"The business continuity planning and disaster recovery are the key activities to ensure availability of the PKI operations. The business continuity planning is used to define the recovery time objectives (RTO) and recovery point objectives (RPO) for the PKI. The RTO and RPO are used to define the required resources and their availability."},"|","#### Guidance","Adoption and application of open standards","Guidance","3.2.3.GX",{"$f":"IF(AND(BK72<>\"\",LEFT(BK72,1)<>\"#\"),IF(LEFT(BK72,1)=\"-\",REPLACE(BK72,1,1,tech!$H$2),BK72),\"\")","v":""},"|",null,"Event logs from systems are collected","Assessment","3.3.2.AX",{"$f":"IF(AND(BQ72<>\"\",LEFT(BQ72,1)<>\"#\"),IF(LEFT(BQ72,1)=\"-\",REPLACE(BQ72,1,1,tech!$H$2),BQ72),\"\")","v":""},"|",null,"Incidents and exceptions handling","Guidance","3.4.3.GX",{"$f":"IF(AND(BW72<>\"\",LEFT(BW72,1)<>\"#\"),IF(LEFT(BW72,1)=\"-\",REPLACE(BW72,1,1,tech!$H$2),BW72),\"\")","v":""},"|","- Alignment with the strategy of the organization and scope of the PKI","Availability of resources","Assessment","4.1.3.AY",{"$f":"IF(AND(CC72<>\"\",LEFT(CC72,1)<>\"#\"),IF(LEFT(CC72,1)=\"-\",REPLACE(CC72,1,1,tech!$H$2),CC72),\"\")","v":"• Alignment with the strategy of the organization and scope of the PKI"},"|","- Relevancy of the Training content","Responsible personnel receive training","Assessment","4.2.2.AY",{"$f":"IF(AND(CI72<>\"\",LEFT(CI72,1)<>\"#\"),IF(LEFT(CI72,1)=\"-\",REPLACE(CI72,1,1,tech!$H$2),CI72),\"\")","v":"• Relevancy of the Training content"},"|",null,"Disclose PKI information","References","4.3.2.RX",{"$f":"IF(AND(CO72<>\"\",LEFT(CO72,1)<>\"#\"),IF(LEFT(CO72,1)=\"-\",REPLACE(CO72,1,1,tech!$H$2),CO72),\"\")","v":""},"|"]
[null,null,"- Low probability of compromise and loosing trust","Managed","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D73,tech!$A$13:$B$17,2,0),LEFT(E73,1),IF(G73=\"\",\"X\",\"Y\"))","v":"4AY"},{"$f":"IF(IF(LEFT(C73,1)=\"-\",C73,\"\")=\"\",\"\",REPLACE(IF(LEFT(C73,1)=\"-\",C73,\"\"),1,1,tech!$H$2))","v":"• Low probability of compromise and loosing trust"},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Scope and business drivers for PKI","References","1.1.3.RY",{"$f":"IF(AND(I73<>\"\",LEFT(I73,1)<>\"#\"),IF(LEFT(I73,1)=\"-\",REPLACE(I73,1,1,tech!$H$2),I73),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|","- Interview with the management and PKI responsible personnel to confirm the CP is accurate and followed","Certificate policy is documented and published","Assessment","1.2.2.AY",{"$f":"IF(AND(O73<>\"\",LEFT(O73,1)<>\"#\"),IF(LEFT(O73,1)=\"-\",REPLACE(O73,1,1,tech!$H$2),O73),\"\")","v":"• Interview with the management and PKI responsible personnel to confirm the CP is accurate and followed"},"|","Documenting specifically \"who\" shall be responsible for ensuring PKI policies are being enforced enhances accountability and trustworthiness of the PKI by enforcing the mentality that \"someone is watching\".  This will help to mitigate risks associated with improper or malicious acts.","Responsibilities for the compliance are formally defined and assigned","Guidance","1.3.3.GY",{"$f":"IF(AND(U73<>\"\",LEFT(U73,1)<>\"#\"),IF(LEFT(U73,1)=\"-\",REPLACE(U73,1,1,tech!$H$2),U73),\"\")","v":"Documenting specifically \"who\" shall be responsible for ensuring PKI policies are being enforced enhances accountability and trustworthiness of the PKI by enforcing the mentality that \"someone is watching\".  This will help to mitigate risks associated with improper or malicious acts."},"|","The following is sample evidence and information that can be collected during the assessment:","Recurring activities are executed on time","Assessment","1.4.3.AY",{"$f":"IF(AND(AA73<>\"\",LEFT(AA73,1)<>\"#\"),IF(LEFT(AA73,1)=\"-\",REPLACE(AA73,1,1,tech!$H$2),AA73),\"\")","v":"The following is sample evidence and information that can be collected during the assessment:"},"|","Sensitive cryptographic keys are protected by hardware security modules that can have various forms and comply with security standards such as FIPS 140-3 or Common Criteria Protection Profiles. The keys may be in some case software-protected when there is no high risk associated with its compromise.","Inventory of cryptographic devices is documented and maintained","Guidance","2.1.3.GY",{"$f":"IF(AND(AG73<>\"\",LEFT(AG73,1)<>\"#\"),IF(LEFT(AG73,1)=\"-\",REPLACE(AG73,1,1,tech!$H$2),AG73),\"\")","v":"Sensitive cryptographic keys are protected by hardware security modules that can have various forms and comply with security standards such as FIPS 140-3 or Common Criteria Protection Profiles. The keys may be in some case software-protected when there is no high risk associated with its compromise."},"|","#### Guidance","Certificate lifecycle management is documented","Guidance","2.2.3.GX",{"$f":"IF(AND(AM73<>\"\",LEFT(AM73,1)<>\"#\"),IF(LEFT(AM73,1)=\"-\",REPLACE(AM73,1,1,tech!$H$2),AM73),\"\")","v":""},"|","- [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)","Separation and segmentation principles are applied","References","2.3.2.RY",{"$f":"IF(AND(AS73<>\"\",LEFT(AS73,1)<>\"#\"),IF(LEFT(AS73,1)=\"-\",REPLACE(AS73,1,1,tech!$H$2),AS73),\"\")","v":"• [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)"},"|","- Sample of change request","Request for change structure is documented and followed","Assessment","2.4.2.AY",{"$f":"IF(AND(AY73<>\"\",LEFT(AY73,1)<>\"#\"),IF(LEFT(AY73,1)=\"-\",REPLACE(AY73,1,1,tech!$H$2),AY73),\"\")","v":"• Sample of change request"},"|",null,"Business continuity planning and disaster recovery","Guidance","3.1.3.GY",{"$f":"IF(AND(BE73<>\"\",LEFT(BE73,1)<>\"#\"),IF(LEFT(BE73,1)=\"-\",REPLACE(BE73,1,1,tech!$H$2),BE73),\"\")","v":""},"|",null,"Adoption and application of open standards","Guidance","3.2.3.GX",{"$f":"IF(AND(BK73<>\"\",LEFT(BK73,1)<>\"#\"),IF(LEFT(BK73,1)=\"-\",REPLACE(BK73,1,1,tech!$H$2),BK73),\"\")","v":""},"|","#### References","Event logs from systems are collected","References","3.3.2.RX",{"$f":"IF(AND(BQ73<>\"\",LEFT(BQ73,1)<>\"#\"),IF(LEFT(BQ73,1)=\"-\",REPLACE(BQ73,1,1,tech!$H$2),BQ73),\"\")","v":""},"|","No automation is perfect and covers everything. There can be edge cases and other situations that were not part of the initial analysis or were simply forgotten. Therefore, there will always be exceptions and incidents that will require manual intervention. The automated process should be able to handle such exceptions and incidents in a way that will not cause any significant damage or disruption to the service.","Incidents and exceptions handling","Guidance","3.4.3.GY",{"$f":"IF(AND(BW73<>\"\",LEFT(BW73,1)<>\"#\"),IF(LEFT(BW73,1)=\"-\",REPLACE(BW73,1,1,tech!$H$2),BW73),\"\")","v":"No automation is perfect and covers everything. There can be edge cases and other situations that were not part of the initial analysis or were simply forgotten. Therefore, there will always be exceptions and incidents that will require manual intervention. The automated process should be able to handle such exceptions and incidents in a way that will not cause any significant damage or disruption to the service."},"|","- Review of the assignment of the resources to the tasks","Availability of resources","Assessment","4.1.3.AY",{"$f":"IF(AND(CC73<>\"\",LEFT(CC73,1)<>\"#\"),IF(LEFT(CC73,1)=\"-\",REPLACE(CC73,1,1,tech!$H$2),CC73),\"\")","v":"• Review of the assignment of the resources to the tasks"},"|","- Training is provided in accordance with the Training plan","Responsible personnel receive training","Assessment","4.2.2.AY",{"$f":"IF(AND(CI73<>\"\",LEFT(CI73,1)<>\"#\"),IF(LEFT(CI73,1)=\"-\",REPLACE(CI73,1,1,tech!$H$2),CI73),\"\")","v":"• Training is provided in accordance with the Training plan"},"|","- [RFC 3647 Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://datatracker.ietf.org/doc/html/rfc3647)","Disclose PKI information","References","4.3.2.RY",{"$f":"IF(AND(CO73<>\"\",LEFT(CO73,1)<>\"#\"),IF(LEFT(CO73,1)=\"-\",REPLACE(CO73,1,1,tech!$H$2),CO73),\"\")","v":"• [RFC 3647 Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://datatracker.ietf.org/doc/html/rfc3647)"},"|"]
[{"$nulls":3},"Managed","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D74,tech!$A$13:$B$17,2,0),LEFT(E74,1),IF(G74=\"\",\"X\",\"Y\"))","v":"4AX"},{"$f":"IF(IF(LEFT(C74,1)=\"-\",C74,\"\")=\"\",\"\",REPLACE(IF(LEFT(C74,1)=\"-\",C74,\"\"),1,1,tech!$H$2))","v":""},"|","- [The Open Group Architecture Framework (TOGAF)](https://www.opengroup.org/togaf)","Scope and business drivers for PKI","References","1.1.3.RY",{"$f":"IF(AND(I74<>\"\",LEFT(I74,1)<>\"#\"),IF(LEFT(I74,1)=\"-\",REPLACE(I74,1,1,tech!$H$2),I74),\"\")","v":"• [The Open Group Architecture Framework (TOGAF)](https://www.opengroup.org/togaf)"},"|",null,"Certificate policy is documented and published","Assessment","1.2.2.AX",{"$f":"IF(AND(O74<>\"\",LEFT(O74,1)<>\"#\"),IF(LEFT(O74,1)=\"-\",REPLACE(O74,1,1,tech!$H$2),O74),\"\")","v":""},"|",null,"Responsibilities for the compliance are formally defined and assigned","Guidance","1.3.3.GX",{"$f":"IF(AND(U74<>\"\",LEFT(U74,1)<>\"#\"),IF(LEFT(U74,1)=\"-\",REPLACE(U74,1,1,tech!$H$2),U74),\"\")","v":""},"|","- Documented business as usual activities","Recurring activities are executed on time","Assessment","1.4.3.AY",{"$f":"IF(AND(AA74<>\"\",LEFT(AA74,1)<>\"#\"),IF(LEFT(AA74,1)=\"-\",REPLACE(AA74,1,1,tech!$H$2),AA74),\"\")","v":"• Documented business as usual activities"},"|",null,"Inventory of cryptographic devices is documented and maintained","Guidance","2.1.3.GY",{"$f":"IF(AND(AG74<>\"\",LEFT(AG74,1)<>\"#\"),IF(LEFT(AG74,1)=\"-\",REPLACE(AG74,1,1,tech!$H$2),AG74),\"\")","v":""},"|",null,"Certificate lifecycle management is documented","Guidance","2.2.3.GX",{"$f":"IF(AND(AM74<>\"\",LEFT(AM74,1)<>\"#\"),IF(LEFT(AM74,1)=\"-\",REPLACE(AM74,1,1,tech!$H$2),AM74),\"\")","v":""},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Separation and segmentation principles are applied","References","2.3.2.RY",{"$f":"IF(AND(AS74<>\"\",LEFT(AS74,1)<>\"#\"),IF(LEFT(AS74,1)=\"-\",REPLACE(AS74,1,1,tech!$H$2),AS74),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|","- Review implemented changes and compare with the request for change","Request for change structure is documented and followed","Assessment","2.4.2.AY",{"$f":"IF(AND(AY74<>\"\",LEFT(AY74,1)<>\"#\"),IF(LEFT(AY74,1)=\"-\",REPLACE(AY74,1,1,tech!$H$2),AY74),\"\")","v":"• Review implemented changes and compare with the request for change"},"|","Requirements for the business continuity and disaster recovery should be properly defined. It contains backups of the PKI resources, such as hardware security modules (HSM), databases, configuration files, etc. The availability of backups should be tested regularly to ensure that the backups are available when needed, especially during the disaster.","Business continuity planning and disaster recovery","Guidance","3.1.3.GY",{"$f":"IF(AND(BE74<>\"\",LEFT(BE74,1)<>\"#\"),IF(LEFT(BE74,1)=\"-\",REPLACE(BE74,1,1,tech!$H$2),BE74),\"\")","v":"Requirements for the business continuity and disaster recovery should be properly defined. It contains backups of the PKI resources, such as hardware security modules (HSM), databases, configuration files, etc. The availability of backups should be tested regularly to ensure that the backups are available when needed, especially during the disaster."},"|","Open standards are publicly available standards that are developed and maintained by communities or standardization bodies. Open standards are developed through a consensus-based process and are available to everyone without any restrictions. Open standards are usually free to use and implement.","Adoption and application of open standards","Guidance","3.2.3.GY",{"$f":"IF(AND(BK74<>\"\",LEFT(BK74,1)<>\"#\"),IF(LEFT(BK74,1)=\"-\",REPLACE(BK74,1,1,tech!$H$2),BK74),\"\")","v":"Open standards are publicly available standards that are developed and maintained by communities or standardization bodies. Open standards are developed through a consensus-based process and are available to everyone without any restrictions. Open standards are usually free to use and implement."},"|",null,"Event logs from systems are collected","References","3.3.2.RX",{"$f":"IF(AND(BQ74<>\"\",LEFT(BQ74,1)<>\"#\"),IF(LEFT(BQ74,1)=\"-\",REPLACE(BQ74,1,1,tech!$H$2),BQ74),\"\")","v":""},"|",null,"Incidents and exceptions handling","Guidance","3.4.3.GY",{"$f":"IF(AND(BW74<>\"\",LEFT(BW74,1)<>\"#\"),IF(LEFT(BW74,1)=\"-\",REPLACE(BW74,1,1,tech!$H$2),BW74),\"\")","v":""},"|","- Utilization and performance of the services","Availability of resources","Assessment","4.1.3.AY",{"$f":"IF(AND(CC74<>\"\",LEFT(CC74,1)<>\"#\"),IF(LEFT(CC74,1)=\"-\",REPLACE(CC74,1,1,tech!$H$2),CC74),\"\")","v":"• Utilization and performance of the services"},"|","- Training Completeness","Responsible personnel receive training","Assessment","4.2.2.AY",{"$f":"IF(AND(CI74<>\"\",LEFT(CI74,1)<>\"#\"),IF(LEFT(CI74,1)=\"-\",REPLACE(CI74,1,1,tech!$H$2),CI74),\"\")","v":"• Training Completeness"},"|","- [ETSI EN 319 401 - General Policy Requirements for Trust Service Providers](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/02.03.01_60/en_319401v020301p.pdf)","Disclose PKI information","References","4.3.2.RY",{"$f":"IF(AND(CO74<>\"\",LEFT(CO74,1)<>\"#\"),IF(LEFT(CO74,1)=\"-\",REPLACE(CO74,1,1,tech!$H$2),CO74),\"\")","v":"• [ETSI EN 319 401 - General Policy Requirements for Trust Service Providers](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/02.03.01_60/en_319401v020301p.pdf)"},"|"]
[null,null,"## Optimized maturity level","Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D75,tech!$A$13:$B$17,2,0),LEFT(E75,1),IF(G75=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C75,1)=\"-\",C75,\"\")=\"\",\"\",REPLACE(IF(LEFT(C75,1)=\"-\",C75,\"\"),1,1,tech!$H$2))","v":""},"|",null,{"$f":"IF(AND(LEFT(I75,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(I75,\" \"))=3,0)),_xlfn.TEXTAFTER(I75,\" \"),J74)","v":"Scope and business drivers for PKI"},"References","1.1.3.RX",{"$f":"IF(AND(I75<>\"\",LEFT(I75,1)<>\"#\"),IF(LEFT(I75,1)=\"-\",REPLACE(I75,1,1,tech!$H$2),I75),\"\")","v":""},"|","#### References",{"$f":"IF(AND(LEFT(O75,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(O75,\" \"))=3,0)),_xlfn.TEXTAFTER(O75,\" \"),P74)","v":"Certificate policy is documented and published"},"References","1.2.2.RX",{"$f":"IF(AND(O75<>\"\",LEFT(O75,1)<>\"#\"),IF(LEFT(O75,1)=\"-\",REPLACE(O75,1,1,tech!$H$2),O75),\"\")","v":""},"|","#### Assessment",{"$f":"IF(AND(LEFT(U75,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(U75,\" \"))=3,0)),_xlfn.TEXTAFTER(U75,\" \"),V74)","v":"Responsibilities for the compliance are formally defined and assigned"},"Assessment","1.3.3.AX",{"$f":"IF(AND(U75<>\"\",LEFT(U75,1)<>\"#\"),IF(LEFT(U75,1)=\"-\",REPLACE(U75,1,1,tech!$H$2),U75),\"\")","v":""},"|","- Evidence of the business as usual activities execution",{"$f":"IF(AND(LEFT(AA75,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AA75,\" \"))=3,0)),_xlfn.TEXTAFTER(AA75,\" \"),AB74)","v":"Recurring activities are executed on time"},"Assessment","1.4.3.AY",{"$f":"IF(AND(AA75<>\"\",LEFT(AA75,1)<>\"#\"),IF(LEFT(AA75,1)=\"-\",REPLACE(AA75,1,1,tech!$H$2),AA75),\"\")","v":"• Evidence of the business as usual activities execution"},"|","The approved ways of protecting cryptographic keys should have defined rules, which can be specified by the key management policy and followed using the key management procedures. Cryptographic devices that protect keys may be quickly identified using the inventory of cryptographic keys with reference to an inventory of cryptographic devices.",{"$f":"IF(AND(LEFT(AG75,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AG75,\" \"))=3,0)),_xlfn.TEXTAFTER(AG75,\" \"),AH74)","v":"Inventory of cryptographic devices is documented and maintained"},"Guidance","2.1.3.GY",{"$f":"IF(AND(AG75<>\"\",LEFT(AG75,1)<>\"#\"),IF(LEFT(AG75,1)=\"-\",REPLACE(AG75,1,1,tech!$H$2),AG75),\"\")","v":"The approved ways of protecting cryptographic keys should have defined rules, which can be specified by the key management policy and followed using the key management procedures. Cryptographic devices that protect keys may be quickly identified using the inventory of cryptographic keys with reference to an inventory of cryptographic devices."},"|","Issuance of certificates follow specific procedures, be it manual processes or automated processes using standard or non-standard PKI protocol. An organization should be clear about the full life cycle management of certificates:",{"$f":"IF(AND(LEFT(AM75,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AM75,\" \"))=3,0)),_xlfn.TEXTAFTER(AM75,\" \"),AN74)","v":"Certificate lifecycle management is documented"},"Guidance","2.2.3.GY",{"$f":"IF(AND(AM75<>\"\",LEFT(AM75,1)<>\"#\"),IF(LEFT(AM75,1)=\"-\",REPLACE(AM75,1,1,tech!$H$2),AM75),\"\")","v":"Issuance of certificates follow specific procedures, be it manual processes or automated processes using standard or non-standard PKI protocol. An organization should be clear about the full life cycle management of certificates:"},"|",null,{"$f":"IF(AND(LEFT(AS75,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AS75,\" \"))=3,0)),_xlfn.TEXTAFTER(AS75,\" \"),AT74)","v":"Separation and segmentation principles are applied"},"References","2.3.2.RX",{"$f":"IF(AND(AS75<>\"\",LEFT(AS75,1)<>\"#\"),IF(LEFT(AS75,1)=\"-\",REPLACE(AS75,1,1,tech!$H$2),AS75),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(AY75,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AY75,\" \"))=3,0)),_xlfn.TEXTAFTER(AY75,\" \"),AZ74)","v":"Request for change structure is documented and followed"},"Assessment","2.4.2.AX",{"$f":"IF(AND(AY75<>\"\",LEFT(AY75,1)<>\"#\"),IF(LEFT(AY75,1)=\"-\",REPLACE(AY75,1,1,tech!$H$2),AY75),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(BE75,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BE75,\" \"))=3,0)),_xlfn.TEXTAFTER(BE75,\" \"),BF74)","v":"Business continuity planning and disaster recovery"},"Guidance","3.1.3.GY",{"$f":"IF(AND(BE75<>\"\",LEFT(BE75,1)<>\"#\"),IF(LEFT(BE75,1)=\"-\",REPLACE(BE75,1,1,tech!$H$2),BE75),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(BK75,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BK75,\" \"))=3,0)),_xlfn.TEXTAFTER(BK75,\" \"),BL74)","v":"Adoption and application of open standards"},"Guidance","3.2.3.GY",{"$f":"IF(AND(BK75<>\"\",LEFT(BK75,1)<>\"#\"),IF(LEFT(BK75,1)=\"-\",REPLACE(BK75,1,1,tech!$H$2),BK75),\"\")","v":""},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)",{"$f":"IF(AND(LEFT(BQ75,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BQ75,\" \"))=3,0)),_xlfn.TEXTAFTER(BQ75,\" \"),BR74)","v":"Event logs from systems are collected"},"References","3.3.2.RY",{"$f":"IF(AND(BQ75<>\"\",LEFT(BQ75,1)<>\"#\"),IF(LEFT(BQ75,1)=\"-\",REPLACE(BQ75,1,1,tech!$H$2),BQ75),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|","It may happen that some certificates are required to be handled manually and therefore the exception should be approved and documented. ",{"$f":"IF(AND(LEFT(BW75,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BW75,\" \"))=3,0)),_xlfn.TEXTAFTER(BW75,\" \"),BX74)","v":"Incidents and exceptions handling"},"Guidance","3.4.3.GY",{"$f":"IF(AND(BW75<>\"\",LEFT(BW75,1)<>\"#\"),IF(LEFT(BW75,1)=\"-\",REPLACE(BW75,1,1,tech!$H$2),BW75),\"\")","v":"It may happen that some certificates are required to be handled manually and therefore the exception should be approved and documented. "},"|",null,{"$f":"IF(AND(LEFT(CC75,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CC75,\" \"))=3,0)),_xlfn.TEXTAFTER(CC75,\" \"),CD74)","v":"Availability of resources"},"Assessment","4.1.3.AX",{"$f":"IF(AND(CC75<>\"\",LEFT(CC75,1)<>\"#\"),IF(LEFT(CC75,1)=\"-\",REPLACE(CC75,1,1,tech!$H$2),CC75),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(CI75,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CI75,\" \"))=3,0)),_xlfn.TEXTAFTER(CI75,\" \"),CJ74)","v":"Responsible personnel receive training"},"Assessment","4.2.2.AX",{"$f":"IF(AND(CI75<>\"\",LEFT(CI75,1)<>\"#\"),IF(LEFT(CI75,1)=\"-\",REPLACE(CI75,1,1,tech!$H$2),CI75),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(CO75,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CO75,\" \"))=3,0)),_xlfn.TEXTAFTER(CO75,\" \"),CP74)","v":"Disclose PKI information"},"References","4.3.2.RX",{"$f":"IF(AND(CO75<>\"\",LEFT(CO75,1)<>\"#\"),IF(LEFT(CO75,1)=\"-\",REPLACE(CO75,1,1,tech!$H$2),CO75),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D76,tech!$A$13:$B$17,2,0),LEFT(E76,1),IF(G76=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C76,1)=\"-\",C76,\"\")=\"\",\"\",REPLACE(IF(LEFT(C76,1)=\"-\",C76,\"\"),1,1,tech!$H$2))","v":""},"|","### Architecture and design of the PKI","Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I76<>\"\",LEFT(I76,1)<>\"#\"),IF(LEFT(I76,1)=\"-\",REPLACE(I76,1,1,tech!$H$2),I76),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(O76,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(O76,\" \"))=3,0)),_xlfn.TEXTAFTER(O76,\" \"),P75)","v":"Certificate policy is documented and published"},"References","1.2.2.RX",{"$f":"IF(AND(O76<>\"\",LEFT(O76,1)<>\"#\"),IF(LEFT(O76,1)=\"-\",REPLACE(O76,1,1,tech!$H$2),O76),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(U76,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(U76,\" \"))=3,0)),_xlfn.TEXTAFTER(U76,\" \"),V75)","v":"Responsibilities for the compliance are formally defined and assigned"},"Assessment","1.3.3.AX",{"$f":"IF(AND(U76<>\"\",LEFT(U76,1)<>\"#\"),IF(LEFT(U76,1)=\"-\",REPLACE(U76,1,1,tech!$H$2),U76),\"\")","v":""},"|","- business as usual activities tracking and Reporting",{"$f":"IF(AND(LEFT(AA76,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AA76,\" \"))=3,0)),_xlfn.TEXTAFTER(AA76,\" \"),AB75)","v":"Recurring activities are executed on time"},"Assessment","1.4.3.AY",{"$f":"IF(AND(AA76<>\"\",LEFT(AA76,1)<>\"#\"),IF(LEFT(AA76,1)=\"-\",REPLACE(AA76,1,1,tech!$H$2),AA76),\"\")","v":"• business as usual activities tracking and Reporting"},"|",null,{"$f":"IF(AND(LEFT(AG76,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AG76,\" \"))=3,0)),_xlfn.TEXTAFTER(AG76,\" \"),AH75)","v":"Inventory of cryptographic devices is documented and maintained"},"Guidance","2.1.3.GY",{"$f":"IF(AND(AG76<>\"\",LEFT(AG76,1)<>\"#\"),IF(LEFT(AG76,1)=\"-\",REPLACE(AG76,1,1,tech!$H$2),AG76),\"\")","v":""},"|","1. Certificate Application and the validation procedures used, by RAs and CAs",{"$f":"IF(AND(LEFT(AM76,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AM76,\" \"))=3,0)),_xlfn.TEXTAFTER(AM76,\" \"),AN75)","v":"Certificate lifecycle management is documented"},"Guidance","2.2.3.GY",{"$f":"IF(AND(AM76<>\"\",LEFT(AM76,1)<>\"#\"),IF(LEFT(AM76,1)=\"-\",REPLACE(AM76,1,1,tech!$H$2),AM76),\"\")","v":"1. Certificate Application and the validation procedures used, by RAs and CAs"},"|","### Network vulnerability management is implemented and maintained",{"$f":"IF(AND(LEFT(AS76,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AS76,\" \"))=3,0)),_xlfn.TEXTAFTER(AS76,\" \"),AT75)","v":"Network vulnerability management is implemented and maintained"},"References","2.3.3.RX",{"$f":"IF(AND(AS76<>\"\",LEFT(AS76,1)<>\"#\"),IF(LEFT(AS76,1)=\"-\",REPLACE(AS76,1,1,tech!$H$2),AS76),\"\")","v":""},"|","#### References",{"$f":"IF(AND(LEFT(AY76,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AY76,\" \"))=3,0)),_xlfn.TEXTAFTER(AY76,\" \"),AZ75)","v":"Request for change structure is documented and followed"},"References","2.4.2.RX",{"$f":"IF(AND(AY76<>\"\",LEFT(AY76,1)<>\"#\"),IF(LEFT(AY76,1)=\"-\",REPLACE(AY76,1,1,tech!$H$2),AY76),\"\")","v":""},"|","Proper measures are applied to identify the disaster and a communication matrix is maintained to ensure that the right people are informed about the disaster on time and the recovery process can be started.",{"$f":"IF(AND(LEFT(BE76,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BE76,\" \"))=3,0)),_xlfn.TEXTAFTER(BE76,\" \"),BF75)","v":"Business continuity planning and disaster recovery"},"Guidance","3.1.3.GY",{"$f":"IF(AND(BE76<>\"\",LEFT(BE76,1)<>\"#\"),IF(LEFT(BE76,1)=\"-\",REPLACE(BE76,1,1,tech!$H$2),BE76),\"\")","v":"Proper measures are applied to identify the disaster and a communication matrix is maintained to ensure that the right people are informed about the disaster on time and the recovery process can be started."},"|","The open standards are important for interoperability as they are typically technology-agnostic and are supported by technologies and solutions. Open standards are applicable for interfaces, communication protocols, cryptographic algorithms, data formats, automation and orchestration, and other aspects of the PKI.",{"$f":"IF(AND(LEFT(BK76,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BK76,\" \"))=3,0)),_xlfn.TEXTAFTER(BK76,\" \"),BL75)","v":"Adoption and application of open standards"},"Guidance","3.2.3.GY",{"$f":"IF(AND(BK76<>\"\",LEFT(BK76,1)<>\"#\"),IF(LEFT(BK76,1)=\"-\",REPLACE(BK76,1,1,tech!$H$2),BK76),\"\")","v":"The open standards are important for interoperability as they are typically technology-agnostic and are supported by technologies and solutions. Open standards are applicable for interfaces, communication protocols, cryptographic algorithms, data formats, automation and orchestration, and other aspects of the PKI."},"|","- [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)",{"$f":"IF(AND(LEFT(BQ76,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BQ76,\" \"))=3,0)),_xlfn.TEXTAFTER(BQ76,\" \"),BR75)","v":"Event logs from systems are collected"},"References","3.3.2.RY",{"$f":"IF(AND(BQ76<>\"\",LEFT(BQ76,1)<>\"#\"),IF(LEFT(BQ76,1)=\"-\",REPLACE(BQ76,1,1,tech!$H$2),BQ76),\"\")","v":"• [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)"},"|",null,{"$f":"IF(AND(LEFT(BW76,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BW76,\" \"))=3,0)),_xlfn.TEXTAFTER(BW76,\" \"),BX75)","v":"Incidents and exceptions handling"},"Guidance","3.4.3.GY",{"$f":"IF(AND(BW76<>\"\",LEFT(BW76,1)<>\"#\"),IF(LEFT(BW76,1)=\"-\",REPLACE(BW76,1,1,tech!$H$2),BW76),\"\")","v":""},"|","#### References",{"$f":"IF(AND(LEFT(CC76,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CC76,\" \"))=3,0)),_xlfn.TEXTAFTER(CC76,\" \"),CD75)","v":"Availability of resources"},"References","4.1.3.RX",{"$f":"IF(AND(CC76<>\"\",LEFT(CC76,1)<>\"#\"),IF(LEFT(CC76,1)=\"-\",REPLACE(CC76,1,1,tech!$H$2),CC76),\"\")","v":""},"|","#### References",{"$f":"IF(AND(LEFT(CI76,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CI76,\" \"))=3,0)),_xlfn.TEXTAFTER(CI76,\" \"),CJ75)","v":"Responsible personnel receive training"},"References","4.2.2.RX",{"$f":"IF(AND(CI76<>\"\",LEFT(CI76,1)<>\"#\"),IF(LEFT(CI76,1)=\"-\",REPLACE(CI76,1,1,tech!$H$2),CI76),\"\")","v":""},"|","### Establish single point of contact",{"$f":"IF(AND(LEFT(CO76,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CO76,\" \"))=3,0)),_xlfn.TEXTAFTER(CO76,\" \"),CP75)","v":"Establish single point of contact"},"References","4.3.3.RX",{"$f":"IF(AND(CO76<>\"\",LEFT(CO76,1)<>\"#\"),IF(LEFT(CO76,1)=\"-\",REPLACE(CO76,1,1,tech!$H$2),CO76),\"\")","v":""},"|"]
[null,null,"### Indicators","Optimized","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D77,tech!$A$13:$B$17,2,0),LEFT(E77,1),IF(G77=\"\",\"X\",\"Y\"))","v":"5IX"},{"$f":"IF(IF(LEFT(C77,1)=\"-\",C77,\"\")=\"\",\"\",REPLACE(IF(LEFT(C77,1)=\"-\",C77,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I77<>\"\",LEFT(I77,1)<>\"#\"),IF(LEFT(I77,1)=\"-\",REPLACE(I77,1,1,tech!$H$2),I77),\"\")","v":""},"|","- [RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://tools.ietf.org/html/rfc3647)","Certificate policy is documented and published","References","1.2.2.RY",{"$f":"IF(AND(O77<>\"\",LEFT(O77,1)<>\"#\"),IF(LEFT(O77,1)=\"-\",REPLACE(O77,1,1,tech!$H$2),O77),\"\")","v":"• [RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://tools.ietf.org/html/rfc3647)"},"|","- For each defined procedure, a specific individual or team is identified and assigned to perform the tasks associated with the procedure","Responsibilities for the compliance are formally defined and assigned","Assessment","1.3.3.AY",{"$f":"IF(AND(U77<>\"\",LEFT(U77,1)<>\"#\"),IF(LEFT(U77,1)=\"-\",REPLACE(U77,1,1,tech!$H$2),U77),\"\")","v":"• For each defined procedure, a specific individual or team is identified and assigned to perform the tasks associated with the procedure"},"|","- Calendar of activities","Recurring activities are executed on time","Assessment","1.4.3.AY",{"$f":"IF(AND(AA77<>\"\",LEFT(AA77,1)<>\"#\"),IF(LEFT(AA77,1)=\"-\",REPLACE(AA77,1,1,tech!$H$2),AA77),\"\")","v":"• Calendar of activities"},"|","The inventory of cryptographic devices should contain relevant information such as:","Inventory of cryptographic devices is documented and maintained","Guidance","2.1.3.GY",{"$f":"IF(AND(AG77<>\"\",LEFT(AG77,1)<>\"#\"),IF(LEFT(AG77,1)=\"-\",REPLACE(AG77,1,1,tech!$H$2),AG77),\"\")","v":"The inventory of cryptographic devices should contain relevant information such as:"},"|","2. Certificate Issuance and protocols used for enrollment, on-line and off-line","Certificate lifecycle management is documented","Guidance","2.2.3.GY",{"$f":"IF(AND(AM77<>\"\",LEFT(AM77,1)<>\"#\"),IF(LEFT(AM77,1)=\"-\",REPLACE(AM77,1,1,tech!$H$2),AM77),\"\")","v":"2. Certificate Issuance and protocols used for enrollment, on-line and off-line"},"|",null,"Network vulnerability management is implemented and maintained","References","2.3.3.RX",{"$f":"IF(AND(AS77<>\"\",LEFT(AS77,1)<>\"#\"),IF(LEFT(AS77,1)=\"-\",REPLACE(AS77,1,1,tech!$H$2),AS77),\"\")","v":""},"|",null,"Request for change structure is documented and followed","References","2.4.2.RX",{"$f":"IF(AND(AY77<>\"\",LEFT(AY77,1)<>\"#\"),IF(LEFT(AY77,1)=\"-\",REPLACE(AY77,1,1,tech!$H$2),AY77),\"\")","v":""},"|",null,"Business continuity planning and disaster recovery","Guidance","3.1.3.GY",{"$f":"IF(AND(BE77<>\"\",LEFT(BE77,1)<>\"#\"),IF(LEFT(BE77,1)=\"-\",REPLACE(BE77,1,1,tech!$H$2),BE77),\"\")","v":""},"|",null,"Adoption and application of open standards","Guidance","3.2.3.GY",{"$f":"IF(AND(BK77<>\"\",LEFT(BK77,1)<>\"#\"),IF(LEFT(BK77,1)=\"-\",REPLACE(BK77,1,1,tech!$H$2),BK77),\"\")","v":""},"|","- [NIST - Guide to Computer Security Log Management](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf)","Event logs from systems are collected","References","3.3.2.RY",{"$f":"IF(AND(BQ77<>\"\",LEFT(BQ77,1)<>\"#\"),IF(LEFT(BQ77,1)=\"-\",REPLACE(BQ77,1,1,tech!$H$2),BQ77),\"\")","v":"• [NIST - Guide to Computer Security Log Management](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf)"},"|","Handling of exceptional situations should be covered in the documentation, stating what should be done in case of an exception or incident:","Incidents and exceptions handling","Guidance","3.4.3.GY",{"$f":"IF(AND(BW77<>\"\",LEFT(BW77,1)<>\"#\"),IF(LEFT(BW77,1)=\"-\",REPLACE(BW77,1,1,tech!$H$2),BW77),\"\")","v":"Handling of exceptional situations should be covered in the documentation, stating what should be done in case of an exception or incident:"},"|",null,"Availability of resources","References","4.1.3.RX",{"$f":"IF(AND(CC77<>\"\",LEFT(CC77,1)<>\"#\"),IF(LEFT(CC77,1)=\"-\",REPLACE(CC77,1,1,tech!$H$2),CC77),\"\")","v":""},"|",null,"Responsible personnel receive training","References","4.2.2.RX",{"$f":"IF(AND(CI77<>\"\",LEFT(CI77,1)<>\"#\"),IF(LEFT(CI77,1)=\"-\",REPLACE(CI77,1,1,tech!$H$2),CI77),\"\")","v":""},"|",null,"Establish single point of contact","References","4.3.3.RX",{"$f":"IF(AND(CO77<>\"\",LEFT(CO77,1)<>\"#\"),IF(LEFT(CO77,1)=\"-\",REPLACE(CO77,1,1,tech!$H$2),CO77),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D78,tech!$A$13:$B$17,2,0),LEFT(E78,1),IF(G78=\"\",\"X\",\"Y\"))","v":"5IX"},{"$f":"IF(IF(LEFT(C78,1)=\"-\",C78,\"\")=\"\",\"\",REPLACE(IF(LEFT(C78,1)=\"-\",C78,\"\"),1,1,tech!$H$2))","v":""},"|","#### Guidance","Architecture and design of the PKI","Guidance","1.1.4.GX",{"$f":"IF(AND(I78<>\"\",LEFT(I78,1)<>\"#\"),IF(LEFT(I78,1)=\"-\",REPLACE(I78,1,1,tech!$H$2),I78),\"\")","v":""},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Certificate policy is documented and published","References","1.2.2.RY",{"$f":"IF(AND(O78<>\"\",LEFT(O78,1)<>\"#\"),IF(LEFT(O78,1)=\"-\",REPLACE(O78,1,1,tech!$H$2),O78),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|","- Interview with the personnel to confirm understanding of the role and responsibilities","Responsibilities for the compliance are formally defined and assigned","Assessment","1.3.3.AY",{"$f":"IF(AND(U78<>\"\",LEFT(U78,1)<>\"#\"),IF(LEFT(U78,1)=\"-\",REPLACE(U78,1,1,tech!$H$2),U78),\"\")","v":"• Interview with the personnel to confirm understanding of the role and responsibilities"},"|","- Interview with the PKI management and staff","Recurring activities are executed on time","Assessment","1.4.3.AY",{"$f":"IF(AND(AA78<>\"\",LEFT(AA78,1)<>\"#\"),IF(LEFT(AA78,1)=\"-\",REPLACE(AA78,1,1,tech!$H$2),AA78),\"\")","v":"• Interview with the PKI management and staff"},"|","- Vendor and device model Identification","Inventory of cryptographic devices is documented and maintained","Guidance","2.1.3.GY",{"$f":"IF(AND(AG78<>\"\",LEFT(AG78,1)<>\"#\"),IF(LEFT(AG78,1)=\"-\",REPLACE(AG78,1,1,tech!$H$2),AG78),\"\")","v":"• Vendor and device model Identification"},"|","3. Certificate Renewal, Re-key and Modification, upon expiration or other causes","Certificate lifecycle management is documented","Guidance","2.2.3.GY",{"$f":"IF(AND(AM78<>\"\",LEFT(AM78,1)<>\"#\"),IF(LEFT(AM78,1)=\"-\",REPLACE(AM78,1,1,tech!$H$2),AM78),\"\")","v":"3. Certificate Renewal, Re-key and Modification, upon expiration or other causes"},"|","#### Guidance","Network vulnerability management is implemented and maintained","Guidance","2.3.3.GX",{"$f":"IF(AND(AS78<>\"\",LEFT(AS78,1)<>\"#\"),IF(LEFT(AS78,1)=\"-\",REPLACE(AS78,1,1,tech!$H$2),AS78),\"\")","v":""},"|","- [COBIT (Control Objectives for Information and Related Technologies)](https://www.isaca.org/resources/cobit)","Request for change structure is documented and followed","References","2.4.2.RY",{"$f":"IF(AND(AY78<>\"\",LEFT(AY78,1)<>\"#\"),IF(LEFT(AY78,1)=\"-\",REPLACE(AY78,1,1,tech!$H$2),AY78),\"\")","v":"• [COBIT (Control Objectives for Information and Related Technologies)](https://www.isaca.org/resources/cobit)"},"|","The following parts are typically covered:","Business continuity planning and disaster recovery","Guidance","3.1.3.GY",{"$f":"IF(AND(BE78<>\"\",LEFT(BE78,1)<>\"#\"),IF(LEFT(BE78,1)=\"-\",REPLACE(BE78,1,1,tech!$H$2),BE78),\"\")","v":"The following parts are typically covered:"},"|","The adoption of open standards significant increase interoperability and reduce the risk of vendor lock-in.","Adoption and application of open standards","Guidance","3.2.3.GY",{"$f":"IF(AND(BK78<>\"\",LEFT(BK78,1)<>\"#\"),IF(LEFT(BK78,1)=\"-\",REPLACE(BK78,1,1,tech!$H$2),BK78),\"\")","v":"The adoption of open standards significant increase interoperability and reduce the risk of vendor lock-in."},"|","- [ISO/IEC 27099 - Public key infrastructure](https://www.iso.org/standard/56590.html)","Event logs from systems are collected","References","3.3.2.RY",{"$f":"IF(AND(BQ78<>\"\",LEFT(BQ78,1)<>\"#\"),IF(LEFT(BQ78,1)=\"-\",REPLACE(BQ78,1,1,tech!$H$2),BQ78),\"\")","v":"• [ISO/IEC 27099 - Public key infrastructure](https://www.iso.org/standard/56590.html)"},"|","- Communication of the exception","Incidents and exceptions handling","Guidance","3.4.3.GY",{"$f":"IF(AND(BW78<>\"\",LEFT(BW78,1)<>\"#\"),IF(LEFT(BW78,1)=\"-\",REPLACE(BW78,1,1,tech!$H$2),BW78),\"\")","v":"• Communication of the exception"},"|","- [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)","Availability of resources","References","4.1.3.RY",{"$f":"IF(AND(CC78<>\"\",LEFT(CC78,1)<>\"#\"),IF(LEFT(CC78,1)=\"-\",REPLACE(CC78,1,1,tech!$H$2),CC78),\"\")","v":"• [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)"},"|","- [NIST SP 800-16 Information Technology Security Training Requirements: a Role- and Performance-Based Model](https://csrc.nist.gov/publications/detail/sp/800-16/final)","Responsible personnel receive training","References","4.2.2.RY",{"$f":"IF(AND(CI78<>\"\",LEFT(CI78,1)<>\"#\"),IF(LEFT(CI78,1)=\"-\",REPLACE(CI78,1,1,tech!$H$2),CI78),\"\")","v":"• [NIST SP 800-16 Information Technology Security Training Requirements: a Role- and Performance-Based Model](https://csrc.nist.gov/publications/detail/sp/800-16/final)"},"|","#### Guidance","Establish single point of contact","Guidance","4.3.3.GX",{"$f":"IF(AND(CO78<>\"\",LEFT(CO78,1)<>\"#\"),IF(LEFT(CO78,1)=\"-\",REPLACE(CO78,1,1,tech!$H$2),CO78),\"\")","v":""},"|"]
[null,null,"- Well-defined CP and CPS","Optimized","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D79,tech!$A$13:$B$17,2,0),LEFT(E79,1),IF(G79=\"\",\"X\",\"Y\"))","v":"5IY"},{"$f":"IF(IF(LEFT(C79,1)=\"-\",C79,\"\")=\"\",\"\",REPLACE(IF(LEFT(C79,1)=\"-\",C79,\"\"),1,1,tech!$H$2))","v":"• Well-defined CP and CPS"},"|",null,"Architecture and design of the PKI","Guidance","1.1.4.GX",{"$f":"IF(AND(I79<>\"\",LEFT(I79,1)<>\"#\"),IF(LEFT(I79,1)=\"-\",REPLACE(I79,1,1,tech!$H$2),I79),\"\")","v":""},"|","- [ETSI EN 319 411-1 - Policy and security requirements for Trust Service Providers issuing certificates](https://www.etsi.org/deliver/etsi_en/319400_319499/31941101/01.03.01_60/en_31941101v010301p.pdf)","Certificate policy is documented and published","References","1.2.2.RY",{"$f":"IF(AND(O79<>\"\",LEFT(O79,1)<>\"#\"),IF(LEFT(O79,1)=\"-\",REPLACE(O79,1,1,tech!$H$2),O79),\"\")","v":"• [ETSI EN 319 411-1 - Policy and security requirements for Trust Service Providers issuing certificates](https://www.etsi.org/deliver/etsi_en/319400_319499/31941101/01.03.01_60/en_31941101v010301p.pdf)"},"|",null,"Responsibilities for the compliance are formally defined and assigned","Assessment","1.3.3.AX",{"$f":"IF(AND(U79<>\"\",LEFT(U79,1)<>\"#\"),IF(LEFT(U79,1)=\"-\",REPLACE(U79,1,1,tech!$H$2),U79),\"\")","v":""},"|",null,"Recurring activities are executed on time","Assessment","1.4.3.AX",{"$f":"IF(AND(AA79<>\"\",LEFT(AA79,1)<>\"#\"),IF(LEFT(AA79,1)=\"-\",REPLACE(AA79,1,1,tech!$H$2),AA79),\"\")","v":""},"|","- Serial numbers","Inventory of cryptographic devices is documented and maintained","Guidance","2.1.3.GY",{"$f":"IF(AND(AG79<>\"\",LEFT(AG79,1)<>\"#\"),IF(LEFT(AG79,1)=\"-\",REPLACE(AG79,1,1,tech!$H$2),AG79),\"\")","v":"• Serial numbers"},"|","   * Process of monitoring certificates for expiration and timely renewal processes prevent common issues","Certificate lifecycle management is documented","Guidance","2.2.3.GY",{"$f":"IF(AND(AM79<>\"\",LEFT(AM79,1)<>\"#\"),IF(LEFT(AM79,1)=\"-\",REPLACE(AM79,1,1,tech!$H$2),AM79),\"\")","v":"   * Process of monitoring certificates for expiration and timely renewal processes prevent common issues"},"|",null,"Network vulnerability management is implemented and maintained","Guidance","2.3.3.GX",{"$f":"IF(AND(AS79<>\"\",LEFT(AS79,1)<>\"#\"),IF(LEFT(AS79,1)=\"-\",REPLACE(AS79,1,1,tech!$H$2),AS79),\"\")","v":""},"|","- [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)","Request for change structure is documented and followed","References","2.4.2.RY",{"$f":"IF(AND(AY79<>\"\",LEFT(AY79,1)<>\"#\"),IF(LEFT(AY79,1)=\"-\",REPLACE(AY79,1,1,tech!$H$2),AY79),\"\")","v":"• [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)"},"|","- Scope of the business continuity and disaster recovery","Business continuity planning and disaster recovery","Guidance","3.1.3.GY",{"$f":"IF(AND(BE79<>\"\",LEFT(BE79,1)<>\"#\"),IF(LEFT(BE79,1)=\"-\",REPLACE(BE79,1,1,tech!$H$2),BE79),\"\")","v":"• Scope of the business continuity and disaster recovery"},"|",null,"Adoption and application of open standards","Guidance","3.2.3.GX",{"$f":"IF(AND(BK79<>\"\",LEFT(BK79,1)<>\"#\"),IF(LEFT(BK79,1)=\"-\",REPLACE(BK79,1,1,tech!$H$2),BK79),\"\")","v":""},"|",null,"Event logs from systems are collected","References","3.3.2.RX",{"$f":"IF(AND(BQ79<>\"\",LEFT(BQ79,1)<>\"#\"),IF(LEFT(BQ79,1)=\"-\",REPLACE(BQ79,1,1,tech!$H$2),BQ79),\"\")","v":""},"|","- Approval of the exception","Incidents and exceptions handling","Guidance","3.4.3.GY",{"$f":"IF(AND(BW79<>\"\",LEFT(BW79,1)<>\"#\"),IF(LEFT(BW79,1)=\"-\",REPLACE(BW79,1,1,tech!$H$2),BW79),\"\")","v":"• Approval of the exception"},"|",null,"Availability of resources","References","4.1.3.RX",{"$f":"IF(AND(CC79<>\"\",LEFT(CC79,1)<>\"#\"),IF(LEFT(CC79,1)=\"-\",REPLACE(CC79,1,1,tech!$H$2),CC79),\"\")","v":""},"|","- [NIST SP 800-50 Building an Information Technology Security Awareness and Training Program](https://csrc.nist.gov/publications/detail/sp/800-50/final)","Responsible personnel receive training","References","4.2.2.RY",{"$f":"IF(AND(CI79<>\"\",LEFT(CI79,1)<>\"#\"),IF(LEFT(CI79,1)=\"-\",REPLACE(CI79,1,1,tech!$H$2),CI79),\"\")","v":"• [NIST SP 800-50 Building an Information Technology Security Awareness and Training Program](https://csrc.nist.gov/publications/detail/sp/800-50/final)"},"|",null,"Establish single point of contact","Guidance","4.3.3.GX",{"$f":"IF(AND(CO79<>\"\",LEFT(CO79,1)<>\"#\"),IF(LEFT(CO79,1)=\"-\",REPLACE(CO79,1,1,tech!$H$2),CO79),\"\")","v":""},"|"]
[null,null,"- Effective procedures for certificate management exist and are followed",{"$f":"IF(AND(LEFT(C80,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(C80,\" \"))=2,0)),_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(C80,\" \"),\" \"),D79)","v":"Optimized"},{"$f":"IF(AND(LEFT(C80,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(C80,\" \"))=3,0)),_xlfn.TEXTAFTER(C80,\" \"),E79)","v":"Indicators"},{"$f":"_xlfn.CONCAT(VLOOKUP(D80,tech!$A$13:$B$17,2,0),LEFT(E80,1),IF(G80=\"\",\"X\",\"Y\"))","v":"5IY"},{"$f":"IF(IF(LEFT(C80,1)=\"-\",C80,\"\")=\"\",\"\",REPLACE(IF(LEFT(C80,1)=\"-\",C80,\"\"),1,1,tech!$H$2))","v":"• Effective procedures for certificate management exist and are followed"},"|","The architecture and design of the PKI should be documented to provide a clear understanding of the implementation and technologies that are involved. The architecture and design should be aligned with the scope and business drivers for the PKI and should be reviewed and updated regularly.",{"$f":"IF(AND(LEFT(I80,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(I80,\" \"))=3,0)),_xlfn.TEXTAFTER(I80,\" \"),J79)","v":"Architecture and design of the PKI"},{"$f":"IF(AND(LEFT(I80,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(I80,\" \"))=4,0)),_xlfn.TEXTAFTER(I80,\" \"),K79)","v":"Guidance"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(J80,$L$4:$M$13,2,0),\"\"),LEFT(K80,1),IF(M80=\"\",IF(AND(M79<>\"\",M81<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"1.1.4.GY"},{"$f":"IF(AND(I80<>\"\",LEFT(I80,1)<>\"#\"),IF(LEFT(I80,1)=\"-\",REPLACE(I80,1,1,tech!$H$2),I80),\"\")","v":"The architecture and design of the PKI should be documented to provide a clear understanding of the implementation and technologies that are involved. The architecture and design should be aligned with the scope and business drivers for the PKI and should be reviewed and updated regularly."},"|",null,"Certificate policy is documented and published",{"$f":"IF(AND(LEFT(O80,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(O80,\" \"))=4,0)),_xlfn.TEXTAFTER(O80,\" \"),Q79)","v":"References"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(P80,$R$4:$S$13,2,0),\"\"),LEFT(Q80,1),IF(S80=\"\",IF(AND(S79<>\"\",S81<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"1.2.2.RX"},{"$f":"IF(AND(O80<>\"\",LEFT(O80,1)<>\"#\"),IF(LEFT(O80,1)=\"-\",REPLACE(O80,1,1,tech!$H$2),O80),\"\")","v":""},"|","#### References","Responsibilities for the compliance are formally defined and assigned",{"$f":"IF(AND(LEFT(U80,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(U80,\" \"))=4,0)),_xlfn.TEXTAFTER(U80,\" \"),W79)","v":"References"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(V80,X$4:Y$13,2,0),\"\"),LEFT(W80,1),IF(Y80=\"\",IF(AND(Y79<>\"\",Y81<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"1.3.3.RX"},{"$f":"IF(AND(U80<>\"\",LEFT(U80,1)<>\"#\"),IF(LEFT(U80,1)=\"-\",REPLACE(U80,1,1,tech!$H$2),U80),\"\")","v":""},"|","#### References","Recurring activities are executed on time",{"$f":"IF(AND(LEFT(AA80,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AA80,\" \"))=4,0)),_xlfn.TEXTAFTER(AA80,\" \"),AC79)","v":"References"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AB80,AD$4:AE$13,2,0),\"\"),LEFT(AC80,1),IF(AE80=\"\",IF(AND(AE79<>\"\",AE81<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"1.4.3.RX"},{"$f":"IF(AND(AA80<>\"\",LEFT(AA80,1)<>\"#\"),IF(LEFT(AA80,1)=\"-\",REPLACE(AA80,1,1,tech!$H$2),AA80),\"\")","v":""},"|","- Hardware / firmware / software versions","Inventory of cryptographic devices is documented and maintained",{"$f":"IF(AND(LEFT(AG80,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AG80,\" \"))=4,0)),_xlfn.TEXTAFTER(AG80,\" \"),AI79)","v":"Guidance"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AH80,AJ$4:AK$13,2,0),\"\"),LEFT(AI80,1),IF(AK80=\"\",IF(AND(AK79<>\"\",AK81<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"2.1.3.GY"},{"$f":"IF(AND(AG80<>\"\",LEFT(AG80,1)<>\"#\"),IF(LEFT(AG80,1)=\"-\",REPLACE(AG80,1,1,tech!$H$2),AG80),\"\")","v":"• Hardware / firmware / software versions"},"|","4. Certificate Revocation","Certificate lifecycle management is documented",{"$f":"IF(AND(LEFT(AM80,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AM80,\" \"))=4,0)),_xlfn.TEXTAFTER(AM80,\" \"),AO79)","v":"Guidance"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AN80,AP$4:AQ$13,2,0),\"\"),LEFT(AO80,1),IF(AQ80=\"\",IF(AND(AQ79<>\"\",AQ81<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"2.2.3.GY"},{"$f":"IF(AND(AM80<>\"\",LEFT(AM80,1)<>\"#\"),IF(LEFT(AM80,1)=\"-\",REPLACE(AM80,1,1,tech!$H$2),AM80),\"\")","v":"4. Certificate Revocation"},"|","The network vulnerability management is a process that is used to identify, classify, remediate, and mitigate vulnerabilities in the network infrastructure and protects PKI implementation from potential attacks. The process should be implemented and maintained in order to ensure that the network infrastructure is properly secured and protected from potential attacks.","Network vulnerability management is implemented and maintained",{"$f":"IF(AND(LEFT(AS80,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AS80,\" \"))=4,0)),_xlfn.TEXTAFTER(AS80,\" \"),AU79)","v":"Guidance"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AT80,AV$4:AW$13,2,0),\"\"),LEFT(AU80,1),IF(AW80=\"\",IF(AND(AW79<>\"\",AW81<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"2.3.3.GY"},{"$f":"IF(AND(AS80<>\"\",LEFT(AS80,1)<>\"#\"),IF(LEFT(AS80,1)=\"-\",REPLACE(AS80,1,1,tech!$H$2),AS80),\"\")","v":"The network vulnerability management is a process that is used to identify, classify, remediate, and mitigate vulnerabilities in the network infrastructure and protects PKI implementation from potential attacks. The process should be implemented and maintained in order to ensure that the network infrastructure is properly secured and protected from potential attacks."},"|","- [The Information Technology Infrastructure Library (ITIL)](https://www.axelos.com/best-practice-solutions/itil)","Request for change structure is documented and followed",{"$f":"IF(AND(LEFT(AY80,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AY80,\" \"))=4,0)),_xlfn.TEXTAFTER(AY80,\" \"),BA79)","v":"References"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AZ80,BB$4:BC$13,2,0),\"\"),LEFT(BA80,1),IF(BC80=\"\",IF(AND(BC79<>\"\",BC81<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"2.4.2.RY"},{"$f":"IF(AND(AY80<>\"\",LEFT(AY80,1)<>\"#\"),IF(LEFT(AY80,1)=\"-\",REPLACE(AY80,1,1,tech!$H$2),AY80),\"\")","v":"• [The Information Technology Infrastructure Library (ITIL)](https://www.axelos.com/best-practice-solutions/itil)"},"|","- roles and responsibilities","Business continuity planning and disaster recovery",{"$f":"IF(AND(LEFT(BE80,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BE80,\" \"))=4,0)),_xlfn.TEXTAFTER(BE80,\" \"),BG79)","v":"Guidance"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BF80,BH$4:BI$13,2,0),\"\"),LEFT(BG80,1),IF(BI80=\"\",IF(AND(BI79<>\"\",BI81<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"3.1.3.GY"},{"$f":"IF(AND(BE80<>\"\",LEFT(BE80,1)<>\"#\"),IF(LEFT(BE80,1)=\"-\",REPLACE(BE80,1,1,tech!$H$2),BE80),\"\")","v":"• roles and responsibilities"},"|","#### Assessment","Adoption and application of open standards",{"$f":"IF(AND(LEFT(BK80,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BK80,\" \"))=4,0)),_xlfn.TEXTAFTER(BK80,\" \"),BM79)","v":"Assessment"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BL80,BN$4:BO$13,2,0),\"\"),LEFT(BM80,1),IF(BO80=\"\",IF(AND(BO79<>\"\",BO81<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"3.2.3.AX"},{"$f":"IF(AND(BK80<>\"\",LEFT(BK80,1)<>\"#\"),IF(LEFT(BK80,1)=\"-\",REPLACE(BK80,1,1,tech!$H$2),BK80),\"\")","v":""},"|","### Audit trail can be reconstructed from audit logs","Audit trail can be reconstructed from audit logs",{"$f":"IF(AND(LEFT(BQ80,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BQ80,\" \"))=4,0)),_xlfn.TEXTAFTER(BQ80,\" \"),BS79)","v":"References"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BR80,BT$4:BU$13,2,0),\"\"),LEFT(BS80,1),IF(BU80=\"\",IF(AND(BU79<>\"\",BU81<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"3.3.3.RX"},{"$f":"IF(AND(BQ80<>\"\",LEFT(BQ80,1)<>\"#\"),IF(LEFT(BQ80,1)=\"-\",REPLACE(BQ80,1,1,tech!$H$2),BQ80),\"\")","v":""},"|","- incident handling and reporting","Incidents and exceptions handling",{"$f":"IF(AND(LEFT(BW80,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BW80,\" \"))=4,0)),_xlfn.TEXTAFTER(BW80,\" \"),BY79)","v":"Guidance"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BX80,BZ$4:CA$13,2,0),\"\"),LEFT(BY80,1),IF(CA80=\"\",IF(AND(CA79<>\"\",CA81<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"3.4.3.GY"},{"$f":"IF(AND(BW80<>\"\",LEFT(BW80,1)<>\"#\"),IF(LEFT(BW80,1)=\"-\",REPLACE(BW80,1,1,tech!$H$2),BW80),\"\")","v":"• incident handling and reporting"},"|","### Resources are periodically reviewed","Resources are periodically reviewed",{"$f":"IF(AND(LEFT(CC80,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CC80,\" \"))=4,0)),_xlfn.TEXTAFTER(CC80,\" \"),CE79)","v":"References"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(CD80,CF$4:CG$13,2,0),\"\"),LEFT(CE80,1),IF(CG80=\"\",IF(AND(CG79<>\"\",CG81<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"4.1.4.RX"},{"$f":"IF(AND(CC80<>\"\",LEFT(CC80,1)<>\"#\"),IF(LEFT(CC80,1)=\"-\",REPLACE(CC80,1,1,tech!$H$2),CC80),\"\")","v":""},"|","- [European Cybersecurity Skills Framework (ECSF)](https://www.enisa.europa.eu/topics/education/european-cybersecurity-skills-framework)","Responsible personnel receive training",{"$f":"IF(AND(LEFT(CI80,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CI80,\" \"))=4,0)),_xlfn.TEXTAFTER(CI80,\" \"),CK79)","v":"References"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(CJ80,CL$4:CM$13,2,0),\"\"),LEFT(CK80,1),IF(CM80=\"\",IF(AND(CM79<>\"\",CM81<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"4.2.2.RY"},{"$f":"IF(AND(CI80<>\"\",LEFT(CI80,1)<>\"#\"),IF(LEFT(CI80,1)=\"-\",REPLACE(CI80,1,1,tech!$H$2),CI80),\"\")","v":"• [European Cybersecurity Skills Framework (ECSF)](https://www.enisa.europa.eu/topics/education/european-cybersecurity-skills-framework)"},"|","The single point of contact (SPOC) provides a convenient way for any PKI participant to contact the organization and responsible personnel of the PKI implementation. The single point of contact should be available 24/7 and should be able to provide relevant information and trigger appropriate procedures if needed based on the situation.","Establish single point of contact",{"$f":"IF(AND(LEFT(CO80,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CO80,\" \"))=4,0)),_xlfn.TEXTAFTER(CO80,\" \"),CQ79)","v":"Guidance"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(CP80,CR$4:CS$13,2,0),\"\"),LEFT(CQ80,1),IF(CS80=\"\",IF(AND(CS79<>\"\",CS81<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"4.3.3.GY"},{"$f":"IF(AND(CO80<>\"\",LEFT(CO80,1)<>\"#\"),IF(LEFT(CO80,1)=\"-\",REPLACE(CO80,1,1,tech!$H$2),CO80),\"\")","v":"The single point of contact (SPOC) provides a convenient way for any PKI participant to contact the organization and responsible personnel of the PKI implementation. The single point of contact should be available 24/7 and should be able to provide relevant information and trigger appropriate procedures if needed based on the situation."},"|"]
[null,null,"- resources with knowledge and experience available","Optimized","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D81,tech!$A$13:$B$17,2,0),LEFT(E81,1),IF(G81=\"\",\"X\",\"Y\"))","v":"5IY"},{"$f":"IF(IF(LEFT(C81,1)=\"-\",C81,\"\")=\"\",\"\",REPLACE(IF(LEFT(C81,1)=\"-\",C81,\"\"),1,1,tech!$H$2))","v":"• resources with knowledge and experience available"},"|",null,"Architecture and design of the PKI","Guidance","1.1.4.GY",{"$f":"IF(AND(I81<>\"\",LEFT(I81,1)<>\"#\"),IF(LEFT(I81,1)=\"-\",REPLACE(I81,1,1,tech!$H$2),I81),\"\")","v":""},"|","### Certification practice statement is documented and published","Certification practice statement is documented and published","References","1.2.3.RX",{"$f":"IF(AND(O81<>\"\",LEFT(O81,1)<>\"#\"),IF(LEFT(O81,1)=\"-\",REPLACE(O81,1,1,tech!$H$2),O81),\"\")","v":""},"|",null,"Responsibilities for the compliance are formally defined and assigned","References","1.3.3.RX",{"$f":"IF(AND(U81<>\"\",LEFT(U81,1)<>\"#\"),IF(LEFT(U81,1)=\"-\",REPLACE(U81,1,1,tech!$H$2),U81),\"\")","v":""},"|",null,"Recurring activities are executed on time","References","1.4.3.RX",{"$f":"IF(AND(AA81<>\"\",LEFT(AA81,1)<>\"#\"),IF(LEFT(AA81,1)=\"-\",REPLACE(AA81,1,1,tech!$H$2),AA81),\"\")","v":""},"|","- Security certification and expiration dates","Inventory of cryptographic devices is documented and maintained","Guidance","2.1.3.GY",{"$f":"IF(AND(AG81<>\"\",LEFT(AG81,1)<>\"#\"),IF(LEFT(AG81,1)=\"-\",REPLACE(AG81,1,1,tech!$H$2),AG81),\"\")","v":"• Security certification and expiration dates"},"|","   * When certificates need to be revoked it is important to have a well-defined certificate revocation process:","Certificate lifecycle management is documented","Guidance","2.2.3.GY",{"$f":"IF(AND(AM81<>\"\",LEFT(AM81,1)<>\"#\"),IF(LEFT(AM81,1)=\"-\",REPLACE(AM81,1,1,tech!$H$2),AM81),\"\")","v":"   * When certificates need to be revoked it is important to have a well-defined certificate revocation process:"},"|",null,"Network vulnerability management is implemented and maintained","Guidance","2.3.3.GY",{"$f":"IF(AND(AS81<>\"\",LEFT(AS81,1)<>\"#\"),IF(LEFT(AS81,1)=\"-\",REPLACE(AS81,1,1,tech!$H$2),AS81),\"\")","v":""},"|",null,"Request for change structure is documented and followed","References","2.4.2.RX",{"$f":"IF(AND(AY81<>\"\",LEFT(AY81,1)<>\"#\"),IF(LEFT(AY81,1)=\"-\",REPLACE(AY81,1,1,tech!$H$2),AY81),\"\")","v":""},"|","- Activation of disaster recovery","Business continuity planning and disaster recovery","Guidance","3.1.3.GY",{"$f":"IF(AND(BE81<>\"\",LEFT(BE81,1)<>\"#\"),IF(LEFT(BE81,1)=\"-\",REPLACE(BE81,1,1,tech!$H$2),BE81),\"\")","v":"• Activation of disaster recovery"},"|",null,"Adoption and application of open standards","Assessment","3.2.3.AX",{"$f":"IF(AND(BK81<>\"\",LEFT(BK81,1)<>\"#\"),IF(LEFT(BK81,1)=\"-\",REPLACE(BK81,1,1,tech!$H$2),BK81),\"\")","v":""},"|",null,"Audit trail can be reconstructed from audit logs","References","3.3.3.RX",{"$f":"IF(AND(BQ81<>\"\",LEFT(BQ81,1)<>\"#\"),IF(LEFT(BQ81,1)=\"-\",REPLACE(BQ81,1,1,tech!$H$2),BQ81),\"\")","v":""},"|","- any other relevant information","Incidents and exceptions handling","Guidance","3.4.3.GY",{"$f":"IF(AND(BW81<>\"\",LEFT(BW81,1)<>\"#\"),IF(LEFT(BW81,1)=\"-\",REPLACE(BW81,1,1,tech!$H$2),BW81),\"\")","v":"• any other relevant information"},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC81<>\"\",LEFT(CC81,1)<>\"#\"),IF(LEFT(CC81,1)=\"-\",REPLACE(CC81,1,1,tech!$H$2),CC81),\"\")","v":""},"|",null,"Responsible personnel receive training","References","4.2.2.RX",{"$f":"IF(AND(CI81<>\"\",LEFT(CI81,1)<>\"#\"),IF(LEFT(CI81,1)=\"-\",REPLACE(CI81,1,1,tech!$H$2),CI81),\"\")","v":""},"|",null,"Establish single point of contact","Guidance","4.3.3.GY",{"$f":"IF(AND(CO81<>\"\",LEFT(CO81,1)<>\"#\"),IF(LEFT(CO81,1)=\"-\",REPLACE(CO81,1,1,tech!$H$2),CO81),\"\")","v":""},"|"]
[null,null,"- Consistent PKI with alignment to current practice and regulation","Optimized","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D82,tech!$A$13:$B$17,2,0),LEFT(E82,1),IF(G82=\"\",\"X\",\"Y\"))","v":"5IY"},{"$f":"IF(IF(LEFT(C82,1)=\"-\",C82,\"\")=\"\",\"\",REPLACE(IF(LEFT(C82,1)=\"-\",C82,\"\"),1,1,tech!$H$2))","v":"• Consistent PKI with alignment to current practice and regulation"},"|","The architecture and design typically consists of the following:","Architecture and design of the PKI","Guidance","1.1.4.GY",{"$f":"IF(AND(I82<>\"\",LEFT(I82,1)<>\"#\"),IF(LEFT(I82,1)=\"-\",REPLACE(I82,1,1,tech!$H$2),I82),\"\")","v":"The architecture and design typically consists of the following:"},"|",null,"Certification practice statement is documented and published","References","1.2.3.RX",{"$f":"IF(AND(O82<>\"\",LEFT(O82,1)<>\"#\"),IF(LEFT(O82,1)=\"-\",REPLACE(O82,1,1,tech!$H$2),O82),\"\")","v":""},"|","- [ISO 37301 - Compliance management systems and related standard](https://www.iso.org/standard/75080.html)","Responsibilities for the compliance are formally defined and assigned","References","1.3.3.RY",{"$f":"IF(AND(U82<>\"\",LEFT(U82,1)<>\"#\"),IF(LEFT(U82,1)=\"-\",REPLACE(U82,1,1,tech!$H$2),U82),\"\")","v":"• [ISO 37301 - Compliance management systems and related standard](https://www.iso.org/standard/75080.html)"},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Recurring activities are executed on time","References","1.4.3.RY",{"$f":"IF(AND(AA82<>\"\",LEFT(AA82,1)<>\"#\"),IF(LEFT(AA82,1)=\"-\",REPLACE(AA82,1,1,tech!$H$2),AA82),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|","- Locations","Inventory of cryptographic devices is documented and maintained","Guidance","2.1.3.GY",{"$f":"IF(AND(AG82<>\"\",LEFT(AG82,1)<>\"#\"),IF(LEFT(AG82,1)=\"-\",REPLACE(AG82,1,1,tech!$H$2),AG82),\"\")","v":"• Locations"},"|","     * How subjects can request a certificate be revoked","Certificate lifecycle management is documented","Guidance","2.2.3.GY",{"$f":"IF(AND(AM82<>\"\",LEFT(AM82,1)<>\"#\"),IF(LEFT(AM82,1)=\"-\",REPLACE(AM82,1,1,tech!$H$2),AM82),\"\")","v":"     * How subjects can request a certificate be revoked"},"|","The network vulnerability management should include the following:","Network vulnerability management is implemented and maintained","Guidance","2.3.3.GY",{"$f":"IF(AND(AS82<>\"\",LEFT(AS82,1)<>\"#\"),IF(LEFT(AS82,1)=\"-\",REPLACE(AS82,1,1,tech!$H$2),AS82),\"\")","v":"The network vulnerability management should include the following:"},"|","### The change management process is documented and implemented","The change management process is documented and implemented","References","2.4.3.RX",{"$f":"IF(AND(AY82<>\"\",LEFT(AY82,1)<>\"#\"),IF(LEFT(AY82,1)=\"-\",REPLACE(AY82,1,1,tech!$H$2),AY82),\"\")","v":""},"|","- Physical Locations","Business continuity planning and disaster recovery","Guidance","3.1.3.GY",{"$f":"IF(AND(BE82<>\"\",LEFT(BE82,1)<>\"#\"),IF(LEFT(BE82,1)=\"-\",REPLACE(BE82,1,1,tech!$H$2),BE82),\"\")","v":"• Physical Locations"},"|","The following evidence should be available for the assessment of the requirement:","Adoption and application of open standards","Assessment","3.2.3.AY",{"$f":"IF(AND(BK82<>\"\",LEFT(BK82,1)<>\"#\"),IF(LEFT(BK82,1)=\"-\",REPLACE(BK82,1,1,tech!$H$2),BK82),\"\")","v":"The following evidence should be available for the assessment of the requirement:"},"|","#### Guidance","Audit trail can be reconstructed from audit logs","Guidance","3.3.3.GX",{"$f":"IF(AND(BQ82<>\"\",LEFT(BQ82,1)<>\"#\"),IF(LEFT(BQ82,1)=\"-\",REPLACE(BQ82,1,1,tech!$H$2),BQ82),\"\")","v":""},"|",null,"Incidents and exceptions handling","Guidance","3.4.3.GY",{"$f":"IF(AND(BW82<>\"\",LEFT(BW82,1)<>\"#\"),IF(LEFT(BW82,1)=\"-\",REPLACE(BW82,1,1,tech!$H$2),BW82),\"\")","v":""},"|","#### Guidance","Resources are periodically reviewed","Guidance","4.1.4.GX",{"$f":"IF(AND(CC82<>\"\",LEFT(CC82,1)<>\"#\"),IF(LEFT(CC82,1)=\"-\",REPLACE(CC82,1,1,tech!$H$2),CC82),\"\")","v":""},"|","### Perform security awareness training","Perform security awareness training","References","4.2.3.RX",{"$f":"IF(AND(CI82<>\"\",LEFT(CI82,1)<>\"#\"),IF(LEFT(CI82,1)=\"-\",REPLACE(CI82,1,1,tech!$H$2),CI82),\"\")","v":""},"|","Contact information for the SPOC should be disclosed to all PKI participants.","Establish single point of contact","Guidance","4.3.3.GY",{"$f":"IF(AND(CO82<>\"\",LEFT(CO82,1)<>\"#\"),IF(LEFT(CO82,1)=\"-\",REPLACE(CO82,1,1,tech!$H$2),CO82),\"\")","v":"Contact information for the SPOC should be disclosed to all PKI participants."},"|"]
[null,null,"- Future proof","Optimized","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D83,tech!$A$13:$B$17,2,0),LEFT(E83,1),IF(G83=\"\",\"X\",\"Y\"))","v":"5IY"},{"$f":"IF(IF(LEFT(C83,1)=\"-\",C83,\"\")=\"\",\"\",REPLACE(IF(LEFT(C83,1)=\"-\",C83,\"\"),1,1,tech!$H$2))","v":"• Future proof"},"|","- Functional and technical design description","Architecture and design of the PKI","Guidance","1.1.4.GY",{"$f":"IF(AND(I83<>\"\",LEFT(I83,1)<>\"#\"),IF(LEFT(I83,1)=\"-\",REPLACE(I83,1,1,tech!$H$2),I83),\"\")","v":"• Functional and technical design description"},"|","#### Guidance","Certification practice statement is documented and published","Guidance","1.2.3.GX",{"$f":"IF(AND(O83<>\"\",LEFT(O83,1)<>\"#\"),IF(LEFT(O83,1)=\"-\",REPLACE(O83,1,1,tech!$H$2),O83),\"\")","v":""},"|","- [NIST Risk Management Framework](https://csrc.nist.gov/Projects/risk-management)","Responsibilities for the compliance are formally defined and assigned","References","1.3.3.RY",{"$f":"IF(AND(U83<>\"\",LEFT(U83,1)<>\"#\"),IF(LEFT(U83,1)=\"-\",REPLACE(U83,1,1,tech!$H$2),U83),\"\")","v":"• [NIST Risk Management Framework](https://csrc.nist.gov/Projects/risk-management)"},"|","- [RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://tools.ietf.org/html/rfc3647)","Recurring activities are executed on time","References","1.4.3.RY",{"$f":"IF(AND(AA83<>\"\",LEFT(AA83,1)<>\"#\"),IF(LEFT(AA83,1)=\"-\",REPLACE(AA83,1,1,tech!$H$2),AA83),\"\")","v":"• [RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://tools.ietf.org/html/rfc3647)"},"|",null,"Inventory of cryptographic devices is documented and maintained","Guidance","2.1.3.GX",{"$f":"IF(AND(AG83<>\"\",LEFT(AG83,1)<>\"#\"),IF(LEFT(AG83,1)=\"-\",REPLACE(AG83,1,1,tech!$H$2),AG83),\"\")","v":""},"|","     * How to report misuse of certificates","Certificate lifecycle management is documented","Guidance","2.2.3.GY",{"$f":"IF(AND(AM83<>\"\",LEFT(AM83,1)<>\"#\"),IF(LEFT(AM83,1)=\"-\",REPLACE(AM83,1,1,tech!$H$2),AM83),\"\")","v":"     * How to report misuse of certificates"},"|","- Included in the overall vulnerability management process","Network vulnerability management is implemented and maintained","Guidance","2.3.3.GY",{"$f":"IF(AND(AS83<>\"\",LEFT(AS83,1)<>\"#\"),IF(LEFT(AS83,1)=\"-\",REPLACE(AS83,1,1,tech!$H$2),AS83),\"\")","v":"• Included in the overall vulnerability management process"},"|",null,"The change management process is documented and implemented","References","2.4.3.RX",{"$f":"IF(AND(AY83<>\"\",LEFT(AY83,1)<>\"#\"),IF(LEFT(AY83,1)=\"-\",REPLACE(AY83,1,1,tech!$H$2),AY83),\"\")","v":""},"|","- Communication matrix","Business continuity planning and disaster recovery","Guidance","3.1.3.GY",{"$f":"IF(AND(BE83<>\"\",LEFT(BE83,1)<>\"#\"),IF(LEFT(BE83,1)=\"-\",REPLACE(BE83,1,1,tech!$H$2),BE83),\"\")","v":"• Communication matrix"},"|","- Documented list of open standards used by the PKI","Adoption and application of open standards","Assessment","3.2.3.AY",{"$f":"IF(AND(BK83<>\"\",LEFT(BK83,1)<>\"#\"),IF(LEFT(BK83,1)=\"-\",REPLACE(BK83,1,1,tech!$H$2),BK83),\"\")","v":"• Documented list of open standards used by the PKI"},"|",null,"Audit trail can be reconstructed from audit logs","Guidance","3.3.3.GX",{"$f":"IF(AND(BQ83<>\"\",LEFT(BQ83,1)<>\"#\"),IF(LEFT(BQ83,1)=\"-\",REPLACE(BQ83,1,1,tech!$H$2),BQ83),\"\")","v":""},"|","The handling of exceptions should be tested and verified on a regular basis to ensure that the process is working as expected.","Incidents and exceptions handling","Guidance","3.4.3.GY",{"$f":"IF(AND(BW83<>\"\",LEFT(BW83,1)<>\"#\"),IF(LEFT(BW83,1)=\"-\",REPLACE(BW83,1,1,tech!$H$2),BW83),\"\")","v":"The handling of exceptions should be tested and verified on a regular basis to ensure that the process is working as expected."},"|",null,"Resources are periodically reviewed","Guidance","4.1.4.GX",{"$f":"IF(AND(CC83<>\"\",LEFT(CC83,1)<>\"#\"),IF(LEFT(CC83,1)=\"-\",REPLACE(CC83,1,1,tech!$H$2),CC83),\"\")","v":""},"|",null,"Perform security awareness training","References","4.2.3.RX",{"$f":"IF(AND(CI83<>\"\",LEFT(CI83,1)<>\"#\"),IF(LEFT(CI83,1)=\"-\",REPLACE(CI83,1,1,tech!$H$2),CI83),\"\")","v":""},"|","The SPOC may be reached through different communication channels, such as:","Establish single point of contact","Guidance","4.3.3.GY",{"$f":"IF(AND(CO83<>\"\",LEFT(CO83,1)<>\"#\"),IF(LEFT(CO83,1)=\"-\",REPLACE(CO83,1,1,tech!$H$2),CO83),\"\")","v":"The SPOC may be reached through different communication channels, such as:"},"|"]
[{"$nulls":3},"Optimized","Indicators",{"$f":"_xlfn.CONCAT(VLOOKUP(D84,tech!$A$13:$B$17,2,0),LEFT(E84,1),IF(G84=\"\",\"X\",\"Y\"))","v":"5IX"},{"$f":"IF(IF(LEFT(C84,1)=\"-\",C84,\"\")=\"\",\"\",REPLACE(IF(LEFT(C84,1)=\"-\",C84,\"\"),1,1,tech!$H$2))","v":""},"|","- description of logical components","Architecture and design of the PKI",{"$f":"IF(AND(LEFT(I84,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(I84,\" \"))=4,0)),_xlfn.TEXTAFTER(I84,\" \"),K83)","v":"Guidance"},"1.1.4.GY",{"$f":"IF(AND(I84<>\"\",LEFT(I84,1)<>\"#\"),IF(LEFT(I84,1)=\"-\",REPLACE(I84,1,1,tech!$H$2),I84),\"\")","v":"• description of logical components"},"|",null,"Certification practice statement is documented and published",{"$f":"IF(AND(LEFT(O84,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(O84,\" \"))=4,0)),_xlfn.TEXTAFTER(O84,\" \"),Q83)","v":"Guidance"},"1.2.3.GX",{"$f":"IF(AND(O84<>\"\",LEFT(O84,1)<>\"#\"),IF(LEFT(O84,1)=\"-\",REPLACE(O84,1,1,tech!$H$2),O84),\"\")","v":""},"|",null,"Responsibilities for the compliance are formally defined and assigned",{"$f":"IF(AND(LEFT(U84,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(U84,\" \"))=4,0)),_xlfn.TEXTAFTER(U84,\" \"),W83)","v":"References"},"1.3.3.RX",{"$f":"IF(AND(U84<>\"\",LEFT(U84,1)<>\"#\"),IF(LEFT(U84,1)=\"-\",REPLACE(U84,1,1,tech!$H$2),U84),\"\")","v":""},"|",null,"Recurring activities are executed on time",{"$f":"IF(AND(LEFT(AA84,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AA84,\" \"))=4,0)),_xlfn.TEXTAFTER(AA84,\" \"),AC83)","v":"References"},"1.4.3.RX",{"$f":"IF(AND(AA84<>\"\",LEFT(AA84,1)<>\"#\"),IF(LEFT(AA84,1)=\"-\",REPLACE(AA84,1,1,tech!$H$2),AA84),\"\")","v":""},"|","#### Assessment","Inventory of cryptographic devices is documented and maintained",{"$f":"IF(AND(LEFT(AG84,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AG84,\" \"))=4,0)),_xlfn.TEXTAFTER(AG84,\" \"),AI83)","v":"Assessment"},"2.1.3.AX",{"$f":"IF(AND(AG84<>\"\",LEFT(AG84,1)<>\"#\"),IF(LEFT(AG84,1)=\"-\",REPLACE(AG84,1,1,tech!$H$2),AG84),\"\")","v":""},"|","     * Expected time for revocation to be completed after a revocation request","Certificate lifecycle management is documented",{"$f":"IF(AND(LEFT(AM84,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AM84,\" \"))=4,0)),_xlfn.TEXTAFTER(AM84,\" \"),AO83)","v":"Guidance"},"2.2.3.GY",{"$f":"IF(AND(AM84<>\"\",LEFT(AM84,1)<>\"#\"),IF(LEFT(AM84,1)=\"-\",REPLACE(AM84,1,1,tech!$H$2),AM84),\"\")","v":"     * Expected time for revocation to be completed after a revocation request"},"|","- Periodical scanning of the network infrastructure","Network vulnerability management is implemented and maintained",{"$f":"IF(AND(LEFT(AS84,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AS84,\" \"))=4,0)),_xlfn.TEXTAFTER(AS84,\" \"),AU83)","v":"Guidance"},"2.3.3.GY",{"$f":"IF(AND(AS84<>\"\",LEFT(AS84,1)<>\"#\"),IF(LEFT(AS84,1)=\"-\",REPLACE(AS84,1,1,tech!$H$2),AS84),\"\")","v":"• Periodical scanning of the network infrastructure"},"|","#### Guidance","The change management process is documented and implemented",{"$f":"IF(AND(LEFT(AY84,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AY84,\" \"))=4,0)),_xlfn.TEXTAFTER(AY84,\" \"),BA83)","v":"Guidance"},"2.4.3.GX",{"$f":"IF(AND(AY84<>\"\",LEFT(AY84,1)<>\"#\"),IF(LEFT(AY84,1)=\"-\",REPLACE(AY84,1,1,tech!$H$2),AY84),\"\")","v":""},"|","- other requirements and information needed","Business continuity planning and disaster recovery",{"$f":"IF(AND(LEFT(BE84,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BE84,\" \"))=4,0)),_xlfn.TEXTAFTER(BE84,\" \"),BG83)","v":"Guidance"},"3.1.3.GY",{"$f":"IF(AND(BE84<>\"\",LEFT(BE84,1)<>\"#\"),IF(LEFT(BE84,1)=\"-\",REPLACE(BE84,1,1,tech!$H$2),BE84),\"\")","v":"• other requirements and information needed"},"|","- Policies requiring the use of open standards","Adoption and application of open standards",{"$f":"IF(AND(LEFT(BK84,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BK84,\" \"))=4,0)),_xlfn.TEXTAFTER(BK84,\" \"),BM83)","v":"Assessment"},"3.2.3.AY",{"$f":"IF(AND(BK84<>\"\",LEFT(BK84,1)<>\"#\"),IF(LEFT(BK84,1)=\"-\",REPLACE(BK84,1,1,tech!$H$2),BK84),\"\")","v":"• Policies requiring the use of open standards"},"|","Audit logging should be implemented to ensure that the audit trail can be reconstructed from audit logs any time. Audit logs are typically recorded for any user executed events that are important for security of the PKI implementation. Audit logs should be stored in a secure location. The audit logs should be protected against unauthorized access, modification, and deletion.","Audit trail can be reconstructed from audit logs",{"$f":"IF(AND(LEFT(BQ84,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BQ84,\" \"))=4,0)),_xlfn.TEXTAFTER(BQ84,\" \"),BS83)","v":"Guidance"},"3.3.3.GY",{"$f":"IF(AND(BQ84<>\"\",LEFT(BQ84,1)<>\"#\"),IF(LEFT(BQ84,1)=\"-\",REPLACE(BQ84,1,1,tech!$H$2),BQ84),\"\")","v":"Audit logging should be implemented to ensure that the audit trail can be reconstructed from audit logs any time. Audit logs are typically recorded for any user executed events that are important for security of the PKI implementation. Audit logs should be stored in a secure location. The audit logs should be protected against unauthorized access, modification, and deletion."},"|",null,"Incidents and exceptions handling",{"$f":"IF(AND(LEFT(BW84,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BW84,\" \"))=4,0)),_xlfn.TEXTAFTER(BW84,\" \"),BY83)","v":"Guidance"},"3.4.3.GX",{"$f":"IF(AND(BW84<>\"\",LEFT(BW84,1)<>\"#\"),IF(LEFT(BW84,1)=\"-\",REPLACE(BW84,1,1,tech!$H$2),BW84),\"\")","v":""},"|","Resource should be periodically reviewed to ensure the accurate use of the resources and secure operations. Frequency of the review depends on the complexity and criticality of the infrastructure. Good practice is to perform reviews at least once a year.","Resources are periodically reviewed",{"$f":"IF(AND(LEFT(CC84,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CC84,\" \"))=4,0)),_xlfn.TEXTAFTER(CC84,\" \"),CE83)","v":"Guidance"},"4.1.4.GY",{"$f":"IF(AND(CC84<>\"\",LEFT(CC84,1)<>\"#\"),IF(LEFT(CC84,1)=\"-\",REPLACE(CC84,1,1,tech!$H$2),CC84),\"\")","v":"Resource should be periodically reviewed to ensure the accurate use of the resources and secure operations. Frequency of the review depends on the complexity and criticality of the infrastructure. Good practice is to perform reviews at least once a year."},"|","#### Guidance","Perform security awareness training",{"$f":"IF(AND(LEFT(CI84,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CI84,\" \"))=4,0)),_xlfn.TEXTAFTER(CI84,\" \"),CK83)","v":"Guidance"},"4.2.3.GX",{"$f":"IF(AND(CI84<>\"\",LEFT(CI84,1)<>\"#\"),IF(LEFT(CI84,1)=\"-\",REPLACE(CI84,1,1,tech!$H$2),CI84),\"\")","v":""},"|","- Email","Establish single point of contact",{"$f":"IF(AND(LEFT(CO84,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CO84,\" \"))=4,0)),_xlfn.TEXTAFTER(CO84,\" \"),CQ83)","v":"Guidance"},"4.3.3.GY",{"$f":"IF(AND(CO84<>\"\",LEFT(CO84,1)<>\"#\"),IF(LEFT(CO84,1)=\"-\",REPLACE(CO84,1,1,tech!$H$2),CO84),\"\")","v":"• Email"},"|"]
[null,null,"### Associated risks","Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D85,tech!$A$13:$B$17,2,0),LEFT(E85,1),IF(G85=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C85,1)=\"-\",C85,\"\")=\"\",\"\",REPLACE(IF(LEFT(C85,1)=\"-\",C85,\"\"),1,1,tech!$H$2))","v":""},"|","- Network infrastructure design","Architecture and design of the PKI",{"$f":"IF(AND(LEFT(I85,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(I85,\" \"))=4,0)),_xlfn.TEXTAFTER(I85,\" \"),K84)","v":"Guidance"},"1.1.4.GY",{"$f":"IF(AND(I85<>\"\",LEFT(I85,1)<>\"#\"),IF(LEFT(I85,1)=\"-\",REPLACE(I85,1,1,tech!$H$2),I85),\"\")","v":"• Network infrastructure design"},"|","In addition to a CP, there is typically a Certification Practice Statement (CPS). While a CP is more at a strategic level, detailed information about how things should be carried out is part of a CPS (tactical level). The CP and CPS can be combined into a single managed document, however they are typically split for most of the PKI implementations for better orientation.","Certification practice statement is documented and published",{"$f":"IF(AND(LEFT(O85,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(O85,\" \"))=4,0)),_xlfn.TEXTAFTER(O85,\" \"),Q84)","v":"Guidance"},"1.2.3.GY",{"$f":"IF(AND(O85<>\"\",LEFT(O85,1)<>\"#\"),IF(LEFT(O85,1)=\"-\",REPLACE(O85,1,1,tech!$H$2),O85),\"\")","v":"In addition to a CP, there is typically a Certification Practice Statement (CPS). While a CP is more at a strategic level, detailed information about how things should be carried out is part of a CPS (tactical level). The CP and CPS can be combined into a single managed document, however they are typically split for most of the PKI implementations for better orientation."},"|","### List of relevant laws, regulations, and standards, exist and is maintained","List of relevant laws, regulations, and standards, exist and is maintained",{"$f":"IF(AND(LEFT(U85,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(U85,\" \"))=4,0)),_xlfn.TEXTAFTER(U85,\" \"),W84)","v":"References"},"1.3.4.RX",{"$f":"IF(AND(U85<>\"\",LEFT(U85,1)<>\"#\"),IF(LEFT(U85,1)=\"-\",REPLACE(U85,1,1,tech!$H$2),U85),\"\")","v":""},"|","### Evidence from procedures is collected and maintained","Evidence from procedures is collected and maintained",{"$f":"IF(AND(LEFT(AA85,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AA85,\" \"))=4,0)),_xlfn.TEXTAFTER(AA85,\" \"),AC84)","v":"References"},"1.4.4.RX",{"$f":"IF(AND(AA85<>\"\",LEFT(AA85,1)<>\"#\"),IF(LEFT(AA85,1)=\"-\",REPLACE(AA85,1,1,tech!$H$2),AA85),\"\")","v":""},"|",null,"Inventory of cryptographic devices is documented and maintained",{"$f":"IF(AND(LEFT(AG85,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AG85,\" \"))=4,0)),_xlfn.TEXTAFTER(AG85,\" \"),AI84)","v":"Assessment"},"2.1.3.AX",{"$f":"IF(AND(AG85<>\"\",LEFT(AG85,1)<>\"#\"),IF(LEFT(AG85,1)=\"-\",REPLACE(AG85,1,1,tech!$H$2),AG85),\"\")","v":""},"|","5. Certificate status dissemination","Certificate lifecycle management is documented",{"$f":"IF(AND(LEFT(AM85,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AM85,\" \"))=4,0)),_xlfn.TEXTAFTER(AM85,\" \"),AO84)","v":"Guidance"},"2.2.3.GY",{"$f":"IF(AND(AM85<>\"\",LEFT(AM85,1)<>\"#\"),IF(LEFT(AM85,1)=\"-\",REPLACE(AM85,1,1,tech!$H$2),AM85),\"\")","v":"5. Certificate status dissemination"},"|","- Identification of vulnerabilities","Network vulnerability management is implemented and maintained",{"$f":"IF(AND(LEFT(AS85,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AS85,\" \"))=4,0)),_xlfn.TEXTAFTER(AS85,\" \"),AU84)","v":"Guidance"},"2.3.3.GY",{"$f":"IF(AND(AS85<>\"\",LEFT(AS85,1)<>\"#\"),IF(LEFT(AS85,1)=\"-\",REPLACE(AS85,1,1,tech!$H$2),AS85),\"\")","v":"• Identification of vulnerabilities"},"|",null,"The change management process is documented and implemented",{"$f":"IF(AND(LEFT(AY85,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AY85,\" \"))=4,0)),_xlfn.TEXTAFTER(AY85,\" \"),BA84)","v":"Guidance"},"2.4.3.GX",{"$f":"IF(AND(AY85<>\"\",LEFT(AY85,1)<>\"#\"),IF(LEFT(AY85,1)=\"-\",REPLACE(AY85,1,1,tech!$H$2),AY85),\"\")","v":""},"|",null,"Business continuity planning and disaster recovery",{"$f":"IF(AND(LEFT(BE85,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BE85,\" \"))=4,0)),_xlfn.TEXTAFTER(BE85,\" \"),BG84)","v":"Guidance"},"3.1.3.GX",{"$f":"IF(AND(BE85<>\"\",LEFT(BE85,1)<>\"#\"),IF(LEFT(BE85,1)=\"-\",REPLACE(BE85,1,1,tech!$H$2),BE85),\"\")","v":""},"|","- Interview with the responsible person to verify Understanding of the open standards","Adoption and application of open standards",{"$f":"IF(AND(LEFT(BK85,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BK85,\" \"))=4,0)),_xlfn.TEXTAFTER(BK85,\" \"),BM84)","v":"Assessment"},"3.2.3.AY",{"$f":"IF(AND(BK85<>\"\",LEFT(BK85,1)<>\"#\"),IF(LEFT(BK85,1)=\"-\",REPLACE(BK85,1,1,tech!$H$2),BK85),\"\")","v":"• Interview with the responsible person to verify Understanding of the open standards"},"|",null,"Audit trail can be reconstructed from audit logs",{"$f":"IF(AND(LEFT(BQ85,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BQ85,\" \"))=4,0)),_xlfn.TEXTAFTER(BQ85,\" \"),BS84)","v":"Guidance"},"3.3.3.GY",{"$f":"IF(AND(BQ85<>\"\",LEFT(BQ85,1)<>\"#\"),IF(LEFT(BQ85,1)=\"-\",REPLACE(BQ85,1,1,tech!$H$2),BQ85),\"\")","v":""},"|","#### Assessment","Incidents and exceptions handling",{"$f":"IF(AND(LEFT(BW85,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BW85,\" \"))=4,0)),_xlfn.TEXTAFTER(BW85,\" \"),BY84)","v":"Assessment"},"3.4.3.AX",{"$f":"IF(AND(BW85<>\"\",LEFT(BW85,1)<>\"#\"),IF(LEFT(BW85,1)=\"-\",REPLACE(BW85,1,1,tech!$H$2),BW85),\"\")","v":""},"|",null,"Resources are periodically reviewed",{"$f":"IF(AND(LEFT(CC85,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CC85,\" \"))=4,0)),_xlfn.TEXTAFTER(CC85,\" \"),CE84)","v":"Guidance"},"4.1.4.GY",{"$f":"IF(AND(CC85<>\"\",LEFT(CC85,1)<>\"#\"),IF(LEFT(CC85,1)=\"-\",REPLACE(CC85,1,1,tech!$H$2),CC85),\"\")","v":""},"|",null,"Perform security awareness training",{"$f":"IF(AND(LEFT(CI85,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CI85,\" \"))=4,0)),_xlfn.TEXTAFTER(CI85,\" \"),CK84)","v":"Guidance"},"4.2.3.GX",{"$f":"IF(AND(CI85<>\"\",LEFT(CI85,1)<>\"#\"),IF(LEFT(CI85,1)=\"-\",REPLACE(CI85,1,1,tech!$H$2),CI85),\"\")","v":""},"|","- Phone","Establish single point of contact",{"$f":"IF(AND(LEFT(CO85,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CO85,\" \"))=4,0)),_xlfn.TEXTAFTER(CO85,\" \"),CQ84)","v":"Guidance"},"4.3.3.GY",{"$f":"IF(AND(CO85<>\"\",LEFT(CO85,1)<>\"#\"),IF(LEFT(CO85,1)=\"-\",REPLACE(CO85,1,1,tech!$H$2),CO85),\"\")","v":"• Phone"},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D86,tech!$A$13:$B$17,2,0),LEFT(E86,1),IF(G86=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C86,1)=\"-\",C86,\"\")=\"\",\"\",REPLACE(IF(LEFT(C86,1)=\"-\",C86,\"\"),1,1,tech!$H$2))","v":""},"|","- Technology involved","Architecture and design of the PKI","Guidance","1.1.4.GY",{"$f":"IF(AND(I86<>\"\",LEFT(I86,1)<>\"#\"),IF(LEFT(I86,1)=\"-\",REPLACE(I86,1,1,tech!$H$2),I86),\"\")","v":"• Technology involved"},"|",null,"Certification practice statement is documented and published","Guidance","1.2.3.GY",{"$f":"IF(AND(O86<>\"\",LEFT(O86,1)<>\"#\"),IF(LEFT(O86,1)=\"-\",REPLACE(O86,1,1,tech!$H$2),O86),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U86<>\"\",LEFT(U86,1)<>\"#\"),IF(LEFT(U86,1)=\"-\",REPLACE(U86,1,1,tech!$H$2),U86),\"\")","v":""},"|",null,"Evidence from procedures is collected and maintained","References","1.4.4.RX",{"$f":"IF(AND(AA86<>\"\",LEFT(AA86,1)<>\"#\"),IF(LEFT(AA86,1)=\"-\",REPLACE(AA86,1,1,tech!$H$2),AA86),\"\")","v":""},"|","- Documented requirements for cryptographic devices","Inventory of cryptographic devices is documented and maintained","Assessment","2.1.3.AY",{"$f":"IF(AND(AG86<>\"\",LEFT(AG86,1)<>\"#\"),IF(LEFT(AG86,1)=\"-\",REPLACE(AG86,1,1,tech!$H$2),AG86),\"\")","v":"• Documented requirements for cryptographic devices"},"|","   * How revocation information is disseminated to relying parties","Certificate lifecycle management is documented","Guidance","2.2.3.GY",{"$f":"IF(AND(AM86<>\"\",LEFT(AM86,1)<>\"#\"),IF(LEFT(AM86,1)=\"-\",REPLACE(AM86,1,1,tech!$H$2),AM86),\"\")","v":"   * How revocation information is disseminated to relying parties"},"|","- Categorization and prioritization of vulnerabilities and remediation","Network vulnerability management is implemented and maintained","Guidance","2.3.3.GY",{"$f":"IF(AND(AS86<>\"\",LEFT(AS86,1)<>\"#\"),IF(LEFT(AS86,1)=\"-\",REPLACE(AS86,1,1,tech!$H$2),AS86),\"\")","v":"• Categorization and prioritization of vulnerabilities and remediation"},"|","The change management process is the core of the change management and agile systems. It provides a robust and reliable process to ensure that every change is properly assessed, approved, implemented, and eventually reviewed.","The change management process is documented and implemented","Guidance","2.4.3.GY",{"$f":"IF(AND(AY86<>\"\",LEFT(AY86,1)<>\"#\"),IF(LEFT(AY86,1)=\"-\",REPLACE(AY86,1,1,tech!$H$2),AY86),\"\")","v":"The change management process is the core of the change management and agile systems. It provides a robust and reliable process to ensure that every change is properly assessed, approved, implemented, and eventually reviewed."},"|","#### Assessment","Business continuity planning and disaster recovery","Assessment","3.1.3.AX",{"$f":"IF(AND(BE86<>\"\",LEFT(BE86,1)<>\"#\"),IF(LEFT(BE86,1)=\"-\",REPLACE(BE86,1,1,tech!$H$2),BE86),\"\")","v":""},"|","- Review of Training materials","Adoption and application of open standards","Assessment","3.2.3.AY",{"$f":"IF(AND(BK86<>\"\",LEFT(BK86,1)<>\"#\"),IF(LEFT(BK86,1)=\"-\",REPLACE(BK86,1,1,tech!$H$2),BK86),\"\")","v":"• Review of Training materials"},"|","Typically, the following events are important for security of the PKI implementation:","Audit trail can be reconstructed from audit logs","Guidance","3.3.3.GY",{"$f":"IF(AND(BQ86<>\"\",LEFT(BQ86,1)<>\"#\"),IF(LEFT(BQ86,1)=\"-\",REPLACE(BQ86,1,1,tech!$H$2),BQ86),\"\")","v":"Typically, the following events are important for security of the PKI implementation:"},"|",null,"Incidents and exceptions handling","Assessment","3.4.3.AX",{"$f":"IF(AND(BW86<>\"\",LEFT(BW86,1)<>\"#\"),IF(LEFT(BW86,1)=\"-\",REPLACE(BW86,1,1,tech!$H$2),BW86),\"\")","v":""},"|","Review includes the following (but not limited to)","Resources are periodically reviewed","Guidance","4.1.4.GY",{"$f":"IF(AND(CC86<>\"\",LEFT(CC86,1)<>\"#\"),IF(LEFT(CC86,1)=\"-\",REPLACE(CC86,1,1,tech!$H$2),CC86),\"\")","v":"Review includes the following (but not limited to)"},"|","Security awareness education is an ongoing activity. The security awareness program is implemented to make all personnel aware of their role in protecting the security and establishing trust by the PKI implementation. It should stay up to date to reflect latest security trends, threats, and challenges.","Perform security awareness training","Guidance","4.2.3.GY",{"$f":"IF(AND(CI86<>\"\",LEFT(CI86,1)<>\"#\"),IF(LEFT(CI86,1)=\"-\",REPLACE(CI86,1,1,tech!$H$2),CI86),\"\")","v":"Security awareness education is an ongoing activity. The security awareness program is implemented to make all personnel aware of their role in protecting the security and establishing trust by the PKI implementation. It should stay up to date to reflect latest security trends, threats, and challenges."},"|","- Web site form","Establish single point of contact","Guidance","4.3.3.GY",{"$f":"IF(AND(CO86<>\"\",LEFT(CO86,1)<>\"#\"),IF(LEFT(CO86,1)=\"-\",REPLACE(CO86,1,1,tech!$H$2),CO86),\"\")","v":"• Web site form"},"|"]
[null,null,"- Minimal probability of operational issues","Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D87,tech!$A$13:$B$17,2,0),LEFT(E87,1),IF(G87=\"\",\"X\",\"Y\"))","v":"5AY"},{"$f":"IF(IF(LEFT(C87,1)=\"-\",C87,\"\")=\"\",\"\",REPLACE(IF(LEFT(C87,1)=\"-\",C87,\"\"),1,1,tech!$H$2))","v":"• Minimal probability of operational issues"},"|","- Integration requirements and interfaces (APIs)","Architecture and design of the PKI","Guidance","1.1.4.GY",{"$f":"IF(AND(I87<>\"\",LEFT(I87,1)<>\"#\"),IF(LEFT(I87,1)=\"-\",REPLACE(I87,1,1,tech!$H$2),I87),\"\")","v":"• Integration requirements and interfaces (APIs)"},"|","The CPS covers the same items as the CP, but includes technical detail of how the CP is implemented. All parties involved in the PKI should be aware of the CPS and follow it. The CPS is a living document that is continuously updated and changed as technologies, security, and compliance requirements change.","Certification practice statement is documented and published","Guidance","1.2.3.GY",{"$f":"IF(AND(O87<>\"\",LEFT(O87,1)<>\"#\"),IF(LEFT(O87,1)=\"-\",REPLACE(O87,1,1,tech!$H$2),O87),\"\")","v":"The CPS covers the same items as the CP, but includes technical detail of how the CP is implemented. All parties involved in the PKI should be aware of the CPS and follow it. The CPS is a living document that is continuously updated and changed as technologies, security, and compliance requirements change."},"|","#### Guidance","List of relevant laws, regulations, and standards, exist and is maintained","Guidance","1.3.4.GX",{"$f":"IF(AND(U87<>\"\",LEFT(U87,1)<>\"#\"),IF(LEFT(U87,1)=\"-\",REPLACE(U87,1,1,tech!$H$2),U87),\"\")","v":""},"|","#### Guidance","Evidence from procedures is collected and maintained","Guidance","1.4.4.GX",{"$f":"IF(AND(AA87<>\"\",LEFT(AA87,1)<>\"#\"),IF(LEFT(AA87,1)=\"-\",REPLACE(AA87,1,1,tech!$H$2),AA87),\"\")","v":""},"|","- Documented inventory of cryptographic devices","Inventory of cryptographic devices is documented and maintained","Assessment","2.1.3.AY",{"$f":"IF(AND(AG87<>\"\",LEFT(AG87,1)<>\"#\"),IF(LEFT(AG87,1)=\"-\",REPLACE(AG87,1,1,tech!$H$2),AG87),\"\")","v":"• Documented inventory of cryptographic devices"},"|","6. Key escrow and recovery","Certificate lifecycle management is documented","Guidance","2.2.3.GY",{"$f":"IF(AND(AM87<>\"\",LEFT(AM87,1)<>\"#\"),IF(LEFT(AM87,1)=\"-\",REPLACE(AM87,1,1,tech!$H$2),AM87),\"\")","v":"6. Key escrow and recovery"},"|","- Updating and patching requirements","Network vulnerability management is implemented and maintained","Guidance","2.3.3.GY",{"$f":"IF(AND(AS87<>\"\",LEFT(AS87,1)<>\"#\"),IF(LEFT(AS87,1)=\"-\",REPLACE(AS87,1,1,tech!$H$2),AS87),\"\")","v":"• Updating and patching requirements"},"|",null,"The change management process is documented and implemented","Guidance","2.4.3.GY",{"$f":"IF(AND(AY87<>\"\",LEFT(AY87,1)<>\"#\"),IF(LEFT(AY87,1)=\"-\",REPLACE(AY87,1,1,tech!$H$2),AY87),\"\")","v":""},"|",null,"Business continuity planning and disaster recovery","Assessment","3.1.3.AX",{"$f":"IF(AND(BE87<>\"\",LEFT(BE87,1)<>\"#\"),IF(LEFT(BE87,1)=\"-\",REPLACE(BE87,1,1,tech!$H$2),BE87),\"\")","v":""},"|",null,"Adoption and application of open standards","Assessment","3.2.3.AX",{"$f":"IF(AND(BK87<>\"\",LEFT(BK87,1)<>\"#\"),IF(LEFT(BK87,1)=\"-\",REPLACE(BK87,1,1,tech!$H$2),BK87),\"\")","v":""},"|","- all individual User accesses to sensitive data","Audit trail can be reconstructed from audit logs","Guidance","3.3.3.GY",{"$f":"IF(AND(BQ87<>\"\",LEFT(BQ87,1)<>\"#\"),IF(LEFT(BQ87,1)=\"-\",REPLACE(BQ87,1,1,tech!$H$2),BQ87),\"\")","v":"• all individual User accesses to sensitive data"},"|","The following is sample evidence that can be used to assess the requirement:","Incidents and exceptions handling","Assessment","3.4.3.AY",{"$f":"IF(AND(BW87<>\"\",LEFT(BW87,1)<>\"#\"),IF(LEFT(BW87,1)=\"-\",REPLACE(BW87,1,1,tech!$H$2),BW87),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|","- Analysis that the resources continue to match with the scope and capacity required to provide the services","Resources are periodically reviewed","Guidance","4.1.4.GY",{"$f":"IF(AND(CC87<>\"\",LEFT(CC87,1)<>\"#\"),IF(LEFT(CC87,1)=\"-\",REPLACE(CC87,1,1,tech!$H$2),CC87),\"\")","v":"• Analysis that the resources continue to match with the scope and capacity required to provide the services"},"|",null,"Perform security awareness training","Guidance","4.2.3.GY",{"$f":"IF(AND(CI87<>\"\",LEFT(CI87,1)<>\"#\"),IF(LEFT(CI87,1)=\"-\",REPLACE(CI87,1,1,tech!$H$2),CI87),\"\")","v":""},"|","- Other","Establish single point of contact","Guidance","4.3.3.GY",{"$f":"IF(AND(CO87<>\"\",LEFT(CO87,1)<>\"#\"),IF(LEFT(CO87,1)=\"-\",REPLACE(CO87,1,1,tech!$H$2),CO87),\"\")","v":"• Other"},"|"]
[null,null,"- Minimal probability of compromise and loosing trust","Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D88,tech!$A$13:$B$17,2,0),LEFT(E88,1),IF(G88=\"\",\"X\",\"Y\"))","v":"5AY"},{"$f":"IF(IF(LEFT(C88,1)=\"-\",C88,\"\")=\"\",\"\",REPLACE(IF(LEFT(C88,1)=\"-\",C88,\"\"),1,1,tech!$H$2))","v":"• Minimal probability of compromise and loosing trust"},"|","- Support systems (such as IAM, logging, monitoring, etc.)","Architecture and design of the PKI","Guidance","1.1.4.GY",{"$f":"IF(AND(I88<>\"\",LEFT(I88,1)<>\"#\"),IF(LEFT(I88,1)=\"-\",REPLACE(I88,1,1,tech!$H$2),I88),\"\")","v":"• Support systems (such as IAM, logging, monitoring, etc.)"},"|",null,"Certification practice statement is documented and published","Guidance","1.2.3.GX",{"$f":"IF(AND(O88<>\"\",LEFT(O88,1)<>\"#\"),IF(LEFT(O88,1)=\"-\",REPLACE(O88,1,1,tech!$H$2),O88),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","Guidance","1.3.4.GX",{"$f":"IF(AND(U88<>\"\",LEFT(U88,1)<>\"#\"),IF(LEFT(U88,1)=\"-\",REPLACE(U88,1,1,tech!$H$2),U88),\"\")","v":""},"|",null,"Evidence from procedures is collected and maintained","Guidance","1.4.4.GX",{"$f":"IF(AND(AA88<>\"\",LEFT(AA88,1)<>\"#\"),IF(LEFT(AA88,1)=\"-\",REPLACE(AA88,1,1,tech!$H$2),AA88),\"\")","v":""},"|","- Completeness, accuracy, and consistency of inventory","Inventory of cryptographic devices is documented and maintained","Assessment","2.1.3.AY",{"$f":"IF(AND(AG88<>\"\",LEFT(AG88,1)<>\"#\"),IF(LEFT(AG88,1)=\"-\",REPLACE(AG88,1,1,tech!$H$2),AG88),\"\")","v":"• Completeness, accuracy, and consistency of inventory"},"|","7. Trust anchor management","Certificate lifecycle management is documented","Guidance","2.2.3.GY",{"$f":"IF(AND(AM88<>\"\",LEFT(AM88,1)<>\"#\"),IF(LEFT(AM88,1)=\"-\",REPLACE(AM88,1,1,tech!$H$2),AM88),\"\")","v":"7. Trust anchor management"},"|",null,"Network vulnerability management is implemented and maintained","Guidance","2.3.3.GX",{"$f":"IF(AND(AS88<>\"\",LEFT(AS88,1)<>\"#\"),IF(LEFT(AS88,1)=\"-\",REPLACE(AS88,1,1,tech!$H$2),AS88),\"\")","v":""},"|","The change management process should be documented, communicated, and integrated into the organization. The process states how a request for change can be submitted and how it is processed, which includes assessment and approval of the change, implementation of the change, functional testing after the change, and review of the change.","The change management process is documented and implemented","Guidance","2.4.3.GY",{"$f":"IF(AND(AY88<>\"\",LEFT(AY88,1)<>\"#\"),IF(LEFT(AY88,1)=\"-\",REPLACE(AY88,1,1,tech!$H$2),AY88),\"\")","v":"The change management process should be documented, communicated, and integrated into the organization. The process states how a request for change can be submitted and how it is processed, which includes assessment and approval of the change, implementation of the change, functional testing after the change, and review of the change."},"|","The following is sample evidence that can be used to assess the requirement:","Business continuity planning and disaster recovery","Assessment","3.1.3.AY",{"$f":"IF(AND(BE88<>\"\",LEFT(BE88,1)<>\"#\"),IF(LEFT(BE88,1)=\"-\",REPLACE(BE88,1,1,tech!$H$2),BE88),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|","#### References","Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK88<>\"\",LEFT(BK88,1)<>\"#\"),IF(LEFT(BK88,1)=\"-\",REPLACE(BK88,1,1,tech!$H$2),BK88),\"\")","v":""},"|","- all actions taken by any individual with root or administrative privileges","Audit trail can be reconstructed from audit logs","Guidance","3.3.3.GY",{"$f":"IF(AND(BQ88<>\"\",LEFT(BQ88,1)<>\"#\"),IF(LEFT(BQ88,1)=\"-\",REPLACE(BQ88,1,1,tech!$H$2),BQ88),\"\")","v":"• all actions taken by any individual with root or administrative privileges"},"|","- Documented Exceptions","Incidents and exceptions handling","Assessment","3.4.3.AY",{"$f":"IF(AND(BW88<>\"\",LEFT(BW88,1)<>\"#\"),IF(LEFT(BW88,1)=\"-\",REPLACE(BW88,1,1,tech!$H$2),BW88),\"\")","v":"• Documented Exceptions"},"|","- Review of the specifications of the resources to continue support of the PKI","Resources are periodically reviewed","Guidance","4.1.4.GY",{"$f":"IF(AND(CC88<>\"\",LEFT(CC88,1)<>\"#\"),IF(LEFT(CC88,1)=\"-\",REPLACE(CC88,1,1,tech!$H$2),CC88),\"\")","v":"• Review of the specifications of the resources to continue support of the PKI"},"|","Security awareness should ensure that personnel are knowledgeable about the threat landscape, their responsibility for the operation of relevant security controls, and are able to access assistance and guidance when required.","Perform security awareness training","Guidance","4.2.3.GY",{"$f":"IF(AND(CI88<>\"\",LEFT(CI88,1)<>\"#\"),IF(LEFT(CI88,1)=\"-\",REPLACE(CI88,1,1,tech!$H$2),CI88),\"\")","v":"Security awareness should ensure that personnel are knowledgeable about the threat landscape, their responsibility for the operation of relevant security controls, and are able to access assistance and guidance when required."},"|",null,"Establish single point of contact","Guidance","4.3.3.GX",{"$f":"IF(AND(CO88<>\"\",LEFT(CO88,1)<>\"#\"),IF(LEFT(CO88,1)=\"-\",REPLACE(CO88,1,1,tech!$H$2),CO88),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D89,tech!$A$13:$B$17,2,0),LEFT(E89,1),IF(G89=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C89,1)=\"-\",C89,\"\")=\"\",\"\",REPLACE(IF(LEFT(C89,1)=\"-\",C89,\"\"),1,1,tech!$H$2))","v":""},"|","- operational requirements","Architecture and design of the PKI","Guidance","1.1.4.GY",{"$f":"IF(AND(I89<>\"\",LEFT(I89,1)<>\"#\"),IF(LEFT(I89,1)=\"-\",REPLACE(I89,1,1,tech!$H$2),I89),\"\")","v":"• operational requirements"},"|","#### Assessment","Certification practice statement is documented and published","Assessment","1.2.3.AX",{"$f":"IF(AND(O89<>\"\",LEFT(O89,1)<>\"#\"),IF(LEFT(O89,1)=\"-\",REPLACE(O89,1,1,tech!$H$2),O89),\"\")","v":""},"|","To better understand the relevance to PKI, one should understand the differences between laws, regulations, and standards.","List of relevant laws, regulations, and standards, exist and is maintained","Guidance","1.3.4.GY",{"$f":"IF(AND(U89<>\"\",LEFT(U89,1)<>\"#\"),IF(LEFT(U89,1)=\"-\",REPLACE(U89,1,1,tech!$H$2),U89),\"\")","v":"To better understand the relevance to PKI, one should understand the differences between laws, regulations, and standards."},"|","Each process, procedure, instruction, or activity would not be effective without evidence confirming that it was performed. The evidence should be descriptive with all relevant information, such as date and time, who performed the activity, what was the result, and other information, if needed. ","Evidence from procedures is collected and maintained","Guidance","1.4.4.GY",{"$f":"IF(AND(AA89<>\"\",LEFT(AA89,1)<>\"#\"),IF(LEFT(AA89,1)=\"-\",REPLACE(AA89,1,1,tech!$H$2),AA89),\"\")","v":"Each process, procedure, instruction, or activity would not be effective without evidence confirming that it was performed. The evidence should be descriptive with all relevant information, such as date and time, who performed the activity, what was the result, and other information, if needed. "},"|","- Validation of records","Inventory of cryptographic devices is documented and maintained","Assessment","2.1.3.AY",{"$f":"IF(AND(AG89<>\"\",LEFT(AG89,1)<>\"#\"),IF(LEFT(AG89,1)=\"-\",REPLACE(AG89,1,1,tech!$H$2),AG89),\"\")","v":"• Validation of records"},"|","   * Trust anchors on machines and devices are a key point of trust management in the organization. Unmanaged trust stores can cause both outages and security issues.","Certificate lifecycle management is documented","Guidance","2.2.3.GY",{"$f":"IF(AND(AM89<>\"\",LEFT(AM89,1)<>\"#\"),IF(LEFT(AM89,1)=\"-\",REPLACE(AM89,1,1,tech!$H$2),AM89),\"\")","v":"   * Trust anchors on machines and devices are a key point of trust management in the organization. Unmanaged trust stores can cause both outages and security issues."},"|","#### Assessment","Network vulnerability management is implemented and maintained","Assessment","2.3.3.AX",{"$f":"IF(AND(AS89<>\"\",LEFT(AS89,1)<>\"#\"),IF(LEFT(AS89,1)=\"-\",REPLACE(AS89,1,1,tech!$H$2),AS89),\"\")","v":""},"|",null,"The change management process is documented and implemented","Guidance","2.4.3.GX",{"$f":"IF(AND(AY89<>\"\",LEFT(AY89,1)<>\"#\"),IF(LEFT(AY89,1)=\"-\",REPLACE(AY89,1,1,tech!$H$2),AY89),\"\")","v":""},"|","- Documented business continuity and disaster recovery plans","Business continuity planning and disaster recovery","Assessment","3.1.3.AY",{"$f":"IF(AND(BE89<>\"\",LEFT(BE89,1)<>\"#\"),IF(LEFT(BE89,1)=\"-\",REPLACE(BE89,1,1,tech!$H$2),BE89),\"\")","v":"• Documented business continuity and disaster recovery plans"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK89<>\"\",LEFT(BK89,1)<>\"#\"),IF(LEFT(BK89,1)=\"-\",REPLACE(BK89,1,1,tech!$H$2),BK89),\"\")","v":""},"|","- access to all Audit trails","Audit trail can be reconstructed from audit logs","Guidance","3.3.3.GY",{"$f":"IF(AND(BQ89<>\"\",LEFT(BQ89,1)<>\"#\"),IF(LEFT(BQ89,1)=\"-\",REPLACE(BQ89,1,1,tech!$H$2),BQ89),\"\")","v":"• access to all Audit trails"},"|","- Interview with responsible personnel about how to handle Exceptions or incidents","Incidents and exceptions handling","Assessment","3.4.3.AY",{"$f":"IF(AND(BW89<>\"\",LEFT(BW89,1)<>\"#\"),IF(LEFT(BW89,1)=\"-\",REPLACE(BW89,1,1,tech!$H$2),BW89),\"\")","v":"• Interview with responsible personnel about how to handle Exceptions or incidents"},"|","- Review announcements and technology trends (for example “end of life” plans for a technology)","Resources are periodically reviewed","Guidance","4.1.4.GY",{"$f":"IF(AND(CC89<>\"\",LEFT(CC89,1)<>\"#\"),IF(LEFT(CC89,1)=\"-\",REPLACE(CC89,1,1,tech!$H$2),CC89),\"\")","v":"• Review announcements and technology trends (for example “end of life” plans for a technology)"},"|",null,"Perform security awareness training","Guidance","4.2.3.GY",{"$f":"IF(AND(CI89<>\"\",LEFT(CI89,1)<>\"#\"),IF(LEFT(CI89,1)=\"-\",REPLACE(CI89,1,1,tech!$H$2),CI89),\"\")","v":""},"|","#### Assessment","Establish single point of contact","Assessment","4.3.3.AX",{"$f":"IF(AND(CO89<>\"\",LEFT(CO89,1)<>\"#\"),IF(LEFT(CO89,1)=\"-\",REPLACE(CO89,1,1,tech!$H$2),CO89),\"\")","v":""},"|"]
[{"$nulls":3},{"$f":"IF(AND(LEFT(C90,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(C90,\" \"))=2,0)),_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(C90,\" \"),\" \"),D89)","v":"Optimized"},{"$f":"IF(AND(LEFT(C90,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(C90,\" \"))=3,0)),_xlfn.TEXTAFTER(C90,\" \"),E89)","v":"Associated risks"},{"$f":"_xlfn.CONCAT(VLOOKUP(D90,tech!$A$13:$B$17,2,0),LEFT(E90,1),IF(G90=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C90,1)=\"-\",C90,\"\")=\"\",\"\",REPLACE(IF(LEFT(C90,1)=\"-\",C90,\"\"),1,1,tech!$H$2))","v":""},"|","- Security requirements","Architecture and design of the PKI","Guidance","1.1.4.GY",{"$f":"IF(AND(I90<>\"\",LEFT(I90,1)<>\"#\"),IF(LEFT(I90,1)=\"-\",REPLACE(I90,1,1,tech!$H$2),I90),\"\")","v":"• Security requirements"},"|",null,"Certification practice statement is documented and published","Assessment","1.2.3.AX",{"$f":"IF(AND(O90<>\"\",LEFT(O90,1)<>\"#\"),IF(LEFT(O90,1)=\"-\",REPLACE(O90,1,1,tech!$H$2),O90),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","Guidance","1.3.4.GY",{"$f":"IF(AND(U90<>\"\",LEFT(U90,1)<>\"#\"),IF(LEFT(U90,1)=\"-\",REPLACE(U90,1,1,tech!$H$2),U90),\"\")","v":""},"|",null,"Evidence from procedures is collected and maintained","Guidance","1.4.4.GY",{"$f":"IF(AND(AA90<>\"\",LEFT(AA90,1)<>\"#\"),IF(LEFT(AA90,1)=\"-\",REPLACE(AA90,1,1,tech!$H$2),AA90),\"\")","v":""},"|",null,"Inventory of cryptographic devices is documented and maintained","Assessment","2.1.3.AX",{"$f":"IF(AND(AG90<>\"\",LEFT(AG90,1)<>\"#\"),IF(LEFT(AG90,1)=\"-\",REPLACE(AG90,1,1,tech!$H$2),AG90),\"\")","v":""},"|",null,"Certificate lifecycle management is documented","Guidance","2.2.3.GX",{"$f":"IF(AND(AM90<>\"\",LEFT(AM90,1)<>\"#\"),IF(LEFT(AM90,1)=\"-\",REPLACE(AM90,1,1,tech!$H$2),AM90),\"\")","v":""},"|",null,"Network vulnerability management is implemented and maintained","Assessment","2.3.3.AX",{"$f":"IF(AND(AS90<>\"\",LEFT(AS90,1)<>\"#\"),IF(LEFT(AS90,1)=\"-\",REPLACE(AS90,1,1,tech!$H$2),AS90),\"\")","v":""},"|","#### Assessment","The change management process is documented and implemented","Assessment","2.4.3.AX",{"$f":"IF(AND(AY90<>\"\",LEFT(AY90,1)<>\"#\"),IF(LEFT(AY90,1)=\"-\",REPLACE(AY90,1,1,tech!$H$2),AY90),\"\")","v":""},"|","- Documented recovery time objectives (RTO) and recovery point objectives (RPO)","Business continuity planning and disaster recovery","Assessment","3.1.3.AY",{"$f":"IF(AND(BE90<>\"\",LEFT(BE90,1)<>\"#\"),IF(LEFT(BE90,1)=\"-\",REPLACE(BE90,1,1,tech!$H$2),BE90),\"\")","v":"• Documented recovery time objectives (RTO) and recovery point objectives (RPO)"},"|","- [Open Standards Principles](https://www.gov.uk/government/publications/open-standards-principles/open-standards-principles)","Adoption and application of open standards","References","3.2.3.RY",{"$f":"IF(AND(BK90<>\"\",LEFT(BK90,1)<>\"#\"),IF(LEFT(BK90,1)=\"-\",REPLACE(BK90,1,1,tech!$H$2),BK90),\"\")","v":"• [Open Standards Principles](https://www.gov.uk/government/publications/open-standards-principles/open-standards-principles)"},"|","- Invalid logical access attempts","Audit trail can be reconstructed from audit logs","Guidance","3.3.3.GY",{"$f":"IF(AND(BQ90<>\"\",LEFT(BQ90,1)<>\"#\"),IF(LEFT(BQ90,1)=\"-\",REPLACE(BQ90,1,1,tech!$H$2),BQ90),\"\")","v":"• Invalid logical access attempts"},"|",null,"Incidents and exceptions handling","Assessment","3.4.3.AX",{"$f":"IF(AND(BW90<>\"\",LEFT(BW90,1)<>\"#\"),IF(LEFT(BW90,1)=\"-\",REPLACE(BW90,1,1,tech!$H$2),BW90),\"\")","v":""},"|","- Documentation of any remediation plan, updates to sourcing of the PKI, that should be approved by the management","Resources are periodically reviewed","Guidance","4.1.4.GY",{"$f":"IF(AND(CC90<>\"\",LEFT(CC90,1)<>\"#\"),IF(LEFT(CC90,1)=\"-\",REPLACE(CC90,1,1,tech!$H$2),CC90),\"\")","v":"• Documentation of any remediation plan, updates to sourcing of the PKI, that should be approved by the management"},"|","Different methods can be applied to provide security awareness, for example:","Perform security awareness training","Guidance","4.2.3.GY",{"$f":"IF(AND(CI90<>\"\",LEFT(CI90,1)<>\"#\"),IF(LEFT(CI90,1)=\"-\",REPLACE(CI90,1,1,tech!$H$2),CI90),\"\")","v":"Different methods can be applied to provide security awareness, for example:"},"|",null,"Establish single point of contact","Assessment","4.3.3.AX",{"$f":"IF(AND(CO90<>\"\",LEFT(CO90,1)<>\"#\"),IF(LEFT(CO90,1)=\"-\",REPLACE(CO90,1,1,tech!$H$2),CO90),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D91,tech!$A$13:$B$17,2,0),LEFT(E91,1),IF(G91=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C91,1)=\"-\",C91,\"\")=\"\",\"\",REPLACE(IF(LEFT(C91,1)=\"-\",C91,\"\"),1,1,tech!$H$2))","v":""},"|","- Deployment options","Architecture and design of the PKI","Guidance","1.1.4.GY",{"$f":"IF(AND(I91<>\"\",LEFT(I91,1)<>\"#\"),IF(LEFT(I91,1)=\"-\",REPLACE(I91,1,1,tech!$H$2),I91),\"\")","v":"• Deployment options"},"|","- the CPS is properly Documented in its full scope","Certification practice statement is documented and published","Assessment","1.2.3.AY",{"$f":"IF(AND(O91<>\"\",LEFT(O91,1)<>\"#\"),IF(LEFT(O91,1)=\"-\",REPLACE(O91,1,1,tech!$H$2),O91),\"\")","v":"• the CPS is properly Documented in its full scope"},"|","Laws are legal rules that are enacted by a governing body, such as a federal, state or local government.  They are binding and enforceable by the legal system within the jurisdiction of the governing body that enacted them.  Violating law can lead to legal consequences, such as fines or imprisonment.","List of relevant laws, regulations, and standards, exist and is maintained","Guidance","1.3.4.GY",{"$f":"IF(AND(U91<>\"\",LEFT(U91,1)<>\"#\"),IF(LEFT(U91,1)=\"-\",REPLACE(U91,1,1,tech!$H$2),U91),\"\")","v":"Laws are legal rules that are enacted by a governing body, such as a federal, state or local government.  They are binding and enforceable by the legal system within the jurisdiction of the governing body that enacted them.  Violating law can lead to legal consequences, such as fines or imprisonment."},"|","The evidence can be collected and maintained in various forms, such as logs, reports, notes, screenshots, etc. The evidence should be collected and maintained for the defined period of time, and should be available for the audit or other purposes.","Evidence from procedures is collected and maintained","Guidance","1.4.4.GY",{"$f":"IF(AND(AA91<>\"\",LEFT(AA91,1)<>\"#\"),IF(LEFT(AA91,1)=\"-\",REPLACE(AA91,1,1,tech!$H$2),AA91),\"\")","v":"The evidence can be collected and maintained in various forms, such as logs, reports, notes, screenshots, etc. The evidence should be collected and maintained for the defined period of time, and should be available for the audit or other purposes."},"|","#### References","Inventory of cryptographic devices is documented and maintained","References","2.1.3.RX",{"$f":"IF(AND(AG91<>\"\",LEFT(AG91,1)<>\"#\"),IF(LEFT(AG91,1)=\"-\",REPLACE(AG91,1,1,tech!$H$2),AG91),\"\")","v":""},"|","#### Assessment","Certificate lifecycle management is documented","Assessment","2.2.3.AX",{"$f":"IF(AND(AM91<>\"\",LEFT(AM91,1)<>\"#\"),IF(LEFT(AM91,1)=\"-\",REPLACE(AM91,1,1,tech!$H$2),AM91),\"\")","v":""},"|","The following is sample evidence that can be used to assess the requirement:","Network vulnerability management is implemented and maintained","Assessment","2.3.3.AY",{"$f":"IF(AND(AS91<>\"\",LEFT(AS91,1)<>\"#\"),IF(LEFT(AS91,1)=\"-\",REPLACE(AS91,1,1,tech!$H$2),AS91),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|",null,"The change management process is documented and implemented","Assessment","2.4.3.AX",{"$f":"IF(AND(AY91<>\"\",LEFT(AY91,1)<>\"#\"),IF(LEFT(AY91,1)=\"-\",REPLACE(AY91,1,1,tech!$H$2),AY91),\"\")","v":""},"|","- Documented Backup and recovery procedures","Business continuity planning and disaster recovery","Assessment","3.1.3.AY",{"$f":"IF(AND(BE91<>\"\",LEFT(BE91,1)<>\"#\"),IF(LEFT(BE91,1)=\"-\",REPLACE(BE91,1,1,tech!$H$2),BE91),\"\")","v":"• Documented Backup and recovery procedures"},"|","- [IETF Request for Comments (RFC)](https://www.ietf.org/standards/rfcs/)","Adoption and application of open standards","References","3.2.3.RY",{"$f":"IF(AND(BK91<>\"\",LEFT(BK91,1)<>\"#\"),IF(LEFT(BK91,1)=\"-\",REPLACE(BK91,1,1,tech!$H$2),BK91),\"\")","v":"• [IETF Request for Comments (RFC)](https://www.ietf.org/standards/rfcs/)"},"|","- Use of and changes to identification and authentication mechanisms - including but not limited to creation of new accounts and elevation of privileges - and all changes, additions, or deletions to accounts with root or administrative privileges","Audit trail can be reconstructed from audit logs","Guidance","3.3.3.GY",{"$f":"IF(AND(BQ91<>\"\",LEFT(BQ91,1)<>\"#\"),IF(LEFT(BQ91,1)=\"-\",REPLACE(BQ91,1,1,tech!$H$2),BQ91),\"\")","v":"• Use of and changes to identification and authentication mechanisms - including but not limited to creation of new accounts and elevation of privileges - and all changes, additions, or deletions to accounts with root or administrative privileges"},"|","#### References","Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW91<>\"\",LEFT(BW91,1)<>\"#\"),IF(LEFT(BW91,1)=\"-\",REPLACE(BW91,1,1,tech!$H$2),BW91),\"\")","v":""},"|",null,"Resources are periodically reviewed","Guidance","4.1.4.GX",{"$f":"IF(AND(CC91<>\"\",LEFT(CC91,1)<>\"#\"),IF(LEFT(CC91,1)=\"-\",REPLACE(CC91,1,1,tech!$H$2),CC91),\"\")","v":""},"|","- Posters and letters with the specific topic","Perform security awareness training","Guidance","4.2.3.GY",{"$f":"IF(AND(CI91<>\"\",LEFT(CI91,1)<>\"#\"),IF(LEFT(CI91,1)=\"-\",REPLACE(CI91,1,1,tech!$H$2),CI91),\"\")","v":"• Posters and letters with the specific topic"},"|","- Contact SPOC to ensure that it is available and responds in a timely manner","Establish single point of contact","Assessment","4.3.3.AY",{"$f":"IF(AND(CO91<>\"\",LEFT(CO91,1)<>\"#\"),IF(LEFT(CO91,1)=\"-\",REPLACE(CO91,1,1,tech!$H$2),CO91),\"\")","v":"• Contact SPOC to ensure that it is available and responds in a timely manner"},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D92,tech!$A$13:$B$17,2,0),LEFT(E92,1),IF(G92=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C92,1)=\"-\",C92,\"\")=\"\",\"\",REPLACE(IF(LEFT(C92,1)=\"-\",C92,\"\"),1,1,tech!$H$2))","v":""},"|","- Staging and testing","Architecture and design of the PKI","Guidance","1.1.4.GY",{"$f":"IF(AND(I92<>\"\",LEFT(I92,1)<>\"#\"),IF(LEFT(I92,1)=\"-\",REPLACE(I92,1,1,tech!$H$2),I92),\"\")","v":"• Staging and testing"},"|","- CPS is published and available to all parties involved","Certification practice statement is documented and published","Assessment","1.2.3.AY",{"$f":"IF(AND(O92<>\"\",LEFT(O92,1)<>\"#\"),IF(LEFT(O92,1)=\"-\",REPLACE(O92,1,1,tech!$H$2),O92),\"\")","v":"• CPS is published and available to all parties involved"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","Guidance","1.3.4.GY",{"$f":"IF(AND(U92<>\"\",LEFT(U92,1)<>\"#\"),IF(LEFT(U92,1)=\"-\",REPLACE(U92,1,1,tech!$H$2),U92),\"\")","v":""},"|",null,"Evidence from procedures is collected and maintained","Guidance","1.4.4.GX",{"$f":"IF(AND(AA92<>\"\",LEFT(AA92,1)<>\"#\"),IF(LEFT(AA92,1)=\"-\",REPLACE(AA92,1,1,tech!$H$2),AA92),\"\")","v":""},"|",null,"Inventory of cryptographic devices is documented and maintained","References","2.1.3.RX",{"$f":"IF(AND(AG92<>\"\",LEFT(AG92,1)<>\"#\"),IF(LEFT(AG92,1)=\"-\",REPLACE(AG92,1,1,tech!$H$2),AG92),\"\")","v":""},"|",null,"Certificate lifecycle management is documented","Assessment","2.2.3.AX",{"$f":"IF(AND(AM92<>\"\",LEFT(AM92,1)<>\"#\"),IF(LEFT(AM92,1)=\"-\",REPLACE(AM92,1,1,tech!$H$2),AM92),\"\")","v":""},"|","- network vulnerability management process","Network vulnerability management is implemented and maintained","Assessment","2.3.3.AY",{"$f":"IF(AND(AS92<>\"\",LEFT(AS92,1)<>\"#\"),IF(LEFT(AS92,1)=\"-\",REPLACE(AS92,1,1,tech!$H$2),AS92),\"\")","v":"• network vulnerability management process"},"|","The following is sample evidence that can be used to assess the requirement:","The change management process is documented and implemented","Assessment","2.4.3.AY",{"$f":"IF(AND(AY92<>\"\",LEFT(AY92,1)<>\"#\"),IF(LEFT(AY92,1)=\"-\",REPLACE(AY92,1,1,tech!$H$2),AY92),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|","- Communication matrix and contact information","Business continuity planning and disaster recovery","Assessment","3.1.3.AY",{"$f":"IF(AND(BE92<>\"\",LEFT(BE92,1)<>\"#\"),IF(LEFT(BE92,1)=\"-\",REPLACE(BE92,1,1,tech!$H$2),BE92),\"\")","v":"• Communication matrix and contact information"},"|","- [OASIS Standards](https://www.oasis-open.org/standards)","Adoption and application of open standards","References","3.2.3.RY",{"$f":"IF(AND(BK92<>\"\",LEFT(BK92,1)<>\"#\"),IF(LEFT(BK92,1)=\"-\",REPLACE(BK92,1,1,tech!$H$2),BK92),\"\")","v":"• [OASIS Standards](https://www.oasis-open.org/standards)"},"|","- Initialization, stopping, or pausing of the audit logs","Audit trail can be reconstructed from audit logs","Guidance","3.3.3.GY",{"$f":"IF(AND(BQ92<>\"\",LEFT(BQ92,1)<>\"#\"),IF(LEFT(BQ92,1)=\"-\",REPLACE(BQ92,1,1,tech!$H$2),BQ92),\"\")","v":"• Initialization, stopping, or pausing of the audit logs"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW92<>\"\",LEFT(BW92,1)<>\"#\"),IF(LEFT(BW92,1)=\"-\",REPLACE(BW92,1,1,tech!$H$2),BW92),\"\")","v":""},"|","#### Assessment","Resources are periodically reviewed","Assessment","4.1.4.AX",{"$f":"IF(AND(CC92<>\"\",LEFT(CC92,1)<>\"#\"),IF(LEFT(CC92,1)=\"-\",REPLACE(CC92,1,1,tech!$H$2),CC92),\"\")","v":""},"|","- team meetings and webinars","Perform security awareness training","Guidance","4.2.3.GY",{"$f":"IF(AND(CI92<>\"\",LEFT(CI92,1)<>\"#\"),IF(LEFT(CI92,1)=\"-\",REPLACE(CI92,1,1,tech!$H$2),CI92),\"\")","v":"• team meetings and webinars"},"|","- Review that the SPOC communicates according to the awareness plan","Establish single point of contact","Assessment","4.3.3.AY",{"$f":"IF(AND(CO92<>\"\",LEFT(CO92,1)<>\"#\"),IF(LEFT(CO92,1)=\"-\",REPLACE(CO92,1,1,tech!$H$2),CO92),\"\")","v":"• Review that the SPOC communicates according to the awareness plan"},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D93,tech!$A$13:$B$17,2,0),LEFT(E93,1),IF(G93=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C93,1)=\"-\",C93,\"\")=\"\",\"\",REPLACE(IF(LEFT(C93,1)=\"-\",C93,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","Guidance","1.1.4.GY",{"$f":"IF(AND(I93<>\"\",LEFT(I93,1)<>\"#\"),IF(LEFT(I93,1)=\"-\",REPLACE(I93,1,1,tech!$H$2),I93),\"\")","v":""},"|","- Interview with the management and PKI responsible personnel to confirm the CPS is accurate and followed","Certification practice statement is documented and published","Assessment","1.2.3.AY",{"$f":"IF(AND(O93<>\"\",LEFT(O93,1)<>\"#\"),IF(LEFT(O93,1)=\"-\",REPLACE(O93,1,1,tech!$H$2),O93),\"\")","v":"• Interview with the management and PKI responsible personnel to confirm the CPS is accurate and followed"},"|","Regulations are derived from laws and are often meant to supplement and clarify the broader provisions outlined in the laws.  Compliance with regulations is mandatory and non-compliance can result in penalties or other legal consequences.","List of relevant laws, regulations, and standards, exist and is maintained","Guidance","1.3.4.GY",{"$f":"IF(AND(U93<>\"\",LEFT(U93,1)<>\"#\"),IF(LEFT(U93,1)=\"-\",REPLACE(U93,1,1,tech!$H$2),U93),\"\")","v":"Regulations are derived from laws and are often meant to supplement and clarify the broader provisions outlined in the laws.  Compliance with regulations is mandatory and non-compliance can result in penalties or other legal consequences."},"|","#### Assessment","Evidence from procedures is collected and maintained","Assessment","1.4.4.AX",{"$f":"IF(AND(AA93<>\"\",LEFT(AA93,1)<>\"#\"),IF(LEFT(AA93,1)=\"-\",REPLACE(AA93,1,1,tech!$H$2),AA93),\"\")","v":""},"|","- [NIST SP 800-57 Recommendation for Key Management](https://csrc.nist.gov/projects/key-management/key-management-guidelines)","Inventory of cryptographic devices is documented and maintained","References","2.1.3.RY",{"$f":"IF(AND(AG93<>\"\",LEFT(AG93,1)<>\"#\"),IF(LEFT(AG93,1)=\"-\",REPLACE(AG93,1,1,tech!$H$2),AG93),\"\")","v":"• [NIST SP 800-57 Recommendation for Key Management](https://csrc.nist.gov/projects/key-management/key-management-guidelines)"},"|","* Documented application and validation rules","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM93<>\"\",LEFT(AM93,1)<>\"#\"),IF(LEFT(AM93,1)=\"-\",REPLACE(AM93,1,1,tech!$H$2),AM93),\"\")","v":"* Documented application and validation rules"},"|","- Results from last network vulnerability scan","Network vulnerability management is implemented and maintained","Assessment","2.3.3.AY",{"$f":"IF(AND(AS93<>\"\",LEFT(AS93,1)<>\"#\"),IF(LEFT(AS93,1)=\"-\",REPLACE(AS93,1,1,tech!$H$2),AS93),\"\")","v":"• Results from last network vulnerability scan"},"|","- Documented change management process","The change management process is documented and implemented","Assessment","2.4.3.AY",{"$f":"IF(AND(AY93<>\"\",LEFT(AY93,1)<>\"#\"),IF(LEFT(AY93,1)=\"-\",REPLACE(AY93,1,1,tech!$H$2),AY93),\"\")","v":"• Documented change management process"},"|","- Availability of backups and other requirements to execute the disaster recovery Procedure","Business continuity planning and disaster recovery","Assessment","3.1.3.AY",{"$f":"IF(AND(BE93<>\"\",LEFT(BE93,1)<>\"#\"),IF(LEFT(BE93,1)=\"-\",REPLACE(BE93,1,1,tech!$H$2),BE93),\"\")","v":"• Availability of backups and other requirements to execute the disaster recovery Procedure"},"|","- [ISO Standards](https://www.iso.org/standards.html)","Adoption and application of open standards","References","3.2.3.RY",{"$f":"IF(AND(BK93<>\"\",LEFT(BK93,1)<>\"#\"),IF(LEFT(BK93,1)=\"-\",REPLACE(BK93,1,1,tech!$H$2),BK93),\"\")","v":"• [ISO Standards](https://www.iso.org/standards.html)"},"|","- creation and deletion of system-level objects","Audit trail can be reconstructed from audit logs","Guidance","3.3.3.GY",{"$f":"IF(AND(BQ93<>\"\",LEFT(BQ93,1)<>\"#\"),IF(LEFT(BQ93,1)=\"-\",REPLACE(BQ93,1,1,tech!$H$2),BQ93),\"\")","v":"• creation and deletion of system-level objects"},"|","N/A","Incidents and exceptions handling","References","3.4.3.RY",{"$f":"IF(AND(BW93<>\"\",LEFT(BW93,1)<>\"#\"),IF(LEFT(BW93,1)=\"-\",REPLACE(BW93,1,1,tech!$H$2),BW93),\"\")","v":"N/A"},"|",null,"Resources are periodically reviewed","Assessment","4.1.4.AX",{"$f":"IF(AND(CC93<>\"\",LEFT(CC93,1)<>\"#\"),IF(LEFT(CC93,1)=\"-\",REPLACE(CC93,1,1,tech!$H$2),CC93),\"\")","v":""},"|","- Security incentives and rewards","Perform security awareness training","Guidance","4.2.3.GY",{"$f":"IF(AND(CI93<>\"\",LEFT(CI93,1)<>\"#\"),IF(LEFT(CI93,1)=\"-\",REPLACE(CI93,1,1,tech!$H$2),CI93),\"\")","v":"• Security incentives and rewards"},"|","- Review that the SPOC is able to provide relevant information and trigger appropriate procedures if needed based on the situation","Establish single point of contact","Assessment","4.3.3.AY",{"$f":"IF(AND(CO93<>\"\",LEFT(CO93,1)<>\"#\"),IF(LEFT(CO93,1)=\"-\",REPLACE(CO93,1,1,tech!$H$2),CO93),\"\")","v":"• Review that the SPOC is able to provide relevant information and trigger appropriate procedures if needed based on the situation"},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D94,tech!$A$13:$B$17,2,0),LEFT(E94,1),IF(G94=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C94,1)=\"-\",C94,\"\")=\"\",\"\",REPLACE(IF(LEFT(C94,1)=\"-\",C94,\"\"),1,1,tech!$H$2))","v":""},"|","The architecture and design are further used for the implementation of the PKI and serves as an input for the PKI team. It can be also used for the procurement of the PKI components and services that are needed for the implementation.","Architecture and design of the PKI","Guidance","1.1.4.GY",{"$f":"IF(AND(I94<>\"\",LEFT(I94,1)<>\"#\"),IF(LEFT(I94,1)=\"-\",REPLACE(I94,1,1,tech!$H$2),I94),\"\")","v":"The architecture and design are further used for the implementation of the PKI and serves as an input for the PKI team. It can be also used for the procurement of the PKI components and services that are needed for the implementation."},"|","- confirm that the information in the CPS is Consistent with the information in the CP","Certification practice statement is documented and published","Assessment","1.2.3.AY",{"$f":"IF(AND(O94<>\"\",LEFT(O94,1)<>\"#\"),IF(LEFT(O94,1)=\"-\",REPLACE(O94,1,1,tech!$H$2),O94),\"\")","v":"• confirm that the information in the CPS is Consistent with the information in the CP"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","Guidance","1.3.4.GY",{"$f":"IF(AND(U94<>\"\",LEFT(U94,1)<>\"#\"),IF(LEFT(U94,1)=\"-\",REPLACE(U94,1,1,tech!$H$2),U94),\"\")","v":""},"|",null,"Evidence from procedures is collected and maintained","Assessment","1.4.4.AX",{"$f":"IF(AND(AA94<>\"\",LEFT(AA94,1)<>\"#\"),IF(LEFT(AA94,1)=\"-\",REPLACE(AA94,1,1,tech!$H$2),AA94),\"\")","v":""},"|","- [ISO/IEC 11770 Key Management](https://www.iso.org/standard/53456.html)","Inventory of cryptographic devices is documented and maintained","References","2.1.3.RY",{"$f":"IF(AND(AG94<>\"\",LEFT(AG94,1)<>\"#\"),IF(LEFT(AG94,1)=\"-\",REPLACE(AG94,1,1,tech!$H$2),AG94),\"\")","v":"• [ISO/IEC 11770 Key Management](https://www.iso.org/standard/53456.html)"},"|","* Documented process for issuing certificates","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM94<>\"\",LEFT(AM94,1)<>\"#\"),IF(LEFT(AM94,1)=\"-\",REPLACE(AM94,1,1,tech!$H$2),AM94),\"\")","v":"* Documented process for issuing certificates"},"|","- remediation plan","Network vulnerability management is implemented and maintained","Assessment","2.3.3.AY",{"$f":"IF(AND(AS94<>\"\",LEFT(AS94,1)<>\"#\"),IF(LEFT(AS94,1)=\"-\",REPLACE(AS94,1,1,tech!$H$2),AS94),\"\")","v":"• remediation plan"},"|","- Sample of change request","The change management process is documented and implemented","Assessment","2.4.3.AY",{"$f":"IF(AND(AY94<>\"\",LEFT(AY94,1)<>\"#\"),IF(LEFT(AY94,1)=\"-\",REPLACE(AY94,1,1,tech!$H$2),AY94),\"\")","v":"• Sample of change request"},"|","- Periodically tested effectiveness of the disaster recovery","Business continuity planning and disaster recovery","Assessment","3.1.3.AY",{"$f":"IF(AND(BE94<>\"\",LEFT(BE94,1)<>\"#\"),IF(LEFT(BE94,1)=\"-\",REPLACE(BE94,1,1,tech!$H$2),BE94),\"\")","v":"• Periodically tested effectiveness of the disaster recovery"},"|","- [ITU Standards](https://www.itu.int/en/ITU-T/standardization/)","Adoption and application of open standards","References","3.2.3.RY",{"$f":"IF(AND(BK94<>\"\",LEFT(BK94,1)<>\"#\"),IF(LEFT(BK94,1)=\"-\",REPLACE(BK94,1,1,tech!$H$2),BK94),\"\")","v":"• [ITU Standards](https://www.itu.int/en/ITU-T/standardization/)"},"|",null,"Audit trail can be reconstructed from audit logs","Guidance","3.3.3.GX",{"$f":"IF(AND(BQ94<>\"\",LEFT(BQ94,1)<>\"#\"),IF(LEFT(BQ94,1)=\"-\",REPLACE(BQ94,1,1,tech!$H$2),BQ94),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW94<>\"\",LEFT(BW94,1)<>\"#\"),IF(LEFT(BW94,1)=\"-\",REPLACE(BW94,1,1,tech!$H$2),BW94),\"\")","v":""},"|","- Review of changes to the PKI scope","Resources are periodically reviewed","Assessment","4.1.4.AY",{"$f":"IF(AND(CC94<>\"\",LEFT(CC94,1)<>\"#\"),IF(LEFT(CC94,1)=\"-\",REPLACE(CC94,1,1,tech!$H$2),CC94),\"\")","v":"• Review of changes to the PKI scope"},"|","- Training and education","Perform security awareness training","Guidance","4.2.3.GY",{"$f":"IF(AND(CI94<>\"\",LEFT(CI94,1)<>\"#\"),IF(LEFT(CI94,1)=\"-\",REPLACE(CI94,1,1,tech!$H$2),CI94),\"\")","v":"• Training and education"},"|",null,"Establish single point of contact","Assessment","4.3.3.AX",{"$f":"IF(AND(CO94<>\"\",LEFT(CO94,1)<>\"#\"),IF(LEFT(CO94,1)=\"-\",REPLACE(CO94,1,1,tech!$H$2),CO94),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D95,tech!$A$13:$B$17,2,0),LEFT(E95,1),IF(G95=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C95,1)=\"-\",C95,\"\")=\"\",\"\",REPLACE(IF(LEFT(C95,1)=\"-\",C95,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","Guidance","1.1.4.GX",{"$f":"IF(AND(I95<>\"\",LEFT(I95,1)<>\"#\"),IF(LEFT(I95,1)=\"-\",REPLACE(I95,1,1,tech!$H$2),I95),\"\")","v":""},"|",null,"Certification practice statement is documented and published","Assessment","1.2.3.AX",{"$f":"IF(AND(O95<>\"\",LEFT(O95,1)<>\"#\"),IF(LEFT(O95,1)=\"-\",REPLACE(O95,1,1,tech!$H$2),O95),\"\")","v":""},"|","Standards are voluntary guidelines or specifications typically established by a particular industry group or standards organization.  Standards usually define best practices, technical specifications, quality benchmarks, and other criteria and are meant as a means of ensuring consistency, interoperability, and quality.  Typically, compliance with standards is not legally required, however, lack of conformance to standards can lead to diminished interoperability and reduced trust.","List of relevant laws, regulations, and standards, exist and is maintained","Guidance","1.3.4.GY",{"$f":"IF(AND(U95<>\"\",LEFT(U95,1)<>\"#\"),IF(LEFT(U95,1)=\"-\",REPLACE(U95,1,1,tech!$H$2),U95),\"\")","v":"Standards are voluntary guidelines or specifications typically established by a particular industry group or standards organization.  Standards usually define best practices, technical specifications, quality benchmarks, and other criteria and are meant as a means of ensuring consistency, interoperability, and quality.  Typically, compliance with standards is not legally required, however, lack of conformance to standards can lead to diminished interoperability and reduced trust."},"|","The following is sample evidence and information that can be collected during the assessment:","Evidence from procedures is collected and maintained","Assessment","1.4.4.AY",{"$f":"IF(AND(AA95<>\"\",LEFT(AA95,1)<>\"#\"),IF(LEFT(AA95,1)=\"-\",REPLACE(AA95,1,1,tech!$H$2),AA95),\"\")","v":"The following is sample evidence and information that can be collected during the assessment:"},"|",null,"Inventory of cryptographic devices is documented and maintained","References","2.1.3.RX",{"$f":"IF(AND(AG95<>\"\",LEFT(AG95,1)<>\"#\"),IF(LEFT(AG95,1)=\"-\",REPLACE(AG95,1,1,tech!$H$2),AG95),\"\")","v":""},"|","  * configuration of protocols","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM95<>\"\",LEFT(AM95,1)<>\"#\"),IF(LEFT(AM95,1)=\"-\",REPLACE(AM95,1,1,tech!$H$2),AM95),\"\")","v":"  * configuration of protocols"},"|","- Interview with the network administrators","Network vulnerability management is implemented and maintained","Assessment","2.3.3.AY",{"$f":"IF(AND(AS95<>\"\",LEFT(AS95,1)<>\"#\"),IF(LEFT(AS95,1)=\"-\",REPLACE(AS95,1,1,tech!$H$2),AS95),\"\")","v":"• Interview with the network administrators"},"|","- Steps involved in the change management process","The change management process is documented and implemented","Assessment","2.4.3.AY",{"$f":"IF(AND(AY95<>\"\",LEFT(AY95,1)<>\"#\"),IF(LEFT(AY95,1)=\"-\",REPLACE(AY95,1,1,tech!$H$2),AY95),\"\")","v":"• Steps involved in the change management process"},"|",null,"Business continuity planning and disaster recovery","Assessment","3.1.3.AX",{"$f":"IF(AND(BE95<>\"\",LEFT(BE95,1)<>\"#\"),IF(LEFT(BE95,1)=\"-\",REPLACE(BE95,1,1,tech!$H$2),BE95),\"\")","v":""},"|","- [NIST Standards](https://www.nist.gov/standards)","Adoption and application of open standards","References","3.2.3.RY",{"$f":"IF(AND(BK95<>\"\",LEFT(BK95,1)<>\"#\"),IF(LEFT(BK95,1)=\"-\",REPLACE(BK95,1,1,tech!$H$2),BK95),\"\")","v":"• [NIST Standards](https://www.nist.gov/standards)"},"|","#### Assessment","Audit trail can be reconstructed from audit logs","Assessment","3.3.3.AX",{"$f":"IF(AND(BQ95<>\"\",LEFT(BQ95,1)<>\"#\"),IF(LEFT(BQ95,1)=\"-\",REPLACE(BQ95,1,1,tech!$H$2),BQ95),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW95<>\"\",LEFT(BW95,1)<>\"#\"),IF(LEFT(BW95,1)=\"-\",REPLACE(BW95,1,1,tech!$H$2),BW95),\"\")","v":""},"|","- Review of the capacity or available resources","Resources are periodically reviewed","Assessment","4.1.4.AY",{"$f":"IF(AND(CC95<>\"\",LEFT(CC95,1)<>\"#\"),IF(LEFT(CC95,1)=\"-\",REPLACE(CC95,1,1,tech!$H$2),CC95),\"\")","v":"• Review of the capacity or available resources"},"|",null,"Perform security awareness training","Guidance","4.2.3.GX",{"$f":"IF(AND(CI95<>\"\",LEFT(CI95,1)<>\"#\"),IF(LEFT(CI95,1)=\"-\",REPLACE(CI95,1,1,tech!$H$2),CI95),\"\")","v":""},"|","#### References","Establish single point of contact","References","4.3.3.RX",{"$f":"IF(AND(CO95<>\"\",LEFT(CO95,1)<>\"#\"),IF(LEFT(CO95,1)=\"-\",REPLACE(CO95,1,1,tech!$H$2),CO95),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D96,tech!$A$13:$B$17,2,0),LEFT(E96,1),IF(G96=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C96,1)=\"-\",C96,\"\")=\"\",\"\",REPLACE(IF(LEFT(C96,1)=\"-\",C96,\"\"),1,1,tech!$H$2))","v":""},"|","#### Assessment","Architecture and design of the PKI","Assessment","1.1.4.AX",{"$f":"IF(AND(I96<>\"\",LEFT(I96,1)<>\"#\"),IF(LEFT(I96,1)=\"-\",REPLACE(I96,1,1,tech!$H$2),I96),\"\")","v":""},"|","#### References","Certification practice statement is documented and published","References","1.2.3.RX",{"$f":"IF(AND(O96<>\"\",LEFT(O96,1)<>\"#\"),IF(LEFT(O96,1)=\"-\",REPLACE(O96,1,1,tech!$H$2),O96),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","Guidance","1.3.4.GY",{"$f":"IF(AND(U96<>\"\",LEFT(U96,1)<>\"#\"),IF(LEFT(U96,1)=\"-\",REPLACE(U96,1,1,tech!$H$2),U96),\"\")","v":""},"|","- Evidence of the execution of the processes and procedures","Evidence from procedures is collected and maintained","Assessment","1.4.4.AY",{"$f":"IF(AND(AA96<>\"\",LEFT(AA96,1)<>\"#\"),IF(LEFT(AA96,1)=\"-\",REPLACE(AA96,1,1,tech!$H$2),AA96),\"\")","v":"• Evidence of the execution of the processes and procedures"},"|","### Each cryptographic key is defined and has documented lifecycle procedures","Each cryptographic key is defined and has documented lifecycle procedures","References","2.1.4.RX",{"$f":"IF(AND(AG96<>\"\",LEFT(AG96,1)<>\"#\"),IF(LEFT(AG96,1)=\"-\",REPLACE(AG96,1,1,tech!$H$2),AG96),\"\")","v":""},"|","* Documented Certificate Acceptance and certificate subject installation procedures","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM96<>\"\",LEFT(AM96,1)<>\"#\"),IF(LEFT(AM96,1)=\"-\",REPLACE(AM96,1,1,tech!$H$2),AM96),\"\")","v":"* Documented Certificate Acceptance and certificate subject installation procedures"},"|",null,"Network vulnerability management is implemented and maintained","Assessment","2.3.3.AX",{"$f":"IF(AND(AS96<>\"\",LEFT(AS96,1)<>\"#\"),IF(LEFT(AS96,1)=\"-\",REPLACE(AS96,1,1,tech!$H$2),AS96),\"\")","v":""},"|","- Interview with the responsible personnel","The change management process is documented and implemented","Assessment","2.4.3.AY",{"$f":"IF(AND(AY96<>\"\",LEFT(AY96,1)<>\"#\"),IF(LEFT(AY96,1)=\"-\",REPLACE(AY96,1,1,tech!$H$2),AY96),\"\")","v":"• Interview with the responsible personnel"},"|","#### References","Business continuity planning and disaster recovery","References","3.1.3.RX",{"$f":"IF(AND(BE96<>\"\",LEFT(BE96,1)<>\"#\"),IF(LEFT(BE96,1)=\"-\",REPLACE(BE96,1,1,tech!$H$2),BE96),\"\")","v":""},"|","- [ETSI Standards](https://www.etsi.org/standards)","Adoption and application of open standards","References","3.2.3.RY",{"$f":"IF(AND(BK96<>\"\",LEFT(BK96,1)<>\"#\"),IF(LEFT(BK96,1)=\"-\",REPLACE(BK96,1,1,tech!$H$2),BK96),\"\")","v":"• [ETSI Standards](https://www.etsi.org/standards)"},"|",null,"Audit trail can be reconstructed from audit logs","Assessment","3.3.3.AX",{"$f":"IF(AND(BQ96<>\"\",LEFT(BQ96,1)<>\"#\"),IF(LEFT(BQ96,1)=\"-\",REPLACE(BQ96,1,1,tech!$H$2),BQ96),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW96<>\"\",LEFT(BW96,1)<>\"#\"),IF(LEFT(BW96,1)=\"-\",REPLACE(BW96,1,1,tech!$H$2),BW96),\"\")","v":""},"|","- Vendor announcements","Resources are periodically reviewed","Assessment","4.1.4.AY",{"$f":"IF(AND(CC96<>\"\",LEFT(CC96,1)<>\"#\"),IF(LEFT(CC96,1)=\"-\",REPLACE(CC96,1,1,tech!$H$2),CC96),\"\")","v":"• Vendor announcements"},"|","#### Assessment","Perform security awareness training","Assessment","4.2.3.AX",{"$f":"IF(AND(CI96<>\"\",LEFT(CI96,1)<>\"#\"),IF(LEFT(CI96,1)=\"-\",REPLACE(CI96,1,1,tech!$H$2),CI96),\"\")","v":""},"|",null,"Establish single point of contact","References","4.3.3.RX",{"$f":"IF(AND(CO96<>\"\",LEFT(CO96,1)<>\"#\"),IF(LEFT(CO96,1)=\"-\",REPLACE(CO96,1,1,tech!$H$2),CO96),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D97,tech!$A$13:$B$17,2,0),LEFT(E97,1),IF(G97=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C97,1)=\"-\",C97,\"\")=\"\",\"\",REPLACE(IF(LEFT(C97,1)=\"-\",C97,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","Assessment","1.1.4.AX",{"$f":"IF(AND(I97<>\"\",LEFT(I97,1)<>\"#\"),IF(LEFT(I97,1)=\"-\",REPLACE(I97,1,1,tech!$H$2),I97),\"\")","v":""},"|",null,"Certification practice statement is documented and published","References","1.2.3.RX",{"$f":"IF(AND(O97<>\"\",LEFT(O97,1)<>\"#\"),IF(LEFT(O97,1)=\"-\",REPLACE(O97,1,1,tech!$H$2),O97),\"\")","v":""},"|","With respect to PKI, it is very important to understand what laws, regulations and standards are relevant to the PKI and its ancillary systems.  For example, given that PKI involves cryptography, one must be certain to adhere to government laws regarding use and deployment of cryptographic products and solutions.","List of relevant laws, regulations, and standards, exist and is maintained","Guidance","1.3.4.GY",{"$f":"IF(AND(U97<>\"\",LEFT(U97,1)<>\"#\"),IF(LEFT(U97,1)=\"-\",REPLACE(U97,1,1,tech!$H$2),U97),\"\")","v":"With respect to PKI, it is very important to understand what laws, regulations and standards are relevant to the PKI and its ancillary systems.  For example, given that PKI involves cryptography, one must be certain to adhere to government laws regarding use and deployment of cryptographic products and solutions."},"|","- Interview with the PKI management and staff","Evidence from procedures is collected and maintained","Assessment","1.4.4.AY",{"$f":"IF(AND(AA97<>\"\",LEFT(AA97,1)<>\"#\"),IF(LEFT(AA97,1)=\"-\",REPLACE(AA97,1,1,tech!$H$2),AA97),\"\")","v":"• Interview with the PKI management and staff"},"|",null,"Each cryptographic key is defined and has documented lifecycle procedures","References","2.1.4.RX",{"$f":"IF(AND(AG97<>\"\",LEFT(AG97,1)<>\"#\"),IF(LEFT(AG97,1)=\"-\",REPLACE(AG97,1,1,tech!$H$2),AG97),\"\")","v":""},"|","* Documented renewal criteria, where re-key is nessecary and which certificate modifications are allowed","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM97<>\"\",LEFT(AM97,1)<>\"#\"),IF(LEFT(AM97,1)=\"-\",REPLACE(AM97,1,1,tech!$H$2),AM97),\"\")","v":"* Documented renewal criteria, where re-key is nessecary and which certificate modifications are allowed"},"|","#### References","Network vulnerability management is implemented and maintained","References","2.3.3.RX",{"$f":"IF(AND(AS97<>\"\",LEFT(AS97,1)<>\"#\"),IF(LEFT(AS97,1)=\"-\",REPLACE(AS97,1,1,tech!$H$2),AS97),\"\")","v":""},"|",null,"The change management process is documented and implemented","Assessment","2.4.3.AX",{"$f":"IF(AND(AY97<>\"\",LEFT(AY97,1)<>\"#\"),IF(LEFT(AY97,1)=\"-\",REPLACE(AY97,1,1,tech!$H$2),AY97),\"\")","v":""},"|",null,"Business continuity planning and disaster recovery","References","3.1.3.RX",{"$f":"IF(AND(BE97<>\"\",LEFT(BE97,1)<>\"#\"),IF(LEFT(BE97,1)=\"-\",REPLACE(BE97,1,1,tech!$H$2),BE97),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK97<>\"\",LEFT(BK97,1)<>\"#\"),IF(LEFT(BK97,1)=\"-\",REPLACE(BK97,1,1,tech!$H$2),BK97),\"\")","v":""},"|","- Audit trail can be reconstructed from Audit logs","Audit trail can be reconstructed from audit logs","Assessment","3.3.3.AY",{"$f":"IF(AND(BQ97<>\"\",LEFT(BQ97,1)<>\"#\"),IF(LEFT(BQ97,1)=\"-\",REPLACE(BQ97,1,1,tech!$H$2),BQ97),\"\")","v":"• Audit trail can be reconstructed from Audit logs"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW97<>\"\",LEFT(BW97,1)<>\"#\"),IF(LEFT(BW97,1)=\"-\",REPLACE(BW97,1,1,tech!$H$2),BW97),\"\")","v":""},"|","- technology trends","Resources are periodically reviewed","Assessment","4.1.4.AY",{"$f":"IF(AND(CC97<>\"\",LEFT(CC97,1)<>\"#\"),IF(LEFT(CC97,1)=\"-\",REPLACE(CC97,1,1,tech!$H$2),CC97),\"\")","v":"• technology trends"},"|",null,"Perform security awareness training","Assessment","4.2.3.AX",{"$f":"IF(AND(CI97<>\"\",LEFT(CI97,1)<>\"#\"),IF(LEFT(CI97,1)=\"-\",REPLACE(CI97,1,1,tech!$H$2),CI97),\"\")","v":""},"|","- [RFC 3647 Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://datatracker.ietf.org/doc/html/rfc3647)","Establish single point of contact","References","4.3.3.RY",{"$f":"IF(AND(CO97<>\"\",LEFT(CO97,1)<>\"#\"),IF(LEFT(CO97,1)=\"-\",REPLACE(CO97,1,1,tech!$H$2),CO97),\"\")","v":"• [RFC 3647 Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://datatracker.ietf.org/doc/html/rfc3647)"},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D98,tech!$A$13:$B$17,2,0),LEFT(E98,1),IF(G98=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C98,1)=\"-\",C98,\"\")=\"\",\"\",REPLACE(IF(LEFT(C98,1)=\"-\",C98,\"\"),1,1,tech!$H$2))","v":""},"|","The following is sample evidence that can be used to assess the requirement:","Architecture and design of the PKI","Assessment","1.1.4.AY",{"$f":"IF(AND(I98<>\"\",LEFT(I98,1)<>\"#\"),IF(LEFT(I98,1)=\"-\",REPLACE(I98,1,1,tech!$H$2),I98),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|","- [RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://tools.ietf.org/html/rfc3647)","Certification practice statement is documented and published","References","1.2.3.RY",{"$f":"IF(AND(O98<>\"\",LEFT(O98,1)<>\"#\"),IF(LEFT(O98,1)=\"-\",REPLACE(O98,1,1,tech!$H$2),O98),\"\")","v":"• [RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://tools.ietf.org/html/rfc3647)"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","Guidance","1.3.4.GY",{"$f":"IF(AND(U98<>\"\",LEFT(U98,1)<>\"#\"),IF(LEFT(U98,1)=\"-\",REPLACE(U98,1,1,tech!$H$2),U98),\"\")","v":""},"|","- Logs, reports, notes, screenshots, and other evidence","Evidence from procedures is collected and maintained","Assessment","1.4.4.AY",{"$f":"IF(AND(AA98<>\"\",LEFT(AA98,1)<>\"#\"),IF(LEFT(AA98,1)=\"-\",REPLACE(AA98,1,1,tech!$H$2),AA98),\"\")","v":"• Logs, reports, notes, screenshots, and other evidence"},"|","#### Guidance","Each cryptographic key is defined and has documented lifecycle procedures","Guidance","2.1.4.GX",{"$f":"IF(AND(AG98<>\"\",LEFT(AG98,1)<>\"#\"),IF(LEFT(AG98,1)=\"-\",REPLACE(AG98,1,1,tech!$H$2),AG98),\"\")","v":""},"|","  * Documented criticality of expiration for different use cases","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM98<>\"\",LEFT(AM98,1)<>\"#\"),IF(LEFT(AM98,1)=\"-\",REPLACE(AM98,1,1,tech!$H$2),AM98),\"\")","v":"  * Documented criticality of expiration for different use cases"},"|",null,"Network vulnerability management is implemented and maintained","References","2.3.3.RX",{"$f":"IF(AND(AS98<>\"\",LEFT(AS98,1)<>\"#\"),IF(LEFT(AS98,1)=\"-\",REPLACE(AS98,1,1,tech!$H$2),AS98),\"\")","v":""},"|","#### References","The change management process is documented and implemented","References","2.4.3.RX",{"$f":"IF(AND(AY98<>\"\",LEFT(AY98,1)<>\"#\"),IF(LEFT(AY98,1)=\"-\",REPLACE(AY98,1,1,tech!$H$2),AY98),\"\")","v":""},"|","- [ISO/IEC 22301 - Business continuity management systems](https://www.iso.org/standard/50056.html)","Business continuity planning and disaster recovery","References","3.1.3.RY",{"$f":"IF(AND(BE98<>\"\",LEFT(BE98,1)<>\"#\"),IF(LEFT(BE98,1)=\"-\",REPLACE(BE98,1,1,tech!$H$2),BE98),\"\")","v":"• [ISO/IEC 22301 - Business continuity management systems](https://www.iso.org/standard/50056.html)"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK98<>\"\",LEFT(BK98,1)<>\"#\"),IF(LEFT(BK98,1)=\"-\",REPLACE(BK98,1,1,tech!$H$2),BK98),\"\")","v":""},"|","- Audit logs are stored in a secure location","Audit trail can be reconstructed from audit logs","Assessment","3.3.3.AY",{"$f":"IF(AND(BQ98<>\"\",LEFT(BQ98,1)<>\"#\"),IF(LEFT(BQ98,1)=\"-\",REPLACE(BQ98,1,1,tech!$H$2),BQ98),\"\")","v":"• Audit logs are stored in a secure location"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW98<>\"\",LEFT(BW98,1)<>\"#\"),IF(LEFT(BW98,1)=\"-\",REPLACE(BW98,1,1,tech!$H$2),BW98),\"\")","v":""},"|","- skills and knowledge of the personnel","Resources are periodically reviewed","Assessment","4.1.4.AY",{"$f":"IF(AND(CC98<>\"\",LEFT(CC98,1)<>\"#\"),IF(LEFT(CC98,1)=\"-\",REPLACE(CC98,1,1,tech!$H$2),CC98),\"\")","v":"• skills and knowledge of the personnel"},"|","- Examine Security awareness program","Perform security awareness training","Assessment","4.2.3.AY",{"$f":"IF(AND(CI98<>\"\",LEFT(CI98,1)<>\"#\"),IF(LEFT(CI98,1)=\"-\",REPLACE(CI98,1,1,tech!$H$2),CI98),\"\")","v":"• Examine Security awareness program"},"|","- [ETSI EN 319 401 - General Policy Requirements for Trust Service Providers](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/02.03.01_60/en_319401v020301p.pdf)","Establish single point of contact","References","4.3.3.RY",{"$f":"IF(AND(CO98<>\"\",LEFT(CO98,1)<>\"#\"),IF(LEFT(CO98,1)=\"-\",REPLACE(CO98,1,1,tech!$H$2),CO98),\"\")","v":"• [ETSI EN 319 401 - General Policy Requirements for Trust Service Providers](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/02.03.01_60/en_319401v020301p.pdf)"},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D99,tech!$A$13:$B$17,2,0),LEFT(E99,1),IF(G99=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C99,1)=\"-\",C99,\"\")=\"\",\"\",REPLACE(IF(LEFT(C99,1)=\"-\",C99,\"\"),1,1,tech!$H$2))","v":""},"|","- Documented architecture and design","Architecture and design of the PKI","Assessment","1.1.4.AY",{"$f":"IF(AND(I99<>\"\",LEFT(I99,1)<>\"#\"),IF(LEFT(I99,1)=\"-\",REPLACE(I99,1,1,tech!$H$2),I99),\"\")","v":"• Documented architecture and design"},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Certification practice statement is documented and published","References","1.2.3.RY",{"$f":"IF(AND(O99<>\"\",LEFT(O99,1)<>\"#\"),IF(LEFT(O99,1)=\"-\",REPLACE(O99,1,1,tech!$H$2),O99),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|","And, many times, a PKI will make use of hardware cryptographic modules for key generation and storage.  Therefore, it’s critical to ensure that the hardware cryptographic modules comply with the relevant standards. There are many laws, regulations and standards that apply to PKI.  As such, it is necessary to maintain a list of the ones that are relevant to your organization to help ensure that none are being overlooked.","List of relevant laws, regulations, and standards, exist and is maintained","Guidance","1.3.4.GY",{"$f":"IF(AND(U99<>\"\",LEFT(U99,1)<>\"#\"),IF(LEFT(U99,1)=\"-\",REPLACE(U99,1,1,tech!$H$2),U99),\"\")","v":"And, many times, a PKI will make use of hardware cryptographic modules for key generation and storage.  Therefore, it’s critical to ensure that the hardware cryptographic modules comply with the relevant standards. There are many laws, regulations and standards that apply to PKI.  As such, it is necessary to maintain a list of the ones that are relevant to your organization to help ensure that none are being overlooked."},"|",null,"Evidence from procedures is collected and maintained","Assessment","1.4.4.AX",{"$f":"IF(AND(AA99<>\"\",LEFT(AA99,1)<>\"#\"),IF(LEFT(AA99,1)=\"-\",REPLACE(AA99,1,1,tech!$H$2),AA99),\"\")","v":""},"|",null,"Each cryptographic key is defined and has documented lifecycle procedures","Guidance","2.1.4.GX",{"$f":"IF(AND(AG99<>\"\",LEFT(AG99,1)<>\"#\"),IF(LEFT(AG99,1)=\"-\",REPLACE(AG99,1,1,tech!$H$2),AG99),\"\")","v":""},"|","  * Automated monitoring and alerting of expiration for critical systems","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM99<>\"\",LEFT(AM99,1)<>\"#\"),IF(LEFT(AM99,1)=\"-\",REPLACE(AM99,1,1,tech!$H$2),AM99),\"\")","v":"  * Automated monitoring and alerting of expiration for critical systems"},"|","- [Common Vulnerability Scoring System (CVSS)](https://www.first.org/cvss/)","Network vulnerability management is implemented and maintained","References","2.3.3.RY",{"$f":"IF(AND(AS99<>\"\",LEFT(AS99,1)<>\"#\"),IF(LEFT(AS99,1)=\"-\",REPLACE(AS99,1,1,tech!$H$2),AS99),\"\")","v":"• [Common Vulnerability Scoring System (CVSS)](https://www.first.org/cvss/)"},"|",null,"The change management process is documented and implemented","References","2.4.3.RX",{"$f":"IF(AND(AY99<>\"\",LEFT(AY99,1)<>\"#\"),IF(LEFT(AY99,1)=\"-\",REPLACE(AY99,1,1,tech!$H$2),AY99),\"\")","v":""},"|","- [NIST Special Publication 800-34 Revision 1 - Contingency Planning Guide for Federal Information Systems](https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final)","Business continuity planning and disaster recovery","References","3.1.3.RY",{"$f":"IF(AND(BE99<>\"\",LEFT(BE99,1)<>\"#\"),IF(LEFT(BE99,1)=\"-\",REPLACE(BE99,1,1,tech!$H$2),BE99),\"\")","v":"• [NIST Special Publication 800-34 Revision 1 - Contingency Planning Guide for Federal Information Systems](https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final)"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK99<>\"\",LEFT(BK99,1)<>\"#\"),IF(LEFT(BK99,1)=\"-\",REPLACE(BK99,1,1,tech!$H$2),BK99),\"\")","v":""},"|","- Audit logs are protected against unauthorized access, modification, and deletion","Audit trail can be reconstructed from audit logs","Assessment","3.3.3.AY",{"$f":"IF(AND(BQ99<>\"\",LEFT(BQ99,1)<>\"#\"),IF(LEFT(BQ99,1)=\"-\",REPLACE(BQ99,1,1,tech!$H$2),BQ99),\"\")","v":"• Audit logs are protected against unauthorized access, modification, and deletion"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW99<>\"\",LEFT(BW99,1)<>\"#\"),IF(LEFT(BW99,1)=\"-\",REPLACE(BW99,1,1,tech!$H$2),BW99),\"\")","v":""},"|",null,"Resources are periodically reviewed","Assessment","4.1.4.AX",{"$f":"IF(AND(CC99<>\"\",LEFT(CC99,1)<>\"#\"),IF(LEFT(CC99,1)=\"-\",REPLACE(CC99,1,1,tech!$H$2),CC99),\"\")","v":""},"|","- Interview personnel to verify that they are aware of their responsibilities","Perform security awareness training","Assessment","4.2.3.AY",{"$f":"IF(AND(CI99<>\"\",LEFT(CI99,1)<>\"#\"),IF(LEFT(CI99,1)=\"-\",REPLACE(CI99,1,1,tech!$H$2),CI99),\"\")","v":"• Interview personnel to verify that they are aware of their responsibilities"},"|",null,"Establish single point of contact","References","4.3.3.RX",{"$f":"IF(AND(CO99<>\"\",LEFT(CO99,1)<>\"#\"),IF(LEFT(CO99,1)=\"-\",REPLACE(CO99,1,1,tech!$H$2),CO99),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D100,tech!$A$13:$B$17,2,0),LEFT(E100,1),IF(G100=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C100,1)=\"-\",C100,\"\")=\"\",\"\",REPLACE(IF(LEFT(C100,1)=\"-\",C100,\"\"),1,1,tech!$H$2))","v":""},"|","- alignment with the scope and business drivers","Architecture and design of the PKI","Assessment","1.1.4.AY",{"$f":"IF(AND(I100<>\"\",LEFT(I100,1)<>\"#\"),IF(LEFT(I100,1)=\"-\",REPLACE(I100,1,1,tech!$H$2),I100),\"\")","v":"• alignment with the scope and business drivers"},"|","- [ETSI EN 319 411-1 - Policy and security requirements for Trust Service Providers issuing certificates](https://www.etsi.org/deliver/etsi_en/319400_319499/31941101/01.03.01_60/en_31941101v010301p.pdf)","Certification practice statement is documented and published","References","1.2.3.RY",{"$f":"IF(AND(O100<>\"\",LEFT(O100,1)<>\"#\"),IF(LEFT(O100,1)=\"-\",REPLACE(O100,1,1,tech!$H$2),O100),\"\")","v":"• [ETSI EN 319 411-1 - Policy and security requirements for Trust Service Providers issuing certificates](https://www.etsi.org/deliver/etsi_en/319400_319499/31941101/01.03.01_60/en_31941101v010301p.pdf)"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","Guidance","1.3.4.GX",{"$f":"IF(AND(U100<>\"\",LEFT(U100,1)<>\"#\"),IF(LEFT(U100,1)=\"-\",REPLACE(U100,1,1,tech!$H$2),U100),\"\")","v":""},"|","#### References","Evidence from procedures is collected and maintained","References","1.4.4.RX",{"$f":"IF(AND(AA100<>\"\",LEFT(AA100,1)<>\"#\"),IF(LEFT(AA100,1)=\"-\",REPLACE(AA100,1,1,tech!$H$2),AA100),\"\")","v":""},"|","Each cryptographic key type that is defined and used for specific use-case should have a complete description of its lifecycle. Each lifecycle phase has a proper description of the process and is backed up with the procedure that is executed when needed.","Each cryptographic key is defined and has documented lifecycle procedures","Guidance","2.1.4.GY",{"$f":"IF(AND(AG100<>\"\",LEFT(AG100,1)<>\"#\"),IF(LEFT(AG100,1)=\"-\",REPLACE(AG100,1,1,tech!$H$2),AG100),\"\")","v":"Each cryptographic key type that is defined and used for specific use-case should have a complete description of its lifecycle. Each lifecycle phase has a proper description of the process and is backed up with the procedure that is executed when needed."},"|","  * Automated certificate renewal","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM100<>\"\",LEFT(AM100,1)<>\"#\"),IF(LEFT(AM100,1)=\"-\",REPLACE(AM100,1,1,tech!$H$2),AM100),\"\")","v":"  * Automated certificate renewal"},"|","- [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)","Network vulnerability management is implemented and maintained","References","2.3.3.RY",{"$f":"IF(AND(AS100<>\"\",LEFT(AS100,1)<>\"#\"),IF(LEFT(AS100,1)=\"-\",REPLACE(AS100,1,1,tech!$H$2),AS100),\"\")","v":"• [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)"},"|","- [COBIT (Control Objectives for Information and Related Technologies)](https://www.isaca.org/resources/cobit)","The change management process is documented and implemented","References","2.4.3.RY",{"$f":"IF(AND(AY100<>\"\",LEFT(AY100,1)<>\"#\"),IF(LEFT(AY100,1)=\"-\",REPLACE(AY100,1,1,tech!$H$2),AY100),\"\")","v":"• [COBIT (Control Objectives for Information and Related Technologies)](https://www.isaca.org/resources/cobit)"},"|",null,"Business continuity planning and disaster recovery","References","3.1.3.RX",{"$f":"IF(AND(BE100<>\"\",LEFT(BE100,1)<>\"#\"),IF(LEFT(BE100,1)=\"-\",REPLACE(BE100,1,1,tech!$H$2),BE100),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK100<>\"\",LEFT(BK100,1)<>\"#\"),IF(LEFT(BK100,1)=\"-\",REPLACE(BK100,1,1,tech!$H$2),BK100),\"\")","v":""},"|","- Review of records","Audit trail can be reconstructed from audit logs","Assessment","3.3.3.AY",{"$f":"IF(AND(BQ100<>\"\",LEFT(BQ100,1)<>\"#\"),IF(LEFT(BQ100,1)=\"-\",REPLACE(BQ100,1,1,tech!$H$2),BQ100),\"\")","v":"• Review of records"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW100<>\"\",LEFT(BW100,1)<>\"#\"),IF(LEFT(BW100,1)=\"-\",REPLACE(BW100,1,1,tech!$H$2),BW100),\"\")","v":""},"|","#### References","Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC100<>\"\",LEFT(CC100,1)<>\"#\"),IF(LEFT(CC100,1)=\"-\",REPLACE(CC100,1,1,tech!$H$2),CC100),\"\")","v":""},"|","- Review Security awareness Training records","Perform security awareness training","Assessment","4.2.3.AY",{"$f":"IF(AND(CI100<>\"\",LEFT(CI100,1)<>\"#\"),IF(LEFT(CI100,1)=\"-\",REPLACE(CI100,1,1,tech!$H$2),CI100),\"\")","v":"• Review Security awareness Training records"},"|","### Timely communication of important information","Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO100<>\"\",LEFT(CO100,1)<>\"#\"),IF(LEFT(CO100,1)=\"-\",REPLACE(CO100,1,1,tech!$H$2),CO100),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D101,tech!$A$13:$B$17,2,0),LEFT(E101,1),IF(G101=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C101,1)=\"-\",C101,\"\")=\"\",\"\",REPLACE(IF(LEFT(C101,1)=\"-\",C101,\"\"),1,1,tech!$H$2))","v":""},"|","- Interview with the PKI team to confirm the Understanding of the architecture and design","Architecture and design of the PKI","Assessment","1.1.4.AY",{"$f":"IF(AND(I101<>\"\",LEFT(I101,1)<>\"#\"),IF(LEFT(I101,1)=\"-\",REPLACE(I101,1,1,tech!$H$2),I101),\"\")","v":"• Interview with the PKI team to confirm the Understanding of the architecture and design"},"|",null,"Certification practice statement is documented and published","References","1.2.3.RX",{"$f":"IF(AND(O101<>\"\",LEFT(O101,1)<>\"#\"),IF(LEFT(O101,1)=\"-\",REPLACE(O101,1,1,tech!$H$2),O101),\"\")","v":""},"|","#### Assessment","List of relevant laws, regulations, and standards, exist and is maintained","Assessment","1.3.4.AX",{"$f":"IF(AND(U101<>\"\",LEFT(U101,1)<>\"#\"),IF(LEFT(U101,1)=\"-\",REPLACE(U101,1,1,tech!$H$2),U101),\"\")","v":""},"|",null,"Evidence from procedures is collected and maintained","References","1.4.4.RX",{"$f":"IF(AND(AA101<>\"\",LEFT(AA101,1)<>\"#\"),IF(LEFT(AA101,1)=\"-\",REPLACE(AA101,1,1,tech!$H$2),AA101),\"\")","v":""},"|",null,"Each cryptographic key is defined and has documented lifecycle procedures","Guidance","2.1.4.GY",{"$f":"IF(AND(AG101<>\"\",LEFT(AG101,1)<>\"#\"),IF(LEFT(AG101,1)=\"-\",REPLACE(AG101,1,1,tech!$H$2),AG101),\"\")","v":""},"|","* Documented revocation process","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM101<>\"\",LEFT(AM101,1)<>\"#\"),IF(LEFT(AM101,1)=\"-\",REPLACE(AM101,1,1,tech!$H$2),AM101),\"\")","v":"* Documented revocation process"},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Network vulnerability management is implemented and maintained","References","2.3.3.RY",{"$f":"IF(AND(AS101<>\"\",LEFT(AS101,1)<>\"#\"),IF(LEFT(AS101,1)=\"-\",REPLACE(AS101,1,1,tech!$H$2),AS101),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|","- [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)","The change management process is documented and implemented","References","2.4.3.RY",{"$f":"IF(AND(AY101<>\"\",LEFT(AY101,1)<>\"#\"),IF(LEFT(AY101,1)=\"-\",REPLACE(AY101,1,1,tech!$H$2),AY101),\"\")","v":"• [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)"},"|","### Technology future proofing","Technology future proofing","References","3.1.4.RX",{"$f":"IF(AND(BE101<>\"\",LEFT(BE101,1)<>\"#\"),IF(LEFT(BE101,1)=\"-\",REPLACE(BE101,1,1,tech!$H$2),BE101),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK101<>\"\",LEFT(BK101,1)<>\"#\"),IF(LEFT(BK101,1)=\"-\",REPLACE(BK101,1,1,tech!$H$2),BK101),\"\")","v":""},"|","- Interviews with personnel to Understand the Audit logging implementation","Audit trail can be reconstructed from audit logs","Assessment","3.3.3.AY",{"$f":"IF(AND(BQ101<>\"\",LEFT(BQ101,1)<>\"#\"),IF(LEFT(BQ101,1)=\"-\",REPLACE(BQ101,1,1,tech!$H$2),BQ101),\"\")","v":"• Interviews with personnel to Understand the Audit logging implementation"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW101<>\"\",LEFT(BW101,1)<>\"#\"),IF(LEFT(BW101,1)=\"-\",REPLACE(BW101,1,1,tech!$H$2),BW101),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC101<>\"\",LEFT(CC101,1)<>\"#\"),IF(LEFT(CC101,1)=\"-\",REPLACE(CC101,1,1,tech!$H$2),CC101),\"\")","v":""},"|","- Security awareness Training is provided in accordance with the Training plan","Perform security awareness training","Assessment","4.2.3.AY",{"$f":"IF(AND(CI101<>\"\",LEFT(CI101,1)<>\"#\"),IF(LEFT(CI101,1)=\"-\",REPLACE(CI101,1,1,tech!$H$2),CI101),\"\")","v":"• Security awareness Training is provided in accordance with the Training plan"},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO101<>\"\",LEFT(CO101,1)<>\"#\"),IF(LEFT(CO101,1)=\"-\",REPLACE(CO101,1,1,tech!$H$2),CO101),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D102,tech!$A$13:$B$17,2,0),LEFT(E102,1),IF(G102=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C102,1)=\"-\",C102,\"\")=\"\",\"\",REPLACE(IF(LEFT(C102,1)=\"-\",C102,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","Assessment","1.1.4.AX",{"$f":"IF(AND(I102<>\"\",LEFT(I102,1)<>\"#\"),IF(LEFT(I102,1)=\"-\",REPLACE(I102,1,1,tech!$H$2),I102),\"\")","v":""},"|","### Disclosure statement is documented and published","Disclosure statement is documented and published","References","1.2.4.RX",{"$f":"IF(AND(O102<>\"\",LEFT(O102,1)<>\"#\"),IF(LEFT(O102,1)=\"-\",REPLACE(O102,1,1,tech!$H$2),O102),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","Assessment","1.3.4.AX",{"$f":"IF(AND(U102<>\"\",LEFT(U102,1)<>\"#\"),IF(LEFT(U102,1)=\"-\",REPLACE(U102,1,1,tech!$H$2),U102),\"\")","v":""},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Evidence from procedures is collected and maintained","References","1.4.4.RY",{"$f":"IF(AND(AA102<>\"\",LEFT(AA102,1)<>\"#\"),IF(LEFT(AA102,1)=\"-\",REPLACE(AA102,1,1,tech!$H$2),AA102),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|","The key can have various lifecycle phases, such as generation, registration, initialization, distribution, loading, storage, archiving, backup, recovery, revocation, removal, destruction, or others applicable for the key.","Each cryptographic key is defined and has documented lifecycle procedures","Guidance","2.1.4.GY",{"$f":"IF(AND(AG102<>\"\",LEFT(AG102,1)<>\"#\"),IF(LEFT(AG102,1)=\"-\",REPLACE(AG102,1,1,tech!$H$2),AG102),\"\")","v":"The key can have various lifecycle phases, such as generation, registration, initialization, distribution, loading, storage, archiving, backup, recovery, revocation, removal, destruction, or others applicable for the key."},"|","  * Documented revocation procedures, both for subjects and administrators","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM102<>\"\",LEFT(AM102,1)<>\"#\"),IF(LEFT(AM102,1)=\"-\",REPLACE(AM102,1,1,tech!$H$2),AM102),\"\")","v":"  * Documented revocation procedures, both for subjects and administrators"},"|",null,"Network vulnerability management is implemented and maintained","References","2.3.3.RX",{"$f":"IF(AND(AS102<>\"\",LEFT(AS102,1)<>\"#\"),IF(LEFT(AS102,1)=\"-\",REPLACE(AS102,1,1,tech!$H$2),AS102),\"\")","v":""},"|","- [The Information Technology Infrastructure Library (ITIL)](https://www.axelos.com/best-practice-solutions/itil)","The change management process is documented and implemented","References","2.4.3.RY",{"$f":"IF(AND(AY102<>\"\",LEFT(AY102,1)<>\"#\"),IF(LEFT(AY102,1)=\"-\",REPLACE(AY102,1,1,tech!$H$2),AY102),\"\")","v":"• [The Information Technology Infrastructure Library (ITIL)](https://www.axelos.com/best-practice-solutions/itil)"},"|",null,"Technology future proofing","References","3.1.4.RX",{"$f":"IF(AND(BE102<>\"\",LEFT(BE102,1)<>\"#\"),IF(LEFT(BE102,1)=\"-\",REPLACE(BE102,1,1,tech!$H$2),BE102),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK102<>\"\",LEFT(BK102,1)<>\"#\"),IF(LEFT(BK102,1)=\"-\",REPLACE(BK102,1,1,tech!$H$2),BK102),\"\")","v":""},"|",null,"Audit trail can be reconstructed from audit logs","Assessment","3.3.3.AX",{"$f":"IF(AND(BQ102<>\"\",LEFT(BQ102,1)<>\"#\"),IF(LEFT(BQ102,1)=\"-\",REPLACE(BQ102,1,1,tech!$H$2),BQ102),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW102<>\"\",LEFT(BW102,1)<>\"#\"),IF(LEFT(BW102,1)=\"-\",REPLACE(BW102,1,1,tech!$H$2),BW102),\"\")","v":""},"|","N/A","Resources are periodically reviewed","References","4.1.4.RY",{"$f":"IF(AND(CC102<>\"\",LEFT(CC102,1)<>\"#\"),IF(LEFT(CC102,1)=\"-\",REPLACE(CC102,1,1,tech!$H$2),CC102),\"\")","v":"N/A"},"|","- Review content of the Security awareness Training","Perform security awareness training","Assessment","4.2.3.AY",{"$f":"IF(AND(CI102<>\"\",LEFT(CI102,1)<>\"#\"),IF(LEFT(CI102,1)=\"-\",REPLACE(CI102,1,1,tech!$H$2),CI102),\"\")","v":"• Review content of the Security awareness Training"},"|","#### Guidance","Timely communication of important information","Guidance","4.3.4.GX",{"$f":"IF(AND(CO102<>\"\",LEFT(CO102,1)<>\"#\"),IF(LEFT(CO102,1)=\"-\",REPLACE(CO102,1,1,tech!$H$2),CO102),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D103,tech!$A$13:$B$17,2,0),LEFT(E103,1),IF(G103=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C103,1)=\"-\",C103,\"\")=\"\",\"\",REPLACE(IF(LEFT(C103,1)=\"-\",C103,\"\"),1,1,tech!$H$2))","v":""},"|","#### References","Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I103<>\"\",LEFT(I103,1)<>\"#\"),IF(LEFT(I103,1)=\"-\",REPLACE(I103,1,1,tech!$H$2),I103),\"\")","v":""},"|",null,"Disclosure statement is documented and published","References","1.2.4.RX",{"$f":"IF(AND(O103<>\"\",LEFT(O103,1)<>\"#\"),IF(LEFT(O103,1)=\"-\",REPLACE(O103,1,1,tech!$H$2),O103),\"\")","v":""},"|","- Documented list of applicable laws, regulations and standards is maintained","List of relevant laws, regulations, and standards, exist and is maintained","Assessment","1.3.4.AY",{"$f":"IF(AND(U103<>\"\",LEFT(U103,1)<>\"#\"),IF(LEFT(U103,1)=\"-\",REPLACE(U103,1,1,tech!$H$2),U103),\"\")","v":"• Documented list of applicable laws, regulations and standards is maintained"},"|","- [RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://tools.ietf.org/html/rfc3647)","Evidence from procedures is collected and maintained","References","1.4.4.RY",{"$f":"IF(AND(AA103<>\"\",LEFT(AA103,1)<>\"#\"),IF(LEFT(AA103,1)=\"-\",REPLACE(AA103,1,1,tech!$H$2),AA103),\"\")","v":"• [RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://tools.ietf.org/html/rfc3647)"},"|",null,"Each cryptographic key is defined and has documented lifecycle procedures","Guidance","2.1.4.GY",{"$f":"IF(AND(AG103<>\"\",LEFT(AG103,1)<>\"#\"),IF(LEFT(AG103,1)=\"-\",REPLACE(AG103,1,1,tech!$H$2),AG103),\"\")","v":""},"|","  * If suspension is used the process to lift (or remove) suspension","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM103<>\"\",LEFT(AM103,1)<>\"#\"),IF(LEFT(AM103,1)=\"-\",REPLACE(AM103,1,1,tech!$H$2),AM103),\"\")","v":"  * If suspension is used the process to lift (or remove) suspension"},"|","### Infrastructure recovery objectives controls","Infrastructure recovery objectives controls","References","2.3.4.RX",{"$f":"IF(AND(AS103<>\"\",LEFT(AS103,1)<>\"#\"),IF(LEFT(AS103,1)=\"-\",REPLACE(AS103,1,1,tech!$H$2),AS103),\"\")","v":""},"|",null,"The change management process is documented and implemented","References","2.4.3.RX",{"$f":"IF(AND(AY103<>\"\",LEFT(AY103,1)<>\"#\"),IF(LEFT(AY103,1)=\"-\",REPLACE(AY103,1,1,tech!$H$2),AY103),\"\")","v":""},"|","#### Guidance","Technology future proofing","Guidance","3.1.4.GX",{"$f":"IF(AND(BE103<>\"\",LEFT(BE103,1)<>\"#\"),IF(LEFT(BE103,1)=\"-\",REPLACE(BE103,1,1,tech!$H$2),BE103),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK103<>\"\",LEFT(BK103,1)<>\"#\"),IF(LEFT(BK103,1)=\"-\",REPLACE(BK103,1,1,tech!$H$2),BK103),\"\")","v":""},"|","#### References","Audit trail can be reconstructed from audit logs","References","3.3.3.RX",{"$f":"IF(AND(BQ103<>\"\",LEFT(BQ103,1)<>\"#\"),IF(LEFT(BQ103,1)=\"-\",REPLACE(BQ103,1,1,tech!$H$2),BQ103),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW103<>\"\",LEFT(BW103,1)<>\"#\"),IF(LEFT(BW103,1)=\"-\",REPLACE(BW103,1,1,tech!$H$2),BW103),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC103<>\"\",LEFT(CC103,1)<>\"#\"),IF(LEFT(CC103,1)=\"-\",REPLACE(CC103,1,1,tech!$H$2),CC103),\"\")","v":""},"|",null,"Perform security awareness training","Assessment","4.2.3.AX",{"$f":"IF(AND(CI103<>\"\",LEFT(CI103,1)<>\"#\"),IF(LEFT(CI103,1)=\"-\",REPLACE(CI103,1,1,tech!$H$2),CI103),\"\")","v":""},"|",null,"Timely communication of important information","Guidance","4.3.4.GX",{"$f":"IF(AND(CO103<>\"\",LEFT(CO103,1)<>\"#\"),IF(LEFT(CO103,1)=\"-\",REPLACE(CO103,1,1,tech!$H$2),CO103),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D104,tech!$A$13:$B$17,2,0),LEFT(E104,1),IF(G104=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C104,1)=\"-\",C104,\"\")=\"\",\"\",REPLACE(IF(LEFT(C104,1)=\"-\",C104,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I104<>\"\",LEFT(I104,1)<>\"#\"),IF(LEFT(I104,1)=\"-\",REPLACE(I104,1,1,tech!$H$2),I104),\"\")","v":""},"|","#### Guidance","Disclosure statement is documented and published","Guidance","1.2.4.GX",{"$f":"IF(AND(O104<>\"\",LEFT(O104,1)<>\"#\"),IF(LEFT(O104,1)=\"-\",REPLACE(O104,1,1,tech!$H$2),O104),\"\")","v":""},"|","- Procedures established for periodic review of the laws, regulations and standards","List of relevant laws, regulations, and standards, exist and is maintained","Assessment","1.3.4.AY",{"$f":"IF(AND(U104<>\"\",LEFT(U104,1)<>\"#\"),IF(LEFT(U104,1)=\"-\",REPLACE(U104,1,1,tech!$H$2),U104),\"\")","v":"• Procedures established for periodic review of the laws, regulations and standards"},"|","- [ENISA Publications](https://www.enisa.europa.eu/publications)","Evidence from procedures is collected and maintained","References","1.4.4.RY",{"$f":"IF(AND(AA104<>\"\",LEFT(AA104,1)<>\"#\"),IF(LEFT(AA104,1)=\"-\",REPLACE(AA104,1,1,tech!$H$2),AA104),\"\")","v":"• [ENISA Publications](https://www.enisa.europa.eu/publications)"},"|","The lifecycle phases contains appropriate description of the procedure such as:","Each cryptographic key is defined and has documented lifecycle procedures","Guidance","2.1.4.GY",{"$f":"IF(AND(AG104<>\"\",LEFT(AG104,1)<>\"#\"),IF(LEFT(AG104,1)=\"-\",REPLACE(AG104,1,1,tech!$H$2),AG104),\"\")","v":"The lifecycle phases contains appropriate description of the procedure such as:"},"|","  * Documented contact points for reports in the organizations or from relying parties","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM104<>\"\",LEFT(AM104,1)<>\"#\"),IF(LEFT(AM104,1)=\"-\",REPLACE(AM104,1,1,tech!$H$2),AM104),\"\")","v":"  * Documented contact points for reports in the organizations or from relying parties"},"|",null,"Infrastructure recovery objectives controls","References","2.3.4.RX",{"$f":"IF(AND(AS104<>\"\",LEFT(AS104,1)<>\"#\"),IF(LEFT(AS104,1)=\"-\",REPLACE(AS104,1,1,tech!$H$2),AS104),\"\")","v":""},"|","### Requirements for agility are identified","Requirements for agility are identified","References","2.4.4.RX",{"$f":"IF(AND(AY104<>\"\",LEFT(AY104,1)<>\"#\"),IF(LEFT(AY104,1)=\"-\",REPLACE(AY104,1,1,tech!$H$2),AY104),\"\")","v":""},"|",null,"Technology future proofing","Guidance","3.1.4.GX",{"$f":"IF(AND(BE104<>\"\",LEFT(BE104,1)<>\"#\"),IF(LEFT(BE104,1)=\"-\",REPLACE(BE104,1,1,tech!$H$2),BE104),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK104<>\"\",LEFT(BK104,1)<>\"#\"),IF(LEFT(BK104,1)=\"-\",REPLACE(BK104,1,1,tech!$H$2),BK104),\"\")","v":""},"|",null,"Audit trail can be reconstructed from audit logs","References","3.3.3.RX",{"$f":"IF(AND(BQ104<>\"\",LEFT(BQ104,1)<>\"#\"),IF(LEFT(BQ104,1)=\"-\",REPLACE(BQ104,1,1,tech!$H$2),BQ104),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW104<>\"\",LEFT(BW104,1)<>\"#\"),IF(LEFT(BW104,1)=\"-\",REPLACE(BW104,1,1,tech!$H$2),BW104),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC104<>\"\",LEFT(CC104,1)<>\"#\"),IF(LEFT(CC104,1)=\"-\",REPLACE(CC104,1,1,tech!$H$2),CC104),\"\")","v":""},"|","#### References","Perform security awareness training","References","4.2.3.RX",{"$f":"IF(AND(CI104<>\"\",LEFT(CI104,1)<>\"#\"),IF(LEFT(CI104,1)=\"-\",REPLACE(CI104,1,1,tech!$H$2),CI104),\"\")","v":""},"|","In the event of an incident with high impact to the security and established trust of the PKI implementation, the organization should communicate the information to the PKI participants in a timely manner to avoid increased escalation of the event and inform participants of further actions that may be required to execute.","Timely communication of important information","Guidance","4.3.4.GY",{"$f":"IF(AND(CO104<>\"\",LEFT(CO104,1)<>\"#\"),IF(LEFT(CO104,1)=\"-\",REPLACE(CO104,1,1,tech!$H$2),CO104),\"\")","v":"In the event of an incident with high impact to the security and established trust of the PKI implementation, the organization should communicate the information to the PKI participants in a timely manner to avoid increased escalation of the event and inform participants of further actions that may be required to execute."},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D105,tech!$A$13:$B$17,2,0),LEFT(E105,1),IF(G105=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C105,1)=\"-\",C105,\"\")=\"\",\"\",REPLACE(IF(LEFT(C105,1)=\"-\",C105,\"\"),1,1,tech!$H$2))","v":""},"|","- [ETSI EN 319 401 - General Policy Requirements for Trust Service Providers](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/02.03.01_60/en_319401v020301p.pdf)","Architecture and design of the PKI","References","1.1.4.RY",{"$f":"IF(AND(I105<>\"\",LEFT(I105,1)<>\"#\"),IF(LEFT(I105,1)=\"-\",REPLACE(I105,1,1,tech!$H$2),I105),\"\")","v":"• [ETSI EN 319 401 - General Policy Requirements for Trust Service Providers](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/02.03.01_60/en_319401v020301p.pdf)"},"|",null,"Disclosure statement is documented and published","Guidance","1.2.4.GX",{"$f":"IF(AND(O105<>\"\",LEFT(O105,1)<>\"#\"),IF(LEFT(O105,1)=\"-\",REPLACE(O105,1,1,tech!$H$2),O105),\"\")","v":""},"|","- Procedures established to remediate Any deficiencies or non-Compliance issues identified","List of relevant laws, regulations, and standards, exist and is maintained","Assessment","1.3.4.AY",{"$f":"IF(AND(U105<>\"\",LEFT(U105,1)<>\"#\"),IF(LEFT(U105,1)=\"-\",REPLACE(U105,1,1,tech!$H$2),U105),\"\")","v":"• Procedures established to remediate Any deficiencies or non-Compliance issues identified"},"|",null,"Evidence from procedures is collected and maintained","References","1.4.4.RX",{"$f":"IF(AND(AA105<>\"\",LEFT(AA105,1)<>\"#\"),IF(LEFT(AA105,1)=\"-\",REPLACE(AA105,1,1,tech!$H$2),AA105),\"\")","v":""},"|","- Prerequisites for execution","Each cryptographic key is defined and has documented lifecycle procedures","Guidance","2.1.4.GY",{"$f":"IF(AND(AG105<>\"\",LEFT(AG105,1)<>\"#\"),IF(LEFT(AG105,1)=\"-\",REPLACE(AG105,1,1,tech!$H$2),AG105),\"\")","v":"• Prerequisites for execution"},"|","  * List of relying parties that depend on updated revocation information","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM105<>\"\",LEFT(AM105,1)<>\"#\"),IF(LEFT(AM105,1)=\"-\",REPLACE(AM105,1,1,tech!$H$2),AM105),\"\")","v":"  * List of relying parties that depend on updated revocation information"},"|","#### Guidance","Infrastructure recovery objectives controls","Guidance","2.3.4.GX",{"$f":"IF(AND(AS105<>\"\",LEFT(AS105,1)<>\"#\"),IF(LEFT(AS105,1)=\"-\",REPLACE(AS105,1,1,tech!$H$2),AS105),\"\")","v":""},"|",null,"Requirements for agility are identified","References","2.4.4.RX",{"$f":"IF(AND(AY105<>\"\",LEFT(AY105,1)<>\"#\"),IF(LEFT(AY105,1)=\"-\",REPLACE(AY105,1,1,tech!$H$2),AY105),\"\")","v":""},"|","Applicable technology should always be future proofed to ensure that the PKI is able to adapt to changes, and will support the organization PKI in the future when new standards, algorithms, and approach will be developed.","Technology future proofing","Guidance","3.1.4.GY",{"$f":"IF(AND(BE105<>\"\",LEFT(BE105,1)<>\"#\"),IF(LEFT(BE105,1)=\"-\",REPLACE(BE105,1,1,tech!$H$2),BE105),\"\")","v":"Applicable technology should always be future proofed to ensure that the PKI is able to adapt to changes, and will support the organization PKI in the future when new standards, algorithms, and approach will be developed."},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK105<>\"\",LEFT(BK105,1)<>\"#\"),IF(LEFT(BK105,1)=\"-\",REPLACE(BK105,1,1,tech!$H$2),BK105),\"\")","v":""},"|","- [RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://tools.ietf.org/html/rfc3647)","Audit trail can be reconstructed from audit logs","References","3.3.3.RY",{"$f":"IF(AND(BQ105<>\"\",LEFT(BQ105,1)<>\"#\"),IF(LEFT(BQ105,1)=\"-\",REPLACE(BQ105,1,1,tech!$H$2),BQ105),\"\")","v":"• [RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://tools.ietf.org/html/rfc3647)"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW105<>\"\",LEFT(BW105,1)<>\"#\"),IF(LEFT(BW105,1)=\"-\",REPLACE(BW105,1,1,tech!$H$2),BW105),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC105<>\"\",LEFT(CC105,1)<>\"#\"),IF(LEFT(CC105,1)=\"-\",REPLACE(CC105,1,1,tech!$H$2),CC105),\"\")","v":""},"|",null,"Perform security awareness training","References","4.2.3.RX",{"$f":"IF(AND(CI105<>\"\",LEFT(CI105,1)<>\"#\"),IF(LEFT(CI105,1)=\"-\",REPLACE(CI105,1,1,tech!$H$2),CI105),\"\")","v":""},"|",null,"Timely communication of important information","Guidance","4.3.4.GY",{"$f":"IF(AND(CO105<>\"\",LEFT(CO105,1)<>\"#\"),IF(LEFT(CO105,1)=\"-\",REPLACE(CO105,1,1,tech!$H$2),CO105),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D106,tech!$A$13:$B$17,2,0),LEFT(E106,1),IF(G106=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C106,1)=\"-\",C106,\"\")=\"\",\"\",REPLACE(IF(LEFT(C106,1)=\"-\",C106,\"\"),1,1,tech!$H$2))","v":""},"|","- [The Open Group Architecture Framework (TOGAF)](https://www.opengroup.org/togaf)","Architecture and design of the PKI","References","1.1.4.RY",{"$f":"IF(AND(I106<>\"\",LEFT(I106,1)<>\"#\"),IF(LEFT(I106,1)=\"-\",REPLACE(I106,1,1,tech!$H$2),I106),\"\")","v":"• [The Open Group Architecture Framework (TOGAF)](https://www.opengroup.org/togaf)"},"|","The disclosure statement (DS) is a document that describes the PKI and its services. It refers to a document that discloses the relevant information about the CA and its services to the relying parties.","Disclosure statement is documented and published","Guidance","1.2.4.GY",{"$f":"IF(AND(O106<>\"\",LEFT(O106,1)<>\"#\"),IF(LEFT(O106,1)=\"-\",REPLACE(O106,1,1,tech!$H$2),O106),\"\")","v":"The disclosure statement (DS) is a document that describes the PKI and its services. It refers to a document that discloses the relevant information about the CA and its services to the relying parties."},"|","- Procedures established to communicate results of the periodic reviews","List of relevant laws, regulations, and standards, exist and is maintained","Assessment","1.3.4.AY",{"$f":"IF(AND(U106<>\"\",LEFT(U106,1)<>\"#\"),IF(LEFT(U106,1)=\"-\",REPLACE(U106,1,1,tech!$H$2),U106),\"\")","v":"• Procedures established to communicate results of the periodic reviews"},"|","### Processes and procedures are reviewed and updated","Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA106<>\"\",LEFT(AA106,1)<>\"#\"),IF(LEFT(AA106,1)=\"-\",REPLACE(AA106,1,1,tech!$H$2),AA106),\"\")","v":""},"|","- required roles and permissions","Each cryptographic key is defined and has documented lifecycle procedures","Guidance","2.1.4.GY",{"$f":"IF(AND(AG106<>\"\",LEFT(AG106,1)<>\"#\"),IF(LEFT(AG106,1)=\"-\",REPLACE(AG106,1,1,tech!$H$2),AG106),\"\")","v":"• required roles and permissions"},"|","* Documented Certificate status service","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM106<>\"\",LEFT(AM106,1)<>\"#\"),IF(LEFT(AM106,1)=\"-\",REPLACE(AM106,1,1,tech!$H$2),AM106),\"\")","v":"* Documented Certificate status service"},"|",null,"Infrastructure recovery objectives controls","Guidance","2.3.4.GX",{"$f":"IF(AND(AS106<>\"\",LEFT(AS106,1)<>\"#\"),IF(LEFT(AS106,1)=\"-\",REPLACE(AS106,1,1,tech!$H$2),AS106),\"\")","v":""},"|","#### Guidance","Requirements for agility are identified","Guidance","2.4.4.GX",{"$f":"IF(AND(AY106<>\"\",LEFT(AY106,1)<>\"#\"),IF(LEFT(AY106,1)=\"-\",REPLACE(AY106,1,1,tech!$H$2),AY106),\"\")","v":""},"|",null,"Technology future proofing","Guidance","3.1.4.GY",{"$f":"IF(AND(BE106<>\"\",LEFT(BE106,1)<>\"#\"),IF(LEFT(BE106,1)=\"-\",REPLACE(BE106,1,1,tech!$H$2),BE106),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK106<>\"\",LEFT(BK106,1)<>\"#\"),IF(LEFT(BK106,1)=\"-\",REPLACE(BK106,1,1,tech!$H$2),BK106),\"\")","v":""},"|","- [NIST - Guide to Computer Security Log Management](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf)","Audit trail can be reconstructed from audit logs","References","3.3.3.RY",{"$f":"IF(AND(BQ106<>\"\",LEFT(BQ106,1)<>\"#\"),IF(LEFT(BQ106,1)=\"-\",REPLACE(BQ106,1,1,tech!$H$2),BQ106),\"\")","v":"• [NIST - Guide to Computer Security Log Management](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf)"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW106<>\"\",LEFT(BW106,1)<>\"#\"),IF(LEFT(BW106,1)=\"-\",REPLACE(BW106,1,1,tech!$H$2),BW106),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC106<>\"\",LEFT(CC106,1)<>\"#\"),IF(LEFT(CC106,1)=\"-\",REPLACE(CC106,1,1,tech!$H$2),CC106),\"\")","v":""},"|","- [NIST SP 800-50 Building an Information Technology Security Awareness and Training Program](https://csrc.nist.gov/publications/detail/sp/800-50/final)","Perform security awareness training","References","4.2.3.RY",{"$f":"IF(AND(CI106<>\"\",LEFT(CI106,1)<>\"#\"),IF(LEFT(CI106,1)=\"-\",REPLACE(CI106,1,1,tech!$H$2),CI106),\"\")","v":"• [NIST SP 800-50 Building an Information Technology Security Awareness and Training Program](https://csrc.nist.gov/publications/detail/sp/800-50/final)"},"|","Example of events that require timely communication may be:","Timely communication of important information","Guidance","4.3.4.GY",{"$f":"IF(AND(CO106<>\"\",LEFT(CO106,1)<>\"#\"),IF(LEFT(CO106,1)=\"-\",REPLACE(CO106,1,1,tech!$H$2),CO106),\"\")","v":"Example of events that require timely communication may be:"},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D107,tech!$A$13:$B$17,2,0),LEFT(E107,1),IF(G107=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C107,1)=\"-\",C107,\"\")=\"\",\"\",REPLACE(IF(LEFT(C107,1)=\"-\",C107,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I107<>\"\",LEFT(I107,1)<>\"#\"),IF(LEFT(I107,1)=\"-\",REPLACE(I107,1,1,tech!$H$2),I107),\"\")","v":""},"|",null,"Disclosure statement is documented and published","Guidance","1.2.4.GY",{"$f":"IF(AND(O107<>\"\",LEFT(O107,1)<>\"#\"),IF(LEFT(O107,1)=\"-\",REPLACE(O107,1,1,tech!$H$2),O107),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","Assessment","1.3.4.AX",{"$f":"IF(AND(U107<>\"\",LEFT(U107,1)<>\"#\"),IF(LEFT(U107,1)=\"-\",REPLACE(U107,1,1,tech!$H$2),U107),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA107<>\"\",LEFT(AA107,1)<>\"#\"),IF(LEFT(AA107,1)=\"-\",REPLACE(AA107,1,1,tech!$H$2),AA107),\"\")","v":""},"|","- Procedure and records","Each cryptographic key is defined and has documented lifecycle procedures","Guidance","2.1.4.GY",{"$f":"IF(AND(AG107<>\"\",LEFT(AG107,1)<>\"#\"),IF(LEFT(AG107,1)=\"-\",REPLACE(AG107,1,1,tech!$H$2),AG107),\"\")","v":"• Procedure and records"},"|","  * OCSP and/or CRLs","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM107<>\"\",LEFT(AM107,1)<>\"#\"),IF(LEFT(AM107,1)=\"-\",REPLACE(AM107,1,1,tech!$H$2),AM107),\"\")","v":"  * OCSP and/or CRLs"},"|","In case of issues with the infrastructure, it should be possible to quickly identify the root cause and recover the infrastructure to the operational state. The recovery objectives should be defined and aligned with the overall business continuity and disaster recovery strategy of the organization.","Infrastructure recovery objectives controls","Guidance","2.3.4.GY",{"$f":"IF(AND(AS107<>\"\",LEFT(AS107,1)<>\"#\"),IF(LEFT(AS107,1)=\"-\",REPLACE(AS107,1,1,tech!$H$2),AS107),\"\")","v":"In case of issues with the infrastructure, it should be possible to quickly identify the root cause and recover the infrastructure to the operational state. The recovery objectives should be defined and aligned with the overall business continuity and disaster recovery strategy of the organization."},"|",null,"Requirements for agility are identified","Guidance","2.4.4.GX",{"$f":"IF(AND(AY107<>\"\",LEFT(AY107,1)<>\"#\"),IF(LEFT(AY107,1)=\"-\",REPLACE(AY107,1,1,tech!$H$2),AY107),\"\")","v":""},"|","When deciding to apply new technologies, or evaluating if the current technology is still suitable and support the goals of the PKI implementation, the following should be considered:","Technology future proofing","Guidance","3.1.4.GY",{"$f":"IF(AND(BE107<>\"\",LEFT(BE107,1)<>\"#\"),IF(LEFT(BE107,1)=\"-\",REPLACE(BE107,1,1,tech!$H$2),BE107),\"\")","v":"When deciding to apply new technologies, or evaluating if the current technology is still suitable and support the goals of the PKI implementation, the following should be considered:"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK107<>\"\",LEFT(BK107,1)<>\"#\"),IF(LEFT(BK107,1)=\"-\",REPLACE(BK107,1,1,tech!$H$2),BK107),\"\")","v":""},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Audit trail can be reconstructed from audit logs","References","3.3.3.RY",{"$f":"IF(AND(BQ107<>\"\",LEFT(BQ107,1)<>\"#\"),IF(LEFT(BQ107,1)=\"-\",REPLACE(BQ107,1,1,tech!$H$2),BQ107),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW107<>\"\",LEFT(BW107,1)<>\"#\"),IF(LEFT(BW107,1)=\"-\",REPLACE(BW107,1,1,tech!$H$2),BW107),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC107<>\"\",LEFT(CC107,1)<>\"#\"),IF(LEFT(CC107,1)=\"-\",REPLACE(CC107,1,1,tech!$H$2),CC107),\"\")","v":""},"|","- [PCI SSC - Best Practices for Implementing a","Perform security awareness training","References","4.2.3.RY",{"$f":"IF(AND(CI107<>\"\",LEFT(CI107,1)<>\"#\"),IF(LEFT(CI107,1)=\"-\",REPLACE(CI107,1,1,tech!$H$2),CI107),\"\")","v":"• [PCI SSC - Best Practices for Implementing a"},"|","- Compromise of the private key","Timely communication of important information","Guidance","4.3.4.GY",{"$f":"IF(AND(CO107<>\"\",LEFT(CO107,1)<>\"#\"),IF(LEFT(CO107,1)=\"-\",REPLACE(CO107,1,1,tech!$H$2),CO107),\"\")","v":"• Compromise of the private key"},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D108,tech!$A$13:$B$17,2,0),LEFT(E108,1),IF(G108=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C108,1)=\"-\",C108,\"\")=\"\",\"\",REPLACE(IF(LEFT(C108,1)=\"-\",C108,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I108<>\"\",LEFT(I108,1)<>\"#\"),IF(LEFT(I108,1)=\"-\",REPLACE(I108,1,1,tech!$H$2),I108),\"\")","v":""},"|","It typically includes information like:","Disclosure statement is documented and published","Guidance","1.2.4.GY",{"$f":"IF(AND(O108<>\"\",LEFT(O108,1)<>\"#\"),IF(LEFT(O108,1)=\"-\",REPLACE(O108,1,1,tech!$H$2),O108),\"\")","v":"It typically includes information like:"},"|","#### References","List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U108<>\"\",LEFT(U108,1)<>\"#\"),IF(LEFT(U108,1)=\"-\",REPLACE(U108,1,1,tech!$H$2),U108),\"\")","v":""},"|","#### Guidance","Processes and procedures are reviewed and updated","Guidance","1.4.5.GX",{"$f":"IF(AND(AA108<>\"\",LEFT(AA108,1)<>\"#\"),IF(LEFT(AA108,1)=\"-\",REPLACE(AA108,1,1,tech!$H$2),AA108),\"\")","v":""},"|",null,"Each cryptographic key is defined and has documented lifecycle procedures","Guidance","2.1.4.GX",{"$f":"IF(AND(AG108<>\"\",LEFT(AG108,1)<>\"#\"),IF(LEFT(AG108,1)=\"-\",REPLACE(AG108,1,1,tech!$H$2),AG108),\"\")","v":""},"|","  * Documentation how relying parties get access to revocation information","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM108<>\"\",LEFT(AM108,1)<>\"#\"),IF(LEFT(AM108,1)=\"-\",REPLACE(AM108,1,1,tech!$H$2),AM108),\"\")","v":"  * Documentation how relying parties get access to revocation information"},"|",null,"Infrastructure recovery objectives controls","Guidance","2.3.4.GY",{"$f":"IF(AND(AS108<>\"\",LEFT(AS108,1)<>\"#\"),IF(LEFT(AS108,1)=\"-\",REPLACE(AS108,1,1,tech!$H$2),AS108),\"\")","v":""},"|","Agility provides the ability to adapt to changes quickly and efficiently. Agility and change management are closely related and should be considered together. The future-proof PKI implementation should be able to identify the requirements for agility and implement them in a timely manner.","Requirements for agility are identified","Guidance","2.4.4.GY",{"$f":"IF(AND(AY108<>\"\",LEFT(AY108,1)<>\"#\"),IF(LEFT(AY108,1)=\"-\",REPLACE(AY108,1,1,tech!$H$2),AY108),\"\")","v":"Agility provides the ability to adapt to changes quickly and efficiently. Agility and change management are closely related and should be considered together. The future-proof PKI implementation should be able to identify the requirements for agility and implement them in a timely manner."},"|","- Technology is supported by the Vendor","Technology future proofing","Guidance","3.1.4.GY",{"$f":"IF(AND(BE108<>\"\",LEFT(BE108,1)<>\"#\"),IF(LEFT(BE108,1)=\"-\",REPLACE(BE108,1,1,tech!$H$2),BE108),\"\")","v":"• Technology is supported by the Vendor"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK108<>\"\",LEFT(BK108,1)<>\"#\"),IF(LEFT(BK108,1)=\"-\",REPLACE(BK108,1,1,tech!$H$2),BK108),\"\")","v":""},"|","- [ISO/IEC 27099 - Public key infrastructure](https://www.iso.org/standard/56590.html)","Audit trail can be reconstructed from audit logs","References","3.3.3.RY",{"$f":"IF(AND(BQ108<>\"\",LEFT(BQ108,1)<>\"#\"),IF(LEFT(BQ108,1)=\"-\",REPLACE(BQ108,1,1,tech!$H$2),BQ108),\"\")","v":"• [ISO/IEC 27099 - Public key infrastructure](https://www.iso.org/standard/56590.html)"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW108<>\"\",LEFT(BW108,1)<>\"#\"),IF(LEFT(BW108,1)=\"-\",REPLACE(BW108,1,1,tech!$H$2),BW108),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC108<>\"\",LEFT(CC108,1)<>\"#\"),IF(LEFT(CC108,1)=\"-\",REPLACE(CC108,1,1,tech!$H$2),CC108),\"\")","v":""},"|","  Security Awareness Program](https://docs-prv.pcisecuritystandards.org/Guidance%20Document/Security%20Awareness%20Program/PCI_DSS_V1.0_Best_Practices_for_Implementing_Security_Awareness_Program.pdf)","Perform security awareness training","References","4.2.3.RY",{"$f":"IF(AND(CI108<>\"\",LEFT(CI108,1)<>\"#\"),IF(LEFT(CI108,1)=\"-\",REPLACE(CI108,1,1,tech!$H$2),CI108),\"\")","v":"  Security Awareness Program](https://docs-prv.pcisecuritystandards.org/Guidance%20Document/Security%20Awareness%20Program/PCI_DSS_V1.0_Best_Practices_for_Implementing_Security_Awareness_Program.pdf)"},"|","- changes in the Certificate Policy","Timely communication of important information","Guidance","4.3.4.GY",{"$f":"IF(AND(CO108<>\"\",LEFT(CO108,1)<>\"#\"),IF(LEFT(CO108,1)=\"-\",REPLACE(CO108,1,1,tech!$H$2),CO108),\"\")","v":"• changes in the Certificate Policy"},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D109,tech!$A$13:$B$17,2,0),LEFT(E109,1),IF(G109=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C109,1)=\"-\",C109,\"\")=\"\",\"\",REPLACE(IF(LEFT(C109,1)=\"-\",C109,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I109<>\"\",LEFT(I109,1)<>\"#\"),IF(LEFT(I109,1)=\"-\",REPLACE(I109,1,1,tech!$H$2),I109),\"\")","v":""},"|","- CA's identity, legal status, and contact information","Disclosure statement is documented and published","Guidance","1.2.4.GY",{"$f":"IF(AND(O109<>\"\",LEFT(O109,1)<>\"#\"),IF(LEFT(O109,1)=\"-\",REPLACE(O109,1,1,tech!$H$2),O109),\"\")","v":"• CA's identity, legal status, and contact information"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U109<>\"\",LEFT(U109,1)<>\"#\"),IF(LEFT(U109,1)=\"-\",REPLACE(U109,1,1,tech!$H$2),U109),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","Guidance","1.4.5.GX",{"$f":"IF(AND(AA109<>\"\",LEFT(AA109,1)<>\"#\"),IF(LEFT(AA109,1)=\"-\",REPLACE(AA109,1,1,tech!$H$2),AA109),\"\")","v":""},"|","#### Assessment","Each cryptographic key is defined and has documented lifecycle procedures","Assessment","2.1.4.AX",{"$f":"IF(AND(AG109<>\"\",LEFT(AG109,1)<>\"#\"),IF(LEFT(AG109,1)=\"-\",REPLACE(AG109,1,1,tech!$H$2),AG109),\"\")","v":""},"|","* Documented process for key escrow and recovery when encryption keys need to be stored centrally","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM109<>\"\",LEFT(AM109,1)<>\"#\"),IF(LEFT(AM109,1)=\"-\",REPLACE(AM109,1,1,tech!$H$2),AM109),\"\")","v":"* Documented process for key escrow and recovery when encryption keys need to be stored centrally"},"|","The infrastructure should be frequently backed up and the backups should be stored in a secure location. The backups should be tested and validated on a regular basis. Infrastructure managed as code may help to reduce complexity and increase the speed of recovery.","Infrastructure recovery objectives controls","Guidance","2.3.4.GY",{"$f":"IF(AND(AS109<>\"\",LEFT(AS109,1)<>\"#\"),IF(LEFT(AS109,1)=\"-\",REPLACE(AS109,1,1,tech!$H$2),AS109),\"\")","v":"The infrastructure should be frequently backed up and the backups should be stored in a secure location. The backups should be tested and validated on a regular basis. Infrastructure managed as code may help to reduce complexity and increase the speed of recovery."},"|",null,"Requirements for agility are identified","Guidance","2.4.4.GY",{"$f":"IF(AND(AY109<>\"\",LEFT(AY109,1)<>\"#\"),IF(LEFT(AY109,1)=\"-\",REPLACE(AY109,1,1,tech!$H$2),AY109),\"\")","v":""},"|","- Industry standards are applied for interoperability and Security","Technology future proofing","Guidance","3.1.4.GY",{"$f":"IF(AND(BE109<>\"\",LEFT(BE109,1)<>\"#\"),IF(LEFT(BE109,1)=\"-\",REPLACE(BE109,1,1,tech!$H$2),BE109),\"\")","v":"• Industry standards are applied for interoperability and Security"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK109<>\"\",LEFT(BK109,1)<>\"#\"),IF(LEFT(BK109,1)=\"-\",REPLACE(BK109,1,1,tech!$H$2),BK109),\"\")","v":""},"|",null,"Audit trail can be reconstructed from audit logs","References","3.3.3.RX",{"$f":"IF(AND(BQ109<>\"\",LEFT(BQ109,1)<>\"#\"),IF(LEFT(BQ109,1)=\"-\",REPLACE(BQ109,1,1,tech!$H$2),BQ109),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW109<>\"\",LEFT(BW109,1)<>\"#\"),IF(LEFT(BW109,1)=\"-\",REPLACE(BW109,1,1,tech!$H$2),BW109),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC109<>\"\",LEFT(CC109,1)<>\"#\"),IF(LEFT(CC109,1)=\"-\",REPLACE(CC109,1,1,tech!$H$2),CC109),\"\")","v":""},"|","- [Raising Awareness of Cybersecurity](https://www.enisa.europa.eu/publications/raising-awareness-of-cybersecurity)","Perform security awareness training","References","4.2.3.RY",{"$f":"IF(AND(CI109<>\"\",LEFT(CI109,1)<>\"#\"),IF(LEFT(CI109,1)=\"-\",REPLACE(CI109,1,1,tech!$H$2),CI109),\"\")","v":"• [Raising Awareness of Cybersecurity](https://www.enisa.europa.eu/publications/raising-awareness-of-cybersecurity)"},"|","- changes in the Certification Practice Statement","Timely communication of important information","Guidance","4.3.4.GY",{"$f":"IF(AND(CO109<>\"\",LEFT(CO109,1)<>\"#\"),IF(LEFT(CO109,1)=\"-\",REPLACE(CO109,1,1,tech!$H$2),CO109),\"\")","v":"• changes in the Certification Practice Statement"},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D110,tech!$A$13:$B$17,2,0),LEFT(E110,1),IF(G110=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C110,1)=\"-\",C110,\"\")=\"\",\"\",REPLACE(IF(LEFT(C110,1)=\"-\",C110,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I110<>\"\",LEFT(I110,1)<>\"#\"),IF(LEFT(I110,1)=\"-\",REPLACE(I110,1,1,tech!$H$2),I110),\"\")","v":""},"|","- Certificate types, verification procedures and compliance with standards","Disclosure statement is documented and published","Guidance","1.2.4.GY",{"$f":"IF(AND(O110<>\"\",LEFT(O110,1)<>\"#\"),IF(LEFT(O110,1)=\"-\",REPLACE(O110,1,1,tech!$H$2),O110),\"\")","v":"• Certificate types, verification procedures and compliance with standards"},"|","- [ISO 37301 - Compliance management systems and related standard](https://www.iso.org/standard/75080.html)","List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RY",{"$f":"IF(AND(U110<>\"\",LEFT(U110,1)<>\"#\"),IF(LEFT(U110,1)=\"-\",REPLACE(U110,1,1,tech!$H$2),U110),\"\")","v":"• [ISO 37301 - Compliance management systems and related standard](https://www.iso.org/standard/75080.html)"},"|","The processes and procedures should be reviewed and updated on a regular basis, based on the feedback, risk assessment, audit, or other. The review should be performed by the management, and the updates should be approved by the management.","Processes and procedures are reviewed and updated","Guidance","1.4.5.GY",{"$f":"IF(AND(AA110<>\"\",LEFT(AA110,1)<>\"#\"),IF(LEFT(AA110,1)=\"-\",REPLACE(AA110,1,1,tech!$H$2),AA110),\"\")","v":"The processes and procedures should be reviewed and updated on a regular basis, based on the feedback, risk assessment, audit, or other. The review should be performed by the management, and the updates should be approved by the management."},"|",null,"Each cryptographic key is defined and has documented lifecycle procedures","Assessment","2.1.4.AX",{"$f":"IF(AND(AG110<>\"\",LEFT(AG110,1)<>\"#\"),IF(LEFT(AG110,1)=\"-\",REPLACE(AG110,1,1,tech!$H$2),AG110),\"\")","v":""},"|","* Documented trust anchor management","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM110<>\"\",LEFT(AM110,1)<>\"#\"),IF(LEFT(AM110,1)=\"-\",REPLACE(AM110,1,1,tech!$H$2),AM110),\"\")","v":"* Documented trust anchor management"},"|",null,"Infrastructure recovery objectives controls","Guidance","2.3.4.GX",{"$f":"IF(AND(AS110<>\"\",LEFT(AS110,1)<>\"#\"),IF(LEFT(AS110,1)=\"-\",REPLACE(AS110,1,1,tech!$H$2),AS110),\"\")","v":""},"|","Agility can be considered on operational and technical levels. Operational agility means that the PKI is able to adapt to changes in the operational environment, including any changes to the organizational structure, processes, and other operational aspects. Technical agility means that the PKI is able to adapt to changes in the technologies, algorithms, protocols, and other technical aspects.","Requirements for agility are identified","Guidance","2.4.4.GY",{"$f":"IF(AND(AY110<>\"\",LEFT(AY110,1)<>\"#\"),IF(LEFT(AY110,1)=\"-\",REPLACE(AY110,1,1,tech!$H$2),AY110),\"\")","v":"Agility can be considered on operational and technical levels. Operational agility means that the PKI is able to adapt to changes in the operational environment, including any changes to the organizational structure, processes, and other operational aspects. Technical agility means that the PKI is able to adapt to changes in the technologies, algorithms, protocols, and other technical aspects."},"|","- Review and references on the Vendor and Technology","Technology future proofing","Guidance","3.1.4.GY",{"$f":"IF(AND(BE110<>\"\",LEFT(BE110,1)<>\"#\"),IF(LEFT(BE110,1)=\"-\",REPLACE(BE110,1,1,tech!$H$2),BE110),\"\")","v":"• Review and references on the Vendor and Technology"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK110<>\"\",LEFT(BK110,1)<>\"#\"),IF(LEFT(BK110,1)=\"-\",REPLACE(BK110,1,1,tech!$H$2),BK110),\"\")","v":""},"|","### Monitoring of operational and security events is implemented","Monitoring of operational and security events is implemented","References","3.3.4.RX",{"$f":"IF(AND(BQ110<>\"\",LEFT(BQ110,1)<>\"#\"),IF(LEFT(BQ110,1)=\"-\",REPLACE(BQ110,1,1,tech!$H$2),BQ110),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW110<>\"\",LEFT(BW110,1)<>\"#\"),IF(LEFT(BW110,1)=\"-\",REPLACE(BW110,1,1,tech!$H$2),BW110),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC110<>\"\",LEFT(CC110,1)<>\"#\"),IF(LEFT(CC110,1)=\"-\",REPLACE(CC110,1,1,tech!$H$2),CC110),\"\")","v":""},"|",null,"Perform security awareness training","References","4.2.3.RX",{"$f":"IF(AND(CI110<>\"\",LEFT(CI110,1)<>\"#\"),IF(LEFT(CI110,1)=\"-\",REPLACE(CI110,1,1,tech!$H$2),CI110),\"\")","v":""},"|","- Security breach","Timely communication of important information","Guidance","4.3.4.GY",{"$f":"IF(AND(CO110<>\"\",LEFT(CO110,1)<>\"#\"),IF(LEFT(CO110,1)=\"-\",REPLACE(CO110,1,1,tech!$H$2),CO110),\"\")","v":"• Security breach"},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D111,tech!$A$13:$B$17,2,0),LEFT(E111,1),IF(G111=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C111,1)=\"-\",C111,\"\")=\"\",\"\",REPLACE(IF(LEFT(C111,1)=\"-\",C111,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I111<>\"\",LEFT(I111,1)<>\"#\"),IF(LEFT(I111,1)=\"-\",REPLACE(I111,1,1,tech!$H$2),I111),\"\")","v":""},"|","- Reliance limits","Disclosure statement is documented and published","Guidance","1.2.4.GY",{"$f":"IF(AND(O111<>\"\",LEFT(O111,1)<>\"#\"),IF(LEFT(O111,1)=\"-\",REPLACE(O111,1,1,tech!$H$2),O111),\"\")","v":"• Reliance limits"},"|","- [NIST Risk Management Framework](https://csrc.nist.gov/Projects/risk-management)","List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RY",{"$f":"IF(AND(U111<>\"\",LEFT(U111,1)<>\"#\"),IF(LEFT(U111,1)=\"-\",REPLACE(U111,1,1,tech!$H$2),U111),\"\")","v":"• [NIST Risk Management Framework](https://csrc.nist.gov/Projects/risk-management)"},"|",null,"Processes and procedures are reviewed and updated","Guidance","1.4.5.GY",{"$f":"IF(AND(AA111<>\"\",LEFT(AA111,1)<>\"#\"),IF(LEFT(AA111,1)=\"-\",REPLACE(AA111,1,1,tech!$H$2),AA111),\"\")","v":""},"|","- Examine the definition of cryptographic key","Each cryptographic key is defined and has documented lifecycle procedures","Assessment","2.1.4.AY",{"$f":"IF(AND(AG111<>\"\",LEFT(AG111,1)<>\"#\"),IF(LEFT(AG111,1)=\"-\",REPLACE(AG111,1,1,tech!$H$2),AG111),\"\")","v":"• Examine the definition of cryptographic key"},"|","  * Distribution of new and updated trust anchors (Root CA certificates)","Certificate lifecycle management is documented","Assessment","2.2.3.AY",{"$f":"IF(AND(AM111<>\"\",LEFT(AM111,1)<>\"#\"),IF(LEFT(AM111,1)=\"-\",REPLACE(AM111,1,1,tech!$H$2),AM111),\"\")","v":"  * Distribution of new and updated trust anchors (Root CA certificates)"},"|","#### Assessment","Infrastructure recovery objectives controls","Assessment","2.3.4.AX",{"$f":"IF(AND(AS111<>\"\",LEFT(AS111,1)<>\"#\"),IF(LEFT(AS111,1)=\"-\",REPLACE(AS111,1,1,tech!$H$2),AS111),\"\")","v":""},"|",null,"Requirements for agility are identified","Guidance","2.4.4.GY",{"$f":"IF(AND(AY111<>\"\",LEFT(AY111,1)<>\"#\"),IF(LEFT(AY111,1)=\"-\",REPLACE(AY111,1,1,tech!$H$2),AY111),\"\")","v":""},"|","- Applicability of the Technology for long-term use","Technology future proofing","Guidance","3.1.4.GY",{"$f":"IF(AND(BE111<>\"\",LEFT(BE111,1)<>\"#\"),IF(LEFT(BE111,1)=\"-\",REPLACE(BE111,1,1,tech!$H$2),BE111),\"\")","v":"• Applicability of the Technology for long-term use"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK111<>\"\",LEFT(BK111,1)<>\"#\"),IF(LEFT(BK111,1)=\"-\",REPLACE(BK111,1,1,tech!$H$2),BK111),\"\")","v":""},"|",null,"Monitoring of operational and security events is implemented","References","3.3.4.RX",{"$f":"IF(AND(BQ111<>\"\",LEFT(BQ111,1)<>\"#\"),IF(LEFT(BQ111,1)=\"-\",REPLACE(BQ111,1,1,tech!$H$2),BQ111),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW111<>\"\",LEFT(BW111,1)<>\"#\"),IF(LEFT(BW111,1)=\"-\",REPLACE(BW111,1,1,tech!$H$2),BW111),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC111<>\"\",LEFT(CC111,1)<>\"#\"),IF(LEFT(CC111,1)=\"-\",REPLACE(CC111,1,1,tech!$H$2),CC111),\"\")","v":""},"|","### Establish education plan","Establish education plan","References","4.2.4.RX",{"$f":"IF(AND(CI111<>\"\",LEFT(CI111,1)<>\"#\"),IF(LEFT(CI111,1)=\"-\",REPLACE(CI111,1,1,tech!$H$2),CI111),\"\")","v":""},"|","- Other events that may require immediate action by the PKI participants","Timely communication of important information","Guidance","4.3.4.GY",{"$f":"IF(AND(CO111<>\"\",LEFT(CO111,1)<>\"#\"),IF(LEFT(CO111,1)=\"-\",REPLACE(CO111,1,1,tech!$H$2),CO111),\"\")","v":"• Other events that may require immediate action by the PKI participants"},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D112,tech!$A$13:$B$17,2,0),LEFT(E112,1),IF(G112=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C112,1)=\"-\",C112,\"\")=\"\",\"\",REPLACE(IF(LEFT(C112,1)=\"-\",C112,\"\"),1,1,tech!$H$2))","v":""},"|",null,{"$f":"IF(AND(LEFT(I112,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(I112,\" \"))=3,0)),_xlfn.TEXTAFTER(I112,\" \"),J111)","v":"Architecture and design of the PKI"},"References","1.1.4.RX",{"$f":"IF(AND(I112<>\"\",LEFT(I112,1)<>\"#\"),IF(LEFT(I112,1)=\"-\",REPLACE(I112,1,1,tech!$H$2),I112),\"\")","v":""},"|","- Obligations of the CA and the relying parties",{"$f":"IF(AND(LEFT(O112,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(O112,\" \"))=3,0)),_xlfn.TEXTAFTER(O112,\" \"),P111)","v":"Disclosure statement is documented and published"},"Guidance","1.2.4.GY",{"$f":"IF(AND(O112<>\"\",LEFT(O112,1)<>\"#\"),IF(LEFT(O112,1)=\"-\",REPLACE(O112,1,1,tech!$H$2),O112),\"\")","v":"• Obligations of the CA and the relying parties"},"|",null,{"$f":"IF(AND(LEFT(U112,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(U112,\" \"))=3,0)),_xlfn.TEXTAFTER(U112,\" \"),V111)","v":"List of relevant laws, regulations, and standards, exist and is maintained"},"References","1.3.4.RX",{"$f":"IF(AND(U112<>\"\",LEFT(U112,1)<>\"#\"),IF(LEFT(U112,1)=\"-\",REPLACE(U112,1,1,tech!$H$2),U112),\"\")","v":""},"|","The review and update of the processes and procedures helps to keep the PKI implementation up to date, and helps to ensure that the processes and procedures are effective and efficient.",{"$f":"IF(AND(LEFT(AA112,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AA112,\" \"))=3,0)),_xlfn.TEXTAFTER(AA112,\" \"),AB111)","v":"Processes and procedures are reviewed and updated"},"Guidance","1.4.5.GY",{"$f":"IF(AND(AA112<>\"\",LEFT(AA112,1)<>\"#\"),IF(LEFT(AA112,1)=\"-\",REPLACE(AA112,1,1,tech!$H$2),AA112),\"\")","v":"The review and update of the processes and procedures helps to keep the PKI implementation up to date, and helps to ensure that the processes and procedures are effective and efficient."},"|","- Documented key lifecycle phases",{"$f":"IF(AND(LEFT(AG112,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AG112,\" \"))=3,0)),_xlfn.TEXTAFTER(AG112,\" \"),AH111)","v":"Each cryptographic key is defined and has documented lifecycle procedures"},"Assessment","2.1.4.AY",{"$f":"IF(AND(AG112<>\"\",LEFT(AG112,1)<>\"#\"),IF(LEFT(AG112,1)=\"-\",REPLACE(AG112,1,1,tech!$H$2),AG112),\"\")","v":"• Documented key lifecycle phases"},"|",null,{"$f":"IF(AND(LEFT(AM112,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AM112,\" \"))=3,0)),_xlfn.TEXTAFTER(AM112,\" \"),AN111)","v":"Certificate lifecycle management is documented"},"Assessment","2.2.3.AX",{"$f":"IF(AND(AM112<>\"\",LEFT(AM112,1)<>\"#\"),IF(LEFT(AM112,1)=\"-\",REPLACE(AM112,1,1,tech!$H$2),AM112),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(AS112,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AS112,\" \"))=3,0)),_xlfn.TEXTAFTER(AS112,\" \"),AT111)","v":"Infrastructure recovery objectives controls"},"Assessment","2.3.4.AX",{"$f":"IF(AND(AS112<>\"\",LEFT(AS112,1)<>\"#\"),IF(LEFT(AS112,1)=\"-\",REPLACE(AS112,1,1,tech!$H$2),AS112),\"\")","v":""},"|","Identification of requirements where agility is needed is important to ensure changes are implemented when needed.",{"$f":"IF(AND(LEFT(AY112,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AY112,\" \"))=3,0)),_xlfn.TEXTAFTER(AY112,\" \"),AZ111)","v":"Requirements for agility are identified"},"Guidance","2.4.4.GY",{"$f":"IF(AND(AY112<>\"\",LEFT(AY112,1)<>\"#\"),IF(LEFT(AY112,1)=\"-\",REPLACE(AY112,1,1,tech!$H$2),AY112),\"\")","v":"Identification of requirements where agility is needed is important to ensure changes are implemented when needed."},"|","- vulnerabilities and Security reports of the Technology",{"$f":"IF(AND(LEFT(BE112,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BE112,\" \"))=3,0)),_xlfn.TEXTAFTER(BE112,\" \"),BF111)","v":"Technology future proofing"},"Guidance","3.1.4.GY",{"$f":"IF(AND(BE112<>\"\",LEFT(BE112,1)<>\"#\"),IF(LEFT(BE112,1)=\"-\",REPLACE(BE112,1,1,tech!$H$2),BE112),\"\")","v":"• vulnerabilities and Security reports of the Technology"},"|",null,{"$f":"IF(AND(LEFT(BK112,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BK112,\" \"))=3,0)),_xlfn.TEXTAFTER(BK112,\" \"),BL111)","v":"Adoption and application of open standards"},"References","3.2.3.RX",{"$f":"IF(AND(BK112<>\"\",LEFT(BK112,1)<>\"#\"),IF(LEFT(BK112,1)=\"-\",REPLACE(BK112,1,1,tech!$H$2),BK112),\"\")","v":""},"|","#### Guidance",{"$f":"IF(AND(LEFT(BQ112,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BQ112,\" \"))=3,0)),_xlfn.TEXTAFTER(BQ112,\" \"),BR111)","v":"Monitoring of operational and security events is implemented"},"Guidance","3.3.4.GX",{"$f":"IF(AND(BQ112<>\"\",LEFT(BQ112,1)<>\"#\"),IF(LEFT(BQ112,1)=\"-\",REPLACE(BQ112,1,1,tech!$H$2),BQ112),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(BW112,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BW112,\" \"))=3,0)),_xlfn.TEXTAFTER(BW112,\" \"),BX111)","v":"Incidents and exceptions handling"},"References","3.4.3.RX",{"$f":"IF(AND(BW112<>\"\",LEFT(BW112,1)<>\"#\"),IF(LEFT(BW112,1)=\"-\",REPLACE(BW112,1,1,tech!$H$2),BW112),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(CC112,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CC112,\" \"))=3,0)),_xlfn.TEXTAFTER(CC112,\" \"),CD111)","v":"Resources are periodically reviewed"},"References","4.1.4.RX",{"$f":"IF(AND(CC112<>\"\",LEFT(CC112,1)<>\"#\"),IF(LEFT(CC112,1)=\"-\",REPLACE(CC112,1,1,tech!$H$2),CC112),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(CI112,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CI112,\" \"))=3,0)),_xlfn.TEXTAFTER(CI112,\" \"),CJ111)","v":"Establish education plan"},"References","4.2.4.RX",{"$f":"IF(AND(CI112<>\"\",LEFT(CI112,1)<>\"#\"),IF(LEFT(CI112,1)=\"-\",REPLACE(CI112,1,1,tech!$H$2),CI112),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(CO112,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CO112,\" \"))=3,0)),_xlfn.TEXTAFTER(CO112,\" \"),CP111)","v":"Timely communication of important information"},"Guidance","4.3.4.GX",{"$f":"IF(AND(CO112<>\"\",LEFT(CO112,1)<>\"#\"),IF(LEFT(CO112,1)=\"-\",REPLACE(CO112,1,1,tech!$H$2),CO112),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D113,tech!$A$13:$B$17,2,0),LEFT(E113,1),IF(G113=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C113,1)=\"-\",C113,\"\")=\"\",\"\",REPLACE(IF(LEFT(C113,1)=\"-\",C113,\"\"),1,1,tech!$H$2))","v":""},"|",null,{"$f":"IF(AND(LEFT(I113,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(I113,\" \"))=3,0)),_xlfn.TEXTAFTER(I113,\" \"),J112)","v":"Architecture and design of the PKI"},"References","1.1.4.RX",{"$f":"IF(AND(I113<>\"\",LEFT(I113,1)<>\"#\"),IF(LEFT(I113,1)=\"-\",REPLACE(I113,1,1,tech!$H$2),I113),\"\")","v":""},"|","- Warranty and liability limitations",{"$f":"IF(AND(LEFT(O113,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(O113,\" \"))=3,0)),_xlfn.TEXTAFTER(O113,\" \"),P112)","v":"Disclosure statement is documented and published"},"Guidance","1.2.4.GY",{"$f":"IF(AND(O113<>\"\",LEFT(O113,1)<>\"#\"),IF(LEFT(O113,1)=\"-\",REPLACE(O113,1,1,tech!$H$2),O113),\"\")","v":"• Warranty and liability limitations"},"|",null,{"$f":"IF(AND(LEFT(U113,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(U113,\" \"))=3,0)),_xlfn.TEXTAFTER(U113,\" \"),V112)","v":"List of relevant laws, regulations, and standards, exist and is maintained"},"References","1.3.4.RX",{"$f":"IF(AND(U113<>\"\",LEFT(U113,1)<>\"#\"),IF(LEFT(U113,1)=\"-\",REPLACE(U113,1,1,tech!$H$2),U113),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(AA113,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AA113,\" \"))=3,0)),_xlfn.TEXTAFTER(AA113,\" \"),AB112)","v":"Processes and procedures are reviewed and updated"},"Guidance","1.4.5.GX",{"$f":"IF(AND(AA113<>\"\",LEFT(AA113,1)<>\"#\"),IF(LEFT(AA113,1)=\"-\",REPLACE(AA113,1,1,tech!$H$2),AA113),\"\")","v":""},"|","- Documented procedures and related records for the key lifecycle",{"$f":"IF(AND(LEFT(AG113,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AG113,\" \"))=3,0)),_xlfn.TEXTAFTER(AG113,\" \"),AH112)","v":"Each cryptographic key is defined and has documented lifecycle procedures"},"Assessment","2.1.4.AY",{"$f":"IF(AND(AG113<>\"\",LEFT(AG113,1)<>\"#\"),IF(LEFT(AG113,1)=\"-\",REPLACE(AG113,1,1,tech!$H$2),AG113),\"\")","v":"• Documented procedures and related records for the key lifecycle"},"|","#### References",{"$f":"IF(AND(LEFT(AM113,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AM113,\" \"))=3,0)),_xlfn.TEXTAFTER(AM113,\" \"),AN112)","v":"Certificate lifecycle management is documented"},"References","2.2.3.RX",{"$f":"IF(AND(AM113<>\"\",LEFT(AM113,1)<>\"#\"),IF(LEFT(AM113,1)=\"-\",REPLACE(AM113,1,1,tech!$H$2),AM113),\"\")","v":""},"|","The following is sample evidence that can be used to assess the requirement:",{"$f":"IF(AND(LEFT(AS113,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AS113,\" \"))=3,0)),_xlfn.TEXTAFTER(AS113,\" \"),AT112)","v":"Infrastructure recovery objectives controls"},"Assessment","2.3.4.AY",{"$f":"IF(AND(AS113<>\"\",LEFT(AS113,1)<>\"#\"),IF(LEFT(AS113,1)=\"-\",REPLACE(AS113,1,1,tech!$H$2),AS113),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|",null,{"$f":"IF(AND(LEFT(AY113,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AY113,\" \"))=3,0)),_xlfn.TEXTAFTER(AY113,\" \"),AZ112)","v":"Requirements for agility are identified"},"Guidance","2.4.4.GX",{"$f":"IF(AND(AY113<>\"\",LEFT(AY113,1)<>\"#\"),IF(LEFT(AY113,1)=\"-\",REPLACE(AY113,1,1,tech!$H$2),AY113),\"\")","v":""},"|","- Integration capabilities and customizations needed",{"$f":"IF(AND(LEFT(BE113,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BE113,\" \"))=3,0)),_xlfn.TEXTAFTER(BE113,\" \"),BF112)","v":"Technology future proofing"},"Guidance","3.1.4.GY",{"$f":"IF(AND(BE113<>\"\",LEFT(BE113,1)<>\"#\"),IF(LEFT(BE113,1)=\"-\",REPLACE(BE113,1,1,tech!$H$2),BE113),\"\")","v":"• Integration capabilities and customizations needed"},"|",null,{"$f":"IF(AND(LEFT(BK113,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BK113,\" \"))=3,0)),_xlfn.TEXTAFTER(BK113,\" \"),BL112)","v":"Adoption and application of open standards"},"References","3.2.3.RX",{"$f":"IF(AND(BK113<>\"\",LEFT(BK113,1)<>\"#\"),IF(LEFT(BK113,1)=\"-\",REPLACE(BK113,1,1,tech!$H$2),BK113),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(BQ113,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BQ113,\" \"))=3,0)),_xlfn.TEXTAFTER(BQ113,\" \"),BR112)","v":"Monitoring of operational and security events is implemented"},"Guidance","3.3.4.GX",{"$f":"IF(AND(BQ113<>\"\",LEFT(BQ113,1)<>\"#\"),IF(LEFT(BQ113,1)=\"-\",REPLACE(BQ113,1,1,tech!$H$2),BQ113),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(BW113,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BW113,\" \"))=3,0)),_xlfn.TEXTAFTER(BW113,\" \"),BX112)","v":"Incidents and exceptions handling"},"References","3.4.3.RX",{"$f":"IF(AND(BW113<>\"\",LEFT(BW113,1)<>\"#\"),IF(LEFT(BW113,1)=\"-\",REPLACE(BW113,1,1,tech!$H$2),BW113),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(CC113,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CC113,\" \"))=3,0)),_xlfn.TEXTAFTER(CC113,\" \"),CD112)","v":"Resources are periodically reviewed"},"References","4.1.4.RX",{"$f":"IF(AND(CC113<>\"\",LEFT(CC113,1)<>\"#\"),IF(LEFT(CC113,1)=\"-\",REPLACE(CC113,1,1,tech!$H$2),CC113),\"\")","v":""},"|","#### Guidance",{"$f":"IF(AND(LEFT(CI113,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CI113,\" \"))=3,0)),_xlfn.TEXTAFTER(CI113,\" \"),CJ112)","v":"Establish education plan"},"Guidance","4.2.4.GX",{"$f":"IF(AND(CI113<>\"\",LEFT(CI113,1)<>\"#\"),IF(LEFT(CI113,1)=\"-\",REPLACE(CI113,1,1,tech!$H$2),CI113),\"\")","v":""},"|","#### Assessment",{"$f":"IF(AND(LEFT(CO113,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CO113,\" \"))=3,0)),_xlfn.TEXTAFTER(CO113,\" \"),CP112)","v":"Timely communication of important information"},"Assessment","4.3.4.AX",{"$f":"IF(AND(CO113<>\"\",LEFT(CO113,1)<>\"#\"),IF(LEFT(CO113,1)=\"-\",REPLACE(CO113,1,1,tech!$H$2),CO113),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D114,tech!$A$13:$B$17,2,0),LEFT(E114,1),IF(G114=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C114,1)=\"-\",C114,\"\")=\"\",\"\",REPLACE(IF(LEFT(C114,1)=\"-\",C114,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I114<>\"\",LEFT(I114,1)<>\"#\"),IF(LEFT(I114,1)=\"-\",REPLACE(I114,1,1,tech!$H$2),I114),\"\")","v":""},"|","- Agreement, CP and CPS","Disclosure statement is documented and published","Guidance","1.2.4.GY",{"$f":"IF(AND(O114<>\"\",LEFT(O114,1)<>\"#\"),IF(LEFT(O114,1)=\"-\",REPLACE(O114,1,1,tech!$H$2),O114),\"\")","v":"• Agreement, CP and CPS"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U114<>\"\",LEFT(U114,1)<>\"#\"),IF(LEFT(U114,1)=\"-\",REPLACE(U114,1,1,tech!$H$2),U114),\"\")","v":""},"|","#### Assessment","Processes and procedures are reviewed and updated","Assessment","1.4.5.AX",{"$f":"IF(AND(AA114<>\"\",LEFT(AA114,1)<>\"#\"),IF(LEFT(AA114,1)=\"-\",REPLACE(AA114,1,1,tech!$H$2),AA114),\"\")","v":""},"|","- lifecycle is integrated and followed in the organization","Each cryptographic key is defined and has documented lifecycle procedures","Assessment","2.1.4.AY",{"$f":"IF(AND(AG114<>\"\",LEFT(AG114,1)<>\"#\"),IF(LEFT(AG114,1)=\"-\",REPLACE(AG114,1,1,tech!$H$2),AG114),\"\")","v":"• lifecycle is integrated and followed in the organization"},"|",null,"Certificate lifecycle management is documented","References","2.2.3.RX",{"$f":"IF(AND(AM114<>\"\",LEFT(AM114,1)<>\"#\"),IF(LEFT(AM114,1)=\"-\",REPLACE(AM114,1,1,tech!$H$2),AM114),\"\")","v":""},"|","- infrastructure recovery objectives","Infrastructure recovery objectives controls","Assessment","2.3.4.AY",{"$f":"IF(AND(AS114<>\"\",LEFT(AS114,1)<>\"#\"),IF(LEFT(AS114,1)=\"-\",REPLACE(AS114,1,1,tech!$H$2),AS114),\"\")","v":"• infrastructure recovery objectives"},"|","#### Assessment","Requirements for agility are identified","Assessment","2.4.4.AX",{"$f":"IF(AND(AY114<>\"\",LEFT(AY114,1)<>\"#\"),IF(LEFT(AY114,1)=\"-\",REPLACE(AY114,1,1,tech!$H$2),AY114),\"\")","v":""},"|","- open source vs. proprietary Technology","Technology future proofing","Guidance","3.1.4.GY",{"$f":"IF(AND(BE114<>\"\",LEFT(BE114,1)<>\"#\"),IF(LEFT(BE114,1)=\"-\",REPLACE(BE114,1,1,tech!$H$2),BE114),\"\")","v":"• open source vs. proprietary Technology"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK114<>\"\",LEFT(BK114,1)<>\"#\"),IF(LEFT(BK114,1)=\"-\",REPLACE(BK114,1,1,tech!$H$2),BK114),\"\")","v":""},"|","Monitoring of operational and security events should be implemented to ensure that the PKI implementation is operating as expected and that the security events are detected and responded to in a timely manner and that evidence of any malicious event is identified. The monitoring should be implemented for all critical systems and components, including the CA, RA, OCSP, HSM, and other relevant systems.","Monitoring of operational and security events is implemented","Guidance","3.3.4.GY",{"$f":"IF(AND(BQ114<>\"\",LEFT(BQ114,1)<>\"#\"),IF(LEFT(BQ114,1)=\"-\",REPLACE(BQ114,1,1,tech!$H$2),BQ114),\"\")","v":"Monitoring of operational and security events should be implemented to ensure that the PKI implementation is operating as expected and that the security events are detected and responded to in a timely manner and that evidence of any malicious event is identified. The monitoring should be implemented for all critical systems and components, including the CA, RA, OCSP, HSM, and other relevant systems."},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW114<>\"\",LEFT(BW114,1)<>\"#\"),IF(LEFT(BW114,1)=\"-\",REPLACE(BW114,1,1,tech!$H$2),BW114),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC114<>\"\",LEFT(CC114,1)<>\"#\"),IF(LEFT(CC114,1)=\"-\",REPLACE(CC114,1,1,tech!$H$2),CC114),\"\")","v":""},"|",null,"Establish education plan","Guidance","4.2.4.GX",{"$f":"IF(AND(CI114<>\"\",LEFT(CI114,1)<>\"#\"),IF(LEFT(CI114,1)=\"-\",REPLACE(CI114,1,1,tech!$H$2),CI114),\"\")","v":""},"|",null,"Timely communication of important information","Assessment","4.3.4.AX",{"$f":"IF(AND(CO114<>\"\",LEFT(CO114,1)<>\"#\"),IF(LEFT(CO114,1)=\"-\",REPLACE(CO114,1,1,tech!$H$2),CO114),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D115,tech!$A$13:$B$17,2,0),LEFT(E115,1),IF(G115=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C115,1)=\"-\",C115,\"\")=\"\",\"\",REPLACE(IF(LEFT(C115,1)=\"-\",C115,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I115<>\"\",LEFT(I115,1)<>\"#\"),IF(LEFT(I115,1)=\"-\",REPLACE(I115,1,1,tech!$H$2),I115),\"\")","v":""},"|","- Privacy policy","Disclosure statement is documented and published","Guidance","1.2.4.GY",{"$f":"IF(AND(O115<>\"\",LEFT(O115,1)<>\"#\"),IF(LEFT(O115,1)=\"-\",REPLACE(O115,1,1,tech!$H$2),O115),\"\")","v":"• Privacy policy"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U115<>\"\",LEFT(U115,1)<>\"#\"),IF(LEFT(U115,1)=\"-\",REPLACE(U115,1,1,tech!$H$2),U115),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","Assessment","1.4.5.AX",{"$f":"IF(AND(AA115<>\"\",LEFT(AA115,1)<>\"#\"),IF(LEFT(AA115,1)=\"-\",REPLACE(AA115,1,1,tech!$H$2),AA115),\"\")","v":""},"|",null,"Each cryptographic key is defined and has documented lifecycle procedures","Assessment","2.1.4.AX",{"$f":"IF(AND(AG115<>\"\",LEFT(AG115,1)<>\"#\"),IF(LEFT(AG115,1)=\"-\",REPLACE(AG115,1,1,tech!$H$2),AG115),\"\")","v":""},"|","Examples of process, protocols and profiled usage:","Certificate lifecycle management is documented","References","2.2.3.RY",{"$f":"IF(AND(AM115<>\"\",LEFT(AM115,1)<>\"#\"),IF(LEFT(AM115,1)=\"-\",REPLACE(AM115,1,1,tech!$H$2),AM115),\"\")","v":"Examples of process, protocols and profiled usage:"},"|","- Backup and recovery plan","Infrastructure recovery objectives controls","Assessment","2.3.4.AY",{"$f":"IF(AND(AS115<>\"\",LEFT(AS115,1)<>\"#\"),IF(LEFT(AS115,1)=\"-\",REPLACE(AS115,1,1,tech!$H$2),AS115),\"\")","v":"• Backup and recovery plan"},"|",null,"Requirements for agility are identified","Assessment","2.4.4.AX",{"$f":"IF(AND(AY115<>\"\",LEFT(AY115,1)<>\"#\"),IF(LEFT(AY115,1)=\"-\",REPLACE(AY115,1,1,tech!$H$2),AY115),\"\")","v":""},"|",null,"Technology future proofing","Guidance","3.1.4.GX",{"$f":"IF(AND(BE115<>\"\",LEFT(BE115,1)<>\"#\"),IF(LEFT(BE115,1)=\"-\",REPLACE(BE115,1,1,tech!$H$2),BE115),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK115<>\"\",LEFT(BK115,1)<>\"#\"),IF(LEFT(BK115,1)=\"-\",REPLACE(BK115,1,1,tech!$H$2),BK115),\"\")","v":""},"|",null,"Monitoring of operational and security events is implemented","Guidance","3.3.4.GY",{"$f":"IF(AND(BQ115<>\"\",LEFT(BQ115,1)<>\"#\"),IF(LEFT(BQ115,1)=\"-\",REPLACE(BQ115,1,1,tech!$H$2),BQ115),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW115<>\"\",LEFT(BW115,1)<>\"#\"),IF(LEFT(BW115,1)=\"-\",REPLACE(BW115,1,1,tech!$H$2),BW115),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC115<>\"\",LEFT(CC115,1)<>\"#\"),IF(LEFT(CC115,1)=\"-\",REPLACE(CC115,1,1,tech!$H$2),CC115),\"\")","v":""},"|","Proper education plan is required to stay up to date with the development of the latest technologies, security practices, and controls that have impact on the PKI and its future development. ","Establish education plan","Guidance","4.2.4.GY",{"$f":"IF(AND(CI115<>\"\",LEFT(CI115,1)<>\"#\"),IF(LEFT(CI115,1)=\"-\",REPLACE(CI115,1,1,tech!$H$2),CI115),\"\")","v":"Proper education plan is required to stay up to date with the development of the latest technologies, security practices, and controls that have impact on the PKI and its future development. "},"|","- Documented procedures to timely inform PKI participants about high impact events","Timely communication of important information","Assessment","4.3.4.AY",{"$f":"IF(AND(CO115<>\"\",LEFT(CO115,1)<>\"#\"),IF(LEFT(CO115,1)=\"-\",REPLACE(CO115,1,1,tech!$H$2),CO115),\"\")","v":"• Documented procedures to timely inform PKI participants about high impact events"},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D116,tech!$A$13:$B$17,2,0),LEFT(E116,1),IF(G116=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C116,1)=\"-\",C116,\"\")=\"\",\"\",REPLACE(IF(LEFT(C116,1)=\"-\",C116,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I116<>\"\",LEFT(I116,1)<>\"#\"),IF(LEFT(I116,1)=\"-\",REPLACE(I116,1,1,tech!$H$2),I116),\"\")","v":""},"|","- Refund policy and claims","Disclosure statement is documented and published","Guidance","1.2.4.GY",{"$f":"IF(AND(O116<>\"\",LEFT(O116,1)<>\"#\"),IF(LEFT(O116,1)=\"-\",REPLACE(O116,1,1,tech!$H$2),O116),\"\")","v":"• Refund policy and claims"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U116<>\"\",LEFT(U116,1)<>\"#\"),IF(LEFT(U116,1)=\"-\",REPLACE(U116,1,1,tech!$H$2),U116),\"\")","v":""},"|","The following is sample evidence and information that can be collected during the assessment:","Processes and procedures are reviewed and updated","Assessment","1.4.5.AY",{"$f":"IF(AND(AA116<>\"\",LEFT(AA116,1)<>\"#\"),IF(LEFT(AA116,1)=\"-\",REPLACE(AA116,1,1,tech!$H$2),AA116),\"\")","v":"The following is sample evidence and information that can be collected during the assessment:"},"|","#### References","Each cryptographic key is defined and has documented lifecycle procedures","References","2.1.4.RX",{"$f":"IF(AND(AG116<>\"\",LEFT(AG116,1)<>\"#\"),IF(LEFT(AG116,1)=\"-\",REPLACE(AG116,1,1,tech!$H$2),AG116),\"\")","v":""},"|","* [RFC 4210 - Internet X.509 Public Key Infrastructure","Certificate lifecycle management is documented","References","2.2.3.RY",{"$f":"IF(AND(AM116<>\"\",LEFT(AM116,1)<>\"#\"),IF(LEFT(AM116,1)=\"-\",REPLACE(AM116,1,1,tech!$H$2),AM116),\"\")","v":"* [RFC 4210 - Internet X.509 Public Key Infrastructure"},"|","- infrastructure configuration as a code","Infrastructure recovery objectives controls","Assessment","2.3.4.AY",{"$f":"IF(AND(AS116<>\"\",LEFT(AS116,1)<>\"#\"),IF(LEFT(AS116,1)=\"-\",REPLACE(AS116,1,1,tech!$H$2),AS116),\"\")","v":"• infrastructure configuration as a code"},"|","The following is sample evidence that can be used to assess the requirement:","Requirements for agility are identified","Assessment","2.4.4.AY",{"$f":"IF(AND(AY116<>\"\",LEFT(AY116,1)<>\"#\"),IF(LEFT(AY116,1)=\"-\",REPLACE(AY116,1,1,tech!$H$2),AY116),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|","#### Assessment","Technology future proofing","Assessment","3.1.4.AX",{"$f":"IF(AND(BE116<>\"\",LEFT(BE116,1)<>\"#\"),IF(LEFT(BE116,1)=\"-\",REPLACE(BE116,1,1,tech!$H$2),BE116),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK116<>\"\",LEFT(BK116,1)<>\"#\"),IF(LEFT(BK116,1)=\"-\",REPLACE(BK116,1,1,tech!$H$2),BK116),\"\")","v":""},"|","Monitoring should be aligned with the monitoring and auditing requirements defined in the CP, CPS, and other relevant documents. The monitoring should be implemented to ensure that the requirements are met.","Monitoring of operational and security events is implemented","Guidance","3.3.4.GY",{"$f":"IF(AND(BQ116<>\"\",LEFT(BQ116,1)<>\"#\"),IF(LEFT(BQ116,1)=\"-\",REPLACE(BQ116,1,1,tech!$H$2),BQ116),\"\")","v":"Monitoring should be aligned with the monitoring and auditing requirements defined in the CP, CPS, and other relevant documents. The monitoring should be implemented to ensure that the requirements are met."},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW116<>\"\",LEFT(BW116,1)<>\"#\"),IF(LEFT(BW116,1)=\"-\",REPLACE(BW116,1,1,tech!$H$2),BW116),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC116<>\"\",LEFT(CC116,1)<>\"#\"),IF(LEFT(CC116,1)=\"-\",REPLACE(CC116,1,1,tech!$H$2),CC116),\"\")","v":""},"|",null,"Establish education plan","Guidance","4.2.4.GY",{"$f":"IF(AND(CI116<>\"\",LEFT(CI116,1)<>\"#\"),IF(LEFT(CI116,1)=\"-\",REPLACE(CI116,1,1,tech!$H$2),CI116),\"\")","v":""},"|","- Review that the procedures are followed","Timely communication of important information","Assessment","4.3.4.AY",{"$f":"IF(AND(CO116<>\"\",LEFT(CO116,1)<>\"#\"),IF(LEFT(CO116,1)=\"-\",REPLACE(CO116,1,1,tech!$H$2),CO116),\"\")","v":"• Review that the procedures are followed"},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D117,tech!$A$13:$B$17,2,0),LEFT(E117,1),IF(G117=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C117,1)=\"-\",C117,\"\")=\"\",\"\",REPLACE(IF(LEFT(C117,1)=\"-\",C117,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I117<>\"\",LEFT(I117,1)<>\"#\"),IF(LEFT(I117,1)=\"-\",REPLACE(I117,1,1,tech!$H$2),I117),\"\")","v":""},"|","- information on audit and compliance","Disclosure statement is documented and published","Guidance","1.2.4.GY",{"$f":"IF(AND(O117<>\"\",LEFT(O117,1)<>\"#\"),IF(LEFT(O117,1)=\"-\",REPLACE(O117,1,1,tech!$H$2),O117),\"\")","v":"• information on audit and compliance"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U117<>\"\",LEFT(U117,1)<>\"#\"),IF(LEFT(U117,1)=\"-\",REPLACE(U117,1,1,tech!$H$2),U117),\"\")","v":""},"|","- Documented review and update process","Processes and procedures are reviewed and updated","Assessment","1.4.5.AY",{"$f":"IF(AND(AA117<>\"\",LEFT(AA117,1)<>\"#\"),IF(LEFT(AA117,1)=\"-\",REPLACE(AA117,1,1,tech!$H$2),AA117),\"\")","v":"• Documented review and update process"},"|",null,"Each cryptographic key is defined and has documented lifecycle procedures","References","2.1.4.RX",{"$f":"IF(AND(AG117<>\"\",LEFT(AG117,1)<>\"#\"),IF(LEFT(AG117,1)=\"-\",REPLACE(AG117,1,1,tech!$H$2),AG117),\"\")","v":""},"|","  Certificate Management Protocol (CMP)](https://datatracker.ietf.org/doc/html/rfc4210/)","Certificate lifecycle management is documented","References","2.2.3.RY",{"$f":"IF(AND(AM117<>\"\",LEFT(AM117,1)<>\"#\"),IF(LEFT(AM117,1)=\"-\",REPLACE(AM117,1,1,tech!$H$2),AM117),\"\")","v":"  Certificate Management Protocol (CMP)](https://datatracker.ietf.org/doc/html/rfc4210/)"},"|","- Interview with the infrastructure administrators","Infrastructure recovery objectives controls","Assessment","2.3.4.AY",{"$f":"IF(AND(AS117<>\"\",LEFT(AS117,1)<>\"#\"),IF(LEFT(AS117,1)=\"-\",REPLACE(AS117,1,1,tech!$H$2),AS117),\"\")","v":"• Interview with the infrastructure administrators"},"|","- agility requirements of the PKI implementation","Requirements for agility are identified","Assessment","2.4.4.AY",{"$f":"IF(AND(AY117<>\"\",LEFT(AY117,1)<>\"#\"),IF(LEFT(AY117,1)=\"-\",REPLACE(AY117,1,1,tech!$H$2),AY117),\"\")","v":"• agility requirements of the PKI implementation"},"|",null,"Technology future proofing","Assessment","3.1.4.AX",{"$f":"IF(AND(BE117<>\"\",LEFT(BE117,1)<>\"#\"),IF(LEFT(BE117,1)=\"-\",REPLACE(BE117,1,1,tech!$H$2),BE117),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK117<>\"\",LEFT(BK117,1)<>\"#\"),IF(LEFT(BK117,1)=\"-\",REPLACE(BK117,1,1,tech!$H$2),BK117),\"\")","v":""},"|",null,"Monitoring of operational and security events is implemented","Guidance","3.3.4.GX",{"$f":"IF(AND(BQ117<>\"\",LEFT(BQ117,1)<>\"#\"),IF(LEFT(BQ117,1)=\"-\",REPLACE(BQ117,1,1,tech!$H$2),BQ117),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW117<>\"\",LEFT(BW117,1)<>\"#\"),IF(LEFT(BW117,1)=\"-\",REPLACE(BW117,1,1,tech!$H$2),BW117),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC117<>\"\",LEFT(CC117,1)<>\"#\"),IF(LEFT(CC117,1)=\"-\",REPLACE(CC117,1,1,tech!$H$2),CC117),\"\")","v":""},"|","The education plan should establish a robust base for the personnel to gain relevant knowledge that are out of scope of the internal training plan, but should be aligned with it to ensure that the personnel are able to perform their duties and responsibilities. The education plan should cover:","Establish education plan","Guidance","4.2.4.GY",{"$f":"IF(AND(CI117<>\"\",LEFT(CI117,1)<>\"#\"),IF(LEFT(CI117,1)=\"-\",REPLACE(CI117,1,1,tech!$H$2),CI117),\"\")","v":"The education plan should establish a robust base for the personnel to gain relevant knowledge that are out of scope of the internal training plan, but should be aligned with it to ensure that the personnel are able to perform their duties and responsibilities. The education plan should cover:"},"|","- Interview personnel to ensure that they are aware of the procedures and know How to communicate the information","Timely communication of important information","Assessment","4.3.4.AY",{"$f":"IF(AND(CO117<>\"\",LEFT(CO117,1)<>\"#\"),IF(LEFT(CO117,1)=\"-\",REPLACE(CO117,1,1,tech!$H$2),CO117),\"\")","v":"• Interview personnel to ensure that they are aware of the procedures and know How to communicate the information"},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D118,tech!$A$13:$B$17,2,0),LEFT(E118,1),IF(G118=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C118,1)=\"-\",C118,\"\")=\"\",\"\",REPLACE(IF(LEFT(C118,1)=\"-\",C118,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I118<>\"\",LEFT(I118,1)<>\"#\"),IF(LEFT(I118,1)=\"-\",REPLACE(I118,1,1,tech!$H$2),I118),\"\")","v":""},"|",null,"Disclosure statement is documented and published","Guidance","1.2.4.GY",{"$f":"IF(AND(O118<>\"\",LEFT(O118,1)<>\"#\"),IF(LEFT(O118,1)=\"-\",REPLACE(O118,1,1,tech!$H$2),O118),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U118<>\"\",LEFT(U118,1)<>\"#\"),IF(LEFT(U118,1)=\"-\",REPLACE(U118,1,1,tech!$H$2),U118),\"\")","v":""},"|","- Evidence of the review and update of the processes and procedures","Processes and procedures are reviewed and updated","Assessment","1.4.5.AY",{"$f":"IF(AND(AA118<>\"\",LEFT(AA118,1)<>\"#\"),IF(LEFT(AA118,1)=\"-\",REPLACE(AA118,1,1,tech!$H$2),AA118),\"\")","v":"• Evidence of the review and update of the processes and procedures"},"|","- [NIST SP 800-57 Recommendation for Key Management](https://csrc.nist.gov/projects/key-management/key-management-guidelines)","Each cryptographic key is defined and has documented lifecycle procedures","References","2.1.4.RY",{"$f":"IF(AND(AG118<>\"\",LEFT(AG118,1)<>\"#\"),IF(LEFT(AG118,1)=\"-\",REPLACE(AG118,1,1,tech!$H$2),AG118),\"\")","v":"• [NIST SP 800-57 Recommendation for Key Management](https://csrc.nist.gov/projects/key-management/key-management-guidelines)"},"|","* [CA/B Forum baseline requirements](https://cabforum.org/baseline-requirements/)","Certificate lifecycle management is documented","References","2.2.3.RY",{"$f":"IF(AND(AM118<>\"\",LEFT(AM118,1)<>\"#\"),IF(LEFT(AM118,1)=\"-\",REPLACE(AM118,1,1,tech!$H$2),AM118),\"\")","v":"* [CA/B Forum baseline requirements](https://cabforum.org/baseline-requirements/)"},"|",null,"Infrastructure recovery objectives controls","Assessment","2.3.4.AX",{"$f":"IF(AND(AS118<>\"\",LEFT(AS118,1)<>\"#\"),IF(LEFT(AS118,1)=\"-\",REPLACE(AS118,1,1,tech!$H$2),AS118),\"\")","v":""},"|","- configuration changes","Requirements for agility are identified","Assessment","2.4.4.AY",{"$f":"IF(AND(AY118<>\"\",LEFT(AY118,1)<>\"#\"),IF(LEFT(AY118,1)=\"-\",REPLACE(AY118,1,1,tech!$H$2),AY118),\"\")","v":"• configuration changes"},"|","The following is sample evidence that can be used to assess the requirement:","Technology future proofing","Assessment","3.1.4.AY",{"$f":"IF(AND(BE118<>\"\",LEFT(BE118,1)<>\"#\"),IF(LEFT(BE118,1)=\"-\",REPLACE(BE118,1,1,tech!$H$2),BE118),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK118<>\"\",LEFT(BK118,1)<>\"#\"),IF(LEFT(BK118,1)=\"-\",REPLACE(BK118,1,1,tech!$H$2),BK118),\"\")","v":""},"|","#### Assessment","Monitoring of operational and security events is implemented","Assessment","3.3.4.AX",{"$f":"IF(AND(BQ118<>\"\",LEFT(BQ118,1)<>\"#\"),IF(LEFT(BQ118,1)=\"-\",REPLACE(BQ118,1,1,tech!$H$2),BQ118),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW118<>\"\",LEFT(BW118,1)<>\"#\"),IF(LEFT(BW118,1)=\"-\",REPLACE(BW118,1,1,tech!$H$2),BW118),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC118<>\"\",LEFT(CC118,1)<>\"#\"),IF(LEFT(CC118,1)=\"-\",REPLACE(CC118,1,1,tech!$H$2),CC118),\"\")","v":""},"|","- education requirements and Prerequisites","Establish education plan","Guidance","4.2.4.GY",{"$f":"IF(AND(CI118<>\"\",LEFT(CI118,1)<>\"#\"),IF(LEFT(CI118,1)=\"-\",REPLACE(CI118,1,1,tech!$H$2),CI118),\"\")","v":"• education requirements and Prerequisites"},"|",null,"Timely communication of important information","Assessment","4.3.4.AX",{"$f":"IF(AND(CO118<>\"\",LEFT(CO118,1)<>\"#\"),IF(LEFT(CO118,1)=\"-\",REPLACE(CO118,1,1,tech!$H$2),CO118),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D119,tech!$A$13:$B$17,2,0),LEFT(E119,1),IF(G119=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C119,1)=\"-\",C119,\"\")=\"\",\"\",REPLACE(IF(LEFT(C119,1)=\"-\",C119,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I119<>\"\",LEFT(I119,1)<>\"#\"),IF(LEFT(I119,1)=\"-\",REPLACE(I119,1,1,tech!$H$2),I119),\"\")","v":""},"|","The purpose of a DS is to provide transparency to relying parties, allowing them to assess the trustworthiness and reliability of the CA before relying on its certificates.","Disclosure statement is documented and published","Guidance","1.2.4.GY",{"$f":"IF(AND(O119<>\"\",LEFT(O119,1)<>\"#\"),IF(LEFT(O119,1)=\"-\",REPLACE(O119,1,1,tech!$H$2),O119),\"\")","v":"The purpose of a DS is to provide transparency to relying parties, allowing them to assess the trustworthiness and reliability of the CA before relying on its certificates."},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U119<>\"\",LEFT(U119,1)<>\"#\"),IF(LEFT(U119,1)=\"-\",REPLACE(U119,1,1,tech!$H$2),U119),\"\")","v":""},"|","- Interview with the PKI management and staff","Processes and procedures are reviewed and updated","Assessment","1.4.5.AY",{"$f":"IF(AND(AA119<>\"\",LEFT(AA119,1)<>\"#\"),IF(LEFT(AA119,1)=\"-\",REPLACE(AA119,1,1,tech!$H$2),AA119),\"\")","v":"• Interview with the PKI management and staff"},"|","- [ISO/IEC 11770 Key Management](https://www.iso.org/standard/53456.html)","Each cryptographic key is defined and has documented lifecycle procedures","References","2.1.4.RY",{"$f":"IF(AND(AG119<>\"\",LEFT(AG119,1)<>\"#\"),IF(LEFT(AG119,1)=\"-\",REPLACE(AG119,1,1,tech!$H$2),AG119),\"\")","v":"• [ISO/IEC 11770 Key Management](https://www.iso.org/standard/53456.html)"},"|","* [3GPP 33.310 - Network Domain Security (NDS); Authentication Framework (AF)](https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId2293)","Certificate lifecycle management is documented","References","2.2.3.RY",{"$f":"IF(AND(AM119<>\"\",LEFT(AM119,1)<>\"#\"),IF(LEFT(AM119,1)=\"-\",REPLACE(AM119,1,1,tech!$H$2),AM119),\"\")","v":"* [3GPP 33.310 - Network Domain Security (NDS); Authentication Framework (AF)](https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId2293)"},"|","#### References","Infrastructure recovery objectives controls","References","2.3.4.RX",{"$f":"IF(AND(AS119<>\"\",LEFT(AS119,1)<>\"#\"),IF(LEFT(AS119,1)=\"-\",REPLACE(AS119,1,1,tech!$H$2),AS119),\"\")","v":""},"|","- changes in the operational environment","Requirements for agility are identified","Assessment","2.4.4.AY",{"$f":"IF(AND(AY119<>\"\",LEFT(AY119,1)<>\"#\"),IF(LEFT(AY119,1)=\"-\",REPLACE(AY119,1,1,tech!$H$2),AY119),\"\")","v":"• changes in the operational environment"},"|","- Interview with the CTO or CIO","Technology future proofing","Assessment","3.1.4.AY",{"$f":"IF(AND(BE119<>\"\",LEFT(BE119,1)<>\"#\"),IF(LEFT(BE119,1)=\"-\",REPLACE(BE119,1,1,tech!$H$2),BE119),\"\")","v":"• Interview with the CTO or CIO"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK119<>\"\",LEFT(BK119,1)<>\"#\"),IF(LEFT(BK119,1)=\"-\",REPLACE(BK119,1,1,tech!$H$2),BK119),\"\")","v":""},"|",null,"Monitoring of operational and security events is implemented","Assessment","3.3.4.AX",{"$f":"IF(AND(BQ119<>\"\",LEFT(BQ119,1)<>\"#\"),IF(LEFT(BQ119,1)=\"-\",REPLACE(BQ119,1,1,tech!$H$2),BQ119),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW119<>\"\",LEFT(BW119,1)<>\"#\"),IF(LEFT(BW119,1)=\"-\",REPLACE(BW119,1,1,tech!$H$2),BW119),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC119<>\"\",LEFT(CC119,1)<>\"#\"),IF(LEFT(CC119,1)=\"-\",REPLACE(CC119,1,1,tech!$H$2),CC119),\"\")","v":""},"|","- Recommended education Approach and methods","Establish education plan","Guidance","4.2.4.GY",{"$f":"IF(AND(CI119<>\"\",LEFT(CI119,1)<>\"#\"),IF(LEFT(CI119,1)=\"-\",REPLACE(CI119,1,1,tech!$H$2),CI119),\"\")","v":"• Recommended education Approach and methods"},"|","#### References","Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO119<>\"\",LEFT(CO119,1)<>\"#\"),IF(LEFT(CO119,1)=\"-\",REPLACE(CO119,1,1,tech!$H$2),CO119),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D120,tech!$A$13:$B$17,2,0),LEFT(E120,1),IF(G120=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C120,1)=\"-\",C120,\"\")=\"\",\"\",REPLACE(IF(LEFT(C120,1)=\"-\",C120,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I120<>\"\",LEFT(I120,1)<>\"#\"),IF(LEFT(I120,1)=\"-\",REPLACE(I120,1,1,tech!$H$2),I120),\"\")","v":""},"|",null,"Disclosure statement is documented and published","Guidance","1.2.4.GX",{"$f":"IF(AND(O120<>\"\",LEFT(O120,1)<>\"#\"),IF(LEFT(O120,1)=\"-\",REPLACE(O120,1,1,tech!$H$2),O120),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U120<>\"\",LEFT(U120,1)<>\"#\"),IF(LEFT(U120,1)=\"-\",REPLACE(U120,1,1,tech!$H$2),U120),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","Assessment","1.4.5.AX",{"$f":"IF(AND(AA120<>\"\",LEFT(AA120,1)<>\"#\"),IF(LEFT(AA120,1)=\"-\",REPLACE(AA120,1,1,tech!$H$2),AA120),\"\")","v":""},"|",null,"Each cryptographic key is defined and has documented lifecycle procedures","References","2.1.4.RX",{"$f":"IF(AND(AG120<>\"\",LEFT(AG120,1)<>\"#\"),IF(LEFT(AG120,1)=\"-\",REPLACE(AG120,1,1,tech!$H$2),AG120),\"\")","v":""},"|","* [UNISIG SUBSET-137](https://www.era.europa.eu/system/files/2022-11/index083_-_subset-137_v100.pdf)","Certificate lifecycle management is documented","References","2.2.3.RY",{"$f":"IF(AND(AM120<>\"\",LEFT(AM120,1)<>\"#\"),IF(LEFT(AM120,1)=\"-\",REPLACE(AM120,1,1,tech!$H$2),AM120),\"\")","v":"* [UNISIG SUBSET-137](https://www.era.europa.eu/system/files/2022-11/index083_-_subset-137_v100.pdf)"},"|",null,"Infrastructure recovery objectives controls","References","2.3.4.RX",{"$f":"IF(AND(AS120<>\"\",LEFT(AS120,1)<>\"#\"),IF(LEFT(AS120,1)=\"-\",REPLACE(AS120,1,1,tech!$H$2),AS120),\"\")","v":""},"|","- changes in the technologies","Requirements for agility are identified","Assessment","2.4.4.AY",{"$f":"IF(AND(AY120<>\"\",LEFT(AY120,1)<>\"#\"),IF(LEFT(AY120,1)=\"-\",REPLACE(AY120,1,1,tech!$H$2),AY120),\"\")","v":"• changes in the technologies"},"|","- documentation of the Technology future proofing","Technology future proofing","Assessment","3.1.4.AY",{"$f":"IF(AND(BE120<>\"\",LEFT(BE120,1)<>\"#\"),IF(LEFT(BE120,1)=\"-\",REPLACE(BE120,1,1,tech!$H$2),BE120),\"\")","v":"• documentation of the Technology future proofing"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK120<>\"\",LEFT(BK120,1)<>\"#\"),IF(LEFT(BK120,1)=\"-\",REPLACE(BK120,1,1,tech!$H$2),BK120),\"\")","v":""},"|","- Monitoring of operational and Security events is implemented according to the requirements","Monitoring of operational and security events is implemented","Assessment","3.3.4.AY",{"$f":"IF(AND(BQ120<>\"\",LEFT(BQ120,1)<>\"#\"),IF(LEFT(BQ120,1)=\"-\",REPLACE(BQ120,1,1,tech!$H$2),BQ120),\"\")","v":"• Monitoring of operational and Security events is implemented according to the requirements"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW120<>\"\",LEFT(BW120,1)<>\"#\"),IF(LEFT(BW120,1)=\"-\",REPLACE(BW120,1,1,tech!$H$2),BW120),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC120<>\"\",LEFT(CC120,1)<>\"#\"),IF(LEFT(CC120,1)=\"-\",REPLACE(CC120,1,1,tech!$H$2),CC120),\"\")","v":""},"|","- Approach to Monitor and assess the education Results","Establish education plan","Guidance","4.2.4.GY",{"$f":"IF(AND(CI120<>\"\",LEFT(CI120,1)<>\"#\"),IF(LEFT(CI120,1)=\"-\",REPLACE(CI120,1,1,tech!$H$2),CI120),\"\")","v":"• Approach to Monitor and assess the education Results"},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO120<>\"\",LEFT(CO120,1)<>\"#\"),IF(LEFT(CO120,1)=\"-\",REPLACE(CO120,1,1,tech!$H$2),CO120),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D121,tech!$A$13:$B$17,2,0),LEFT(E121,1),IF(G121=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C121,1)=\"-\",C121,\"\")=\"\",\"\",REPLACE(IF(LEFT(C121,1)=\"-\",C121,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I121<>\"\",LEFT(I121,1)<>\"#\"),IF(LEFT(I121,1)=\"-\",REPLACE(I121,1,1,tech!$H$2),I121),\"\")","v":""},"|","#### Assessment","Disclosure statement is documented and published","Assessment","1.2.4.AX",{"$f":"IF(AND(O121<>\"\",LEFT(O121,1)<>\"#\"),IF(LEFT(O121,1)=\"-\",REPLACE(O121,1,1,tech!$H$2),O121),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U121<>\"\",LEFT(U121,1)<>\"#\"),IF(LEFT(U121,1)=\"-\",REPLACE(U121,1,1,tech!$H$2),U121),\"\")","v":""},"|","#### References","Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA121<>\"\",LEFT(AA121,1)<>\"#\"),IF(LEFT(AA121,1)=\"-\",REPLACE(AA121,1,1,tech!$H$2),AA121),\"\")","v":""},"|","### Cryptographic cipher suites and protocols are documented and maintained","Cryptographic cipher suites and protocols are documented and maintained","References","2.1.5.RX",{"$f":"IF(AND(AG121<>\"\",LEFT(AG121,1)<>\"#\"),IF(LEFT(AG121,1)=\"-\",REPLACE(AG121,1,1,tech!$H$2),AG121),\"\")","v":""},"|",null,"Certificate lifecycle management is documented","References","2.2.3.RX",{"$f":"IF(AND(AM121<>\"\",LEFT(AM121,1)<>\"#\"),IF(LEFT(AM121,1)=\"-\",REPLACE(AM121,1,1,tech!$H$2),AM121),\"\")","v":""},"|","- [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)","Infrastructure recovery objectives controls","References","2.3.4.RY",{"$f":"IF(AND(AS121<>\"\",LEFT(AS121,1)<>\"#\"),IF(LEFT(AS121,1)=\"-\",REPLACE(AS121,1,1,tech!$H$2),AS121),\"\")","v":"• [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)"},"|","- and other relevant evidence","Requirements for agility are identified","Assessment","2.4.4.AY",{"$f":"IF(AND(AY121<>\"\",LEFT(AY121,1)<>\"#\"),IF(LEFT(AY121,1)=\"-\",REPLACE(AY121,1,1,tech!$H$2),AY121),\"\")","v":"• and other relevant evidence"},"|","- RFI and RFP documents","Technology future proofing","Assessment","3.1.4.AY",{"$f":"IF(AND(BE121<>\"\",LEFT(BE121,1)<>\"#\"),IF(LEFT(BE121,1)=\"-\",REPLACE(BE121,1,1,tech!$H$2),BE121),\"\")","v":"• RFI and RFP documents"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK121<>\"\",LEFT(BK121,1)<>\"#\"),IF(LEFT(BK121,1)=\"-\",REPLACE(BK121,1,1,tech!$H$2),BK121),\"\")","v":""},"|","- Review of monitoring implementation, including CA key life cycle management related events, security sensitive events, and other relevant events","Monitoring of operational and security events is implemented","Assessment","3.3.4.AY",{"$f":"IF(AND(BQ121<>\"\",LEFT(BQ121,1)<>\"#\"),IF(LEFT(BQ121,1)=\"-\",REPLACE(BQ121,1,1,tech!$H$2),BQ121),\"\")","v":"• Review of monitoring implementation, including CA key life cycle management related events, security sensitive events, and other relevant events"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW121<>\"\",LEFT(BW121,1)<>\"#\"),IF(LEFT(BW121,1)=\"-\",REPLACE(BW121,1,1,tech!$H$2),BW121),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC121<>\"\",LEFT(CC121,1)<>\"#\"),IF(LEFT(CC121,1)=\"-\",REPLACE(CC121,1,1,tech!$H$2),CC121),\"\")","v":""},"|",null,"Establish education plan","Guidance","4.2.4.GY",{"$f":"IF(AND(CI121<>\"\",LEFT(CI121,1)<>\"#\"),IF(LEFT(CI121,1)=\"-\",REPLACE(CI121,1,1,tech!$H$2),CI121),\"\")","v":""},"|","- [RFC 3647 Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://datatracker.ietf.org/doc/html/rfc3647)","Timely communication of important information","References","4.3.4.RY",{"$f":"IF(AND(CO121<>\"\",LEFT(CO121,1)<>\"#\"),IF(LEFT(CO121,1)=\"-\",REPLACE(CO121,1,1,tech!$H$2),CO121),\"\")","v":"• [RFC 3647 Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://datatracker.ietf.org/doc/html/rfc3647)"},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D122,tech!$A$13:$B$17,2,0),LEFT(E122,1),IF(G122=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C122,1)=\"-\",C122,\"\")=\"\",\"\",REPLACE(IF(LEFT(C122,1)=\"-\",C122,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I122<>\"\",LEFT(I122,1)<>\"#\"),IF(LEFT(I122,1)=\"-\",REPLACE(I122,1,1,tech!$H$2),I122),\"\")","v":""},"|",null,"Disclosure statement is documented and published","Assessment","1.2.4.AX",{"$f":"IF(AND(O122<>\"\",LEFT(O122,1)<>\"#\"),IF(LEFT(O122,1)=\"-\",REPLACE(O122,1,1,tech!$H$2),O122),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U122<>\"\",LEFT(U122,1)<>\"#\"),IF(LEFT(U122,1)=\"-\",REPLACE(U122,1,1,tech!$H$2),U122),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA122<>\"\",LEFT(AA122,1)<>\"#\"),IF(LEFT(AA122,1)=\"-\",REPLACE(AA122,1,1,tech!$H$2),AA122),\"\")","v":""},"|",null,"Cryptographic cipher suites and protocols are documented and maintained","References","2.1.5.RX",{"$f":"IF(AND(AG122<>\"\",LEFT(AG122,1)<>\"#\"),IF(LEFT(AG122,1)=\"-\",REPLACE(AG122,1,1,tech!$H$2),AG122),\"\")","v":""},"|","### Inventory of issued certificates is documented","Inventory of issued certificates is documented","References","2.2.4.RX",{"$f":"IF(AND(AM122<>\"\",LEFT(AM122,1)<>\"#\"),IF(LEFT(AM122,1)=\"-\",REPLACE(AM122,1,1,tech!$H$2),AM122),\"\")","v":""},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Infrastructure recovery objectives controls","References","2.3.4.RY",{"$f":"IF(AND(AS122<>\"\",LEFT(AS122,1)<>\"#\"),IF(LEFT(AS122,1)=\"-\",REPLACE(AS122,1,1,tech!$H$2),AS122),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|",null,"Requirements for agility are identified","Assessment","2.4.4.AX",{"$f":"IF(AND(AY122<>\"\",LEFT(AY122,1)<>\"#\"),IF(LEFT(AY122,1)=\"-\",REPLACE(AY122,1,1,tech!$H$2),AY122),\"\")","v":""},"|","- Vendor and Technology check","Technology future proofing","Assessment","3.1.4.AY",{"$f":"IF(AND(BE122<>\"\",LEFT(BE122,1)<>\"#\"),IF(LEFT(BE122,1)=\"-\",REPLACE(BE122,1,1,tech!$H$2),BE122),\"\")","v":"• Vendor and Technology check"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK122<>\"\",LEFT(BK122,1)<>\"#\"),IF(LEFT(BK122,1)=\"-\",REPLACE(BK122,1,1,tech!$H$2),BK122),\"\")","v":""},"|","- Review of Monitoring events and alerts","Monitoring of operational and security events is implemented","Assessment","3.3.4.AY",{"$f":"IF(AND(BQ122<>\"\",LEFT(BQ122,1)<>\"#\"),IF(LEFT(BQ122,1)=\"-\",REPLACE(BQ122,1,1,tech!$H$2),BQ122),\"\")","v":"• Review of Monitoring events and alerts"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW122<>\"\",LEFT(BW122,1)<>\"#\"),IF(LEFT(BW122,1)=\"-\",REPLACE(BW122,1,1,tech!$H$2),BW122),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC122<>\"\",LEFT(CC122,1)<>\"#\"),IF(LEFT(CC122,1)=\"-\",REPLACE(CC122,1,1,tech!$H$2),CC122),\"\")","v":""},"|","Methods to provide education can vary:","Establish education plan","Guidance","4.2.4.GY",{"$f":"IF(AND(CI122<>\"\",LEFT(CI122,1)<>\"#\"),IF(LEFT(CI122,1)=\"-\",REPLACE(CI122,1,1,tech!$H$2),CI122),\"\")","v":"Methods to provide education can vary:"},"|","- [ETSI EN 319 401 - General Policy Requirements for Trust Service Providers](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/02.03.01_60/en_319401v020301p.pdf)","Timely communication of important information","References","4.3.4.RY",{"$f":"IF(AND(CO122<>\"\",LEFT(CO122,1)<>\"#\"),IF(LEFT(CO122,1)=\"-\",REPLACE(CO122,1,1,tech!$H$2),CO122),\"\")","v":"• [ETSI EN 319 401 - General Policy Requirements for Trust Service Providers](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/02.03.01_60/en_319401v020301p.pdf)"},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D123,tech!$A$13:$B$17,2,0),LEFT(E123,1),IF(G123=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C123,1)=\"-\",C123,\"\")=\"\",\"\",REPLACE(IF(LEFT(C123,1)=\"-\",C123,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I123<>\"\",LEFT(I123,1)<>\"#\"),IF(LEFT(I123,1)=\"-\",REPLACE(I123,1,1,tech!$H$2),I123),\"\")","v":""},"|","- the DS is properly Documented in its full scope","Disclosure statement is documented and published","Assessment","1.2.4.AY",{"$f":"IF(AND(O123<>\"\",LEFT(O123,1)<>\"#\"),IF(LEFT(O123,1)=\"-\",REPLACE(O123,1,1,tech!$H$2),O123),\"\")","v":"• the DS is properly Documented in its full scope"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U123<>\"\",LEFT(U123,1)<>\"#\"),IF(LEFT(U123,1)=\"-\",REPLACE(U123,1,1,tech!$H$2),U123),\"\")","v":""},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Processes and procedures are reviewed and updated","References","1.4.5.RY",{"$f":"IF(AND(AA123<>\"\",LEFT(AA123,1)<>\"#\"),IF(LEFT(AA123,1)=\"-\",REPLACE(AA123,1,1,tech!$H$2),AA123),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|","#### Guidance","Cryptographic cipher suites and protocols are documented and maintained","Guidance","2.1.5.GX",{"$f":"IF(AND(AG123<>\"\",LEFT(AG123,1)<>\"#\"),IF(LEFT(AG123,1)=\"-\",REPLACE(AG123,1,1,tech!$H$2),AG123),\"\")","v":""},"|",null,"Inventory of issued certificates is documented","References","2.2.4.RX",{"$f":"IF(AND(AM123<>\"\",LEFT(AM123,1)<>\"#\"),IF(LEFT(AM123,1)=\"-\",REPLACE(AM123,1,1,tech!$H$2),AM123),\"\")","v":""},"|",null,"Infrastructure recovery objectives controls","References","2.3.4.RX",{"$f":"IF(AND(AS123<>\"\",LEFT(AS123,1)<>\"#\"),IF(LEFT(AS123,1)=\"-\",REPLACE(AS123,1,1,tech!$H$2),AS123),\"\")","v":""},"|","#### References","Requirements for agility are identified","References","2.4.4.RX",{"$f":"IF(AND(AY123<>\"\",LEFT(AY123,1)<>\"#\"),IF(LEFT(AY123,1)=\"-\",REPLACE(AY123,1,1,tech!$H$2),AY123),\"\")","v":""},"|",null,"Technology future proofing","Assessment","3.1.4.AX",{"$f":"IF(AND(BE123<>\"\",LEFT(BE123,1)<>\"#\"),IF(LEFT(BE123,1)=\"-\",REPLACE(BE123,1,1,tech!$H$2),BE123),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK123<>\"\",LEFT(BK123,1)<>\"#\"),IF(LEFT(BK123,1)=\"-\",REPLACE(BK123,1,1,tech!$H$2),BK123),\"\")","v":""},"|","- Interviews with personnel responsible for Monitoring","Monitoring of operational and security events is implemented","Assessment","3.3.4.AY",{"$f":"IF(AND(BQ123<>\"\",LEFT(BQ123,1)<>\"#\"),IF(LEFT(BQ123,1)=\"-\",REPLACE(BQ123,1,1,tech!$H$2),BQ123),\"\")","v":"• Interviews with personnel responsible for Monitoring"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW123<>\"\",LEFT(BW123,1)<>\"#\"),IF(LEFT(BW123,1)=\"-\",REPLACE(BW123,1,1,tech!$H$2),BW123),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC123<>\"\",LEFT(CC123,1)<>\"#\"),IF(LEFT(CC123,1)=\"-\",REPLACE(CC123,1,1,tech!$H$2),CC123),\"\")","v":""},"|","- internal or external courses","Establish education plan","Guidance","4.2.4.GY",{"$f":"IF(AND(CI123<>\"\",LEFT(CI123,1)<>\"#\"),IF(LEFT(CI123,1)=\"-\",REPLACE(CI123,1,1,tech!$H$2),CI123),\"\")","v":"• internal or external courses"},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO123<>\"\",LEFT(CO123,1)<>\"#\"),IF(LEFT(CO123,1)=\"-\",REPLACE(CO123,1,1,tech!$H$2),CO123),\"\")","v":""},"|"]
[{"$nulls":3},{"$f":"IF(AND(LEFT(C124,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(C124,\" \"))=2,0)),_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(C124,\" \"),\" \"),D123)","v":"Optimized"},{"$f":"IF(AND(LEFT(C124,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(C124,\" \"))=3,0)),_xlfn.TEXTAFTER(C124,\" \"),E123)","v":"Associated risks"},{"$f":"_xlfn.CONCAT(VLOOKUP(D124,tech!$A$13:$B$17,2,0),LEFT(E124,1),IF(G124=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C124,1)=\"-\",C124,\"\")=\"\",\"\",REPLACE(IF(LEFT(C124,1)=\"-\",C124,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I124<>\"\",LEFT(I124,1)<>\"#\"),IF(LEFT(I124,1)=\"-\",REPLACE(I124,1,1,tech!$H$2),I124),\"\")","v":""},"|","- DS is published and available to all parties involved","Disclosure statement is documented and published","Assessment","1.2.4.AY",{"$f":"IF(AND(O124<>\"\",LEFT(O124,1)<>\"#\"),IF(LEFT(O124,1)=\"-\",REPLACE(O124,1,1,tech!$H$2),O124),\"\")","v":"• DS is published and available to all parties involved"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U124<>\"\",LEFT(U124,1)<>\"#\"),IF(LEFT(U124,1)=\"-\",REPLACE(U124,1,1,tech!$H$2),U124),\"\")","v":""},"|","- [RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://tools.ietf.org/html/rfc3647)","Processes and procedures are reviewed and updated","References","1.4.5.RY",{"$f":"IF(AND(AA124<>\"\",LEFT(AA124,1)<>\"#\"),IF(LEFT(AA124,1)=\"-\",REPLACE(AA124,1,1,tech!$H$2),AA124),\"\")","v":"• [RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://tools.ietf.org/html/rfc3647)"},"|",null,"Cryptographic cipher suites and protocols are documented and maintained","Guidance","2.1.5.GX",{"$f":"IF(AND(AG124<>\"\",LEFT(AG124,1)<>\"#\"),IF(LEFT(AG124,1)=\"-\",REPLACE(AG124,1,1,tech!$H$2),AG124),\"\")","v":""},"|","#### Guidance","Inventory of issued certificates is documented","Guidance","2.2.4.GX",{"$f":"IF(AND(AM124<>\"\",LEFT(AM124,1)<>\"#\"),IF(LEFT(AM124,1)=\"-\",REPLACE(AM124,1,1,tech!$H$2),AM124),\"\")","v":""},"|","### Infrastructure activities are periodically reviewed","Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS124<>\"\",LEFT(AS124,1)<>\"#\"),IF(LEFT(AS124,1)=\"-\",REPLACE(AS124,1,1,tech!$H$2),AS124),\"\")","v":""},"|",null,"Requirements for agility are identified","References","2.4.4.RX",{"$f":"IF(AND(AY124<>\"\",LEFT(AY124,1)<>\"#\"),IF(LEFT(AY124,1)=\"-\",REPLACE(AY124,1,1,tech!$H$2),AY124),\"\")","v":""},"|","#### References","Technology future proofing","References","3.1.4.RX",{"$f":"IF(AND(BE124<>\"\",LEFT(BE124,1)<>\"#\"),IF(LEFT(BE124,1)=\"-\",REPLACE(BE124,1,1,tech!$H$2),BE124),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK124<>\"\",LEFT(BK124,1)<>\"#\"),IF(LEFT(BK124,1)=\"-\",REPLACE(BK124,1,1,tech!$H$2),BK124),\"\")","v":""},"|",null,"Monitoring of operational and security events is implemented","Assessment","3.3.4.AX",{"$f":"IF(AND(BQ124<>\"\",LEFT(BQ124,1)<>\"#\"),IF(LEFT(BQ124,1)=\"-\",REPLACE(BQ124,1,1,tech!$H$2),BQ124),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW124<>\"\",LEFT(BW124,1)<>\"#\"),IF(LEFT(BW124,1)=\"-\",REPLACE(BW124,1,1,tech!$H$2),BW124),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC124<>\"\",LEFT(CC124,1)<>\"#\"),IF(LEFT(CC124,1)=\"-\",REPLACE(CC124,1,1,tech!$H$2),CC124),\"\")","v":""},"|","- incentives and rewards","Establish education plan","Guidance","4.2.4.GY",{"$f":"IF(AND(CI124<>\"\",LEFT(CI124,1)<>\"#\"),IF(LEFT(CI124,1)=\"-\",REPLACE(CI124,1,1,tech!$H$2),CI124),\"\")","v":"• incentives and rewards"},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO124<>\"\",LEFT(CO124,1)<>\"#\"),IF(LEFT(CO124,1)=\"-\",REPLACE(CO124,1,1,tech!$H$2),CO124),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D125,tech!$A$13:$B$17,2,0),LEFT(E125,1),IF(G125=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C125,1)=\"-\",C125,\"\")=\"\",\"\",REPLACE(IF(LEFT(C125,1)=\"-\",C125,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI",{"$f":"IF(AND(LEFT(I125,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(I125,\" \"))=4,0)),_xlfn.TEXTAFTER(I125,\" \"),K124)","v":"References"},"1.1.4.RX",{"$f":"IF(AND(I125<>\"\",LEFT(I125,1)<>\"#\"),IF(LEFT(I125,1)=\"-\",REPLACE(I125,1,1,tech!$H$2),I125),\"\")","v":""},"|","- Interview with the management and PKI responsible personnel to confirm the DS is accurate","Disclosure statement is documented and published",{"$f":"IF(AND(LEFT(O125,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(O125,\" \"))=4,0)),_xlfn.TEXTAFTER(O125,\" \"),Q124)","v":"Assessment"},"1.2.4.AY",{"$f":"IF(AND(O125<>\"\",LEFT(O125,1)<>\"#\"),IF(LEFT(O125,1)=\"-\",REPLACE(O125,1,1,tech!$H$2),O125),\"\")","v":"• Interview with the management and PKI responsible personnel to confirm the DS is accurate"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained",{"$f":"IF(AND(LEFT(U125,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(U125,\" \"))=4,0)),_xlfn.TEXTAFTER(U125,\" \"),W124)","v":"References"},"1.3.4.RX",{"$f":"IF(AND(U125<>\"\",LEFT(U125,1)<>\"#\"),IF(LEFT(U125,1)=\"-\",REPLACE(U125,1,1,tech!$H$2),U125),\"\")","v":""},"|","- [ENISA Publications](https://www.enisa.europa.eu/publications)","Processes and procedures are reviewed and updated",{"$f":"IF(AND(LEFT(AA125,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AA125,\" \"))=4,0)),_xlfn.TEXTAFTER(AA125,\" \"),AC124)","v":"References"},"1.4.5.RY",{"$f":"IF(AND(AA125<>\"\",LEFT(AA125,1)<>\"#\"),IF(LEFT(AA125,1)=\"-\",REPLACE(AA125,1,1,tech!$H$2),AA125),\"\")","v":"• [ENISA Publications](https://www.enisa.europa.eu/publications)"},"|","Protocols and encryption strengths may quickly change or be deprecated due to identification of vulnerabilities or design flaws. In order to support current and future data security needs, the organization should know where cryptography is used and understand how they would be able to respond rapidly to changes impacting the strength of their cryptographic implementations.","Cryptographic cipher suites and protocols are documented and maintained",{"$f":"IF(AND(LEFT(AG125,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AG125,\" \"))=4,0)),_xlfn.TEXTAFTER(AG125,\" \"),AI124)","v":"Guidance"},"2.1.5.GY",{"$f":"IF(AND(AG125<>\"\",LEFT(AG125,1)<>\"#\"),IF(LEFT(AG125,1)=\"-\",REPLACE(AG125,1,1,tech!$H$2),AG125),\"\")","v":"Protocols and encryption strengths may quickly change or be deprecated due to identification of vulnerabilities or design flaws. In order to support current and future data security needs, the organization should know where cryptography is used and understand how they would be able to respond rapidly to changes impacting the strength of their cryptographic implementations."},"|",null,"Inventory of issued certificates is documented",{"$f":"IF(AND(LEFT(AM125,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AM125,\" \"))=4,0)),_xlfn.TEXTAFTER(AM125,\" \"),AO124)","v":"Guidance"},"2.2.4.GX",{"$f":"IF(AND(AM125<>\"\",LEFT(AM125,1)<>\"#\"),IF(LEFT(AM125,1)=\"-\",REPLACE(AM125,1,1,tech!$H$2),AM125),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed",{"$f":"IF(AND(LEFT(AS125,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AS125,\" \"))=4,0)),_xlfn.TEXTAFTER(AS125,\" \"),AU124)","v":"References"},"2.3.5.RX",{"$f":"IF(AND(AS125<>\"\",LEFT(AS125,1)<>\"#\"),IF(LEFT(AS125,1)=\"-\",REPLACE(AS125,1,1,tech!$H$2),AS125),\"\")","v":""},"|","- [COBIT (Control Objectives for Information and Related Technologies)](https://www.isaca.org/resources/cobit)","Requirements for agility are identified",{"$f":"IF(AND(LEFT(AY125,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AY125,\" \"))=4,0)),_xlfn.TEXTAFTER(AY125,\" \"),BA124)","v":"References"},"2.4.4.RY",{"$f":"IF(AND(AY125<>\"\",LEFT(AY125,1)<>\"#\"),IF(LEFT(AY125,1)=\"-\",REPLACE(AY125,1,1,tech!$H$2),AY125),\"\")","v":"• [COBIT (Control Objectives for Information and Related Technologies)](https://www.isaca.org/resources/cobit)"},"|",null,"Technology future proofing",{"$f":"IF(AND(LEFT(BE125,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BE125,\" \"))=4,0)),_xlfn.TEXTAFTER(BE125,\" \"),BG124)","v":"References"},"3.1.4.RX",{"$f":"IF(AND(BE125<>\"\",LEFT(BE125,1)<>\"#\"),IF(LEFT(BE125,1)=\"-\",REPLACE(BE125,1,1,tech!$H$2),BE125),\"\")","v":""},"|",null,"Adoption and application of open standards",{"$f":"IF(AND(LEFT(BK125,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BK125,\" \"))=4,0)),_xlfn.TEXTAFTER(BK125,\" \"),BM124)","v":"References"},"3.2.3.RX",{"$f":"IF(AND(BK125<>\"\",LEFT(BK125,1)<>\"#\"),IF(LEFT(BK125,1)=\"-\",REPLACE(BK125,1,1,tech!$H$2),BK125),\"\")","v":""},"|","#### References","Monitoring of operational and security events is implemented",{"$f":"IF(AND(LEFT(BQ125,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BQ125,\" \"))=4,0)),_xlfn.TEXTAFTER(BQ125,\" \"),BS124)","v":"References"},"3.3.4.RX",{"$f":"IF(AND(BQ125<>\"\",LEFT(BQ125,1)<>\"#\"),IF(LEFT(BQ125,1)=\"-\",REPLACE(BQ125,1,1,tech!$H$2),BQ125),\"\")","v":""},"|",null,"Incidents and exceptions handling",{"$f":"IF(AND(LEFT(BW125,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BW125,\" \"))=4,0)),_xlfn.TEXTAFTER(BW125,\" \"),BY124)","v":"References"},"3.4.3.RX",{"$f":"IF(AND(BW125<>\"\",LEFT(BW125,1)<>\"#\"),IF(LEFT(BW125,1)=\"-\",REPLACE(BW125,1,1,tech!$H$2),BW125),\"\")","v":""},"|",null,"Resources are periodically reviewed",{"$f":"IF(AND(LEFT(CC125,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CC125,\" \"))=4,0)),_xlfn.TEXTAFTER(CC125,\" \"),CE124)","v":"References"},"4.1.4.RX",{"$f":"IF(AND(CC125<>\"\",LEFT(CC125,1)<>\"#\"),IF(LEFT(CC125,1)=\"-\",REPLACE(CC125,1,1,tech!$H$2),CC125),\"\")","v":""},"|","- Mentoring, coaching, and shadowing","Establish education plan",{"$f":"IF(AND(LEFT(CI125,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CI125,\" \"))=4,0)),_xlfn.TEXTAFTER(CI125,\" \"),CK124)","v":"Guidance"},"4.2.4.GY",{"$f":"IF(AND(CI125<>\"\",LEFT(CI125,1)<>\"#\"),IF(LEFT(CI125,1)=\"-\",REPLACE(CI125,1,1,tech!$H$2),CI125),\"\")","v":"• Mentoring, coaching, and shadowing"},"|",null,"Timely communication of important information",{"$f":"IF(AND(LEFT(CO125,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CO125,\" \"))=4,0)),_xlfn.TEXTAFTER(CO125,\" \"),CQ124)","v":"References"},"4.3.4.RX",{"$f":"IF(AND(CO125<>\"\",LEFT(CO125,1)<>\"#\"),IF(LEFT(CO125,1)=\"-\",REPLACE(CO125,1,1,tech!$H$2),CO125),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D126,tech!$A$13:$B$17,2,0),LEFT(E126,1),IF(G126=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C126,1)=\"-\",C126,\"\")=\"\",\"\",REPLACE(IF(LEFT(C126,1)=\"-\",C126,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI",{"$f":"IF(AND(LEFT(I126,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(I126,\" \"))=4,0)),_xlfn.TEXTAFTER(I126,\" \"),K125)","v":"References"},"1.1.4.RX",{"$f":"IF(AND(I126<>\"\",LEFT(I126,1)<>\"#\"),IF(LEFT(I126,1)=\"-\",REPLACE(I126,1,1,tech!$H$2),I126),\"\")","v":""},"|","- confirm that the information in the DS is Consistent with the information in the CP and CPS","Disclosure statement is documented and published",{"$f":"IF(AND(LEFT(O126,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(O126,\" \"))=4,0)),_xlfn.TEXTAFTER(O126,\" \"),Q125)","v":"Assessment"},"1.2.4.AY",{"$f":"IF(AND(O126<>\"\",LEFT(O126,1)<>\"#\"),IF(LEFT(O126,1)=\"-\",REPLACE(O126,1,1,tech!$H$2),O126),\"\")","v":"• confirm that the information in the DS is Consistent with the information in the CP and CPS"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained",{"$f":"IF(AND(LEFT(U126,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(U126,\" \"))=4,0)),_xlfn.TEXTAFTER(U126,\" \"),W125)","v":"References"},"1.3.4.RX",{"$f":"IF(AND(U126<>\"\",LEFT(U126,1)<>\"#\"),IF(LEFT(U126,1)=\"-\",REPLACE(U126,1,1,tech!$H$2),U126),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated",{"$f":"IF(AND(LEFT(AA126,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AA126,\" \"))=4,0)),_xlfn.TEXTAFTER(AA126,\" \"),AC125)","v":"References"},"1.4.5.RX",{"$f":"IF(AND(AA126<>\"\",LEFT(AA126,1)<>\"#\"),IF(LEFT(AA126,1)=\"-\",REPLACE(AA126,1,1,tech!$H$2),AA126),\"\")","v":""},"|",null,"Cryptographic cipher suites and protocols are documented and maintained",{"$f":"IF(AND(LEFT(AG126,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AG126,\" \"))=4,0)),_xlfn.TEXTAFTER(AG126,\" \"),AI125)","v":"Guidance"},"2.1.5.GY",{"$f":"IF(AND(AG126<>\"\",LEFT(AG126,1)<>\"#\"),IF(LEFT(AG126,1)=\"-\",REPLACE(AG126,1,1,tech!$H$2),AG126),\"\")","v":""},"|","Certificate inventory consists of all known certificates and provides an overview of known certificates in the organization. Certificates in inventory are subject to certificate lifecycle management. The certificate inventory is important for the organization because:","Inventory of issued certificates is documented",{"$f":"IF(AND(LEFT(AM126,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AM126,\" \"))=4,0)),_xlfn.TEXTAFTER(AM126,\" \"),AO125)","v":"Guidance"},"2.2.4.GY",{"$f":"IF(AND(AM126<>\"\",LEFT(AM126,1)<>\"#\"),IF(LEFT(AM126,1)=\"-\",REPLACE(AM126,1,1,tech!$H$2),AM126),\"\")","v":"Certificate inventory consists of all known certificates and provides an overview of known certificates in the organization. Certificates in inventory are subject to certificate lifecycle management. The certificate inventory is important for the organization because:"},"|","#### Guidance","Infrastructure activities are periodically reviewed",{"$f":"IF(AND(LEFT(AS126,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AS126,\" \"))=4,0)),_xlfn.TEXTAFTER(AS126,\" \"),AU125)","v":"Guidance"},"2.3.5.GX",{"$f":"IF(AND(AS126<>\"\",LEFT(AS126,1)<>\"#\"),IF(LEFT(AS126,1)=\"-\",REPLACE(AS126,1,1,tech!$H$2),AS126),\"\")","v":""},"|","- [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)","Requirements for agility are identified",{"$f":"IF(AND(LEFT(AY126,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AY126,\" \"))=4,0)),_xlfn.TEXTAFTER(AY126,\" \"),BA125)","v":"References"},"2.4.4.RY",{"$f":"IF(AND(AY126<>\"\",LEFT(AY126,1)<>\"#\"),IF(LEFT(AY126,1)=\"-\",REPLACE(AY126,1,1,tech!$H$2),AY126),\"\")","v":"• [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)"},"|","- [ISO 223XX Security and resilience standards](https://www.iso.org/standard/77008.html)","Technology future proofing",{"$f":"IF(AND(LEFT(BE126,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BE126,\" \"))=4,0)),_xlfn.TEXTAFTER(BE126,\" \"),BG125)","v":"References"},"3.1.4.RY",{"$f":"IF(AND(BE126<>\"\",LEFT(BE126,1)<>\"#\"),IF(LEFT(BE126,1)=\"-\",REPLACE(BE126,1,1,tech!$H$2),BE126),\"\")","v":"• [ISO 223XX Security and resilience standards](https://www.iso.org/standard/77008.html)"},"|",null,"Adoption and application of open standards",{"$f":"IF(AND(LEFT(BK126,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BK126,\" \"))=4,0)),_xlfn.TEXTAFTER(BK126,\" \"),BM125)","v":"References"},"3.2.3.RX",{"$f":"IF(AND(BK126<>\"\",LEFT(BK126,1)<>\"#\"),IF(LEFT(BK126,1)=\"-\",REPLACE(BK126,1,1,tech!$H$2),BK126),\"\")","v":""},"|",null,"Monitoring of operational and security events is implemented",{"$f":"IF(AND(LEFT(BQ126,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BQ126,\" \"))=4,0)),_xlfn.TEXTAFTER(BQ126,\" \"),BS125)","v":"References"},"3.3.4.RX",{"$f":"IF(AND(BQ126<>\"\",LEFT(BQ126,1)<>\"#\"),IF(LEFT(BQ126,1)=\"-\",REPLACE(BQ126,1,1,tech!$H$2),BQ126),\"\")","v":""},"|",null,"Incidents and exceptions handling",{"$f":"IF(AND(LEFT(BW126,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BW126,\" \"))=4,0)),_xlfn.TEXTAFTER(BW126,\" \"),BY125)","v":"References"},"3.4.3.RX",{"$f":"IF(AND(BW126<>\"\",LEFT(BW126,1)<>\"#\"),IF(LEFT(BW126,1)=\"-\",REPLACE(BW126,1,1,tech!$H$2),BW126),\"\")","v":""},"|",null,"Resources are periodically reviewed",{"$f":"IF(AND(LEFT(CC126,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CC126,\" \"))=4,0)),_xlfn.TEXTAFTER(CC126,\" \"),CE125)","v":"References"},"4.1.4.RX",{"$f":"IF(AND(CC126<>\"\",LEFT(CC126,1)<>\"#\"),IF(LEFT(CC126,1)=\"-\",REPLACE(CC126,1,1,tech!$H$2),CC126),\"\")","v":""},"|","- Competitions and challenges","Establish education plan",{"$f":"IF(AND(LEFT(CI126,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CI126,\" \"))=4,0)),_xlfn.TEXTAFTER(CI126,\" \"),CK125)","v":"Guidance"},"4.2.4.GY",{"$f":"IF(AND(CI126<>\"\",LEFT(CI126,1)<>\"#\"),IF(LEFT(CI126,1)=\"-\",REPLACE(CI126,1,1,tech!$H$2),CI126),\"\")","v":"• Competitions and challenges"},"|",null,"Timely communication of important information",{"$f":"IF(AND(LEFT(CO126,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CO126,\" \"))=4,0)),_xlfn.TEXTAFTER(CO126,\" \"),CQ125)","v":"References"},"4.3.4.RX",{"$f":"IF(AND(CO126<>\"\",LEFT(CO126,1)<>\"#\"),IF(LEFT(CO126,1)=\"-\",REPLACE(CO126,1,1,tech!$H$2),CO126),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D127,tech!$A$13:$B$17,2,0),LEFT(E127,1),IF(G127=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C127,1)=\"-\",C127,\"\")=\"\",\"\",REPLACE(IF(LEFT(C127,1)=\"-\",C127,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I127<>\"\",LEFT(I127,1)<>\"#\"),IF(LEFT(I127,1)=\"-\",REPLACE(I127,1,1,tech!$H$2),I127),\"\")","v":""},"|",null,"Disclosure statement is documented and published","Assessment","1.2.4.AX",{"$f":"IF(AND(O127<>\"\",LEFT(O127,1)<>\"#\"),IF(LEFT(O127,1)=\"-\",REPLACE(O127,1,1,tech!$H$2),O127),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U127<>\"\",LEFT(U127,1)<>\"#\"),IF(LEFT(U127,1)=\"-\",REPLACE(U127,1,1,tech!$H$2),U127),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA127<>\"\",LEFT(AA127,1)<>\"#\"),IF(LEFT(AA127,1)=\"-\",REPLACE(AA127,1,1,tech!$H$2),AA127),\"\")","v":""},"|","Specific rules and boundaries to be applied for cryptographic cipher suites and protocols should be documented in encryption management policy that reflect the current status of cryptography practice.","Cryptographic cipher suites and protocols are documented and maintained","Guidance","2.1.5.GY",{"$f":"IF(AND(AG127<>\"\",LEFT(AG127,1)<>\"#\"),IF(LEFT(AG127,1)=\"-\",REPLACE(AG127,1,1,tech!$H$2),AG127),\"\")","v":"Specific rules and boundaries to be applied for cryptographic cipher suites and protocols should be documented in encryption management policy that reflect the current status of cryptography practice."},"|","- it provides immediate access to the current status of certificates","Inventory of issued certificates is documented","Guidance","2.2.4.GY",{"$f":"IF(AND(AM127<>\"\",LEFT(AM127,1)<>\"#\"),IF(LEFT(AM127,1)=\"-\",REPLACE(AM127,1,1,tech!$H$2),AM127),\"\")","v":"• it provides immediate access to the current status of certificates"},"|",null,"Infrastructure activities are periodically reviewed","Guidance","2.3.5.GX",{"$f":"IF(AND(AS127<>\"\",LEFT(AS127,1)<>\"#\"),IF(LEFT(AS127,1)=\"-\",REPLACE(AS127,1,1,tech!$H$2),AS127),\"\")","v":""},"|","- [The Information Technology Infrastructure Library (ITIL)](https://www.axelos.com/best-practice-solutions/itil)","Requirements for agility are identified","References","2.4.4.RY",{"$f":"IF(AND(AY127<>\"\",LEFT(AY127,1)<>\"#\"),IF(LEFT(AY127,1)=\"-\",REPLACE(AY127,1,1,tech!$H$2),AY127),\"\")","v":"• [The Information Technology Infrastructure Library (ITIL)](https://www.axelos.com/best-practice-solutions/itil)"},"|","- [ISO/IEC 22301 - Business continuity management systems](https://www.iso.org/standard/50056.html)","Technology future proofing","References","3.1.4.RY",{"$f":"IF(AND(BE127<>\"\",LEFT(BE127,1)<>\"#\"),IF(LEFT(BE127,1)=\"-\",REPLACE(BE127,1,1,tech!$H$2),BE127),\"\")","v":"• [ISO/IEC 22301 - Business continuity management systems](https://www.iso.org/standard/50056.html)"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK127<>\"\",LEFT(BK127,1)<>\"#\"),IF(LEFT(BK127,1)=\"-\",REPLACE(BK127,1,1,tech!$H$2),BK127),\"\")","v":""},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Monitoring of operational and security events is implemented","References","3.3.4.RY",{"$f":"IF(AND(BQ127<>\"\",LEFT(BQ127,1)<>\"#\"),IF(LEFT(BQ127,1)=\"-\",REPLACE(BQ127,1,1,tech!$H$2),BQ127),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW127<>\"\",LEFT(BW127,1)<>\"#\"),IF(LEFT(BW127,1)=\"-\",REPLACE(BW127,1,1,tech!$H$2),BW127),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC127<>\"\",LEFT(CC127,1)<>\"#\"),IF(LEFT(CC127,1)=\"-\",REPLACE(CC127,1,1,tech!$H$2),CC127),\"\")","v":""},"|",null,"Establish education plan","Guidance","4.2.4.GX",{"$f":"IF(AND(CI127<>\"\",LEFT(CI127,1)<>\"#\"),IF(LEFT(CI127,1)=\"-\",REPLACE(CI127,1,1,tech!$H$2),CI127),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO127<>\"\",LEFT(CO127,1)<>\"#\"),IF(LEFT(CO127,1)=\"-\",REPLACE(CO127,1,1,tech!$H$2),CO127),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D128,tech!$A$13:$B$17,2,0),LEFT(E128,1),IF(G128=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C128,1)=\"-\",C128,\"\")=\"\",\"\",REPLACE(IF(LEFT(C128,1)=\"-\",C128,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I128<>\"\",LEFT(I128,1)<>\"#\"),IF(LEFT(I128,1)=\"-\",REPLACE(I128,1,1,tech!$H$2),I128),\"\")","v":""},"|","#### References","Disclosure statement is documented and published","References","1.2.4.RX",{"$f":"IF(AND(O128<>\"\",LEFT(O128,1)<>\"#\"),IF(LEFT(O128,1)=\"-\",REPLACE(O128,1,1,tech!$H$2),O128),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U128<>\"\",LEFT(U128,1)<>\"#\"),IF(LEFT(U128,1)=\"-\",REPLACE(U128,1,1,tech!$H$2),U128),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA128<>\"\",LEFT(AA128,1)<>\"#\"),IF(LEFT(AA128,1)=\"-\",REPLACE(AA128,1,1,tech!$H$2),AA128),\"\")","v":""},"|",null,"Cryptographic cipher suites and protocols are documented and maintained","Guidance","2.1.5.GY",{"$f":"IF(AND(AG128<>\"\",LEFT(AG128,1)<>\"#\"),IF(LEFT(AG128,1)=\"-\",REPLACE(AG128,1,1,tech!$H$2),AG128),\"\")","v":""},"|","- provides possibility to react on certificate-related events (compromise, change, expiration, etc.)","Inventory of issued certificates is documented","Guidance","2.2.4.GY",{"$f":"IF(AND(AM128<>\"\",LEFT(AM128,1)<>\"#\"),IF(LEFT(AM128,1)=\"-\",REPLACE(AM128,1,1,tech!$H$2),AM128),\"\")","v":"• provides possibility to react on certificate-related events (compromise, change, expiration, etc.)"},"|","Infrastructure management related activities should be periodically reviewed, updated and approved. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends.","Infrastructure activities are periodically reviewed","Guidance","2.3.5.GY",{"$f":"IF(AND(AS128<>\"\",LEFT(AS128,1)<>\"#\"),IF(LEFT(AS128,1)=\"-\",REPLACE(AS128,1,1,tech!$H$2),AS128),\"\")","v":"Infrastructure management related activities should be periodically reviewed, updated and approved. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends."},"|",null,"Requirements for agility are identified","References","2.4.4.RX",{"$f":"IF(AND(AY128<>\"\",LEFT(AY128,1)<>\"#\"),IF(LEFT(AY128,1)=\"-\",REPLACE(AY128,1,1,tech!$H$2),AY128),\"\")","v":""},"|",null,"Technology future proofing","References","3.1.4.RX",{"$f":"IF(AND(BE128<>\"\",LEFT(BE128,1)<>\"#\"),IF(LEFT(BE128,1)=\"-\",REPLACE(BE128,1,1,tech!$H$2),BE128),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK128<>\"\",LEFT(BK128,1)<>\"#\"),IF(LEFT(BK128,1)=\"-\",REPLACE(BK128,1,1,tech!$H$2),BK128),\"\")","v":""},"|","- [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)","Monitoring of operational and security events is implemented","References","3.3.4.RY",{"$f":"IF(AND(BQ128<>\"\",LEFT(BQ128,1)<>\"#\"),IF(LEFT(BQ128,1)=\"-\",REPLACE(BQ128,1,1,tech!$H$2),BQ128),\"\")","v":"• [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW128<>\"\",LEFT(BW128,1)<>\"#\"),IF(LEFT(BW128,1)=\"-\",REPLACE(BW128,1,1,tech!$H$2),BW128),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC128<>\"\",LEFT(CC128,1)<>\"#\"),IF(LEFT(CC128,1)=\"-\",REPLACE(CC128,1,1,tech!$H$2),CC128),\"\")","v":""},"|","#### Assessment","Establish education plan","Assessment","4.2.4.AX",{"$f":"IF(AND(CI128<>\"\",LEFT(CI128,1)<>\"#\"),IF(LEFT(CI128,1)=\"-\",REPLACE(CI128,1,1,tech!$H$2),CI128),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO128<>\"\",LEFT(CO128,1)<>\"#\"),IF(LEFT(CO128,1)=\"-\",REPLACE(CO128,1,1,tech!$H$2),CO128),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D129,tech!$A$13:$B$17,2,0),LEFT(E129,1),IF(G129=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C129,1)=\"-\",C129,\"\")=\"\",\"\",REPLACE(IF(LEFT(C129,1)=\"-\",C129,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I129<>\"\",LEFT(I129,1)<>\"#\"),IF(LEFT(I129,1)=\"-\",REPLACE(I129,1,1,tech!$H$2),I129),\"\")","v":""},"|",null,"Disclosure statement is documented and published","References","1.2.4.RX",{"$f":"IF(AND(O129<>\"\",LEFT(O129,1)<>\"#\"),IF(LEFT(O129,1)=\"-\",REPLACE(O129,1,1,tech!$H$2),O129),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U129<>\"\",LEFT(U129,1)<>\"#\"),IF(LEFT(U129,1)=\"-\",REPLACE(U129,1,1,tech!$H$2),U129),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA129<>\"\",LEFT(AA129,1)<>\"#\"),IF(LEFT(AA129,1)=\"-\",REPLACE(AA129,1,1,tech!$H$2),AA129),\"\")","v":""},"|","Cipher suites and protocols should be regularly checked against the implemented technology and configuration. Any deviation from the documented and allowed protocols should be fixed.","Cryptographic cipher suites and protocols are documented and maintained","Guidance","2.1.5.GY",{"$f":"IF(AND(AG129<>\"\",LEFT(AG129,1)<>\"#\"),IF(LEFT(AG129,1)=\"-\",REPLACE(AG129,1,1,tech!$H$2),AG129),\"\")","v":"Cipher suites and protocols should be regularly checked against the implemented technology and configuration. Any deviation from the documented and allowed protocols should be fixed."},"|","- Understand impact of lifecycle changes","Inventory of issued certificates is documented","Guidance","2.2.4.GY",{"$f":"IF(AND(AM129<>\"\",LEFT(AM129,1)<>\"#\"),IF(LEFT(AM129,1)=\"-\",REPLACE(AM129,1,1,tech!$H$2),AM129),\"\")","v":"• Understand impact of lifecycle changes"},"|",null,"Infrastructure activities are periodically reviewed","Guidance","2.3.5.GY",{"$f":"IF(AND(AS129<>\"\",LEFT(AS129,1)<>\"#\"),IF(LEFT(AS129,1)=\"-\",REPLACE(AS129,1,1,tech!$H$2),AS129),\"\")","v":""},"|","### Change management and agility is periodically reviewed","Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY129<>\"\",LEFT(AY129,1)<>\"#\"),IF(LEFT(AY129,1)=\"-\",REPLACE(AY129,1,1,tech!$H$2),AY129),\"\")","v":""},"|","### Competence and information sharing","Competence and information sharing","References","3.1.5.RX",{"$f":"IF(AND(BE129<>\"\",LEFT(BE129,1)<>\"#\"),IF(LEFT(BE129,1)=\"-\",REPLACE(BE129,1,1,tech!$H$2),BE129),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK129<>\"\",LEFT(BK129,1)<>\"#\"),IF(LEFT(BK129,1)=\"-\",REPLACE(BK129,1,1,tech!$H$2),BK129),\"\")","v":""},"|","- [ISO/IEC 27099 - Public key infrastructure](https://www.iso.org/standard/56590.html)","Monitoring of operational and security events is implemented","References","3.3.4.RY",{"$f":"IF(AND(BQ129<>\"\",LEFT(BQ129,1)<>\"#\"),IF(LEFT(BQ129,1)=\"-\",REPLACE(BQ129,1,1,tech!$H$2),BQ129),\"\")","v":"• [ISO/IEC 27099 - Public key infrastructure](https://www.iso.org/standard/56590.html)"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW129<>\"\",LEFT(BW129,1)<>\"#\"),IF(LEFT(BW129,1)=\"-\",REPLACE(BW129,1,1,tech!$H$2),BW129),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC129<>\"\",LEFT(CC129,1)<>\"#\"),IF(LEFT(CC129,1)=\"-\",REPLACE(CC129,1,1,tech!$H$2),CC129),\"\")","v":""},"|",null,"Establish education plan","Assessment","4.2.4.AX",{"$f":"IF(AND(CI129<>\"\",LEFT(CI129,1)<>\"#\"),IF(LEFT(CI129,1)=\"-\",REPLACE(CI129,1,1,tech!$H$2),CI129),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO129<>\"\",LEFT(CO129,1)<>\"#\"),IF(LEFT(CO129,1)=\"-\",REPLACE(CO129,1,1,tech!$H$2),CO129),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D130,tech!$A$13:$B$17,2,0),LEFT(E130,1),IF(G130=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C130,1)=\"-\",C130,\"\")=\"\",\"\",REPLACE(IF(LEFT(C130,1)=\"-\",C130,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I130<>\"\",LEFT(I130,1)<>\"#\"),IF(LEFT(I130,1)=\"-\",REPLACE(I130,1,1,tech!$H$2),I130),\"\")","v":""},"|","- [ETSI EN 319 411-1 - Policy and security requirements for Trust Service Providers issuing certificates](https://www.etsi.org/deliver/etsi_en/319400_319499/31941101/01.03.01_60/en_31941101v010301p.pdf)","Disclosure statement is documented and published","References","1.2.4.RY",{"$f":"IF(AND(O130<>\"\",LEFT(O130,1)<>\"#\"),IF(LEFT(O130,1)=\"-\",REPLACE(O130,1,1,tech!$H$2),O130),\"\")","v":"• [ETSI EN 319 411-1 - Policy and security requirements for Trust Service Providers issuing certificates](https://www.etsi.org/deliver/etsi_en/319400_319499/31941101/01.03.01_60/en_31941101v010301p.pdf)"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U130<>\"\",LEFT(U130,1)<>\"#\"),IF(LEFT(U130,1)=\"-\",REPLACE(U130,1,1,tech!$H$2),U130),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA130<>\"\",LEFT(AA130,1)<>\"#\"),IF(LEFT(AA130,1)=\"-\",REPLACE(AA130,1,1,tech!$H$2),AA130),\"\")","v":""},"|",null,"Cryptographic cipher suites and protocols are documented and maintained","Guidance","2.1.5.GX",{"$f":"IF(AND(AG130<>\"\",LEFT(AG130,1)<>\"#\"),IF(LEFT(AG130,1)=\"-\",REPLACE(AG130,1,1,tech!$H$2),AG130),\"\")","v":""},"|","- it gives information on all Locations of certificates","Inventory of issued certificates is documented","Guidance","2.2.4.GY",{"$f":"IF(AND(AM130<>\"\",LEFT(AM130,1)<>\"#\"),IF(LEFT(AM130,1)=\"-\",REPLACE(AM130,1,1,tech!$H$2),AM130),\"\")","v":"• it gives information on all Locations of certificates"},"|","Periodical review helps to keep the infrastructure management accurate and helps to maintain required skills and knowledge.","Infrastructure activities are periodically reviewed","Guidance","2.3.5.GY",{"$f":"IF(AND(AS130<>\"\",LEFT(AS130,1)<>\"#\"),IF(LEFT(AS130,1)=\"-\",REPLACE(AS130,1,1,tech!$H$2),AS130),\"\")","v":"Periodical review helps to keep the infrastructure management accurate and helps to maintain required skills and knowledge."},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY130<>\"\",LEFT(AY130,1)<>\"#\"),IF(LEFT(AY130,1)=\"-\",REPLACE(AY130,1,1,tech!$H$2),AY130),\"\")","v":""},"|",null,"Competence and information sharing","References","3.1.5.RX",{"$f":"IF(AND(BE130<>\"\",LEFT(BE130,1)<>\"#\"),IF(LEFT(BE130,1)=\"-\",REPLACE(BE130,1,1,tech!$H$2),BE130),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK130<>\"\",LEFT(BK130,1)<>\"#\"),IF(LEFT(BK130,1)=\"-\",REPLACE(BK130,1,1,tech!$H$2),BK130),\"\")","v":""},"|",null,"Monitoring of operational and security events is implemented","References","3.3.4.RX",{"$f":"IF(AND(BQ130<>\"\",LEFT(BQ130,1)<>\"#\"),IF(LEFT(BQ130,1)=\"-\",REPLACE(BQ130,1,1,tech!$H$2),BQ130),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW130<>\"\",LEFT(BW130,1)<>\"#\"),IF(LEFT(BW130,1)=\"-\",REPLACE(BW130,1,1,tech!$H$2),BW130),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC130<>\"\",LEFT(CC130,1)<>\"#\"),IF(LEFT(CC130,1)=\"-\",REPLACE(CC130,1,1,tech!$H$2),CC130),\"\")","v":""},"|","- Review education plan and its Alignment with the Training plan","Establish education plan","Assessment","4.2.4.AY",{"$f":"IF(AND(CI130<>\"\",LEFT(CI130,1)<>\"#\"),IF(LEFT(CI130,1)=\"-\",REPLACE(CI130,1,1,tech!$H$2),CI130),\"\")","v":"• Review education plan and its Alignment with the Training plan"},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO130<>\"\",LEFT(CO130,1)<>\"#\"),IF(LEFT(CO130,1)=\"-\",REPLACE(CO130,1,1,tech!$H$2),CO130),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D131,tech!$A$13:$B$17,2,0),LEFT(E131,1),IF(G131=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C131,1)=\"-\",C131,\"\")=\"\",\"\",REPLACE(IF(LEFT(C131,1)=\"-\",C131,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I131<>\"\",LEFT(I131,1)<>\"#\"),IF(LEFT(I131,1)=\"-\",REPLACE(I131,1,1,tech!$H$2),I131),\"\")","v":""},"|",null,"Disclosure statement is documented and published","References","1.2.4.RX",{"$f":"IF(AND(O131<>\"\",LEFT(O131,1)<>\"#\"),IF(LEFT(O131,1)=\"-\",REPLACE(O131,1,1,tech!$H$2),O131),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U131<>\"\",LEFT(U131,1)<>\"#\"),IF(LEFT(U131,1)=\"-\",REPLACE(U131,1,1,tech!$H$2),U131),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA131<>\"\",LEFT(AA131,1)<>\"#\"),IF(LEFT(AA131,1)=\"-\",REPLACE(AA131,1,1,tech!$H$2),AA131),\"\")","v":""},"|","#### Assessment","Cryptographic cipher suites and protocols are documented and maintained","Assessment","2.1.5.AX",{"$f":"IF(AND(AG131<>\"\",LEFT(AG131,1)<>\"#\"),IF(LEFT(AG131,1)=\"-\",REPLACE(AG131,1,1,tech!$H$2),AG131),\"\")","v":""},"|","- can enforce and maintain ownership of certificates","Inventory of issued certificates is documented","Guidance","2.2.4.GY",{"$f":"IF(AND(AM131<>\"\",LEFT(AM131,1)<>\"#\"),IF(LEFT(AM131,1)=\"-\",REPLACE(AM131,1,1,tech!$H$2),AM131),\"\")","v":"• can enforce and maintain ownership of certificates"},"|","It provides assurance that the expected controls are active and working as intended.","Infrastructure activities are periodically reviewed","Guidance","2.3.5.GY",{"$f":"IF(AND(AS131<>\"\",LEFT(AS131,1)<>\"#\"),IF(LEFT(AS131,1)=\"-\",REPLACE(AS131,1,1,tech!$H$2),AS131),\"\")","v":"It provides assurance that the expected controls are active and working as intended."},"|","#### Guidance","Change management and agility is periodically reviewed","Guidance","2.4.5.GX",{"$f":"IF(AND(AY131<>\"\",LEFT(AY131,1)<>\"#\"),IF(LEFT(AY131,1)=\"-\",REPLACE(AY131,1,1,tech!$H$2),AY131),\"\")","v":""},"|","#### Guidance","Competence and information sharing","Guidance","3.1.5.GX",{"$f":"IF(AND(BE131<>\"\",LEFT(BE131,1)<>\"#\"),IF(LEFT(BE131,1)=\"-\",REPLACE(BE131,1,1,tech!$H$2),BE131),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK131<>\"\",LEFT(BK131,1)<>\"#\"),IF(LEFT(BK131,1)=\"-\",REPLACE(BK131,1,1,tech!$H$2),BK131),\"\")","v":""},"|","### Critical events are immediately alerted and resolved according to incident response plans","Critical events are immediately alerted and resolved according to incident response plans","References","3.3.5.RX",{"$f":"IF(AND(BQ131<>\"\",LEFT(BQ131,1)<>\"#\"),IF(LEFT(BQ131,1)=\"-\",REPLACE(BQ131,1,1,tech!$H$2),BQ131),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW131<>\"\",LEFT(BW131,1)<>\"#\"),IF(LEFT(BW131,1)=\"-\",REPLACE(BW131,1,1,tech!$H$2),BW131),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC131<>\"\",LEFT(CC131,1)<>\"#\"),IF(LEFT(CC131,1)=\"-\",REPLACE(CC131,1,1,tech!$H$2),CC131),\"\")","v":""},"|","- Interview personnel to verify their educational goals","Establish education plan","Assessment","4.2.4.AY",{"$f":"IF(AND(CI131<>\"\",LEFT(CI131,1)<>\"#\"),IF(LEFT(CI131,1)=\"-\",REPLACE(CI131,1,1,tech!$H$2),CI131),\"\")","v":"• Interview personnel to verify their educational goals"},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO131<>\"\",LEFT(CO131,1)<>\"#\"),IF(LEFT(CO131,1)=\"-\",REPLACE(CO131,1,1,tech!$H$2),CO131),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D132,tech!$A$13:$B$17,2,0),LEFT(E132,1),IF(G132=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C132,1)=\"-\",C132,\"\")=\"\",\"\",REPLACE(IF(LEFT(C132,1)=\"-\",C132,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I132<>\"\",LEFT(I132,1)<>\"#\"),IF(LEFT(I132,1)=\"-\",REPLACE(I132,1,1,tech!$H$2),I132),\"\")","v":""},"|","### Policies are periodically reviewed and updated","Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O132<>\"\",LEFT(O132,1)<>\"#\"),IF(LEFT(O132,1)=\"-\",REPLACE(O132,1,1,tech!$H$2),O132),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U132<>\"\",LEFT(U132,1)<>\"#\"),IF(LEFT(U132,1)=\"-\",REPLACE(U132,1,1,tech!$H$2),U132),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA132<>\"\",LEFT(AA132,1)<>\"#\"),IF(LEFT(AA132,1)=\"-\",REPLACE(AA132,1,1,tech!$H$2),AA132),\"\")","v":""},"|",null,"Cryptographic cipher suites and protocols are documented and maintained","Assessment","2.1.5.AX",{"$f":"IF(AND(AG132<>\"\",LEFT(AG132,1)<>\"#\"),IF(LEFT(AG132,1)=\"-\",REPLACE(AG132,1,1,tech!$H$2),AG132),\"\")","v":""},"|",null,"Inventory of issued certificates is documented","Guidance","2.2.4.GY",{"$f":"IF(AND(AM132<>\"\",LEFT(AM132,1)<>\"#\"),IF(LEFT(AM132,1)=\"-\",REPLACE(AM132,1,1,tech!$H$2),AM132),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","Guidance","2.3.5.GY",{"$f":"IF(AND(AS132<>\"\",LEFT(AS132,1)<>\"#\"),IF(LEFT(AS132,1)=\"-\",REPLACE(AS132,1,1,tech!$H$2),AS132),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","Guidance","2.4.5.GX",{"$f":"IF(AND(AY132<>\"\",LEFT(AY132,1)<>\"#\"),IF(LEFT(AY132,1)=\"-\",REPLACE(AY132,1,1,tech!$H$2),AY132),\"\")","v":""},"|",null,"Competence and information sharing","Guidance","3.1.5.GX",{"$f":"IF(AND(BE132<>\"\",LEFT(BE132,1)<>\"#\"),IF(LEFT(BE132,1)=\"-\",REPLACE(BE132,1,1,tech!$H$2),BE132),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK132<>\"\",LEFT(BK132,1)<>\"#\"),IF(LEFT(BK132,1)=\"-\",REPLACE(BK132,1,1,tech!$H$2),BK132),\"\")","v":""},"|",null,"Critical events are immediately alerted and resolved according to incident response plans","References","3.3.5.RX",{"$f":"IF(AND(BQ132<>\"\",LEFT(BQ132,1)<>\"#\"),IF(LEFT(BQ132,1)=\"-\",REPLACE(BQ132,1,1,tech!$H$2),BQ132),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW132<>\"\",LEFT(BW132,1)<>\"#\"),IF(LEFT(BW132,1)=\"-\",REPLACE(BW132,1,1,tech!$H$2),BW132),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC132<>\"\",LEFT(CC132,1)<>\"#\"),IF(LEFT(CC132,1)=\"-\",REPLACE(CC132,1,1,tech!$H$2),CC132),\"\")","v":""},"|","- Validate education records","Establish education plan","Assessment","4.2.4.AY",{"$f":"IF(AND(CI132<>\"\",LEFT(CI132,1)<>\"#\"),IF(LEFT(CI132,1)=\"-\",REPLACE(CI132,1,1,tech!$H$2),CI132),\"\")","v":"• Validate education records"},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO132<>\"\",LEFT(CO132,1)<>\"#\"),IF(LEFT(CO132,1)=\"-\",REPLACE(CO132,1,1,tech!$H$2),CO132),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D133,tech!$A$13:$B$17,2,0),LEFT(E133,1),IF(G133=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C133,1)=\"-\",C133,\"\")=\"\",\"\",REPLACE(IF(LEFT(C133,1)=\"-\",C133,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I133<>\"\",LEFT(I133,1)<>\"#\"),IF(LEFT(I133,1)=\"-\",REPLACE(I133,1,1,tech!$H$2),I133),\"\")","v":""},"|",null,"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O133<>\"\",LEFT(O133,1)<>\"#\"),IF(LEFT(O133,1)=\"-\",REPLACE(O133,1,1,tech!$H$2),O133),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U133<>\"\",LEFT(U133,1)<>\"#\"),IF(LEFT(U133,1)=\"-\",REPLACE(U133,1,1,tech!$H$2),U133),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA133<>\"\",LEFT(AA133,1)<>\"#\"),IF(LEFT(AA133,1)=\"-\",REPLACE(AA133,1,1,tech!$H$2),AA133),\"\")","v":""},"|","- Documented encryption management policy","Cryptographic cipher suites and protocols are documented and maintained","Assessment","2.1.5.AY",{"$f":"IF(AND(AG133<>\"\",LEFT(AG133,1)<>\"#\"),IF(LEFT(AG133,1)=\"-\",REPLACE(AG133,1,1,tech!$H$2),AG133),\"\")","v":"• Documented encryption management policy"},"|","The certificate inventory therefore consists of information related to certificate like certificate attributes, validity and validation information, fingerprint and serial number, trust chain, owner, public key, signature algorithm, certificate type, compliance information, certificate locations, change history, or any other attributes and properties of the certificates that is required.","Inventory of issued certificates is documented","Guidance","2.2.4.GY",{"$f":"IF(AND(AM133<>\"\",LEFT(AM133,1)<>\"#\"),IF(LEFT(AM133,1)=\"-\",REPLACE(AM133,1,1,tech!$H$2),AM133),\"\")","v":"The certificate inventory therefore consists of information related to certificate like certificate attributes, validity and validation information, fingerprint and serial number, trust chain, owner, public key, signature algorithm, certificate type, compliance information, certificate locations, change history, or any other attributes and properties of the certificates that is required."},"|","The review can include the following:","Infrastructure activities are periodically reviewed","Guidance","2.3.5.GY",{"$f":"IF(AND(AS133<>\"\",LEFT(AS133,1)<>\"#\"),IF(LEFT(AS133,1)=\"-\",REPLACE(AS133,1,1,tech!$H$2),AS133),\"\")","v":"The review can include the following:"},"|","The change management and agility requirements should be periodically reviewed to ensure that they are still valid and relevant. The review should be performed by the responsible personnel and should be documented. A good practice is to review the change management and agility requirements at least once a year, however, the frequency of the review can be different depending on the PKI implementation.","Change management and agility is periodically reviewed","Guidance","2.4.5.GY",{"$f":"IF(AND(AY133<>\"\",LEFT(AY133,1)<>\"#\"),IF(LEFT(AY133,1)=\"-\",REPLACE(AY133,1,1,tech!$H$2),AY133),\"\")","v":"The change management and agility requirements should be periodically reviewed to ensure that they are still valid and relevant. The review should be performed by the responsible personnel and should be documented. A good practice is to review the change management and agility requirements at least once a year, however, the frequency of the review can be different depending on the PKI implementation."},"|","Organization environments may change over time. The impact of changes can be in various forms, for example:","Competence and information sharing","Guidance","3.1.5.GY",{"$f":"IF(AND(BE133<>\"\",LEFT(BE133,1)<>\"#\"),IF(LEFT(BE133,1)=\"-\",REPLACE(BE133,1,1,tech!$H$2),BE133),\"\")","v":"Organization environments may change over time. The impact of changes can be in various forms, for example:"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK133<>\"\",LEFT(BK133,1)<>\"#\"),IF(LEFT(BK133,1)=\"-\",REPLACE(BK133,1,1,tech!$H$2),BK133),\"\")","v":""},"|","#### Guidance","Critical events are immediately alerted and resolved according to incident response plans","Guidance","3.3.5.GX",{"$f":"IF(AND(BQ133<>\"\",LEFT(BQ133,1)<>\"#\"),IF(LEFT(BQ133,1)=\"-\",REPLACE(BQ133,1,1,tech!$H$2),BQ133),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW133<>\"\",LEFT(BW133,1)<>\"#\"),IF(LEFT(BW133,1)=\"-\",REPLACE(BW133,1,1,tech!$H$2),BW133),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC133<>\"\",LEFT(CC133,1)<>\"#\"),IF(LEFT(CC133,1)=\"-\",REPLACE(CC133,1,1,tech!$H$2),CC133),\"\")","v":""},"|",null,"Establish education plan","Assessment","4.2.4.AX",{"$f":"IF(AND(CI133<>\"\",LEFT(CI133,1)<>\"#\"),IF(LEFT(CI133,1)=\"-\",REPLACE(CI133,1,1,tech!$H$2),CI133),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO133<>\"\",LEFT(CO133,1)<>\"#\"),IF(LEFT(CO133,1)=\"-\",REPLACE(CO133,1,1,tech!$H$2),CO133),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D134,tech!$A$13:$B$17,2,0),LEFT(E134,1),IF(G134=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C134,1)=\"-\",C134,\"\")=\"\",\"\",REPLACE(IF(LEFT(C134,1)=\"-\",C134,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I134<>\"\",LEFT(I134,1)<>\"#\"),IF(LEFT(I134,1)=\"-\",REPLACE(I134,1,1,tech!$H$2),I134),\"\")","v":""},"|","#### Guidance","Policies are periodically reviewed and updated","Guidance","1.2.5.GX",{"$f":"IF(AND(O134<>\"\",LEFT(O134,1)<>\"#\"),IF(LEFT(O134,1)=\"-\",REPLACE(O134,1,1,tech!$H$2),O134),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U134<>\"\",LEFT(U134,1)<>\"#\"),IF(LEFT(U134,1)=\"-\",REPLACE(U134,1,1,tech!$H$2),U134),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA134<>\"\",LEFT(AA134,1)<>\"#\"),IF(LEFT(AA134,1)=\"-\",REPLACE(AA134,1,1,tech!$H$2),AA134),\"\")","v":""},"|","- Validation of implementation and used protocols against what is Documented","Cryptographic cipher suites and protocols are documented and maintained","Assessment","2.1.5.AY",{"$f":"IF(AND(AG134<>\"\",LEFT(AG134,1)<>\"#\"),IF(LEFT(AG134,1)=\"-\",REPLACE(AG134,1,1,tech!$H$2),AG134),\"\")","v":"• Validation of implementation and used protocols against what is Documented"},"|",null,"Inventory of issued certificates is documented","Guidance","2.2.4.GX",{"$f":"IF(AND(AM134<>\"\",LEFT(AM134,1)<>\"#\"),IF(LEFT(AM134,1)=\"-\",REPLACE(AM134,1,1,tech!$H$2),AM134),\"\")","v":""},"|","- changes made to the infrastructure","Infrastructure activities are periodically reviewed","Guidance","2.3.5.GY",{"$f":"IF(AND(AS134<>\"\",LEFT(AS134,1)<>\"#\"),IF(LEFT(AS134,1)=\"-\",REPLACE(AS134,1,1,tech!$H$2),AS134),\"\")","v":"• changes made to the infrastructure"},"|",null,"Change management and agility is periodically reviewed","Guidance","2.4.5.GX",{"$f":"IF(AND(AY134<>\"\",LEFT(AY134,1)<>\"#\"),IF(LEFT(AY134,1)=\"-\",REPLACE(AY134,1,1,tech!$H$2),AY134),\"\")","v":""},"|","- personnel can rotate in their positions, new people can be hired, or people can leave the organization","Competence and information sharing","Guidance","3.1.5.GY",{"$f":"IF(AND(BE134<>\"\",LEFT(BE134,1)<>\"#\"),IF(LEFT(BE134,1)=\"-\",REPLACE(BE134,1,1,tech!$H$2),BE134),\"\")","v":"• personnel can rotate in their positions, new people can be hired, or people can leave the organization"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK134<>\"\",LEFT(BK134,1)<>\"#\"),IF(LEFT(BK134,1)=\"-\",REPLACE(BK134,1,1,tech!$H$2),BK134),\"\")","v":""},"|",null,"Critical events are immediately alerted and resolved according to incident response plans","Guidance","3.3.5.GX",{"$f":"IF(AND(BQ134<>\"\",LEFT(BQ134,1)<>\"#\"),IF(LEFT(BQ134,1)=\"-\",REPLACE(BQ134,1,1,tech!$H$2),BQ134),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW134<>\"\",LEFT(BW134,1)<>\"#\"),IF(LEFT(BW134,1)=\"-\",REPLACE(BW134,1,1,tech!$H$2),BW134),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC134<>\"\",LEFT(CC134,1)<>\"#\"),IF(LEFT(CC134,1)=\"-\",REPLACE(CC134,1,1,tech!$H$2),CC134),\"\")","v":""},"|","#### References","Establish education plan","References","4.2.4.RX",{"$f":"IF(AND(CI134<>\"\",LEFT(CI134,1)<>\"#\"),IF(LEFT(CI134,1)=\"-\",REPLACE(CI134,1,1,tech!$H$2),CI134),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO134<>\"\",LEFT(CO134,1)<>\"#\"),IF(LEFT(CO134,1)=\"-\",REPLACE(CO134,1,1,tech!$H$2),CO134),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D135,tech!$A$13:$B$17,2,0),LEFT(E135,1),IF(G135=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C135,1)=\"-\",C135,\"\")=\"\",\"\",REPLACE(IF(LEFT(C135,1)=\"-\",C135,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I135<>\"\",LEFT(I135,1)<>\"#\"),IF(LEFT(I135,1)=\"-\",REPLACE(I135,1,1,tech!$H$2),I135),\"\")","v":""},"|",null,"Policies are periodically reviewed and updated","Guidance","1.2.5.GX",{"$f":"IF(AND(O135<>\"\",LEFT(O135,1)<>\"#\"),IF(LEFT(O135,1)=\"-\",REPLACE(O135,1,1,tech!$H$2),O135),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U135<>\"\",LEFT(U135,1)<>\"#\"),IF(LEFT(U135,1)=\"-\",REPLACE(U135,1,1,tech!$H$2),U135),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA135<>\"\",LEFT(AA135,1)<>\"#\"),IF(LEFT(AA135,1)=\"-\",REPLACE(AA135,1,1,tech!$H$2),AA135),\"\")","v":""},"|","- Accuracy of the description","Cryptographic cipher suites and protocols are documented and maintained","Assessment","2.1.5.AY",{"$f":"IF(AND(AG135<>\"\",LEFT(AG135,1)<>\"#\"),IF(LEFT(AG135,1)=\"-\",REPLACE(AG135,1,1,tech!$H$2),AG135),\"\")","v":"• Accuracy of the description"},"|","#### Assessment","Inventory of issued certificates is documented","Assessment","2.2.4.AX",{"$f":"IF(AND(AM135<>\"\",LEFT(AM135,1)<>\"#\"),IF(LEFT(AM135,1)=\"-\",REPLACE(AM135,1,1,tech!$H$2),AM135),\"\")","v":""},"|","- Regular checks of firewall rules","Infrastructure activities are periodically reviewed","Guidance","2.3.5.GY",{"$f":"IF(AND(AS135<>\"\",LEFT(AS135,1)<>\"#\"),IF(LEFT(AS135,1)=\"-\",REPLACE(AS135,1,1,tech!$H$2),AS135),\"\")","v":"• Regular checks of firewall rules"},"|","#### Assessment","Change management and agility is periodically reviewed","Assessment","2.4.5.AX",{"$f":"IF(AND(AY135<>\"\",LEFT(AY135,1)<>\"#\"),IF(LEFT(AY135,1)=\"-\",REPLACE(AY135,1,1,tech!$H$2),AY135),\"\")","v":""},"|","- technologies are changing, therefore required skills and knowledge may change","Competence and information sharing","Guidance","3.1.5.GY",{"$f":"IF(AND(BE135<>\"\",LEFT(BE135,1)<>\"#\"),IF(LEFT(BE135,1)=\"-\",REPLACE(BE135,1,1,tech!$H$2),BE135),\"\")","v":"• technologies are changing, therefore required skills and knowledge may change"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK135<>\"\",LEFT(BK135,1)<>\"#\"),IF(LEFT(BK135,1)=\"-\",REPLACE(BK135,1,1,tech!$H$2),BK135),\"\")","v":""},"|","Critical events should be immediately alerted and resolved according to incident response plans. Monitoring implementation should ensure that critical events are detected and alerted in a timely manner. This can be done manually or in an automated way. ","Critical events are immediately alerted and resolved according to incident response plans","Guidance","3.3.5.GY",{"$f":"IF(AND(BQ135<>\"\",LEFT(BQ135,1)<>\"#\"),IF(LEFT(BQ135,1)=\"-\",REPLACE(BQ135,1,1,tech!$H$2),BQ135),\"\")","v":"Critical events should be immediately alerted and resolved according to incident response plans. Monitoring implementation should ensure that critical events are detected and alerted in a timely manner. This can be done manually or in an automated way. "},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW135<>\"\",LEFT(BW135,1)<>\"#\"),IF(LEFT(BW135,1)=\"-\",REPLACE(BW135,1,1,tech!$H$2),BW135),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC135<>\"\",LEFT(CC135,1)<>\"#\"),IF(LEFT(CC135,1)=\"-\",REPLACE(CC135,1,1,tech!$H$2),CC135),\"\")","v":""},"|",null,"Establish education plan","References","4.2.4.RX",{"$f":"IF(AND(CI135<>\"\",LEFT(CI135,1)<>\"#\"),IF(LEFT(CI135,1)=\"-\",REPLACE(CI135,1,1,tech!$H$2),CI135),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO135<>\"\",LEFT(CO135,1)<>\"#\"),IF(LEFT(CO135,1)=\"-\",REPLACE(CO135,1,1,tech!$H$2),CO135),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D136,tech!$A$13:$B$17,2,0),LEFT(E136,1),IF(G136=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C136,1)=\"-\",C136,\"\")=\"\",\"\",REPLACE(IF(LEFT(C136,1)=\"-\",C136,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I136<>\"\",LEFT(I136,1)<>\"#\"),IF(LEFT(I136,1)=\"-\",REPLACE(I136,1,1,tech!$H$2),I136),\"\")","v":""},"|","Policies are living documents that are continuously updated and changed as technologies, security, and compliance requirements change. The policies should be reviewed and updated periodically. The frequency of review should be determined by the organization. Good practice is to review policies at least annually or when there are significant changes in the PKI or its environment.","Policies are periodically reviewed and updated","Guidance","1.2.5.GY",{"$f":"IF(AND(O136<>\"\",LEFT(O136,1)<>\"#\"),IF(LEFT(O136,1)=\"-\",REPLACE(O136,1,1,tech!$H$2),O136),\"\")","v":"Policies are living documents that are continuously updated and changed as technologies, security, and compliance requirements change. The policies should be reviewed and updated periodically. The frequency of review should be determined by the organization. Good practice is to review policies at least annually or when there are significant changes in the PKI or its environment."},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U136<>\"\",LEFT(U136,1)<>\"#\"),IF(LEFT(U136,1)=\"-\",REPLACE(U136,1,1,tech!$H$2),U136),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA136<>\"\",LEFT(AA136,1)<>\"#\"),IF(LEFT(AA136,1)=\"-\",REPLACE(AA136,1,1,tech!$H$2),AA136),\"\")","v":""},"|","- Security and vulnerabilities of applicable cipher suites and protocols","Cryptographic cipher suites and protocols are documented and maintained","Assessment","2.1.5.AY",{"$f":"IF(AND(AG136<>\"\",LEFT(AG136,1)<>\"#\"),IF(LEFT(AG136,1)=\"-\",REPLACE(AG136,1,1,tech!$H$2),AG136),\"\")","v":"• Security and vulnerabilities of applicable cipher suites and protocols"},"|",null,"Inventory of issued certificates is documented","Assessment","2.2.4.AX",{"$f":"IF(AND(AM136<>\"\",LEFT(AM136,1)<>\"#\"),IF(LEFT(AM136,1)=\"-\",REPLACE(AM136,1,1,tech!$H$2),AM136),\"\")","v":""},"|","- Review of the network topology","Infrastructure activities are periodically reviewed","Guidance","2.3.5.GY",{"$f":"IF(AND(AS136<>\"\",LEFT(AS136,1)<>\"#\"),IF(LEFT(AS136,1)=\"-\",REPLACE(AS136,1,1,tech!$H$2),AS136),\"\")","v":"• Review of the network topology"},"|",null,"Change management and agility is periodically reviewed","Assessment","2.4.5.AX",{"$f":"IF(AND(AY136<>\"\",LEFT(AY136,1)<>\"#\"),IF(LEFT(AY136,1)=\"-\",REPLACE(AY136,1,1,tech!$H$2),AY136),\"\")","v":""},"|","- procedures and eventually management of the PKI will be adjusted","Competence and information sharing","Guidance","3.1.5.GY",{"$f":"IF(AND(BE136<>\"\",LEFT(BE136,1)<>\"#\"),IF(LEFT(BE136,1)=\"-\",REPLACE(BE136,1,1,tech!$H$2),BE136),\"\")","v":"• procedures and eventually management of the PKI will be adjusted"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK136<>\"\",LEFT(BK136,1)<>\"#\"),IF(LEFT(BK136,1)=\"-\",REPLACE(BK136,1,1,tech!$H$2),BK136),\"\")","v":""},"|",null,"Critical events are immediately alerted and resolved according to incident response plans","Guidance","3.3.5.GX",{"$f":"IF(AND(BQ136<>\"\",LEFT(BQ136,1)<>\"#\"),IF(LEFT(BQ136,1)=\"-\",REPLACE(BQ136,1,1,tech!$H$2),BQ136),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW136<>\"\",LEFT(BW136,1)<>\"#\"),IF(LEFT(BW136,1)=\"-\",REPLACE(BW136,1,1,tech!$H$2),BW136),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC136<>\"\",LEFT(CC136,1)<>\"#\"),IF(LEFT(CC136,1)=\"-\",REPLACE(CC136,1,1,tech!$H$2),CC136),\"\")","v":""},"|","- [NIST SP 800-16 Information Technology Security Training Requirements: a Role- and Performance-Based Model](https://csrc.nist.gov/publications/detail/sp/800-16/final)","Establish education plan","References","4.2.4.RY",{"$f":"IF(AND(CI136<>\"\",LEFT(CI136,1)<>\"#\"),IF(LEFT(CI136,1)=\"-\",REPLACE(CI136,1,1,tech!$H$2),CI136),\"\")","v":"• [NIST SP 800-16 Information Technology Security Training Requirements: a Role- and Performance-Based Model](https://csrc.nist.gov/publications/detail/sp/800-16/final)"},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO136<>\"\",LEFT(CO136,1)<>\"#\"),IF(LEFT(CO136,1)=\"-\",REPLACE(CO136,1,1,tech!$H$2),CO136),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D137,tech!$A$13:$B$17,2,0),LEFT(E137,1),IF(G137=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C137,1)=\"-\",C137,\"\")=\"\",\"\",REPLACE(IF(LEFT(C137,1)=\"-\",C137,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I137<>\"\",LEFT(I137,1)<>\"#\"),IF(LEFT(I137,1)=\"-\",REPLACE(I137,1,1,tech!$H$2),I137),\"\")","v":""},"|",null,"Policies are periodically reviewed and updated","Guidance","1.2.5.GX",{"$f":"IF(AND(O137<>\"\",LEFT(O137,1)<>\"#\"),IF(LEFT(O137,1)=\"-\",REPLACE(O137,1,1,tech!$H$2),O137),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U137<>\"\",LEFT(U137,1)<>\"#\"),IF(LEFT(U137,1)=\"-\",REPLACE(U137,1,1,tech!$H$2),U137),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA137<>\"\",LEFT(AA137,1)<>\"#\"),IF(LEFT(AA137,1)=\"-\",REPLACE(AA137,1,1,tech!$H$2),AA137),\"\")","v":""},"|",null,"Cryptographic cipher suites and protocols are documented and maintained","Assessment","2.1.5.AX",{"$f":"IF(AND(AG137<>\"\",LEFT(AG137,1)<>\"#\"),IF(LEFT(AG137,1)=\"-\",REPLACE(AG137,1,1,tech!$H$2),AG137),\"\")","v":""},"|","* Documented inventory","Inventory of issued certificates is documented","Assessment","2.2.4.AY",{"$f":"IF(AND(AM137<>\"\",LEFT(AM137,1)<>\"#\"),IF(LEFT(AM137,1)=\"-\",REPLACE(AM137,1,1,tech!$H$2),AM137),\"\")","v":"* Documented inventory"},"|","- Review of the network segmentation","Infrastructure activities are periodically reviewed","Guidance","2.3.5.GY",{"$f":"IF(AND(AS137<>\"\",LEFT(AS137,1)<>\"#\"),IF(LEFT(AS137,1)=\"-\",REPLACE(AS137,1,1,tech!$H$2),AS137),\"\")","v":"• Review of the network segmentation"},"|","- change management Review frequency","Change management and agility is periodically reviewed","Assessment","2.4.5.AY",{"$f":"IF(AND(AY137<>\"\",LEFT(AY137,1)<>\"#\"),IF(LEFT(AY137,1)=\"-\",REPLACE(AY137,1,1,tech!$H$2),AY137),\"\")","v":"• change management Review frequency"},"|",null,"Competence and information sharing","Guidance","3.1.5.GY",{"$f":"IF(AND(BE137<>\"\",LEFT(BE137,1)<>\"#\"),IF(LEFT(BE137,1)=\"-\",REPLACE(BE137,1,1,tech!$H$2),BE137),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK137<>\"\",LEFT(BK137,1)<>\"#\"),IF(LEFT(BK137,1)=\"-\",REPLACE(BK137,1,1,tech!$H$2),BK137),\"\")","v":""},"|","#### Assessment","Critical events are immediately alerted and resolved according to incident response plans","Assessment","3.3.5.AX",{"$f":"IF(AND(BQ137<>\"\",LEFT(BQ137,1)<>\"#\"),IF(LEFT(BQ137,1)=\"-\",REPLACE(BQ137,1,1,tech!$H$2),BQ137),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW137<>\"\",LEFT(BW137,1)<>\"#\"),IF(LEFT(BW137,1)=\"-\",REPLACE(BW137,1,1,tech!$H$2),BW137),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC137<>\"\",LEFT(CC137,1)<>\"#\"),IF(LEFT(CC137,1)=\"-\",REPLACE(CC137,1,1,tech!$H$2),CC137),\"\")","v":""},"|","- [NIST SP 800-50 Building an Information Technology Security Awareness and Training Program](https://csrc.nist.gov/publications/detail/sp/800-50/final)","Establish education plan","References","4.2.4.RY",{"$f":"IF(AND(CI137<>\"\",LEFT(CI137,1)<>\"#\"),IF(LEFT(CI137,1)=\"-\",REPLACE(CI137,1,1,tech!$H$2),CI137),\"\")","v":"• [NIST SP 800-50 Building an Information Technology Security Awareness and Training Program](https://csrc.nist.gov/publications/detail/sp/800-50/final)"},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO137<>\"\",LEFT(CO137,1)<>\"#\"),IF(LEFT(CO137,1)=\"-\",REPLACE(CO137,1,1,tech!$H$2),CO137),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D138,tech!$A$13:$B$17,2,0),LEFT(E138,1),IF(G138=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C138,1)=\"-\",C138,\"\")=\"\",\"\",REPLACE(IF(LEFT(C138,1)=\"-\",C138,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I138<>\"\",LEFT(I138,1)<>\"#\"),IF(LEFT(I138,1)=\"-\",REPLACE(I138,1,1,tech!$H$2),I138),\"\")","v":""},"|","#### Assessment","Policies are periodically reviewed and updated","Assessment","1.2.5.AX",{"$f":"IF(AND(O138<>\"\",LEFT(O138,1)<>\"#\"),IF(LEFT(O138,1)=\"-\",REPLACE(O138,1,1,tech!$H$2),O138),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U138<>\"\",LEFT(U138,1)<>\"#\"),IF(LEFT(U138,1)=\"-\",REPLACE(U138,1,1,tech!$H$2),U138),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA138<>\"\",LEFT(AA138,1)<>\"#\"),IF(LEFT(AA138,1)=\"-\",REPLACE(AA138,1,1,tech!$H$2),AA138),\"\")","v":""},"|","#### References","Cryptographic cipher suites and protocols are documented and maintained","References","2.1.5.RX",{"$f":"IF(AND(AG138<>\"\",LEFT(AG138,1)<>\"#\"),IF(LEFT(AG138,1)=\"-\",REPLACE(AG138,1,1,tech!$H$2),AG138),\"\")","v":""},"|","  * How inventory is maintained across the organization","Inventory of issued certificates is documented","Assessment","2.2.4.AY",{"$f":"IF(AND(AM138<>\"\",LEFT(AM138,1)<>\"#\"),IF(LEFT(AM138,1)=\"-\",REPLACE(AM138,1,1,tech!$H$2),AM138),\"\")","v":"  * How inventory is maintained across the organization"},"|","- Regular checks of access control lists","Infrastructure activities are periodically reviewed","Guidance","2.3.5.GY",{"$f":"IF(AND(AS138<>\"\",LEFT(AS138,1)<>\"#\"),IF(LEFT(AS138,1)=\"-\",REPLACE(AS138,1,1,tech!$H$2),AS138),\"\")","v":"• Regular checks of access control lists"},"|","- implementation of Review process and documentation","Change management and agility is periodically reviewed","Assessment","2.4.5.AY",{"$f":"IF(AND(AY138<>\"\",LEFT(AY138,1)<>\"#\"),IF(LEFT(AY138,1)=\"-\",REPLACE(AY138,1,1,tech!$H$2),AY138),\"\")","v":"• implementation of Review process and documentation"},"|","The organization needs to ensure that the competence of the personnel is maintained and the information is shared to not lose the knowledge introduced by changes within known and unknown variables. The organization should have a plan to ensure that the competence is maintained for the most critical parts of the PKI.","Competence and information sharing","Guidance","3.1.5.GY",{"$f":"IF(AND(BE138<>\"\",LEFT(BE138,1)<>\"#\"),IF(LEFT(BE138,1)=\"-\",REPLACE(BE138,1,1,tech!$H$2),BE138),\"\")","v":"The organization needs to ensure that the competence of the personnel is maintained and the information is shared to not lose the knowledge introduced by changes within known and unknown variables. The organization should have a plan to ensure that the competence is maintained for the most critical parts of the PKI."},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK138<>\"\",LEFT(BK138,1)<>\"#\"),IF(LEFT(BK138,1)=\"-\",REPLACE(BK138,1,1,tech!$H$2),BK138),\"\")","v":""},"|",null,"Critical events are immediately alerted and resolved according to incident response plans","Assessment","3.3.5.AX",{"$f":"IF(AND(BQ138<>\"\",LEFT(BQ138,1)<>\"#\"),IF(LEFT(BQ138,1)=\"-\",REPLACE(BQ138,1,1,tech!$H$2),BQ138),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW138<>\"\",LEFT(BW138,1)<>\"#\"),IF(LEFT(BW138,1)=\"-\",REPLACE(BW138,1,1,tech!$H$2),BW138),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC138<>\"\",LEFT(CC138,1)<>\"#\"),IF(LEFT(CC138,1)=\"-\",REPLACE(CC138,1,1,tech!$H$2),CC138),\"\")","v":""},"|","- [European Cybersecurity Skills Framework (ECSF)](https://www.enisa.europa.eu/topics/education/european-cybersecurity-skills-framework)","Establish education plan","References","4.2.4.RY",{"$f":"IF(AND(CI138<>\"\",LEFT(CI138,1)<>\"#\"),IF(LEFT(CI138,1)=\"-\",REPLACE(CI138,1,1,tech!$H$2),CI138),\"\")","v":"• [European Cybersecurity Skills Framework (ECSF)](https://www.enisa.europa.eu/topics/education/european-cybersecurity-skills-framework)"},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO138<>\"\",LEFT(CO138,1)<>\"#\"),IF(LEFT(CO138,1)=\"-\",REPLACE(CO138,1,1,tech!$H$2),CO138),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D139,tech!$A$13:$B$17,2,0),LEFT(E139,1),IF(G139=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C139,1)=\"-\",C139,\"\")=\"\",\"\",REPLACE(IF(LEFT(C139,1)=\"-\",C139,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I139<>\"\",LEFT(I139,1)<>\"#\"),IF(LEFT(I139,1)=\"-\",REPLACE(I139,1,1,tech!$H$2),I139),\"\")","v":""},"|",null,"Policies are periodically reviewed and updated","Assessment","1.2.5.AX",{"$f":"IF(AND(O139<>\"\",LEFT(O139,1)<>\"#\"),IF(LEFT(O139,1)=\"-\",REPLACE(O139,1,1,tech!$H$2),O139),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U139<>\"\",LEFT(U139,1)<>\"#\"),IF(LEFT(U139,1)=\"-\",REPLACE(U139,1,1,tech!$H$2),U139),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA139<>\"\",LEFT(AA139,1)<>\"#\"),IF(LEFT(AA139,1)=\"-\",REPLACE(AA139,1,1,tech!$H$2),AA139),\"\")","v":""},"|",null,"Cryptographic cipher suites and protocols are documented and maintained","References","2.1.5.RX",{"$f":"IF(AND(AG139<>\"\",LEFT(AG139,1)<>\"#\"),IF(LEFT(AG139,1)=\"-\",REPLACE(AG139,1,1,tech!$H$2),AG139),\"\")","v":""},"|","* Documented certificate inventory management","Inventory of issued certificates is documented","Assessment","2.2.4.AY",{"$f":"IF(AND(AM139<>\"\",LEFT(AM139,1)<>\"#\"),IF(LEFT(AM139,1)=\"-\",REPLACE(AM139,1,1,tech!$H$2),AM139),\"\")","v":"* Documented certificate inventory management"},"|","- vulnerability reports and timely remediation","Infrastructure activities are periodically reviewed","Guidance","2.3.5.GY",{"$f":"IF(AND(AS139<>\"\",LEFT(AS139,1)<>\"#\"),IF(LEFT(AS139,1)=\"-\",REPLACE(AS139,1,1,tech!$H$2),AS139),\"\")","v":"• vulnerability reports and timely remediation"},"|","- Interview with the responsible personnel","Change management and agility is periodically reviewed","Assessment","2.4.5.AY",{"$f":"IF(AND(AY139<>\"\",LEFT(AY139,1)<>\"#\"),IF(LEFT(AY139,1)=\"-\",REPLACE(AY139,1,1,tech!$H$2),AY139),\"\")","v":"• Interview with the responsible personnel"},"|",null,"Competence and information sharing","Guidance","3.1.5.GY",{"$f":"IF(AND(BE139<>\"\",LEFT(BE139,1)<>\"#\"),IF(LEFT(BE139,1)=\"-\",REPLACE(BE139,1,1,tech!$H$2),BE139),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK139<>\"\",LEFT(BK139,1)<>\"#\"),IF(LEFT(BK139,1)=\"-\",REPLACE(BK139,1,1,tech!$H$2),BK139),\"\")","v":""},"|","- Review of requirements for alerting on critical event, including security sensitive events","Critical events are immediately alerted and resolved according to incident response plans","Assessment","3.3.5.AY",{"$f":"IF(AND(BQ139<>\"\",LEFT(BQ139,1)<>\"#\"),IF(LEFT(BQ139,1)=\"-\",REPLACE(BQ139,1,1,tech!$H$2),BQ139),\"\")","v":"• Review of requirements for alerting on critical event, including security sensitive events"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW139<>\"\",LEFT(BW139,1)<>\"#\"),IF(LEFT(BW139,1)=\"-\",REPLACE(BW139,1,1,tech!$H$2),BW139),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC139<>\"\",LEFT(CC139,1)<>\"#\"),IF(LEFT(CC139,1)=\"-\",REPLACE(CC139,1,1,tech!$H$2),CC139),\"\")","v":""},"|",null,"Establish education plan","References","4.2.4.RX",{"$f":"IF(AND(CI139<>\"\",LEFT(CI139,1)<>\"#\"),IF(LEFT(CI139,1)=\"-\",REPLACE(CI139,1,1,tech!$H$2),CI139),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO139<>\"\",LEFT(CO139,1)<>\"#\"),IF(LEFT(CO139,1)=\"-\",REPLACE(CO139,1,1,tech!$H$2),CO139),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D140,tech!$A$13:$B$17,2,0),LEFT(E140,1),IF(G140=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C140,1)=\"-\",C140,\"\")=\"\",\"\",REPLACE(IF(LEFT(C140,1)=\"-\",C140,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I140<>\"\",LEFT(I140,1)<>\"#\"),IF(LEFT(I140,1)=\"-\",REPLACE(I140,1,1,tech!$H$2),I140),\"\")","v":""},"|","- the policies are reviewed and updated periodically","Policies are periodically reviewed and updated","Assessment","1.2.5.AY",{"$f":"IF(AND(O140<>\"\",LEFT(O140,1)<>\"#\"),IF(LEFT(O140,1)=\"-\",REPLACE(O140,1,1,tech!$H$2),O140),\"\")","v":"• the policies are reviewed and updated periodically"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U140<>\"\",LEFT(U140,1)<>\"#\"),IF(LEFT(U140,1)=\"-\",REPLACE(U140,1,1,tech!$H$2),U140),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA140<>\"\",LEFT(AA140,1)<>\"#\"),IF(LEFT(AA140,1)=\"-\",REPLACE(AA140,1,1,tech!$H$2),AA140),\"\")","v":""},"|","- [NIST SP 800-57 Recommendation for Key Management](https://csrc.nist.gov/projects/key-management/key-management-guidelines)","Cryptographic cipher suites and protocols are documented and maintained","References","2.1.5.RY",{"$f":"IF(AND(AG140<>\"\",LEFT(AG140,1)<>\"#\"),IF(LEFT(AG140,1)=\"-\",REPLACE(AG140,1,1,tech!$H$2),AG140),\"\")","v":"• [NIST SP 800-57 Recommendation for Key Management](https://csrc.nist.gov/projects/key-management/key-management-guidelines)"},"|","* Validation of certificate inventory records","Inventory of issued certificates is documented","Assessment","2.2.4.AY",{"$f":"IF(AND(AM140<>\"\",LEFT(AM140,1)<>\"#\"),IF(LEFT(AM140,1)=\"-\",REPLACE(AM140,1,1,tech!$H$2),AM140),\"\")","v":"* Validation of certificate inventory records"},"|","- Review and correlation of logs","Infrastructure activities are periodically reviewed","Guidance","2.3.5.GY",{"$f":"IF(AND(AS140<>\"\",LEFT(AS140,1)<>\"#\"),IF(LEFT(AS140,1)=\"-\",REPLACE(AS140,1,1,tech!$H$2),AS140),\"\")","v":"• Review and correlation of logs"},"|",null,"Change management and agility is periodically reviewed","Assessment","2.4.5.AX",{"$f":"IF(AND(AY140<>\"\",LEFT(AY140,1)<>\"#\"),IF(LEFT(AY140,1)=\"-\",REPLACE(AY140,1,1,tech!$H$2),AY140),\"\")","v":""},"|","The competence and information sharing is an important part to achieve the resilience of the PKI implementation by having relevant information and competencies ready when needed.","Competence and information sharing","Guidance","3.1.5.GY",{"$f":"IF(AND(BE140<>\"\",LEFT(BE140,1)<>\"#\"),IF(LEFT(BE140,1)=\"-\",REPLACE(BE140,1,1,tech!$H$2),BE140),\"\")","v":"The competence and information sharing is an important part to achieve the resilience of the PKI implementation by having relevant information and competencies ready when needed."},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK140<>\"\",LEFT(BK140,1)<>\"#\"),IF(LEFT(BK140,1)=\"-\",REPLACE(BK140,1,1,tech!$H$2),BK140),\"\")","v":""},"|","- Review of Monitoring implementation","Critical events are immediately alerted and resolved according to incident response plans","Assessment","3.3.5.AY",{"$f":"IF(AND(BQ140<>\"\",LEFT(BQ140,1)<>\"#\"),IF(LEFT(BQ140,1)=\"-\",REPLACE(BQ140,1,1,tech!$H$2),BQ140),\"\")","v":"• Review of Monitoring implementation"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW140<>\"\",LEFT(BW140,1)<>\"#\"),IF(LEFT(BW140,1)=\"-\",REPLACE(BW140,1,1,tech!$H$2),BW140),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC140<>\"\",LEFT(CC140,1)<>\"#\"),IF(LEFT(CC140,1)=\"-\",REPLACE(CC140,1,1,tech!$H$2),CC140),\"\")","v":""},"|","### Periodically review knowledge","Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI140<>\"\",LEFT(CI140,1)<>\"#\"),IF(LEFT(CI140,1)=\"-\",REPLACE(CI140,1,1,tech!$H$2),CI140),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO140<>\"\",LEFT(CO140,1)<>\"#\"),IF(LEFT(CO140,1)=\"-\",REPLACE(CO140,1,1,tech!$H$2),CO140),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D141,tech!$A$13:$B$17,2,0),LEFT(E141,1),IF(G141=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C141,1)=\"-\",C141,\"\")=\"\",\"\",REPLACE(IF(LEFT(C141,1)=\"-\",C141,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I141<>\"\",LEFT(I141,1)<>\"#\"),IF(LEFT(I141,1)=\"-\",REPLACE(I141,1,1,tech!$H$2),I141),\"\")","v":""},"|","- Check the last review date of the policies","Policies are periodically reviewed and updated","Assessment","1.2.5.AY",{"$f":"IF(AND(O141<>\"\",LEFT(O141,1)<>\"#\"),IF(LEFT(O141,1)=\"-\",REPLACE(O141,1,1,tech!$H$2),O141),\"\")","v":"• Check the last review date of the policies"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U141<>\"\",LEFT(U141,1)<>\"#\"),IF(LEFT(U141,1)=\"-\",REPLACE(U141,1,1,tech!$H$2),U141),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA141<>\"\",LEFT(AA141,1)<>\"#\"),IF(LEFT(AA141,1)=\"-\",REPLACE(AA141,1,1,tech!$H$2),AA141),\"\")","v":""},"|","- [ISO/IEC 11770 Key Management](https://www.iso.org/standard/53456.html)","Cryptographic cipher suites and protocols are documented and maintained","References","2.1.5.RY",{"$f":"IF(AND(AG141<>\"\",LEFT(AG141,1)<>\"#\"),IF(LEFT(AG141,1)=\"-\",REPLACE(AG141,1,1,tech!$H$2),AG141),\"\")","v":"• [ISO/IEC 11770 Key Management](https://www.iso.org/standard/53456.html)"},"|","* Effectiveness of the certificate inventory implementation","Inventory of issued certificates is documented","Assessment","2.2.4.AY",{"$f":"IF(AND(AM141<>\"\",LEFT(AM141,1)<>\"#\"),IF(LEFT(AM141,1)=\"-\",REPLACE(AM141,1,1,tech!$H$2),AM141),\"\")","v":"* Effectiveness of the certificate inventory implementation"},"|","- and other activities related to the infrastructure management","Infrastructure activities are periodically reviewed","Guidance","2.3.5.GY",{"$f":"IF(AND(AS141<>\"\",LEFT(AS141,1)<>\"#\"),IF(LEFT(AS141,1)=\"-\",REPLACE(AS141,1,1,tech!$H$2),AS141),\"\")","v":"• and other activities related to the infrastructure management"},"|","#### References","Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY141<>\"\",LEFT(AY141,1)<>\"#\"),IF(LEFT(AY141,1)=\"-\",REPLACE(AY141,1,1,tech!$H$2),AY141),\"\")","v":""},"|",null,"Competence and information sharing","Guidance","3.1.5.GX",{"$f":"IF(AND(BE141<>\"\",LEFT(BE141,1)<>\"#\"),IF(LEFT(BE141,1)=\"-\",REPLACE(BE141,1,1,tech!$H$2),BE141),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK141<>\"\",LEFT(BK141,1)<>\"#\"),IF(LEFT(BK141,1)=\"-\",REPLACE(BK141,1,1,tech!$H$2),BK141),\"\")","v":""},"|","- Review of documentation of critical events","Critical events are immediately alerted and resolved according to incident response plans","Assessment","3.3.5.AY",{"$f":"IF(AND(BQ141<>\"\",LEFT(BQ141,1)<>\"#\"),IF(LEFT(BQ141,1)=\"-\",REPLACE(BQ141,1,1,tech!$H$2),BQ141),\"\")","v":"• Review of documentation of critical events"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW141<>\"\",LEFT(BW141,1)<>\"#\"),IF(LEFT(BW141,1)=\"-\",REPLACE(BW141,1,1,tech!$H$2),BW141),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC141<>\"\",LEFT(CC141,1)<>\"#\"),IF(LEFT(CC141,1)=\"-\",REPLACE(CC141,1,1,tech!$H$2),CC141),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI141<>\"\",LEFT(CI141,1)<>\"#\"),IF(LEFT(CI141,1)=\"-\",REPLACE(CI141,1,1,tech!$H$2),CI141),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO141<>\"\",LEFT(CO141,1)<>\"#\"),IF(LEFT(CO141,1)=\"-\",REPLACE(CO141,1,1,tech!$H$2),CO141),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D142,tech!$A$13:$B$17,2,0),LEFT(E142,1),IF(G142=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C142,1)=\"-\",C142,\"\")=\"\",\"\",REPLACE(IF(LEFT(C142,1)=\"-\",C142,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I142<>\"\",LEFT(I142,1)<>\"#\"),IF(LEFT(I142,1)=\"-\",REPLACE(I142,1,1,tech!$H$2),I142),\"\")","v":""},"|","- implementation of review process","Policies are periodically reviewed and updated","Assessment","1.2.5.AY",{"$f":"IF(AND(O142<>\"\",LEFT(O142,1)<>\"#\"),IF(LEFT(O142,1)=\"-\",REPLACE(O142,1,1,tech!$H$2),O142),\"\")","v":"• implementation of review process"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U142<>\"\",LEFT(U142,1)<>\"#\"),IF(LEFT(U142,1)=\"-\",REPLACE(U142,1,1,tech!$H$2),U142),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA142<>\"\",LEFT(AA142,1)<>\"#\"),IF(LEFT(AA142,1)=\"-\",REPLACE(AA142,1,1,tech!$H$2),AA142),\"\")","v":""},"|","- [NIST SP 800-131A Transitioning the Use of Cryptographic Algorithms and Key Lengths](https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final)","Cryptographic cipher suites and protocols are documented and maintained","References","2.1.5.RY",{"$f":"IF(AND(AG142<>\"\",LEFT(AG142,1)<>\"#\"),IF(LEFT(AG142,1)=\"-\",REPLACE(AG142,1,1,tech!$H$2),AG142),\"\")","v":"• [NIST SP 800-131A Transitioning the Use of Cryptographic Algorithms and Key Lengths](https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final)"},"|",null,"Inventory of issued certificates is documented","Assessment","2.2.4.AX",{"$f":"IF(AND(AM142<>\"\",LEFT(AM142,1)<>\"#\"),IF(LEFT(AM142,1)=\"-\",REPLACE(AM142,1,1,tech!$H$2),AM142),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","Guidance","2.3.5.GX",{"$f":"IF(AND(AS142<>\"\",LEFT(AS142,1)<>\"#\"),IF(LEFT(AS142,1)=\"-\",REPLACE(AS142,1,1,tech!$H$2),AS142),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY142<>\"\",LEFT(AY142,1)<>\"#\"),IF(LEFT(AY142,1)=\"-\",REPLACE(AY142,1,1,tech!$H$2),AY142),\"\")","v":""},"|","#### Assessment","Competence and information sharing","Assessment","3.1.5.AX",{"$f":"IF(AND(BE142<>\"\",LEFT(BE142,1)<>\"#\"),IF(LEFT(BE142,1)=\"-\",REPLACE(BE142,1,1,tech!$H$2),BE142),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK142<>\"\",LEFT(BK142,1)<>\"#\"),IF(LEFT(BK142,1)=\"-\",REPLACE(BK142,1,1,tech!$H$2),BK142),\"\")","v":""},"|","- Interviews with personnel to check the Understanding of critical events and their handling","Critical events are immediately alerted and resolved according to incident response plans","Assessment","3.3.5.AY",{"$f":"IF(AND(BQ142<>\"\",LEFT(BQ142,1)<>\"#\"),IF(LEFT(BQ142,1)=\"-\",REPLACE(BQ142,1,1,tech!$H$2),BQ142),\"\")","v":"• Interviews with personnel to check the Understanding of critical events and their handling"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW142<>\"\",LEFT(BW142,1)<>\"#\"),IF(LEFT(BW142,1)=\"-\",REPLACE(BW142,1,1,tech!$H$2),BW142),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC142<>\"\",LEFT(CC142,1)<>\"#\"),IF(LEFT(CC142,1)=\"-\",REPLACE(CC142,1,1,tech!$H$2),CC142),\"\")","v":""},"|","#### Guidance","Periodically review knowledge","Guidance","4.2.5.GX",{"$f":"IF(AND(CI142<>\"\",LEFT(CI142,1)<>\"#\"),IF(LEFT(CI142,1)=\"-\",REPLACE(CI142,1,1,tech!$H$2),CI142),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO142<>\"\",LEFT(CO142,1)<>\"#\"),IF(LEFT(CO142,1)=\"-\",REPLACE(CO142,1,1,tech!$H$2),CO142),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D143,tech!$A$13:$B$17,2,0),LEFT(E143,1),IF(G143=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C143,1)=\"-\",C143,\"\")=\"\",\"\",REPLACE(IF(LEFT(C143,1)=\"-\",C143,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I143<>\"\",LEFT(I143,1)<>\"#\"),IF(LEFT(I143,1)=\"-\",REPLACE(I143,1,1,tech!$H$2),I143),\"\")","v":""},"|","- Validation of documentation and reviews","Policies are periodically reviewed and updated","Assessment","1.2.5.AY",{"$f":"IF(AND(O143<>\"\",LEFT(O143,1)<>\"#\"),IF(LEFT(O143,1)=\"-\",REPLACE(O143,1,1,tech!$H$2),O143),\"\")","v":"• Validation of documentation and reviews"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U143<>\"\",LEFT(U143,1)<>\"#\"),IF(LEFT(U143,1)=\"-\",REPLACE(U143,1,1,tech!$H$2),U143),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA143<>\"\",LEFT(AA143,1)<>\"#\"),IF(LEFT(AA143,1)=\"-\",REPLACE(AA143,1,1,tech!$H$2),AA143),\"\")","v":""},"|",null,"Cryptographic cipher suites and protocols are documented and maintained","References","2.1.5.RX",{"$f":"IF(AND(AG143<>\"\",LEFT(AG143,1)<>\"#\"),IF(LEFT(AG143,1)=\"-\",REPLACE(AG143,1,1,tech!$H$2),AG143),\"\")","v":""},"|","#### References","Inventory of issued certificates is documented","References","2.2.4.RX",{"$f":"IF(AND(AM143<>\"\",LEFT(AM143,1)<>\"#\"),IF(LEFT(AM143,1)=\"-\",REPLACE(AM143,1,1,tech!$H$2),AM143),\"\")","v":""},"|","#### Assessment","Infrastructure activities are periodically reviewed","Assessment","2.3.5.AX",{"$f":"IF(AND(AS143<>\"\",LEFT(AS143,1)<>\"#\"),IF(LEFT(AS143,1)=\"-\",REPLACE(AS143,1,1,tech!$H$2),AS143),\"\")","v":""},"|","- [COBIT (Control Objectives for Information and Related Technologies)](https://www.isaca.org/resources/cobit)","Change management and agility is periodically reviewed","References","2.4.5.RY",{"$f":"IF(AND(AY143<>\"\",LEFT(AY143,1)<>\"#\"),IF(LEFT(AY143,1)=\"-\",REPLACE(AY143,1,1,tech!$H$2),AY143),\"\")","v":"• [COBIT (Control Objectives for Information and Related Technologies)](https://www.isaca.org/resources/cobit)"},"|",null,"Competence and information sharing","Assessment","3.1.5.AX",{"$f":"IF(AND(BE143<>\"\",LEFT(BE143,1)<>\"#\"),IF(LEFT(BE143,1)=\"-\",REPLACE(BE143,1,1,tech!$H$2),BE143),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK143<>\"\",LEFT(BK143,1)<>\"#\"),IF(LEFT(BK143,1)=\"-\",REPLACE(BK143,1,1,tech!$H$2),BK143),\"\")","v":""},"|",null,"Critical events are immediately alerted and resolved according to incident response plans","Assessment","3.3.5.AX",{"$f":"IF(AND(BQ143<>\"\",LEFT(BQ143,1)<>\"#\"),IF(LEFT(BQ143,1)=\"-\",REPLACE(BQ143,1,1,tech!$H$2),BQ143),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW143<>\"\",LEFT(BW143,1)<>\"#\"),IF(LEFT(BW143,1)=\"-\",REPLACE(BW143,1,1,tech!$H$2),BW143),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC143<>\"\",LEFT(CC143,1)<>\"#\"),IF(LEFT(CC143,1)=\"-\",REPLACE(CC143,1,1,tech!$H$2),CC143),\"\")","v":""},"|",null,"Periodically review knowledge","Guidance","4.2.5.GX",{"$f":"IF(AND(CI143<>\"\",LEFT(CI143,1)<>\"#\"),IF(LEFT(CI143,1)=\"-\",REPLACE(CI143,1,1,tech!$H$2),CI143),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO143<>\"\",LEFT(CO143,1)<>\"#\"),IF(LEFT(CO143,1)=\"-\",REPLACE(CO143,1,1,tech!$H$2),CO143),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D144,tech!$A$13:$B$17,2,0),LEFT(E144,1),IF(G144=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C144,1)=\"-\",C144,\"\")=\"\",\"\",REPLACE(IF(LEFT(C144,1)=\"-\",C144,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(J144,$L$4:$M$13,2,0),\"\"),LEFT(K144,1),IF(M144=\"\",IF(AND(M143<>\"\",M145<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"1.1.4.RX"},{"$f":"IF(AND(I144<>\"\",LEFT(I144,1)<>\"#\"),IF(LEFT(I144,1)=\"-\",REPLACE(I144,1,1,tech!$H$2),I144),\"\")","v":""},"|","- Interview with the management and PKI responsible personnel to confirm the policies are reviewed and updated periodically","Policies are periodically reviewed and updated","Assessment",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(P144,$R$4:$S$13,2,0),\"\"),LEFT(Q144,1),IF(S144=\"\",IF(AND(S143<>\"\",S145<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"1.2.5.AY"},{"$f":"IF(AND(O144<>\"\",LEFT(O144,1)<>\"#\"),IF(LEFT(O144,1)=\"-\",REPLACE(O144,1,1,tech!$H$2),O144),\"\")","v":"• Interview with the management and PKI responsible personnel to confirm the policies are reviewed and updated periodically"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(V144,X$4:Y$13,2,0),\"\"),LEFT(W144,1),IF(Y144=\"\",IF(AND(Y143<>\"\",Y145<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"1.3.4.RX"},{"$f":"IF(AND(U144<>\"\",LEFT(U144,1)<>\"#\"),IF(LEFT(U144,1)=\"-\",REPLACE(U144,1,1,tech!$H$2),U144),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AB144,AD$4:AE$13,2,0),\"\"),LEFT(AC144,1),IF(AE144=\"\",IF(AND(AE143<>\"\",AE145<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"1.4.5.RX"},{"$f":"IF(AND(AA144<>\"\",LEFT(AA144,1)<>\"#\"),IF(LEFT(AA144,1)=\"-\",REPLACE(AA144,1,1,tech!$H$2),AA144),\"\")","v":""},"|","### Key management is periodically reviewed and updated","Key management is periodically reviewed and updated","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AH144,AJ$4:AK$13,2,0),\"\"),LEFT(AI144,1),IF(AK144=\"\",IF(AND(AK143<>\"\",AK145<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"2.1.6.RX"},{"$f":"IF(AND(AG144<>\"\",LEFT(AG144,1)<>\"#\"),IF(LEFT(AG144,1)=\"-\",REPLACE(AG144,1,1,tech!$H$2),AG144),\"\")","v":""},"|",null,"Inventory of issued certificates is documented","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AN144,AP$4:AQ$13,2,0),\"\"),LEFT(AO144,1),IF(AQ144=\"\",IF(AND(AQ143<>\"\",AQ145<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"2.2.4.RX"},{"$f":"IF(AND(AM144<>\"\",LEFT(AM144,1)<>\"#\"),IF(LEFT(AM144,1)=\"-\",REPLACE(AM144,1,1,tech!$H$2),AM144),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","Assessment",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AT144,AV$4:AW$13,2,0),\"\"),LEFT(AU144,1),IF(AW144=\"\",IF(AND(AW143<>\"\",AW145<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"2.3.5.AX"},{"$f":"IF(AND(AS144<>\"\",LEFT(AS144,1)<>\"#\"),IF(LEFT(AS144,1)=\"-\",REPLACE(AS144,1,1,tech!$H$2),AS144),\"\")","v":""},"|","- [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)","Change management and agility is periodically reviewed","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AZ144,BB$4:BC$13,2,0),\"\"),LEFT(BA144,1),IF(BC144=\"\",IF(AND(BC143<>\"\",BC145<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"2.4.5.RY"},{"$f":"IF(AND(AY144<>\"\",LEFT(AY144,1)<>\"#\"),IF(LEFT(AY144,1)=\"-\",REPLACE(AY144,1,1,tech!$H$2),AY144),\"\")","v":"• [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)"},"|","The following is sample evidence that can be used to assess the requirement:","Competence and information sharing","Assessment",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BF144,BH$4:BI$13,2,0),\"\"),LEFT(BG144,1),IF(BI144=\"\",IF(AND(BI143<>\"\",BI145<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"3.1.5.AY"},{"$f":"IF(AND(BE144<>\"\",LEFT(BE144,1)<>\"#\"),IF(LEFT(BE144,1)=\"-\",REPLACE(BE144,1,1,tech!$H$2),BE144),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|",null,"Adoption and application of open standards","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BL144,BN$4:BO$13,2,0),\"\"),LEFT(BM144,1),IF(BO144=\"\",IF(AND(BO143<>\"\",BO145<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"3.2.3.RX"},{"$f":"IF(AND(BK144<>\"\",LEFT(BK144,1)<>\"#\"),IF(LEFT(BK144,1)=\"-\",REPLACE(BK144,1,1,tech!$H$2),BK144),\"\")","v":""},"|","#### References","Critical events are immediately alerted and resolved according to incident response plans","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BR144,BT$4:BU$13,2,0),\"\"),LEFT(BS144,1),IF(BU144=\"\",IF(AND(BU143<>\"\",BU145<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"3.3.5.RX"},{"$f":"IF(AND(BQ144<>\"\",LEFT(BQ144,1)<>\"#\"),IF(LEFT(BQ144,1)=\"-\",REPLACE(BQ144,1,1,tech!$H$2),BQ144),\"\")","v":""},"|",null,"Incidents and exceptions handling","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BX144,BZ$4:CA$13,2,0),\"\"),LEFT(BY144,1),IF(CA144=\"\",IF(AND(CA143<>\"\",CA145<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"3.4.3.RX"},{"$f":"IF(AND(BW144<>\"\",LEFT(BW144,1)<>\"#\"),IF(LEFT(BW144,1)=\"-\",REPLACE(BW144,1,1,tech!$H$2),BW144),\"\")","v":""},"|",null,"Resources are periodically reviewed","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(CD144,CF$4:CG$13,2,0),\"\"),LEFT(CE144,1),IF(CG144=\"\",IF(AND(CG143<>\"\",CG145<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"4.1.4.RX"},{"$f":"IF(AND(CC144<>\"\",LEFT(CC144,1)<>\"#\"),IF(LEFT(CC144,1)=\"-\",REPLACE(CC144,1,1,tech!$H$2),CC144),\"\")","v":""},"|","The training plan should be reviewed and updated periodically to ensure that it is up-to-date and covers all aspects of the specific PKI implementation.","Periodically review knowledge","Guidance",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(CJ144,CL$4:CM$13,2,0),\"\"),LEFT(CK144,1),IF(CM144=\"\",IF(AND(CM143<>\"\",CM145<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"4.2.5.GY"},{"$f":"IF(AND(CI144<>\"\",LEFT(CI144,1)<>\"#\"),IF(LEFT(CI144,1)=\"-\",REPLACE(CI144,1,1,tech!$H$2),CI144),\"\")","v":"The training plan should be reviewed and updated periodically to ensure that it is up-to-date and covers all aspects of the specific PKI implementation."},"|",null,"Timely communication of important information","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(CP144,CR$4:CS$13,2,0),\"\"),LEFT(CQ144,1),IF(CS144=\"\",IF(AND(CS143<>\"\",CS145<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"4.3.4.RX"},{"$f":"IF(AND(CO144<>\"\",LEFT(CO144,1)<>\"#\"),IF(LEFT(CO144,1)=\"-\",REPLACE(CO144,1,1,tech!$H$2),CO144),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D145,tech!$A$13:$B$17,2,0),LEFT(E145,1),IF(G145=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C145,1)=\"-\",C145,\"\")=\"\",\"\",REPLACE(IF(LEFT(C145,1)=\"-\",C145,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I145<>\"\",LEFT(I145,1)<>\"#\"),IF(LEFT(I145,1)=\"-\",REPLACE(I145,1,1,tech!$H$2),I145),\"\")","v":""},"|",null,"Policies are periodically reviewed and updated","Assessment","1.2.5.AX",{"$f":"IF(AND(O145<>\"\",LEFT(O145,1)<>\"#\"),IF(LEFT(O145,1)=\"-\",REPLACE(O145,1,1,tech!$H$2),O145),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U145<>\"\",LEFT(U145,1)<>\"#\"),IF(LEFT(U145,1)=\"-\",REPLACE(U145,1,1,tech!$H$2),U145),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA145<>\"\",LEFT(AA145,1)<>\"#\"),IF(LEFT(AA145,1)=\"-\",REPLACE(AA145,1,1,tech!$H$2),AA145),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG145<>\"\",LEFT(AG145,1)<>\"#\"),IF(LEFT(AG145,1)=\"-\",REPLACE(AG145,1,1,tech!$H$2),AG145),\"\")","v":""},"|","* [RFC 3647 - Internet X.509 Public Key Infrastructure","Inventory of issued certificates is documented","References","2.2.4.RY",{"$f":"IF(AND(AM145<>\"\",LEFT(AM145,1)<>\"#\"),IF(LEFT(AM145,1)=\"-\",REPLACE(AM145,1,1,tech!$H$2),AM145),\"\")","v":"* [RFC 3647 - Internet X.509 Public Key Infrastructure"},"|","The following is sample evidence that can be used to assess the requirement:","Infrastructure activities are periodically reviewed","Assessment","2.3.5.AY",{"$f":"IF(AND(AS145<>\"\",LEFT(AS145,1)<>\"#\"),IF(LEFT(AS145,1)=\"-\",REPLACE(AS145,1,1,tech!$H$2),AS145),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|","- [The Information Technology Infrastructure Library (ITIL)](https://www.axelos.com/best-practice-solutions/itil)","Change management and agility is periodically reviewed","References","2.4.5.RY",{"$f":"IF(AND(AY145<>\"\",LEFT(AY145,1)<>\"#\"),IF(LEFT(AY145,1)=\"-\",REPLACE(AY145,1,1,tech!$H$2),AY145),\"\")","v":"• [The Information Technology Infrastructure Library (ITIL)](https://www.axelos.com/best-practice-solutions/itil)"},"|","- documentation and collaboration","Competence and information sharing","Assessment","3.1.5.AY",{"$f":"IF(AND(BE145<>\"\",LEFT(BE145,1)<>\"#\"),IF(LEFT(BE145,1)=\"-\",REPLACE(BE145,1,1,tech!$H$2),BE145),\"\")","v":"• documentation and collaboration"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK145<>\"\",LEFT(BK145,1)<>\"#\"),IF(LEFT(BK145,1)=\"-\",REPLACE(BK145,1,1,tech!$H$2),BK145),\"\")","v":""},"|",null,"Critical events are immediately alerted and resolved according to incident response plans","References","3.3.5.RX",{"$f":"IF(AND(BQ145<>\"\",LEFT(BQ145,1)<>\"#\"),IF(LEFT(BQ145,1)=\"-\",REPLACE(BQ145,1,1,tech!$H$2),BQ145),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW145<>\"\",LEFT(BW145,1)<>\"#\"),IF(LEFT(BW145,1)=\"-\",REPLACE(BW145,1,1,tech!$H$2),BW145),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC145<>\"\",LEFT(CC145,1)<>\"#\"),IF(LEFT(CC145,1)=\"-\",REPLACE(CC145,1,1,tech!$H$2),CC145),\"\")","v":""},"|",null,"Periodically review knowledge","Guidance","4.2.5.GY",{"$f":"IF(AND(CI145<>\"\",LEFT(CI145,1)<>\"#\"),IF(LEFT(CI145,1)=\"-\",REPLACE(CI145,1,1,tech!$H$2),CI145),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO145<>\"\",LEFT(CO145,1)<>\"#\"),IF(LEFT(CO145,1)=\"-\",REPLACE(CO145,1,1,tech!$H$2),CO145),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D146,tech!$A$13:$B$17,2,0),LEFT(E146,1),IF(G146=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C146,1)=\"-\",C146,\"\")=\"\",\"\",REPLACE(IF(LEFT(C146,1)=\"-\",C146,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I146<>\"\",LEFT(I146,1)<>\"#\"),IF(LEFT(I146,1)=\"-\",REPLACE(I146,1,1,tech!$H$2),I146),\"\")","v":""},"|","#### References","Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O146<>\"\",LEFT(O146,1)<>\"#\"),IF(LEFT(O146,1)=\"-\",REPLACE(O146,1,1,tech!$H$2),O146),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U146<>\"\",LEFT(U146,1)<>\"#\"),IF(LEFT(U146,1)=\"-\",REPLACE(U146,1,1,tech!$H$2),U146),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA146<>\"\",LEFT(AA146,1)<>\"#\"),IF(LEFT(AA146,1)=\"-\",REPLACE(AA146,1,1,tech!$H$2),AA146),\"\")","v":""},"|","#### Guidance","Key management is periodically reviewed and updated","Guidance","2.1.6.GX",{"$f":"IF(AND(AG146<>\"\",LEFT(AG146,1)<>\"#\"),IF(LEFT(AG146,1)=\"-\",REPLACE(AG146,1,1,tech!$H$2),AG146),\"\")","v":""},"|","  Certificate Policy and Certification Practices Framework - Certificate Life-Cycle Operational Requirements](https://datatracker.ietf.org/doc/html/rfc3647/#section-4.4)","Inventory of issued certificates is documented","References","2.2.4.RY",{"$f":"IF(AND(AM146<>\"\",LEFT(AM146,1)<>\"#\"),IF(LEFT(AM146,1)=\"-\",REPLACE(AM146,1,1,tech!$H$2),AM146),\"\")","v":"  Certificate Policy and Certification Practices Framework - Certificate Life-Cycle Operational Requirements](https://datatracker.ietf.org/doc/html/rfc3647/#section-4.4)"},"|","- infrastructure management activities Review frequency","Infrastructure activities are periodically reviewed","Assessment","2.3.5.AY",{"$f":"IF(AND(AS146<>\"\",LEFT(AS146,1)<>\"#\"),IF(LEFT(AS146,1)=\"-\",REPLACE(AS146,1,1,tech!$H$2),AS146),\"\")","v":"• infrastructure management activities Review frequency"},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY146<>\"\",LEFT(AY146,1)<>\"#\"),IF(LEFT(AY146,1)=\"-\",REPLACE(AY146,1,1,tech!$H$2),AY146),\"\")","v":""},"|","- Onboarding and offboarding procedures","Competence and information sharing","Assessment","3.1.5.AY",{"$f":"IF(AND(BE146<>\"\",LEFT(BE146,1)<>\"#\"),IF(LEFT(BE146,1)=\"-\",REPLACE(BE146,1,1,tech!$H$2),BE146),\"\")","v":"• Onboarding and offboarding procedures"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK146<>\"\",LEFT(BK146,1)<>\"#\"),IF(LEFT(BK146,1)=\"-\",REPLACE(BK146,1,1,tech!$H$2),BK146),\"\")","v":""},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Critical events are immediately alerted and resolved according to incident response plans","References","3.3.5.RY",{"$f":"IF(AND(BQ146<>\"\",LEFT(BQ146,1)<>\"#\"),IF(LEFT(BQ146,1)=\"-\",REPLACE(BQ146,1,1,tech!$H$2),BQ146),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW146<>\"\",LEFT(BW146,1)<>\"#\"),IF(LEFT(BW146,1)=\"-\",REPLACE(BW146,1,1,tech!$H$2),BW146),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC146<>\"\",LEFT(CC146,1)<>\"#\"),IF(LEFT(CC146,1)=\"-\",REPLACE(CC146,1,1,tech!$H$2),CC146),\"\")","v":""},"|","Periodical review of the training plans helps to maintain required skills and knowledge for the responsible personnel.","Periodically review knowledge","Guidance","4.2.5.GY",{"$f":"IF(AND(CI146<>\"\",LEFT(CI146,1)<>\"#\"),IF(LEFT(CI146,1)=\"-\",REPLACE(CI146,1,1,tech!$H$2),CI146),\"\")","v":"Periodical review of the training plans helps to maintain required skills and knowledge for the responsible personnel."},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO146<>\"\",LEFT(CO146,1)<>\"#\"),IF(LEFT(CO146,1)=\"-\",REPLACE(CO146,1,1,tech!$H$2),CO146),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D147,tech!$A$13:$B$17,2,0),LEFT(E147,1),IF(G147=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C147,1)=\"-\",C147,\"\")=\"\",\"\",REPLACE(IF(LEFT(C147,1)=\"-\",C147,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I147<>\"\",LEFT(I147,1)<>\"#\"),IF(LEFT(I147,1)=\"-\",REPLACE(I147,1,1,tech!$H$2),I147),\"\")","v":""},"|",null,"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O147<>\"\",LEFT(O147,1)<>\"#\"),IF(LEFT(O147,1)=\"-\",REPLACE(O147,1,1,tech!$H$2),O147),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U147<>\"\",LEFT(U147,1)<>\"#\"),IF(LEFT(U147,1)=\"-\",REPLACE(U147,1,1,tech!$H$2),U147),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA147<>\"\",LEFT(AA147,1)<>\"#\"),IF(LEFT(AA147,1)=\"-\",REPLACE(AA147,1,1,tech!$H$2),AA147),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","Guidance","2.1.6.GX",{"$f":"IF(AND(AG147<>\"\",LEFT(AG147,1)<>\"#\"),IF(LEFT(AG147,1)=\"-\",REPLACE(AG147,1,1,tech!$H$2),AG147),\"\")","v":""},"|","* [NIST SP 800-57 Part 1 Rev. 5 - certificate inventory management](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf)","Inventory of issued certificates is documented","References","2.2.4.RY",{"$f":"IF(AND(AM147<>\"\",LEFT(AM147,1)<>\"#\"),IF(LEFT(AM147,1)=\"-\",REPLACE(AM147,1,1,tech!$H$2),AM147),\"\")","v":"* [NIST SP 800-57 Part 1 Rev. 5 - certificate inventory management](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf)"},"|","- Organizational implementation of Review process","Infrastructure activities are periodically reviewed","Assessment","2.3.5.AY",{"$f":"IF(AND(AS147<>\"\",LEFT(AS147,1)<>\"#\"),IF(LEFT(AS147,1)=\"-\",REPLACE(AS147,1,1,tech!$H$2),AS147),\"\")","v":"• Organizational implementation of Review process"},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY147<>\"\",LEFT(AY147,1)<>\"#\"),IF(LEFT(AY147,1)=\"-\",REPLACE(AY147,1,1,tech!$H$2),AY147),\"\")","v":""},"|","- Building competence and knowledge sharing","Competence and information sharing","Assessment","3.1.5.AY",{"$f":"IF(AND(BE147<>\"\",LEFT(BE147,1)<>\"#\"),IF(LEFT(BE147,1)=\"-\",REPLACE(BE147,1,1,tech!$H$2),BE147),\"\")","v":"• Building competence and knowledge sharing"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK147<>\"\",LEFT(BK147,1)<>\"#\"),IF(LEFT(BK147,1)=\"-\",REPLACE(BK147,1,1,tech!$H$2),BK147),\"\")","v":""},"|","- [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)","Critical events are immediately alerted and resolved according to incident response plans","References","3.3.5.RY",{"$f":"IF(AND(BQ147<>\"\",LEFT(BQ147,1)<>\"#\"),IF(LEFT(BQ147,1)=\"-\",REPLACE(BQ147,1,1,tech!$H$2),BQ147),\"\")","v":"• [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW147<>\"\",LEFT(BW147,1)<>\"#\"),IF(LEFT(BW147,1)=\"-\",REPLACE(BW147,1,1,tech!$H$2),BW147),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC147<>\"\",LEFT(CC147,1)<>\"#\"),IF(LEFT(CC147,1)=\"-\",REPLACE(CC147,1,1,tech!$H$2),CC147),\"\")","v":""},"|","It provides assurance that the expected controls are active and working as intended.","Periodically review knowledge","Guidance","4.2.5.GY",{"$f":"IF(AND(CI147<>\"\",LEFT(CI147,1)<>\"#\"),IF(LEFT(CI147,1)=\"-\",REPLACE(CI147,1,1,tech!$H$2),CI147),\"\")","v":"It provides assurance that the expected controls are active and working as intended."},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO147<>\"\",LEFT(CO147,1)<>\"#\"),IF(LEFT(CO147,1)=\"-\",REPLACE(CO147,1,1,tech!$H$2),CO147),\"\")","v":""},"|"]
[{"$nulls":3},"Optimized","Associated risks",{"$f":"_xlfn.CONCAT(VLOOKUP(D148,tech!$A$13:$B$17,2,0),LEFT(E148,1),IF(G148=\"\",\"X\",\"Y\"))","v":"5AX"},{"$f":"IF(IF(LEFT(C148,1)=\"-\",C148,\"\")=\"\",\"\",REPLACE(IF(LEFT(C148,1)=\"-\",C148,\"\"),1,1,tech!$H$2))","v":""},"|",null,"Architecture and design of the PKI","References","1.1.4.RX",{"$f":"IF(AND(I148<>\"\",LEFT(I148,1)<>\"#\"),IF(LEFT(I148,1)=\"-\",REPLACE(I148,1,1,tech!$H$2),I148),\"\")","v":""},"|","- [RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://tools.ietf.org/html/rfc3647)","Policies are periodically reviewed and updated","References","1.2.5.RY",{"$f":"IF(AND(O148<>\"\",LEFT(O148,1)<>\"#\"),IF(LEFT(O148,1)=\"-\",REPLACE(O148,1,1,tech!$H$2),O148),\"\")","v":"• [RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework](https://tools.ietf.org/html/rfc3647)"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U148<>\"\",LEFT(U148,1)<>\"#\"),IF(LEFT(U148,1)=\"-\",REPLACE(U148,1,1,tech!$H$2),U148),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA148<>\"\",LEFT(AA148,1)<>\"#\"),IF(LEFT(AA148,1)=\"-\",REPLACE(AA148,1,1,tech!$H$2),AA148),\"\")","v":""},"|","Key management policy, processes and procedures related to cryptographic keys, inventory and lifecycle should be periodically reviewed, updated and approved. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends.","Key management is periodically reviewed and updated","Guidance","2.1.6.GY",{"$f":"IF(AND(AG148<>\"\",LEFT(AG148,1)<>\"#\"),IF(LEFT(AG148,1)=\"-\",REPLACE(AG148,1,1,tech!$H$2),AG148),\"\")","v":"Key management policy, processes and procedures related to cryptographic keys, inventory and lifecycle should be periodically reviewed, updated and approved. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends."},"|",null,"Inventory of issued certificates is documented","References","2.2.4.RX",{"$f":"IF(AND(AM148<>\"\",LEFT(AM148,1)<>\"#\"),IF(LEFT(AM148,1)=\"-\",REPLACE(AM148,1,1,tech!$H$2),AM148),\"\")","v":""},"|","- Validation of documentation, reports, records, and reviews","Infrastructure activities are periodically reviewed","Assessment","2.3.5.AY",{"$f":"IF(AND(AS148<>\"\",LEFT(AS148,1)<>\"#\"),IF(LEFT(AS148,1)=\"-\",REPLACE(AS148,1,1,tech!$H$2),AS148),\"\")","v":"• Validation of documentation, reports, records, and reviews"},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY148<>\"\",LEFT(AY148,1)<>\"#\"),IF(LEFT(AY148,1)=\"-\",REPLACE(AY148,1,1,tech!$H$2),AY148),\"\")","v":""},"|",null,"Competence and information sharing","Assessment","3.1.5.AX",{"$f":"IF(AND(BE148<>\"\",LEFT(BE148,1)<>\"#\"),IF(LEFT(BE148,1)=\"-\",REPLACE(BE148,1,1,tech!$H$2),BE148),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK148<>\"\",LEFT(BK148,1)<>\"#\"),IF(LEFT(BK148,1)=\"-\",REPLACE(BK148,1,1,tech!$H$2),BK148),\"\")","v":""},"|","- [ISO/IEC 27099 - Public key infrastructure](https://www.iso.org/standard/56590.html)","Critical events are immediately alerted and resolved according to incident response plans","References","3.3.5.RY",{"$f":"IF(AND(BQ148<>\"\",LEFT(BQ148,1)<>\"#\"),IF(LEFT(BQ148,1)=\"-\",REPLACE(BQ148,1,1,tech!$H$2),BQ148),\"\")","v":"• [ISO/IEC 27099 - Public key infrastructure](https://www.iso.org/standard/56590.html)"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW148<>\"\",LEFT(BW148,1)<>\"#\"),IF(LEFT(BW148,1)=\"-\",REPLACE(BW148,1,1,tech!$H$2),BW148),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC148<>\"\",LEFT(CC148,1)<>\"#\"),IF(LEFT(CC148,1)=\"-\",REPLACE(CC148,1,1,tech!$H$2),CC148),\"\")","v":""},"|",null,"Periodically review knowledge","Guidance","4.2.5.GX",{"$f":"IF(AND(CI148<>\"\",LEFT(CI148,1)<>\"#\"),IF(LEFT(CI148,1)=\"-\",REPLACE(CI148,1,1,tech!$H$2),CI148),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO148<>\"\",LEFT(CO148,1)<>\"#\"),IF(LEFT(CO148,1)=\"-\",REPLACE(CO148,1,1,tech!$H$2),CO148),\"\")","v":""},"|"]
[{"$nulls":14},"- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)",{"$f":"IF(AND(LEFT(O149,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(O149,\" \"))=3,0)),_xlfn.TEXTAFTER(O149,\" \"),P148)","v":"Policies are periodically reviewed and updated"},{"$f":"IF(AND(LEFT(O149,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(O149,\" \"))=4,0)),_xlfn.TEXTAFTER(O149,\" \"),Q148)","v":"References"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(P149,$R$4:$S$13,2,0),\"\"),LEFT(Q149,1),IF(S149=\"\",IF(AND(S148<>\"\",S150<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"1.2.5.RY"},{"$f":"IF(AND(O149<>\"\",LEFT(O149,1)<>\"#\"),IF(LEFT(O149,1)=\"-\",REPLACE(O149,1,1,tech!$H$2),O149),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|",null,{"$f":"IF(AND(LEFT(U149,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(U149,\" \"))=3,0)),_xlfn.TEXTAFTER(U149,\" \"),V148)","v":"List of relevant laws, regulations, and standards, exist and is maintained"},{"$f":"IF(AND(LEFT(U149,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(U149,\" \"))=4,0)),_xlfn.TEXTAFTER(U149,\" \"),W148)","v":"References"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(V149,X$4:Y$13,2,0),\"\"),LEFT(W149,1),IF(Y149=\"\",IF(AND(Y148<>\"\",Y150<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"1.3.4.RX"},{"$f":"IF(AND(U149<>\"\",LEFT(U149,1)<>\"#\"),IF(LEFT(U149,1)=\"-\",REPLACE(U149,1,1,tech!$H$2),U149),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(AA149,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AA149,\" \"))=3,0)),_xlfn.TEXTAFTER(AA149,\" \"),AB148)","v":"Processes and procedures are reviewed and updated"},{"$f":"IF(AND(LEFT(AA149,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AA149,\" \"))=4,0)),_xlfn.TEXTAFTER(AA149,\" \"),AC148)","v":"References"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AB149,AD$4:AE$13,2,0),\"\"),LEFT(AC149,1),IF(AE149=\"\",IF(AND(AE148<>\"\",AE150<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"1.4.5.RX"},{"$f":"IF(AND(AA149<>\"\",LEFT(AA149,1)<>\"#\"),IF(LEFT(AA149,1)=\"-\",REPLACE(AA149,1,1,tech!$H$2),AA149),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(AG149,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AG149,\" \"))=3,0)),_xlfn.TEXTAFTER(AG149,\" \"),AH148)","v":"Key management is periodically reviewed and updated"},{"$f":"IF(AND(LEFT(AG149,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AG149,\" \"))=4,0)),_xlfn.TEXTAFTER(AG149,\" \"),AI148)","v":"Guidance"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AH149,AJ$4:AK$13,2,0),\"\"),LEFT(AI149,1),IF(AK149=\"\",IF(AND(AK148<>\"\",AK150<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"2.1.6.GY"},{"$f":"IF(AND(AG149<>\"\",LEFT(AG149,1)<>\"#\"),IF(LEFT(AG149,1)=\"-\",REPLACE(AG149,1,1,tech!$H$2),AG149),\"\")","v":""},"|","### Certificate discovery process is documented","Certificate discovery process is documented","References","2.2.5.RX",{"$f":"IF(AND(AM149<>\"\",LEFT(AM149,1)<>\"#\"),IF(LEFT(AM149,1)=\"-\",REPLACE(AM149,1,1,tech!$H$2),AM149),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","Assessment","2.3.5.AX",{"$f":"IF(AND(AS149<>\"\",LEFT(AS149,1)<>\"#\"),IF(LEFT(AS149,1)=\"-\",REPLACE(AS149,1,1,tech!$H$2),AS149),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY149<>\"\",LEFT(AY149,1)<>\"#\"),IF(LEFT(AY149,1)=\"-\",REPLACE(AY149,1,1,tech!$H$2),AY149),\"\")","v":""},"|","#### References","Competence and information sharing","References","3.1.5.RX",{"$f":"IF(AND(BE149<>\"\",LEFT(BE149,1)<>\"#\"),IF(LEFT(BE149,1)=\"-\",REPLACE(BE149,1,1,tech!$H$2),BE149),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK149<>\"\",LEFT(BK149,1)<>\"#\"),IF(LEFT(BK149,1)=\"-\",REPLACE(BK149,1,1,tech!$H$2),BK149),\"\")","v":""},"|",null,"Critical events are immediately alerted and resolved according to incident response plans","References","3.3.5.RX",{"$f":"IF(AND(BQ149<>\"\",LEFT(BQ149,1)<>\"#\"),IF(LEFT(BQ149,1)=\"-\",REPLACE(BQ149,1,1,tech!$H$2),BQ149),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW149<>\"\",LEFT(BW149,1)<>\"#\"),IF(LEFT(BW149,1)=\"-\",REPLACE(BW149,1,1,tech!$H$2),BW149),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC149<>\"\",LEFT(CC149,1)<>\"#\"),IF(LEFT(CC149,1)=\"-\",REPLACE(CC149,1,1,tech!$H$2),CC149),\"\")","v":""},"|","#### Assessment","Periodically review knowledge","Assessment","4.2.5.AX",{"$f":"IF(AND(CI149<>\"\",LEFT(CI149,1)<>\"#\"),IF(LEFT(CI149,1)=\"-\",REPLACE(CI149,1,1,tech!$H$2),CI149),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO149<>\"\",LEFT(CO149,1)<>\"#\"),IF(LEFT(CO149,1)=\"-\",REPLACE(CO149,1,1,tech!$H$2),CO149),\"\")","v":""},"|"]
[{"$nulls":14},"- [ETSI EN 319 401 - General Policy Requirements for Trust Service Providers](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/02.03.01_60/en_319401v020301p.pdf)","Policies are periodically reviewed and updated","References","1.2.5.RY",{"$f":"IF(AND(O150<>\"\",LEFT(O150,1)<>\"#\"),IF(LEFT(O150,1)=\"-\",REPLACE(O150,1,1,tech!$H$2),O150),\"\")","v":"• [ETSI EN 319 401 - General Policy Requirements for Trust Service Providers](https://www.etsi.org/deliver/etsi_en/319400_319499/319401/02.03.01_60/en_319401v020301p.pdf)"},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U150<>\"\",LEFT(U150,1)<>\"#\"),IF(LEFT(U150,1)=\"-\",REPLACE(U150,1,1,tech!$H$2),U150),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA150<>\"\",LEFT(AA150,1)<>\"#\"),IF(LEFT(AA150,1)=\"-\",REPLACE(AA150,1,1,tech!$H$2),AA150),\"\")","v":""},"|","Periodical review helps to keep the key management accurate and helps to maintain required skills and knowledge.","Key management is periodically reviewed and updated","Guidance","2.1.6.GY",{"$f":"IF(AND(AG150<>\"\",LEFT(AG150,1)<>\"#\"),IF(LEFT(AG150,1)=\"-\",REPLACE(AG150,1,1,tech!$H$2),AG150),\"\")","v":"Periodical review helps to keep the key management accurate and helps to maintain required skills and knowledge."},"|",null,"Certificate discovery process is documented","References","2.2.5.RX",{"$f":"IF(AND(AM150<>\"\",LEFT(AM150,1)<>\"#\"),IF(LEFT(AM150,1)=\"-\",REPLACE(AM150,1,1,tech!$H$2),AM150),\"\")","v":""},"|","#### References","Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS150<>\"\",LEFT(AS150,1)<>\"#\"),IF(LEFT(AS150,1)=\"-\",REPLACE(AS150,1,1,tech!$H$2),AS150),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY150<>\"\",LEFT(AY150,1)<>\"#\"),IF(LEFT(AY150,1)=\"-\",REPLACE(AY150,1,1,tech!$H$2),AY150),\"\")","v":""},"|",null,"Competence and information sharing","References","3.1.5.RX",{"$f":"IF(AND(BE150<>\"\",LEFT(BE150,1)<>\"#\"),IF(LEFT(BE150,1)=\"-\",REPLACE(BE150,1,1,tech!$H$2),BE150),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK150<>\"\",LEFT(BK150,1)<>\"#\"),IF(LEFT(BK150,1)=\"-\",REPLACE(BK150,1,1,tech!$H$2),BK150),\"\")","v":""},"|","### Review of events and logs is periodically performed","Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ150<>\"\",LEFT(BQ150,1)<>\"#\"),IF(LEFT(BQ150,1)=\"-\",REPLACE(BQ150,1,1,tech!$H$2),BQ150),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW150<>\"\",LEFT(BW150,1)<>\"#\"),IF(LEFT(BW150,1)=\"-\",REPLACE(BW150,1,1,tech!$H$2),BW150),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC150<>\"\",LEFT(CC150,1)<>\"#\"),IF(LEFT(CC150,1)=\"-\",REPLACE(CC150,1,1,tech!$H$2),CC150),\"\")","v":""},"|",null,"Periodically review knowledge","Assessment","4.2.5.AX",{"$f":"IF(AND(CI150<>\"\",LEFT(CI150,1)<>\"#\"),IF(LEFT(CI150,1)=\"-\",REPLACE(CI150,1,1,tech!$H$2),CI150),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO150<>\"\",LEFT(CO150,1)<>\"#\"),IF(LEFT(CO150,1)=\"-\",REPLACE(CO150,1,1,tech!$H$2),CO150),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O151<>\"\",LEFT(O151,1)<>\"#\"),IF(LEFT(O151,1)=\"-\",REPLACE(O151,1,1,tech!$H$2),O151),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U151<>\"\",LEFT(U151,1)<>\"#\"),IF(LEFT(U151,1)=\"-\",REPLACE(U151,1,1,tech!$H$2),U151),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA151<>\"\",LEFT(AA151,1)<>\"#\"),IF(LEFT(AA151,1)=\"-\",REPLACE(AA151,1,1,tech!$H$2),AA151),\"\")","v":""},"|","It provides assurance that the expected controls are active and working as intended.","Key management is periodically reviewed and updated","Guidance","2.1.6.GY",{"$f":"IF(AND(AG151<>\"\",LEFT(AG151,1)<>\"#\"),IF(LEFT(AG151,1)=\"-\",REPLACE(AG151,1,1,tech!$H$2),AG151),\"\")","v":"It provides assurance that the expected controls are active and working as intended."},"|","#### Guidance","Certificate discovery process is documented","Guidance","2.2.5.GX",{"$f":"IF(AND(AM151<>\"\",LEFT(AM151,1)<>\"#\"),IF(LEFT(AM151,1)=\"-\",REPLACE(AM151,1,1,tech!$H$2),AM151),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS151<>\"\",LEFT(AS151,1)<>\"#\"),IF(LEFT(AS151,1)=\"-\",REPLACE(AS151,1,1,tech!$H$2),AS151),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY151<>\"\",LEFT(AY151,1)<>\"#\"),IF(LEFT(AY151,1)=\"-\",REPLACE(AY151,1,1,tech!$H$2),AY151),\"\")","v":""},"|","- [ISO 223XX Security and resilience standards](https://www.iso.org/standard/77008.html)","Competence and information sharing","References","3.1.5.RY",{"$f":"IF(AND(BE151<>\"\",LEFT(BE151,1)<>\"#\"),IF(LEFT(BE151,1)=\"-\",REPLACE(BE151,1,1,tech!$H$2),BE151),\"\")","v":"• [ISO 223XX Security and resilience standards](https://www.iso.org/standard/77008.html)"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK151<>\"\",LEFT(BK151,1)<>\"#\"),IF(LEFT(BK151,1)=\"-\",REPLACE(BK151,1,1,tech!$H$2),BK151),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ151<>\"\",LEFT(BQ151,1)<>\"#\"),IF(LEFT(BQ151,1)=\"-\",REPLACE(BQ151,1,1,tech!$H$2),BQ151),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW151<>\"\",LEFT(BW151,1)<>\"#\"),IF(LEFT(BW151,1)=\"-\",REPLACE(BW151,1,1,tech!$H$2),BW151),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC151<>\"\",LEFT(CC151,1)<>\"#\"),IF(LEFT(CC151,1)=\"-\",REPLACE(CC151,1,1,tech!$H$2),CC151),\"\")","v":""},"|","- Training plan Review process","Periodically review knowledge","Assessment","4.2.5.AY",{"$f":"IF(AND(CI151<>\"\",LEFT(CI151,1)<>\"#\"),IF(LEFT(CI151,1)=\"-\",REPLACE(CI151,1,1,tech!$H$2),CI151),\"\")","v":"• Training plan Review process"},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO151<>\"\",LEFT(CO151,1)<>\"#\"),IF(LEFT(CO151,1)=\"-\",REPLACE(CO151,1,1,tech!$H$2),CO151),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O152<>\"\",LEFT(O152,1)<>\"#\"),IF(LEFT(O152,1)=\"-\",REPLACE(O152,1,1,tech!$H$2),O152),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U152<>\"\",LEFT(U152,1)<>\"#\"),IF(LEFT(U152,1)=\"-\",REPLACE(U152,1,1,tech!$H$2),U152),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA152<>\"\",LEFT(AA152,1)<>\"#\"),IF(LEFT(AA152,1)=\"-\",REPLACE(AA152,1,1,tech!$H$2),AA152),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","Guidance","2.1.6.GX",{"$f":"IF(AND(AG152<>\"\",LEFT(AG152,1)<>\"#\"),IF(LEFT(AG152,1)=\"-\",REPLACE(AG152,1,1,tech!$H$2),AG152),\"\")","v":""},"|",null,"Certificate discovery process is documented","Guidance","2.2.5.GX",{"$f":"IF(AND(AM152<>\"\",LEFT(AM152,1)<>\"#\"),IF(LEFT(AM152,1)=\"-\",REPLACE(AM152,1,1,tech!$H$2),AM152),\"\")","v":""},"|","- [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)","Infrastructure activities are periodically reviewed","References","2.3.5.RY",{"$f":"IF(AND(AS152<>\"\",LEFT(AS152,1)<>\"#\"),IF(LEFT(AS152,1)=\"-\",REPLACE(AS152,1,1,tech!$H$2),AS152),\"\")","v":"• [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)"},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY152<>\"\",LEFT(AY152,1)<>\"#\"),IF(LEFT(AY152,1)=\"-\",REPLACE(AY152,1,1,tech!$H$2),AY152),\"\")","v":""},"|",null,"Competence and information sharing","References","3.1.5.RX",{"$f":"IF(AND(BE152<>\"\",LEFT(BE152,1)<>\"#\"),IF(LEFT(BE152,1)=\"-\",REPLACE(BE152,1,1,tech!$H$2),BE152),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK152<>\"\",LEFT(BK152,1)<>\"#\"),IF(LEFT(BK152,1)=\"-\",REPLACE(BK152,1,1,tech!$H$2),BK152),\"\")","v":""},"|","#### Guidance","Review of events and logs is periodically performed","Guidance","3.3.6.GX",{"$f":"IF(AND(BQ152<>\"\",LEFT(BQ152,1)<>\"#\"),IF(LEFT(BQ152,1)=\"-\",REPLACE(BQ152,1,1,tech!$H$2),BQ152),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW152<>\"\",LEFT(BW152,1)<>\"#\"),IF(LEFT(BW152,1)=\"-\",REPLACE(BW152,1,1,tech!$H$2),BW152),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC152<>\"\",LEFT(CC152,1)<>\"#\"),IF(LEFT(CC152,1)=\"-\",REPLACE(CC152,1,1,tech!$H$2),CC152),\"\")","v":""},"|","- implementation of Review process","Periodically review knowledge","Assessment","4.2.5.AY",{"$f":"IF(AND(CI152<>\"\",LEFT(CI152,1)<>\"#\"),IF(LEFT(CI152,1)=\"-\",REPLACE(CI152,1,1,tech!$H$2),CI152),\"\")","v":"• implementation of Review process"},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO152<>\"\",LEFT(CO152,1)<>\"#\"),IF(LEFT(CO152,1)=\"-\",REPLACE(CO152,1,1,tech!$H$2),CO152),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O153<>\"\",LEFT(O153,1)<>\"#\"),IF(LEFT(O153,1)=\"-\",REPLACE(O153,1,1,tech!$H$2),O153),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U153<>\"\",LEFT(U153,1)<>\"#\"),IF(LEFT(U153,1)=\"-\",REPLACE(U153,1,1,tech!$H$2),U153),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA153<>\"\",LEFT(AA153,1)<>\"#\"),IF(LEFT(AA153,1)=\"-\",REPLACE(AA153,1,1,tech!$H$2),AA153),\"\")","v":""},"|","#### Assessment","Key management is periodically reviewed and updated","Assessment","2.1.6.AX",{"$f":"IF(AND(AG153<>\"\",LEFT(AG153,1)<>\"#\"),IF(LEFT(AG153,1)=\"-\",REPLACE(AG153,1,1,tech!$H$2),AG153),\"\")","v":""},"|","Certificate discovery process protects an organization from unknown certificates that may be deployed in the infrastructure. Unknown certificates may be further issued by unauthorized certification authorities and mislead users of services. Certificate discovery helps to maintain current inventory of certificates, but does not depend on the inventory and is not nessecary to maintain an inventory. Certificate discovery process should be implemented based on supported certificates and use-cases, for example:","Certificate discovery process is documented","Guidance","2.2.5.GY",{"$f":"IF(AND(AM153<>\"\",LEFT(AM153,1)<>\"#\"),IF(LEFT(AM153,1)=\"-\",REPLACE(AM153,1,1,tech!$H$2),AM153),\"\")","v":"Certificate discovery process protects an organization from unknown certificates that may be deployed in the infrastructure. Unknown certificates may be further issued by unauthorized certification authorities and mislead users of services. Certificate discovery helps to maintain current inventory of certificates, but does not depend on the inventory and is not nessecary to maintain an inventory. Certificate discovery process should be implemented based on supported certificates and use-cases, for example:"},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Infrastructure activities are periodically reviewed","References","2.3.5.RY",{"$f":"IF(AND(AS153<>\"\",LEFT(AS153,1)<>\"#\"),IF(LEFT(AS153,1)=\"-\",REPLACE(AS153,1,1,tech!$H$2),AS153),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY153<>\"\",LEFT(AY153,1)<>\"#\"),IF(LEFT(AY153,1)=\"-\",REPLACE(AY153,1,1,tech!$H$2),AY153),\"\")","v":""},"|","### Continual review and improvement","Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE153<>\"\",LEFT(BE153,1)<>\"#\"),IF(LEFT(BE153,1)=\"-\",REPLACE(BE153,1,1,tech!$H$2),BE153),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK153<>\"\",LEFT(BK153,1)<>\"#\"),IF(LEFT(BK153,1)=\"-\",REPLACE(BK153,1,1,tech!$H$2),BK153),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","Guidance","3.3.6.GX",{"$f":"IF(AND(BQ153<>\"\",LEFT(BQ153,1)<>\"#\"),IF(LEFT(BQ153,1)=\"-\",REPLACE(BQ153,1,1,tech!$H$2),BQ153),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW153<>\"\",LEFT(BW153,1)<>\"#\"),IF(LEFT(BW153,1)=\"-\",REPLACE(BW153,1,1,tech!$H$2),BW153),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC153<>\"\",LEFT(CC153,1)<>\"#\"),IF(LEFT(CC153,1)=\"-\",REPLACE(CC153,1,1,tech!$H$2),CC153),\"\")","v":""},"|","- Validation of documentation and reviews","Periodically review knowledge","Assessment","4.2.5.AY",{"$f":"IF(AND(CI153<>\"\",LEFT(CI153,1)<>\"#\"),IF(LEFT(CI153,1)=\"-\",REPLACE(CI153,1,1,tech!$H$2),CI153),\"\")","v":"• Validation of documentation and reviews"},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO153<>\"\",LEFT(CO153,1)<>\"#\"),IF(LEFT(CO153,1)=\"-\",REPLACE(CO153,1,1,tech!$H$2),CO153),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O154<>\"\",LEFT(O154,1)<>\"#\"),IF(LEFT(O154,1)=\"-\",REPLACE(O154,1,1,tech!$H$2),O154),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U154<>\"\",LEFT(U154,1)<>\"#\"),IF(LEFT(U154,1)=\"-\",REPLACE(U154,1,1,tech!$H$2),U154),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA154<>\"\",LEFT(AA154,1)<>\"#\"),IF(LEFT(AA154,1)=\"-\",REPLACE(AA154,1,1,tech!$H$2),AA154),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","Assessment","2.1.6.AX",{"$f":"IF(AND(AG154<>\"\",LEFT(AG154,1)<>\"#\"),IF(LEFT(AG154,1)=\"-\",REPLACE(AG154,1,1,tech!$H$2),AG154),\"\")","v":""},"|","- to scan the network for certificates used on known protocols and ports to discover certificates that can potentially cause service outage or breach","Certificate discovery process is documented","Guidance","2.2.5.GY",{"$f":"IF(AND(AM154<>\"\",LEFT(AM154,1)<>\"#\"),IF(LEFT(AM154,1)=\"-\",REPLACE(AM154,1,1,tech!$H$2),AM154),\"\")","v":"• to scan the network for certificates used on known protocols and ports to discover certificates that can potentially cause service outage or breach"},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS154<>\"\",LEFT(AS154,1)<>\"#\"),IF(LEFT(AS154,1)=\"-\",REPLACE(AS154,1,1,tech!$H$2),AS154),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY154<>\"\",LEFT(AY154,1)<>\"#\"),IF(LEFT(AY154,1)=\"-\",REPLACE(AY154,1,1,tech!$H$2),AY154),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE154<>\"\",LEFT(BE154,1)<>\"#\"),IF(LEFT(BE154,1)=\"-\",REPLACE(BE154,1,1,tech!$H$2),BE154),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK154<>\"\",LEFT(BK154,1)<>\"#\"),IF(LEFT(BK154,1)=\"-\",REPLACE(BK154,1,1,tech!$H$2),BK154),\"\")","v":""},"|","Logs and events should be reviewed frequently, preferably automatically, to determine security related issues, potential systems failure, identify anomalies or suspected activity. Regular review should be confirmed by authorized personnel who can proactively identify issues before they become problems.","Review of events and logs is periodically performed","Guidance","3.3.6.GY",{"$f":"IF(AND(BQ154<>\"\",LEFT(BQ154,1)<>\"#\"),IF(LEFT(BQ154,1)=\"-\",REPLACE(BQ154,1,1,tech!$H$2),BQ154),\"\")","v":"Logs and events should be reviewed frequently, preferably automatically, to determine security related issues, potential systems failure, identify anomalies or suspected activity. Regular review should be confirmed by authorized personnel who can proactively identify issues before they become problems."},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW154<>\"\",LEFT(BW154,1)<>\"#\"),IF(LEFT(BW154,1)=\"-\",REPLACE(BW154,1,1,tech!$H$2),BW154),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC154<>\"\",LEFT(CC154,1)<>\"#\"),IF(LEFT(CC154,1)=\"-\",REPLACE(CC154,1,1,tech!$H$2),CC154),\"\")","v":""},"|",null,"Periodically review knowledge","Assessment","4.2.5.AX",{"$f":"IF(AND(CI154<>\"\",LEFT(CI154,1)<>\"#\"),IF(LEFT(CI154,1)=\"-\",REPLACE(CI154,1,1,tech!$H$2),CI154),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO154<>\"\",LEFT(CO154,1)<>\"#\"),IF(LEFT(CO154,1)=\"-\",REPLACE(CO154,1,1,tech!$H$2),CO154),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O155<>\"\",LEFT(O155,1)<>\"#\"),IF(LEFT(O155,1)=\"-\",REPLACE(O155,1,1,tech!$H$2),O155),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U155<>\"\",LEFT(U155,1)<>\"#\"),IF(LEFT(U155,1)=\"-\",REPLACE(U155,1,1,tech!$H$2),U155),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA155<>\"\",LEFT(AA155,1)<>\"#\"),IF(LEFT(AA155,1)=\"-\",REPLACE(AA155,1,1,tech!$H$2),AA155),\"\")","v":""},"|","- Risk management and Review frequency","Key management is periodically reviewed and updated","Assessment","2.1.6.AY",{"$f":"IF(AND(AG155<>\"\",LEFT(AG155,1)<>\"#\"),IF(LEFT(AG155,1)=\"-\",REPLACE(AG155,1,1,tech!$H$2),AG155),\"\")","v":"• Risk management and Review frequency"},"|","- search for the certificates on file system to discover unauthorized or unsecured certificates","Certificate discovery process is documented","Guidance","2.2.5.GY",{"$f":"IF(AND(AM155<>\"\",LEFT(AM155,1)<>\"#\"),IF(LEFT(AM155,1)=\"-\",REPLACE(AM155,1,1,tech!$H$2),AM155),\"\")","v":"• search for the certificates on file system to discover unauthorized or unsecured certificates"},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS155<>\"\",LEFT(AS155,1)<>\"#\"),IF(LEFT(AS155,1)=\"-\",REPLACE(AS155,1,1,tech!$H$2),AS155),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY155<>\"\",LEFT(AY155,1)<>\"#\"),IF(LEFT(AY155,1)=\"-\",REPLACE(AY155,1,1,tech!$H$2),AY155),\"\")","v":""},"|","#### Guidance","Continual review and improvement","Guidance","3.1.6.GX",{"$f":"IF(AND(BE155<>\"\",LEFT(BE155,1)<>\"#\"),IF(LEFT(BE155,1)=\"-\",REPLACE(BE155,1,1,tech!$H$2),BE155),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK155<>\"\",LEFT(BK155,1)<>\"#\"),IF(LEFT(BK155,1)=\"-\",REPLACE(BK155,1,1,tech!$H$2),BK155),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","Guidance","3.3.6.GY",{"$f":"IF(AND(BQ155<>\"\",LEFT(BQ155,1)<>\"#\"),IF(LEFT(BQ155,1)=\"-\",REPLACE(BQ155,1,1,tech!$H$2),BQ155),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW155<>\"\",LEFT(BW155,1)<>\"#\"),IF(LEFT(BW155,1)=\"-\",REPLACE(BW155,1,1,tech!$H$2),BW155),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC155<>\"\",LEFT(CC155,1)<>\"#\"),IF(LEFT(CC155,1)=\"-\",REPLACE(CC155,1,1,tech!$H$2),CC155),\"\")","v":""},"|","#### References","Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI155<>\"\",LEFT(CI155,1)<>\"#\"),IF(LEFT(CI155,1)=\"-\",REPLACE(CI155,1,1,tech!$H$2),CI155),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO155<>\"\",LEFT(CO155,1)<>\"#\"),IF(LEFT(CO155,1)=\"-\",REPLACE(CO155,1,1,tech!$H$2),CO155),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O156<>\"\",LEFT(O156,1)<>\"#\"),IF(LEFT(O156,1)=\"-\",REPLACE(O156,1,1,tech!$H$2),O156),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U156<>\"\",LEFT(U156,1)<>\"#\"),IF(LEFT(U156,1)=\"-\",REPLACE(U156,1,1,tech!$H$2),U156),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA156<>\"\",LEFT(AA156,1)<>\"#\"),IF(LEFT(AA156,1)=\"-\",REPLACE(AA156,1,1,tech!$H$2),AA156),\"\")","v":""},"|","- implementation of Review process","Key management is periodically reviewed and updated","Assessment","2.1.6.AY",{"$f":"IF(AND(AG156<>\"\",LEFT(AG156,1)<>\"#\"),IF(LEFT(AG156,1)=\"-\",REPLACE(AG156,1,1,tech!$H$2),AG156),\"\")","v":"• implementation of Review process"},"|",null,"Certificate discovery process is documented","Guidance","2.2.5.GY",{"$f":"IF(AND(AM156<>\"\",LEFT(AM156,1)<>\"#\"),IF(LEFT(AM156,1)=\"-\",REPLACE(AM156,1,1,tech!$H$2),AM156),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS156<>\"\",LEFT(AS156,1)<>\"#\"),IF(LEFT(AS156,1)=\"-\",REPLACE(AS156,1,1,tech!$H$2),AS156),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY156<>\"\",LEFT(AY156,1)<>\"#\"),IF(LEFT(AY156,1)=\"-\",REPLACE(AY156,1,1,tech!$H$2),AY156),\"\")","v":""},"|",null,"Continual review and improvement","Guidance","3.1.6.GX",{"$f":"IF(AND(BE156<>\"\",LEFT(BE156,1)<>\"#\"),IF(LEFT(BE156,1)=\"-\",REPLACE(BE156,1,1,tech!$H$2),BE156),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK156<>\"\",LEFT(BK156,1)<>\"#\"),IF(LEFT(BK156,1)=\"-\",REPLACE(BK156,1,1,tech!$H$2),BK156),\"\")","v":""},"|","The review of logs and events should be performed periodically and the frequency should be based on the risk assessment. Any potential issues should be reported and resolved according to the incident response plans.","Review of events and logs is periodically performed","Guidance","3.3.6.GY",{"$f":"IF(AND(BQ156<>\"\",LEFT(BQ156,1)<>\"#\"),IF(LEFT(BQ156,1)=\"-\",REPLACE(BQ156,1,1,tech!$H$2),BQ156),\"\")","v":"The review of logs and events should be performed periodically and the frequency should be based on the risk assessment. Any potential issues should be reported and resolved according to the incident response plans."},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW156<>\"\",LEFT(BW156,1)<>\"#\"),IF(LEFT(BW156,1)=\"-\",REPLACE(BW156,1,1,tech!$H$2),BW156),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC156<>\"\",LEFT(CC156,1)<>\"#\"),IF(LEFT(CC156,1)=\"-\",REPLACE(CC156,1,1,tech!$H$2),CC156),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI156<>\"\",LEFT(CI156,1)<>\"#\"),IF(LEFT(CI156,1)=\"-\",REPLACE(CI156,1,1,tech!$H$2),CI156),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO156<>\"\",LEFT(CO156,1)<>\"#\"),IF(LEFT(CO156,1)=\"-\",REPLACE(CO156,1,1,tech!$H$2),CO156),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O157<>\"\",LEFT(O157,1)<>\"#\"),IF(LEFT(O157,1)=\"-\",REPLACE(O157,1,1,tech!$H$2),O157),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U157<>\"\",LEFT(U157,1)<>\"#\"),IF(LEFT(U157,1)=\"-\",REPLACE(U157,1,1,tech!$H$2),U157),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA157<>\"\",LEFT(AA157,1)<>\"#\"),IF(LEFT(AA157,1)=\"-\",REPLACE(AA157,1,1,tech!$H$2),AA157),\"\")","v":""},"|","- Validation of documentation and reviews","Key management is periodically reviewed and updated","Assessment","2.1.6.AY",{"$f":"IF(AND(AG157<>\"\",LEFT(AG157,1)<>\"#\"),IF(LEFT(AG157,1)=\"-\",REPLACE(AG157,1,1,tech!$H$2),AG157),\"\")","v":"• Validation of documentation and reviews"},"|","Discovery process should be run frequently on the specified locations and the certificate inventory should be updated based on the results of the certificate discovery to keep it current.","Certificate discovery process is documented","Guidance","2.2.5.GY",{"$f":"IF(AND(AM157<>\"\",LEFT(AM157,1)<>\"#\"),IF(LEFT(AM157,1)=\"-\",REPLACE(AM157,1,1,tech!$H$2),AM157),\"\")","v":"Discovery process should be run frequently on the specified locations and the certificate inventory should be updated based on the results of the certificate discovery to keep it current."},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS157<>\"\",LEFT(AS157,1)<>\"#\"),IF(LEFT(AS157,1)=\"-\",REPLACE(AS157,1,1,tech!$H$2),AS157),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY157<>\"\",LEFT(AY157,1)<>\"#\"),IF(LEFT(AY157,1)=\"-\",REPLACE(AY157,1,1,tech!$H$2),AY157),\"\")","v":""},"|","The resilience of the PKI implementation should be reviewed and improved regularly. The review and improvement process should be documented and the results should be used to improve the resilience of the PKI implementation. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends.","Continual review and improvement","Guidance","3.1.6.GY",{"$f":"IF(AND(BE157<>\"\",LEFT(BE157,1)<>\"#\"),IF(LEFT(BE157,1)=\"-\",REPLACE(BE157,1,1,tech!$H$2),BE157),\"\")","v":"The resilience of the PKI implementation should be reviewed and improved regularly. The review and improvement process should be documented and the results should be used to improve the resilience of the PKI implementation. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends."},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK157<>\"\",LEFT(BK157,1)<>\"#\"),IF(LEFT(BK157,1)=\"-\",REPLACE(BK157,1,1,tech!$H$2),BK157),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","Guidance","3.3.6.GX",{"$f":"IF(AND(BQ157<>\"\",LEFT(BQ157,1)<>\"#\"),IF(LEFT(BQ157,1)=\"-\",REPLACE(BQ157,1,1,tech!$H$2),BQ157),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW157<>\"\",LEFT(BW157,1)<>\"#\"),IF(LEFT(BW157,1)=\"-\",REPLACE(BW157,1,1,tech!$H$2),BW157),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC157<>\"\",LEFT(CC157,1)<>\"#\"),IF(LEFT(CC157,1)=\"-\",REPLACE(CC157,1,1,tech!$H$2),CC157),\"\")","v":""},"|","- [NIST SP 800-16 Information Technology Security Training Requirements: a Role- and Performance-Based Model](https://csrc.nist.gov/publications/detail/sp/800-16/final)","Periodically review knowledge","References","4.2.5.RY",{"$f":"IF(AND(CI157<>\"\",LEFT(CI157,1)<>\"#\"),IF(LEFT(CI157,1)=\"-\",REPLACE(CI157,1,1,tech!$H$2),CI157),\"\")","v":"• [NIST SP 800-16 Information Technology Security Training Requirements: a Role- and Performance-Based Model](https://csrc.nist.gov/publications/detail/sp/800-16/final)"},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO157<>\"\",LEFT(CO157,1)<>\"#\"),IF(LEFT(CO157,1)=\"-\",REPLACE(CO157,1,1,tech!$H$2),CO157),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O158<>\"\",LEFT(O158,1)<>\"#\"),IF(LEFT(O158,1)=\"-\",REPLACE(O158,1,1,tech!$H$2),O158),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U158<>\"\",LEFT(U158,1)<>\"#\"),IF(LEFT(U158,1)=\"-\",REPLACE(U158,1,1,tech!$H$2),U158),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA158<>\"\",LEFT(AA158,1)<>\"#\"),IF(LEFT(AA158,1)=\"-\",REPLACE(AA158,1,1,tech!$H$2),AA158),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","Assessment","2.1.6.AX",{"$f":"IF(AND(AG158<>\"\",LEFT(AG158,1)<>\"#\"),IF(LEFT(AG158,1)=\"-\",REPLACE(AG158,1,1,tech!$H$2),AG158),\"\")","v":""},"|",null,"Certificate discovery process is documented","Guidance","2.2.5.GX",{"$f":"IF(AND(AM158<>\"\",LEFT(AM158,1)<>\"#\"),IF(LEFT(AM158,1)=\"-\",REPLACE(AM158,1,1,tech!$H$2),AM158),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS158<>\"\",LEFT(AS158,1)<>\"#\"),IF(LEFT(AS158,1)=\"-\",REPLACE(AS158,1,1,tech!$H$2),AS158),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY158<>\"\",LEFT(AY158,1)<>\"#\"),IF(LEFT(AY158,1)=\"-\",REPLACE(AY158,1,1,tech!$H$2),AY158),\"\")","v":""},"|",null,"Continual review and improvement","Guidance","3.1.6.GX",{"$f":"IF(AND(BE158<>\"\",LEFT(BE158,1)<>\"#\"),IF(LEFT(BE158,1)=\"-\",REPLACE(BE158,1,1,tech!$H$2),BE158),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK158<>\"\",LEFT(BK158,1)<>\"#\"),IF(LEFT(BK158,1)=\"-\",REPLACE(BK158,1,1,tech!$H$2),BK158),\"\")","v":""},"|","#### Assessment","Review of events and logs is periodically performed","Assessment","3.3.6.AX",{"$f":"IF(AND(BQ158<>\"\",LEFT(BQ158,1)<>\"#\"),IF(LEFT(BQ158,1)=\"-\",REPLACE(BQ158,1,1,tech!$H$2),BQ158),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW158<>\"\",LEFT(BW158,1)<>\"#\"),IF(LEFT(BW158,1)=\"-\",REPLACE(BW158,1,1,tech!$H$2),BW158),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC158<>\"\",LEFT(CC158,1)<>\"#\"),IF(LEFT(CC158,1)=\"-\",REPLACE(CC158,1,1,tech!$H$2),CC158),\"\")","v":""},"|","- [NIST SP 800-50 Building an Information Technology Security Awareness and Training Program](https://csrc.nist.gov/publications/detail/sp/800-50/final)","Periodically review knowledge","References","4.2.5.RY",{"$f":"IF(AND(CI158<>\"\",LEFT(CI158,1)<>\"#\"),IF(LEFT(CI158,1)=\"-\",REPLACE(CI158,1,1,tech!$H$2),CI158),\"\")","v":"• [NIST SP 800-50 Building an Information Technology Security Awareness and Training Program](https://csrc.nist.gov/publications/detail/sp/800-50/final)"},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO158<>\"\",LEFT(CO158,1)<>\"#\"),IF(LEFT(CO158,1)=\"-\",REPLACE(CO158,1,1,tech!$H$2),CO158),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O159<>\"\",LEFT(O159,1)<>\"#\"),IF(LEFT(O159,1)=\"-\",REPLACE(O159,1,1,tech!$H$2),O159),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U159<>\"\",LEFT(U159,1)<>\"#\"),IF(LEFT(U159,1)=\"-\",REPLACE(U159,1,1,tech!$H$2),U159),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA159<>\"\",LEFT(AA159,1)<>\"#\"),IF(LEFT(AA159,1)=\"-\",REPLACE(AA159,1,1,tech!$H$2),AA159),\"\")","v":""},"|","#### References","Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG159<>\"\",LEFT(AG159,1)<>\"#\"),IF(LEFT(AG159,1)=\"-\",REPLACE(AG159,1,1,tech!$H$2),AG159),\"\")","v":""},"|","#### Assessment","Certificate discovery process is documented","Assessment","2.2.5.AX",{"$f":"IF(AND(AM159<>\"\",LEFT(AM159,1)<>\"#\"),IF(LEFT(AM159,1)=\"-\",REPLACE(AM159,1,1,tech!$H$2),AM159),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS159<>\"\",LEFT(AS159,1)<>\"#\"),IF(LEFT(AS159,1)=\"-\",REPLACE(AS159,1,1,tech!$H$2),AS159),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY159<>\"\",LEFT(AY159,1)<>\"#\"),IF(LEFT(AY159,1)=\"-\",REPLACE(AY159,1,1,tech!$H$2),AY159),\"\")","v":""},"|","#### Assessment","Continual review and improvement","Assessment","3.1.6.AX",{"$f":"IF(AND(BE159<>\"\",LEFT(BE159,1)<>\"#\"),IF(LEFT(BE159,1)=\"-\",REPLACE(BE159,1,1,tech!$H$2),BE159),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK159<>\"\",LEFT(BK159,1)<>\"#\"),IF(LEFT(BK159,1)=\"-\",REPLACE(BK159,1,1,tech!$H$2),BK159),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","Assessment","3.3.6.AX",{"$f":"IF(AND(BQ159<>\"\",LEFT(BQ159,1)<>\"#\"),IF(LEFT(BQ159,1)=\"-\",REPLACE(BQ159,1,1,tech!$H$2),BQ159),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW159<>\"\",LEFT(BW159,1)<>\"#\"),IF(LEFT(BW159,1)=\"-\",REPLACE(BW159,1,1,tech!$H$2),BW159),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC159<>\"\",LEFT(CC159,1)<>\"#\"),IF(LEFT(CC159,1)=\"-\",REPLACE(CC159,1,1,tech!$H$2),CC159),\"\")","v":""},"|","- [European Cybersecurity Skills Framework (ECSF)](https://www.enisa.europa.eu/topics/education/european-cybersecurity-skills-framework)","Periodically review knowledge","References","4.2.5.RY",{"$f":"IF(AND(CI159<>\"\",LEFT(CI159,1)<>\"#\"),IF(LEFT(CI159,1)=\"-\",REPLACE(CI159,1,1,tech!$H$2),CI159),\"\")","v":"• [European Cybersecurity Skills Framework (ECSF)](https://www.enisa.europa.eu/topics/education/european-cybersecurity-skills-framework)"},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO159<>\"\",LEFT(CO159,1)<>\"#\"),IF(LEFT(CO159,1)=\"-\",REPLACE(CO159,1,1,tech!$H$2),CO159),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O160<>\"\",LEFT(O160,1)<>\"#\"),IF(LEFT(O160,1)=\"-\",REPLACE(O160,1,1,tech!$H$2),O160),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U160<>\"\",LEFT(U160,1)<>\"#\"),IF(LEFT(U160,1)=\"-\",REPLACE(U160,1,1,tech!$H$2),U160),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA160<>\"\",LEFT(AA160,1)<>\"#\"),IF(LEFT(AA160,1)=\"-\",REPLACE(AA160,1,1,tech!$H$2),AA160),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG160<>\"\",LEFT(AG160,1)<>\"#\"),IF(LEFT(AG160,1)=\"-\",REPLACE(AG160,1,1,tech!$H$2),AG160),\"\")","v":""},"|",null,"Certificate discovery process is documented","Assessment","2.2.5.AX",{"$f":"IF(AND(AM160<>\"\",LEFT(AM160,1)<>\"#\"),IF(LEFT(AM160,1)=\"-\",REPLACE(AM160,1,1,tech!$H$2),AM160),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS160<>\"\",LEFT(AS160,1)<>\"#\"),IF(LEFT(AS160,1)=\"-\",REPLACE(AS160,1,1,tech!$H$2),AS160),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY160<>\"\",LEFT(AY160,1)<>\"#\"),IF(LEFT(AY160,1)=\"-\",REPLACE(AY160,1,1,tech!$H$2),AY160),\"\")","v":""},"|",null,"Continual review and improvement","Assessment","3.1.6.AX",{"$f":"IF(AND(BE160<>\"\",LEFT(BE160,1)<>\"#\"),IF(LEFT(BE160,1)=\"-\",REPLACE(BE160,1,1,tech!$H$2),BE160),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK160<>\"\",LEFT(BK160,1)<>\"#\"),IF(LEFT(BK160,1)=\"-\",REPLACE(BK160,1,1,tech!$H$2),BK160),\"\")","v":""},"|","- Review of logs and events is performed Periodically","Review of events and logs is periodically performed","Assessment","3.3.6.AY",{"$f":"IF(AND(BQ160<>\"\",LEFT(BQ160,1)<>\"#\"),IF(LEFT(BQ160,1)=\"-\",REPLACE(BQ160,1,1,tech!$H$2),BQ160),\"\")","v":"• Review of logs and events is performed Periodically"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW160<>\"\",LEFT(BW160,1)<>\"#\"),IF(LEFT(BW160,1)=\"-\",REPLACE(BW160,1,1,tech!$H$2),BW160),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC160<>\"\",LEFT(CC160,1)<>\"#\"),IF(LEFT(CC160,1)=\"-\",REPLACE(CC160,1,1,tech!$H$2),CC160),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI160<>\"\",LEFT(CI160,1)<>\"#\"),IF(LEFT(CI160,1)=\"-\",REPLACE(CI160,1,1,tech!$H$2),CI160),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO160<>\"\",LEFT(CO160,1)<>\"#\"),IF(LEFT(CO160,1)=\"-\",REPLACE(CO160,1,1,tech!$H$2),CO160),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O161<>\"\",LEFT(O161,1)<>\"#\"),IF(LEFT(O161,1)=\"-\",REPLACE(O161,1,1,tech!$H$2),O161),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U161<>\"\",LEFT(U161,1)<>\"#\"),IF(LEFT(U161,1)=\"-\",REPLACE(U161,1,1,tech!$H$2),U161),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA161<>\"\",LEFT(AA161,1)<>\"#\"),IF(LEFT(AA161,1)=\"-\",REPLACE(AA161,1,1,tech!$H$2),AA161),\"\")","v":""},"|","- [ISO/IEC 27001 and related standards](https://www.iso.org/isoiec-27001-information-security.html)","Key management is periodically reviewed and updated","References","2.1.6.RY",{"$f":"IF(AND(AG161<>\"\",LEFT(AG161,1)<>\"#\"),IF(LEFT(AG161,1)=\"-\",REPLACE(AG161,1,1,tech!$H$2),AG161),\"\")","v":"• [ISO/IEC 27001 and related standards](https://www.iso.org/isoiec-27001-information-security.html)"},"|","* Documented certificate discovery requirements","Certificate discovery process is documented","Assessment","2.2.5.AY",{"$f":"IF(AND(AM161<>\"\",LEFT(AM161,1)<>\"#\"),IF(LEFT(AM161,1)=\"-\",REPLACE(AM161,1,1,tech!$H$2),AM161),\"\")","v":"* Documented certificate discovery requirements"},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS161<>\"\",LEFT(AS161,1)<>\"#\"),IF(LEFT(AS161,1)=\"-\",REPLACE(AS161,1,1,tech!$H$2),AS161),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY161<>\"\",LEFT(AY161,1)<>\"#\"),IF(LEFT(AY161,1)=\"-\",REPLACE(AY161,1,1,tech!$H$2),AY161),\"\")","v":""},"|","The following is sample evidence that can be used to assess the requirement:","Continual review and improvement","Assessment","3.1.6.AY",{"$f":"IF(AND(BE161<>\"\",LEFT(BE161,1)<>\"#\"),IF(LEFT(BE161,1)=\"-\",REPLACE(BE161,1,1,tech!$H$2),BE161),\"\")","v":"The following is sample evidence that can be used to assess the requirement:"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK161<>\"\",LEFT(BK161,1)<>\"#\"),IF(LEFT(BK161,1)=\"-\",REPLACE(BK161,1,1,tech!$H$2),BK161),\"\")","v":""},"|","- Review of logs and events is performed according to the requirements","Review of events and logs is periodically performed","Assessment","3.3.6.AY",{"$f":"IF(AND(BQ161<>\"\",LEFT(BQ161,1)<>\"#\"),IF(LEFT(BQ161,1)=\"-\",REPLACE(BQ161,1,1,tech!$H$2),BQ161),\"\")","v":"• Review of logs and events is performed according to the requirements"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW161<>\"\",LEFT(BW161,1)<>\"#\"),IF(LEFT(BW161,1)=\"-\",REPLACE(BW161,1,1,tech!$H$2),BW161),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC161<>\"\",LEFT(CC161,1)<>\"#\"),IF(LEFT(CC161,1)=\"-\",REPLACE(CC161,1,1,tech!$H$2),CC161),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI161<>\"\",LEFT(CI161,1)<>\"#\"),IF(LEFT(CI161,1)=\"-\",REPLACE(CI161,1,1,tech!$H$2),CI161),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO161<>\"\",LEFT(CO161,1)<>\"#\"),IF(LEFT(CO161,1)=\"-\",REPLACE(CO161,1,1,tech!$H$2),CO161),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O162<>\"\",LEFT(O162,1)<>\"#\"),IF(LEFT(O162,1)=\"-\",REPLACE(O162,1,1,tech!$H$2),O162),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U162<>\"\",LEFT(U162,1)<>\"#\"),IF(LEFT(U162,1)=\"-\",REPLACE(U162,1,1,tech!$H$2),U162),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA162<>\"\",LEFT(AA162,1)<>\"#\"),IF(LEFT(AA162,1)=\"-\",REPLACE(AA162,1,1,tech!$H$2),AA162),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG162<>\"\",LEFT(AG162,1)<>\"#\"),IF(LEFT(AG162,1)=\"-\",REPLACE(AG162,1,1,tech!$H$2),AG162),\"\")","v":""},"|","* Documented certificate discovery process and frequency","Certificate discovery process is documented","Assessment","2.2.5.AY",{"$f":"IF(AND(AM162<>\"\",LEFT(AM162,1)<>\"#\"),IF(LEFT(AM162,1)=\"-\",REPLACE(AM162,1,1,tech!$H$2),AM162),\"\")","v":"* Documented certificate discovery process and frequency"},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS162<>\"\",LEFT(AS162,1)<>\"#\"),IF(LEFT(AS162,1)=\"-\",REPLACE(AS162,1,1,tech!$H$2),AS162),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY162<>\"\",LEFT(AY162,1)<>\"#\"),IF(LEFT(AY162,1)=\"-\",REPLACE(AY162,1,1,tech!$H$2),AY162),\"\")","v":""},"|","- resilience effectiveness Review frequency","Continual review and improvement","Assessment","3.1.6.AY",{"$f":"IF(AND(BE162<>\"\",LEFT(BE162,1)<>\"#\"),IF(LEFT(BE162,1)=\"-\",REPLACE(BE162,1,1,tech!$H$2),BE162),\"\")","v":"• resilience effectiveness Review frequency"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK162<>\"\",LEFT(BK162,1)<>\"#\"),IF(LEFT(BK162,1)=\"-\",REPLACE(BK162,1,1,tech!$H$2),BK162),\"\")","v":""},"|","- Review of logs and events is confirmed by authorized personnel","Review of events and logs is periodically performed","Assessment","3.3.6.AY",{"$f":"IF(AND(BQ162<>\"\",LEFT(BQ162,1)<>\"#\"),IF(LEFT(BQ162,1)=\"-\",REPLACE(BQ162,1,1,tech!$H$2),BQ162),\"\")","v":"• Review of logs and events is confirmed by authorized personnel"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW162<>\"\",LEFT(BW162,1)<>\"#\"),IF(LEFT(BW162,1)=\"-\",REPLACE(BW162,1,1,tech!$H$2),BW162),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC162<>\"\",LEFT(CC162,1)<>\"#\"),IF(LEFT(CC162,1)=\"-\",REPLACE(CC162,1,1,tech!$H$2),CC162),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI162<>\"\",LEFT(CI162,1)<>\"#\"),IF(LEFT(CI162,1)=\"-\",REPLACE(CI162,1,1,tech!$H$2),CI162),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO162<>\"\",LEFT(CO162,1)<>\"#\"),IF(LEFT(CO162,1)=\"-\",REPLACE(CO162,1,1,tech!$H$2),CO162),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O163<>\"\",LEFT(O163,1)<>\"#\"),IF(LEFT(O163,1)=\"-\",REPLACE(O163,1,1,tech!$H$2),O163),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U163<>\"\",LEFT(U163,1)<>\"#\"),IF(LEFT(U163,1)=\"-\",REPLACE(U163,1,1,tech!$H$2),U163),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA163<>\"\",LEFT(AA163,1)<>\"#\"),IF(LEFT(AA163,1)=\"-\",REPLACE(AA163,1,1,tech!$H$2),AA163),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG163<>\"\",LEFT(AG163,1)<>\"#\"),IF(LEFT(AG163,1)=\"-\",REPLACE(AG163,1,1,tech!$H$2),AG163),\"\")","v":""},"|","* The supporting tools for the certificate discovery","Certificate discovery process is documented","Assessment","2.2.5.AY",{"$f":"IF(AND(AM163<>\"\",LEFT(AM163,1)<>\"#\"),IF(LEFT(AM163,1)=\"-\",REPLACE(AM163,1,1,tech!$H$2),AM163),\"\")","v":"* The supporting tools for the certificate discovery"},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS163<>\"\",LEFT(AS163,1)<>\"#\"),IF(LEFT(AS163,1)=\"-\",REPLACE(AS163,1,1,tech!$H$2),AS163),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY163<>\"\",LEFT(AY163,1)<>\"#\"),IF(LEFT(AY163,1)=\"-\",REPLACE(AY163,1,1,tech!$H$2),AY163),\"\")","v":""},"|","- implementation of Review process","Continual review and improvement","Assessment","3.1.6.AY",{"$f":"IF(AND(BE163<>\"\",LEFT(BE163,1)<>\"#\"),IF(LEFT(BE163,1)=\"-\",REPLACE(BE163,1,1,tech!$H$2),BE163),\"\")","v":"• implementation of Review process"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK163<>\"\",LEFT(BK163,1)<>\"#\"),IF(LEFT(BK163,1)=\"-\",REPLACE(BK163,1,1,tech!$H$2),BK163),\"\")","v":""},"|","- Interview with personnel responsible for Review of logs and events","Review of events and logs is periodically performed","Assessment","3.3.6.AY",{"$f":"IF(AND(BQ163<>\"\",LEFT(BQ163,1)<>\"#\"),IF(LEFT(BQ163,1)=\"-\",REPLACE(BQ163,1,1,tech!$H$2),BQ163),\"\")","v":"• Interview with personnel responsible for Review of logs and events"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW163<>\"\",LEFT(BW163,1)<>\"#\"),IF(LEFT(BW163,1)=\"-\",REPLACE(BW163,1,1,tech!$H$2),BW163),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC163<>\"\",LEFT(CC163,1)<>\"#\"),IF(LEFT(CC163,1)=\"-\",REPLACE(CC163,1,1,tech!$H$2),CC163),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI163<>\"\",LEFT(CI163,1)<>\"#\"),IF(LEFT(CI163,1)=\"-\",REPLACE(CI163,1,1,tech!$H$2),CI163),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO163<>\"\",LEFT(CO163,1)<>\"#\"),IF(LEFT(CO163,1)=\"-\",REPLACE(CO163,1,1,tech!$H$2),CO163),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O164<>\"\",LEFT(O164,1)<>\"#\"),IF(LEFT(O164,1)=\"-\",REPLACE(O164,1,1,tech!$H$2),O164),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U164<>\"\",LEFT(U164,1)<>\"#\"),IF(LEFT(U164,1)=\"-\",REPLACE(U164,1,1,tech!$H$2),U164),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA164<>\"\",LEFT(AA164,1)<>\"#\"),IF(LEFT(AA164,1)=\"-\",REPLACE(AA164,1,1,tech!$H$2),AA164),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG164<>\"\",LEFT(AG164,1)<>\"#\"),IF(LEFT(AG164,1)=\"-\",REPLACE(AG164,1,1,tech!$H$2),AG164),\"\")","v":""},"|","* Certificate inventory is updated with discovered certificates","Certificate discovery process is documented","Assessment","2.2.5.AY",{"$f":"IF(AND(AM164<>\"\",LEFT(AM164,1)<>\"#\"),IF(LEFT(AM164,1)=\"-\",REPLACE(AM164,1,1,tech!$H$2),AM164),\"\")","v":"* Certificate inventory is updated with discovered certificates"},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS164<>\"\",LEFT(AS164,1)<>\"#\"),IF(LEFT(AS164,1)=\"-\",REPLACE(AS164,1,1,tech!$H$2),AS164),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY164<>\"\",LEFT(AY164,1)<>\"#\"),IF(LEFT(AY164,1)=\"-\",REPLACE(AY164,1,1,tech!$H$2),AY164),\"\")","v":""},"|","- Validation of documentation and reviews","Continual review and improvement","Assessment","3.1.6.AY",{"$f":"IF(AND(BE164<>\"\",LEFT(BE164,1)<>\"#\"),IF(LEFT(BE164,1)=\"-\",REPLACE(BE164,1,1,tech!$H$2),BE164),\"\")","v":"• Validation of documentation and reviews"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK164<>\"\",LEFT(BK164,1)<>\"#\"),IF(LEFT(BK164,1)=\"-\",REPLACE(BK164,1,1,tech!$H$2),BK164),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","Assessment","3.3.6.AX",{"$f":"IF(AND(BQ164<>\"\",LEFT(BQ164,1)<>\"#\"),IF(LEFT(BQ164,1)=\"-\",REPLACE(BQ164,1,1,tech!$H$2),BQ164),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW164<>\"\",LEFT(BW164,1)<>\"#\"),IF(LEFT(BW164,1)=\"-\",REPLACE(BW164,1,1,tech!$H$2),BW164),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC164<>\"\",LEFT(CC164,1)<>\"#\"),IF(LEFT(CC164,1)=\"-\",REPLACE(CC164,1,1,tech!$H$2),CC164),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI164<>\"\",LEFT(CI164,1)<>\"#\"),IF(LEFT(CI164,1)=\"-\",REPLACE(CI164,1,1,tech!$H$2),CI164),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO164<>\"\",LEFT(CO164,1)<>\"#\"),IF(LEFT(CO164,1)=\"-\",REPLACE(CO164,1,1,tech!$H$2),CO164),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O165<>\"\",LEFT(O165,1)<>\"#\"),IF(LEFT(O165,1)=\"-\",REPLACE(O165,1,1,tech!$H$2),O165),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U165<>\"\",LEFT(U165,1)<>\"#\"),IF(LEFT(U165,1)=\"-\",REPLACE(U165,1,1,tech!$H$2),U165),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA165<>\"\",LEFT(AA165,1)<>\"#\"),IF(LEFT(AA165,1)=\"-\",REPLACE(AA165,1,1,tech!$H$2),AA165),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG165<>\"\",LEFT(AG165,1)<>\"#\"),IF(LEFT(AG165,1)=\"-\",REPLACE(AG165,1,1,tech!$H$2),AG165),\"\")","v":""},"|",null,"Certificate discovery process is documented","Assessment","2.2.5.AX",{"$f":"IF(AND(AM165<>\"\",LEFT(AM165,1)<>\"#\"),IF(LEFT(AM165,1)=\"-\",REPLACE(AM165,1,1,tech!$H$2),AM165),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS165<>\"\",LEFT(AS165,1)<>\"#\"),IF(LEFT(AS165,1)=\"-\",REPLACE(AS165,1,1,tech!$H$2),AS165),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY165<>\"\",LEFT(AY165,1)<>\"#\"),IF(LEFT(AY165,1)=\"-\",REPLACE(AY165,1,1,tech!$H$2),AY165),\"\")","v":""},"|","- Training records","Continual review and improvement","Assessment","3.1.6.AY",{"$f":"IF(AND(BE165<>\"\",LEFT(BE165,1)<>\"#\"),IF(LEFT(BE165,1)=\"-\",REPLACE(BE165,1,1,tech!$H$2),BE165),\"\")","v":"• Training records"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK165<>\"\",LEFT(BK165,1)<>\"#\"),IF(LEFT(BK165,1)=\"-\",REPLACE(BK165,1,1,tech!$H$2),BK165),\"\")","v":""},"|","#### References","Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ165<>\"\",LEFT(BQ165,1)<>\"#\"),IF(LEFT(BQ165,1)=\"-\",REPLACE(BQ165,1,1,tech!$H$2),BQ165),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW165<>\"\",LEFT(BW165,1)<>\"#\"),IF(LEFT(BW165,1)=\"-\",REPLACE(BW165,1,1,tech!$H$2),BW165),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC165<>\"\",LEFT(CC165,1)<>\"#\"),IF(LEFT(CC165,1)=\"-\",REPLACE(CC165,1,1,tech!$H$2),CC165),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI165<>\"\",LEFT(CI165,1)<>\"#\"),IF(LEFT(CI165,1)=\"-\",REPLACE(CI165,1,1,tech!$H$2),CI165),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO165<>\"\",LEFT(CO165,1)<>\"#\"),IF(LEFT(CO165,1)=\"-\",REPLACE(CO165,1,1,tech!$H$2),CO165),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O166<>\"\",LEFT(O166,1)<>\"#\"),IF(LEFT(O166,1)=\"-\",REPLACE(O166,1,1,tech!$H$2),O166),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U166<>\"\",LEFT(U166,1)<>\"#\"),IF(LEFT(U166,1)=\"-\",REPLACE(U166,1,1,tech!$H$2),U166),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA166<>\"\",LEFT(AA166,1)<>\"#\"),IF(LEFT(AA166,1)=\"-\",REPLACE(AA166,1,1,tech!$H$2),AA166),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG166<>\"\",LEFT(AG166,1)<>\"#\"),IF(LEFT(AG166,1)=\"-\",REPLACE(AG166,1,1,tech!$H$2),AG166),\"\")","v":""},"|","#### References","Certificate discovery process is documented","References","2.2.5.RX",{"$f":"IF(AND(AM166<>\"\",LEFT(AM166,1)<>\"#\"),IF(LEFT(AM166,1)=\"-\",REPLACE(AM166,1,1,tech!$H$2),AM166),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS166<>\"\",LEFT(AS166,1)<>\"#\"),IF(LEFT(AS166,1)=\"-\",REPLACE(AS166,1,1,tech!$H$2),AS166),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY166<>\"\",LEFT(AY166,1)<>\"#\"),IF(LEFT(AY166,1)=\"-\",REPLACE(AY166,1,1,tech!$H$2),AY166),\"\")","v":""},"|",null,"Continual review and improvement","Assessment","3.1.6.AX",{"$f":"IF(AND(BE166<>\"\",LEFT(BE166,1)<>\"#\"),IF(LEFT(BE166,1)=\"-\",REPLACE(BE166,1,1,tech!$H$2),BE166),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK166<>\"\",LEFT(BK166,1)<>\"#\"),IF(LEFT(BK166,1)=\"-\",REPLACE(BK166,1,1,tech!$H$2),BK166),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ166<>\"\",LEFT(BQ166,1)<>\"#\"),IF(LEFT(BQ166,1)=\"-\",REPLACE(BQ166,1,1,tech!$H$2),BQ166),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW166<>\"\",LEFT(BW166,1)<>\"#\"),IF(LEFT(BW166,1)=\"-\",REPLACE(BW166,1,1,tech!$H$2),BW166),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC166<>\"\",LEFT(CC166,1)<>\"#\"),IF(LEFT(CC166,1)=\"-\",REPLACE(CC166,1,1,tech!$H$2),CC166),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI166<>\"\",LEFT(CI166,1)<>\"#\"),IF(LEFT(CI166,1)=\"-\",REPLACE(CI166,1,1,tech!$H$2),CI166),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO166<>\"\",LEFT(CO166,1)<>\"#\"),IF(LEFT(CO166,1)=\"-\",REPLACE(CO166,1,1,tech!$H$2),CO166),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O167<>\"\",LEFT(O167,1)<>\"#\"),IF(LEFT(O167,1)=\"-\",REPLACE(O167,1,1,tech!$H$2),O167),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U167<>\"\",LEFT(U167,1)<>\"#\"),IF(LEFT(U167,1)=\"-\",REPLACE(U167,1,1,tech!$H$2),U167),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA167<>\"\",LEFT(AA167,1)<>\"#\"),IF(LEFT(AA167,1)=\"-\",REPLACE(AA167,1,1,tech!$H$2),AA167),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG167<>\"\",LEFT(AG167,1)<>\"#\"),IF(LEFT(AG167,1)=\"-\",REPLACE(AG167,1,1,tech!$H$2),AG167),\"\")","v":""},"|",null,"Certificate discovery process is documented","References","2.2.5.RX",{"$f":"IF(AND(AM167<>\"\",LEFT(AM167,1)<>\"#\"),IF(LEFT(AM167,1)=\"-\",REPLACE(AM167,1,1,tech!$H$2),AM167),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS167<>\"\",LEFT(AS167,1)<>\"#\"),IF(LEFT(AS167,1)=\"-\",REPLACE(AS167,1,1,tech!$H$2),AS167),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY167<>\"\",LEFT(AY167,1)<>\"#\"),IF(LEFT(AY167,1)=\"-\",REPLACE(AY167,1,1,tech!$H$2),AY167),\"\")","v":""},"|","#### References","Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE167<>\"\",LEFT(BE167,1)<>\"#\"),IF(LEFT(BE167,1)=\"-\",REPLACE(BE167,1,1,tech!$H$2),BE167),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK167<>\"\",LEFT(BK167,1)<>\"#\"),IF(LEFT(BK167,1)=\"-\",REPLACE(BK167,1,1,tech!$H$2),BK167),\"\")","v":""},"|","- [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)","Review of events and logs is periodically performed","References","3.3.6.RY",{"$f":"IF(AND(BQ167<>\"\",LEFT(BQ167,1)<>\"#\"),IF(LEFT(BQ167,1)=\"-\",REPLACE(BQ167,1,1,tech!$H$2),BQ167),\"\")","v":"• [ISO/IEC 27001 - Information security management systems](https://www.iso.org/standard/54534.html)"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW167<>\"\",LEFT(BW167,1)<>\"#\"),IF(LEFT(BW167,1)=\"-\",REPLACE(BW167,1,1,tech!$H$2),BW167),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC167<>\"\",LEFT(CC167,1)<>\"#\"),IF(LEFT(CC167,1)=\"-\",REPLACE(CC167,1,1,tech!$H$2),CC167),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI167<>\"\",LEFT(CI167,1)<>\"#\"),IF(LEFT(CI167,1)=\"-\",REPLACE(CI167,1,1,tech!$H$2),CI167),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO167<>\"\",LEFT(CO167,1)<>\"#\"),IF(LEFT(CO167,1)=\"-\",REPLACE(CO167,1,1,tech!$H$2),CO167),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O168<>\"\",LEFT(O168,1)<>\"#\"),IF(LEFT(O168,1)=\"-\",REPLACE(O168,1,1,tech!$H$2),O168),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U168<>\"\",LEFT(U168,1)<>\"#\"),IF(LEFT(U168,1)=\"-\",REPLACE(U168,1,1,tech!$H$2),U168),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA168<>\"\",LEFT(AA168,1)<>\"#\"),IF(LEFT(AA168,1)=\"-\",REPLACE(AA168,1,1,tech!$H$2),AA168),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG168<>\"\",LEFT(AG168,1)<>\"#\"),IF(LEFT(AG168,1)=\"-\",REPLACE(AG168,1,1,tech!$H$2),AG168),\"\")","v":""},"|","### Certificate management is periodically reviewed and updated","Certificate management is periodically reviewed and updated","References","2.2.6.RX",{"$f":"IF(AND(AM168<>\"\",LEFT(AM168,1)<>\"#\"),IF(LEFT(AM168,1)=\"-\",REPLACE(AM168,1,1,tech!$H$2),AM168),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS168<>\"\",LEFT(AS168,1)<>\"#\"),IF(LEFT(AS168,1)=\"-\",REPLACE(AS168,1,1,tech!$H$2),AS168),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY168<>\"\",LEFT(AY168,1)<>\"#\"),IF(LEFT(AY168,1)=\"-\",REPLACE(AY168,1,1,tech!$H$2),AY168),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE168<>\"\",LEFT(BE168,1)<>\"#\"),IF(LEFT(BE168,1)=\"-\",REPLACE(BE168,1,1,tech!$H$2),BE168),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK168<>\"\",LEFT(BK168,1)<>\"#\"),IF(LEFT(BK168,1)=\"-\",REPLACE(BK168,1,1,tech!$H$2),BK168),\"\")","v":""},"|","- [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)","Review of events and logs is periodically performed","References","3.3.6.RY",{"$f":"IF(AND(BQ168<>\"\",LEFT(BQ168,1)<>\"#\"),IF(LEFT(BQ168,1)=\"-\",REPLACE(BQ168,1,1,tech!$H$2),BQ168),\"\")","v":"• [ISO/IEC 20000 and related standards](https://www.iso.org/standard/70636.html)"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW168<>\"\",LEFT(BW168,1)<>\"#\"),IF(LEFT(BW168,1)=\"-\",REPLACE(BW168,1,1,tech!$H$2),BW168),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC168<>\"\",LEFT(CC168,1)<>\"#\"),IF(LEFT(CC168,1)=\"-\",REPLACE(CC168,1,1,tech!$H$2),CC168),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI168<>\"\",LEFT(CI168,1)<>\"#\"),IF(LEFT(CI168,1)=\"-\",REPLACE(CI168,1,1,tech!$H$2),CI168),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO168<>\"\",LEFT(CO168,1)<>\"#\"),IF(LEFT(CO168,1)=\"-\",REPLACE(CO168,1,1,tech!$H$2),CO168),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O169<>\"\",LEFT(O169,1)<>\"#\"),IF(LEFT(O169,1)=\"-\",REPLACE(O169,1,1,tech!$H$2),O169),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U169<>\"\",LEFT(U169,1)<>\"#\"),IF(LEFT(U169,1)=\"-\",REPLACE(U169,1,1,tech!$H$2),U169),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA169<>\"\",LEFT(AA169,1)<>\"#\"),IF(LEFT(AA169,1)=\"-\",REPLACE(AA169,1,1,tech!$H$2),AA169),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG169<>\"\",LEFT(AG169,1)<>\"#\"),IF(LEFT(AG169,1)=\"-\",REPLACE(AG169,1,1,tech!$H$2),AG169),\"\")","v":""},"|",null,"Certificate management is periodically reviewed and updated","References","2.2.6.RX",{"$f":"IF(AND(AM169<>\"\",LEFT(AM169,1)<>\"#\"),IF(LEFT(AM169,1)=\"-\",REPLACE(AM169,1,1,tech!$H$2),AM169),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS169<>\"\",LEFT(AS169,1)<>\"#\"),IF(LEFT(AS169,1)=\"-\",REPLACE(AS169,1,1,tech!$H$2),AS169),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY169<>\"\",LEFT(AY169,1)<>\"#\"),IF(LEFT(AY169,1)=\"-\",REPLACE(AY169,1,1,tech!$H$2),AY169),\"\")","v":""},"|","- [ISO 223XX Security and resilience standards](https://www.iso.org/standard/77008.html)","Continual review and improvement","References","3.1.6.RY",{"$f":"IF(AND(BE169<>\"\",LEFT(BE169,1)<>\"#\"),IF(LEFT(BE169,1)=\"-\",REPLACE(BE169,1,1,tech!$H$2),BE169),\"\")","v":"• [ISO 223XX Security and resilience standards](https://www.iso.org/standard/77008.html)"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK169<>\"\",LEFT(BK169,1)<>\"#\"),IF(LEFT(BK169,1)=\"-\",REPLACE(BK169,1,1,tech!$H$2),BK169),\"\")","v":""},"|","- [NIST - Guide to Computer Security Log Management](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf)","Review of events and logs is periodically performed","References","3.3.6.RY",{"$f":"IF(AND(BQ169<>\"\",LEFT(BQ169,1)<>\"#\"),IF(LEFT(BQ169,1)=\"-\",REPLACE(BQ169,1,1,tech!$H$2),BQ169),\"\")","v":"• [NIST - Guide to Computer Security Log Management](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf)"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW169<>\"\",LEFT(BW169,1)<>\"#\"),IF(LEFT(BW169,1)=\"-\",REPLACE(BW169,1,1,tech!$H$2),BW169),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC169<>\"\",LEFT(CC169,1)<>\"#\"),IF(LEFT(CC169,1)=\"-\",REPLACE(CC169,1,1,tech!$H$2),CC169),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI169<>\"\",LEFT(CI169,1)<>\"#\"),IF(LEFT(CI169,1)=\"-\",REPLACE(CI169,1,1,tech!$H$2),CI169),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO169<>\"\",LEFT(CO169,1)<>\"#\"),IF(LEFT(CO169,1)=\"-\",REPLACE(CO169,1,1,tech!$H$2),CO169),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O170<>\"\",LEFT(O170,1)<>\"#\"),IF(LEFT(O170,1)=\"-\",REPLACE(O170,1,1,tech!$H$2),O170),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U170<>\"\",LEFT(U170,1)<>\"#\"),IF(LEFT(U170,1)=\"-\",REPLACE(U170,1,1,tech!$H$2),U170),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA170<>\"\",LEFT(AA170,1)<>\"#\"),IF(LEFT(AA170,1)=\"-\",REPLACE(AA170,1,1,tech!$H$2),AA170),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG170<>\"\",LEFT(AG170,1)<>\"#\"),IF(LEFT(AG170,1)=\"-\",REPLACE(AG170,1,1,tech!$H$2),AG170),\"\")","v":""},"|","#### Guidance","Certificate management is periodically reviewed and updated","Guidance","2.2.6.GX",{"$f":"IF(AND(AM170<>\"\",LEFT(AM170,1)<>\"#\"),IF(LEFT(AM170,1)=\"-\",REPLACE(AM170,1,1,tech!$H$2),AM170),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS170<>\"\",LEFT(AS170,1)<>\"#\"),IF(LEFT(AS170,1)=\"-\",REPLACE(AS170,1,1,tech!$H$2),AS170),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY170<>\"\",LEFT(AY170,1)<>\"#\"),IF(LEFT(AY170,1)=\"-\",REPLACE(AY170,1,1,tech!$H$2),AY170),\"\")","v":""},"|","- [NIST Special Publications 800 - 30, 34, 37, 46, 53, 84](https://csrc.nist.gov/publications)","Continual review and improvement","References","3.1.6.RY",{"$f":"IF(AND(BE170<>\"\",LEFT(BE170,1)<>\"#\"),IF(LEFT(BE170,1)=\"-\",REPLACE(BE170,1,1,tech!$H$2),BE170),\"\")","v":"• [NIST Special Publications 800 - 30, 34, 37, 46, 53, 84](https://csrc.nist.gov/publications)"},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK170<>\"\",LEFT(BK170,1)<>\"#\"),IF(LEFT(BK170,1)=\"-\",REPLACE(BK170,1,1,tech!$H$2),BK170),\"\")","v":""},"|","- [ISO/IEC 27099 - Public key infrastructure](https://www.iso.org/standard/56590.html)","Review of events and logs is periodically performed","References","3.3.6.RY",{"$f":"IF(AND(BQ170<>\"\",LEFT(BQ170,1)<>\"#\"),IF(LEFT(BQ170,1)=\"-\",REPLACE(BQ170,1,1,tech!$H$2),BQ170),\"\")","v":"• [ISO/IEC 27099 - Public key infrastructure](https://www.iso.org/standard/56590.html)"},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW170<>\"\",LEFT(BW170,1)<>\"#\"),IF(LEFT(BW170,1)=\"-\",REPLACE(BW170,1,1,tech!$H$2),BW170),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC170<>\"\",LEFT(CC170,1)<>\"#\"),IF(LEFT(CC170,1)=\"-\",REPLACE(CC170,1,1,tech!$H$2),CC170),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI170<>\"\",LEFT(CI170,1)<>\"#\"),IF(LEFT(CI170,1)=\"-\",REPLACE(CI170,1,1,tech!$H$2),CI170),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO170<>\"\",LEFT(CO170,1)<>\"#\"),IF(LEFT(CO170,1)=\"-\",REPLACE(CO170,1,1,tech!$H$2),CO170),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O171<>\"\",LEFT(O171,1)<>\"#\"),IF(LEFT(O171,1)=\"-\",REPLACE(O171,1,1,tech!$H$2),O171),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U171<>\"\",LEFT(U171,1)<>\"#\"),IF(LEFT(U171,1)=\"-\",REPLACE(U171,1,1,tech!$H$2),U171),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA171<>\"\",LEFT(AA171,1)<>\"#\"),IF(LEFT(AA171,1)=\"-\",REPLACE(AA171,1,1,tech!$H$2),AA171),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG171<>\"\",LEFT(AG171,1)<>\"#\"),IF(LEFT(AG171,1)=\"-\",REPLACE(AG171,1,1,tech!$H$2),AG171),\"\")","v":""},"|",null,"Certificate management is periodically reviewed and updated","Guidance","2.2.6.GX",{"$f":"IF(AND(AM171<>\"\",LEFT(AM171,1)<>\"#\"),IF(LEFT(AM171,1)=\"-\",REPLACE(AM171,1,1,tech!$H$2),AM171),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS171<>\"\",LEFT(AS171,1)<>\"#\"),IF(LEFT(AS171,1)=\"-\",REPLACE(AS171,1,1,tech!$H$2),AS171),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY171<>\"\",LEFT(AY171,1)<>\"#\"),IF(LEFT(AY171,1)=\"-\",REPLACE(AY171,1,1,tech!$H$2),AY171),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE171<>\"\",LEFT(BE171,1)<>\"#\"),IF(LEFT(BE171,1)=\"-\",REPLACE(BE171,1,1,tech!$H$2),BE171),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK171<>\"\",LEFT(BK171,1)<>\"#\"),IF(LEFT(BK171,1)=\"-\",REPLACE(BK171,1,1,tech!$H$2),BK171),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ171<>\"\",LEFT(BQ171,1)<>\"#\"),IF(LEFT(BQ171,1)=\"-\",REPLACE(BQ171,1,1,tech!$H$2),BQ171),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW171<>\"\",LEFT(BW171,1)<>\"#\"),IF(LEFT(BW171,1)=\"-\",REPLACE(BW171,1,1,tech!$H$2),BW171),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC171<>\"\",LEFT(CC171,1)<>\"#\"),IF(LEFT(CC171,1)=\"-\",REPLACE(CC171,1,1,tech!$H$2),CC171),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI171<>\"\",LEFT(CI171,1)<>\"#\"),IF(LEFT(CI171,1)=\"-\",REPLACE(CI171,1,1,tech!$H$2),CI171),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO171<>\"\",LEFT(CO171,1)<>\"#\"),IF(LEFT(CO171,1)=\"-\",REPLACE(CO171,1,1,tech!$H$2),CO171),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O172<>\"\",LEFT(O172,1)<>\"#\"),IF(LEFT(O172,1)=\"-\",REPLACE(O172,1,1,tech!$H$2),O172),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U172<>\"\",LEFT(U172,1)<>\"#\"),IF(LEFT(U172,1)=\"-\",REPLACE(U172,1,1,tech!$H$2),U172),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA172<>\"\",LEFT(AA172,1)<>\"#\"),IF(LEFT(AA172,1)=\"-\",REPLACE(AA172,1,1,tech!$H$2),AA172),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG172<>\"\",LEFT(AG172,1)<>\"#\"),IF(LEFT(AG172,1)=\"-\",REPLACE(AG172,1,1,tech!$H$2),AG172),\"\")","v":""},"|","No certificate issuance and management system works over long periods of time without changes to use-cases, processes, protocols and algorithms. It is important that the certificate management is periodically reviewed and updated to avoid gaps. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends.","Certificate management is periodically reviewed and updated","Guidance","2.2.6.GY",{"$f":"IF(AND(AM172<>\"\",LEFT(AM172,1)<>\"#\"),IF(LEFT(AM172,1)=\"-\",REPLACE(AM172,1,1,tech!$H$2),AM172),\"\")","v":"No certificate issuance and management system works over long periods of time without changes to use-cases, processes, protocols and algorithms. It is important that the certificate management is periodically reviewed and updated to avoid gaps. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends."},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS172<>\"\",LEFT(AS172,1)<>\"#\"),IF(LEFT(AS172,1)=\"-\",REPLACE(AS172,1,1,tech!$H$2),AS172),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY172<>\"\",LEFT(AY172,1)<>\"#\"),IF(LEFT(AY172,1)=\"-\",REPLACE(AY172,1,1,tech!$H$2),AY172),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE172<>\"\",LEFT(BE172,1)<>\"#\"),IF(LEFT(BE172,1)=\"-\",REPLACE(BE172,1,1,tech!$H$2),BE172),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK172<>\"\",LEFT(BK172,1)<>\"#\"),IF(LEFT(BK172,1)=\"-\",REPLACE(BK172,1,1,tech!$H$2),BK172),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ172<>\"\",LEFT(BQ172,1)<>\"#\"),IF(LEFT(BQ172,1)=\"-\",REPLACE(BQ172,1,1,tech!$H$2),BQ172),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW172<>\"\",LEFT(BW172,1)<>\"#\"),IF(LEFT(BW172,1)=\"-\",REPLACE(BW172,1,1,tech!$H$2),BW172),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC172<>\"\",LEFT(CC172,1)<>\"#\"),IF(LEFT(CC172,1)=\"-\",REPLACE(CC172,1,1,tech!$H$2),CC172),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI172<>\"\",LEFT(CI172,1)<>\"#\"),IF(LEFT(CI172,1)=\"-\",REPLACE(CI172,1,1,tech!$H$2),CI172),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO172<>\"\",LEFT(CO172,1)<>\"#\"),IF(LEFT(CO172,1)=\"-\",REPLACE(CO172,1,1,tech!$H$2),CO172),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O173<>\"\",LEFT(O173,1)<>\"#\"),IF(LEFT(O173,1)=\"-\",REPLACE(O173,1,1,tech!$H$2),O173),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U173<>\"\",LEFT(U173,1)<>\"#\"),IF(LEFT(U173,1)=\"-\",REPLACE(U173,1,1,tech!$H$2),U173),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA173<>\"\",LEFT(AA173,1)<>\"#\"),IF(LEFT(AA173,1)=\"-\",REPLACE(AA173,1,1,tech!$H$2),AA173),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG173<>\"\",LEFT(AG173,1)<>\"#\"),IF(LEFT(AG173,1)=\"-\",REPLACE(AG173,1,1,tech!$H$2),AG173),\"\")","v":""},"|",null,"Certificate management is periodically reviewed and updated","Guidance","2.2.6.GY",{"$f":"IF(AND(AM173<>\"\",LEFT(AM173,1)<>\"#\"),IF(LEFT(AM173,1)=\"-\",REPLACE(AM173,1,1,tech!$H$2),AM173),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS173<>\"\",LEFT(AS173,1)<>\"#\"),IF(LEFT(AS173,1)=\"-\",REPLACE(AS173,1,1,tech!$H$2),AS173),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY173<>\"\",LEFT(AY173,1)<>\"#\"),IF(LEFT(AY173,1)=\"-\",REPLACE(AY173,1,1,tech!$H$2),AY173),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE173<>\"\",LEFT(BE173,1)<>\"#\"),IF(LEFT(BE173,1)=\"-\",REPLACE(BE173,1,1,tech!$H$2),BE173),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK173<>\"\",LEFT(BK173,1)<>\"#\"),IF(LEFT(BK173,1)=\"-\",REPLACE(BK173,1,1,tech!$H$2),BK173),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ173<>\"\",LEFT(BQ173,1)<>\"#\"),IF(LEFT(BQ173,1)=\"-\",REPLACE(BQ173,1,1,tech!$H$2),BQ173),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW173<>\"\",LEFT(BW173,1)<>\"#\"),IF(LEFT(BW173,1)=\"-\",REPLACE(BW173,1,1,tech!$H$2),BW173),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC173<>\"\",LEFT(CC173,1)<>\"#\"),IF(LEFT(CC173,1)=\"-\",REPLACE(CC173,1,1,tech!$H$2),CC173),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI173<>\"\",LEFT(CI173,1)<>\"#\"),IF(LEFT(CI173,1)=\"-\",REPLACE(CI173,1,1,tech!$H$2),CI173),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO173<>\"\",LEFT(CO173,1)<>\"#\"),IF(LEFT(CO173,1)=\"-\",REPLACE(CO173,1,1,tech!$H$2),CO173),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O174<>\"\",LEFT(O174,1)<>\"#\"),IF(LEFT(O174,1)=\"-\",REPLACE(O174,1,1,tech!$H$2),O174),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U174<>\"\",LEFT(U174,1)<>\"#\"),IF(LEFT(U174,1)=\"-\",REPLACE(U174,1,1,tech!$H$2),U174),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA174<>\"\",LEFT(AA174,1)<>\"#\"),IF(LEFT(AA174,1)=\"-\",REPLACE(AA174,1,1,tech!$H$2),AA174),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG174<>\"\",LEFT(AG174,1)<>\"#\"),IF(LEFT(AG174,1)=\"-\",REPLACE(AG174,1,1,tech!$H$2),AG174),\"\")","v":""},"|","Periodical review helps to keep the certificate management accurate and helps to maintain required skills and knowledge.","Certificate management is periodically reviewed and updated","Guidance","2.2.6.GY",{"$f":"IF(AND(AM174<>\"\",LEFT(AM174,1)<>\"#\"),IF(LEFT(AM174,1)=\"-\",REPLACE(AM174,1,1,tech!$H$2),AM174),\"\")","v":"Periodical review helps to keep the certificate management accurate and helps to maintain required skills and knowledge."},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS174<>\"\",LEFT(AS174,1)<>\"#\"),IF(LEFT(AS174,1)=\"-\",REPLACE(AS174,1,1,tech!$H$2),AS174),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY174<>\"\",LEFT(AY174,1)<>\"#\"),IF(LEFT(AY174,1)=\"-\",REPLACE(AY174,1,1,tech!$H$2),AY174),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE174<>\"\",LEFT(BE174,1)<>\"#\"),IF(LEFT(BE174,1)=\"-\",REPLACE(BE174,1,1,tech!$H$2),BE174),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK174<>\"\",LEFT(BK174,1)<>\"#\"),IF(LEFT(BK174,1)=\"-\",REPLACE(BK174,1,1,tech!$H$2),BK174),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ174<>\"\",LEFT(BQ174,1)<>\"#\"),IF(LEFT(BQ174,1)=\"-\",REPLACE(BQ174,1,1,tech!$H$2),BQ174),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW174<>\"\",LEFT(BW174,1)<>\"#\"),IF(LEFT(BW174,1)=\"-\",REPLACE(BW174,1,1,tech!$H$2),BW174),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC174<>\"\",LEFT(CC174,1)<>\"#\"),IF(LEFT(CC174,1)=\"-\",REPLACE(CC174,1,1,tech!$H$2),CC174),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI174<>\"\",LEFT(CI174,1)<>\"#\"),IF(LEFT(CI174,1)=\"-\",REPLACE(CI174,1,1,tech!$H$2),CI174),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO174<>\"\",LEFT(CO174,1)<>\"#\"),IF(LEFT(CO174,1)=\"-\",REPLACE(CO174,1,1,tech!$H$2),CO174),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O175<>\"\",LEFT(O175,1)<>\"#\"),IF(LEFT(O175,1)=\"-\",REPLACE(O175,1,1,tech!$H$2),O175),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U175<>\"\",LEFT(U175,1)<>\"#\"),IF(LEFT(U175,1)=\"-\",REPLACE(U175,1,1,tech!$H$2),U175),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA175<>\"\",LEFT(AA175,1)<>\"#\"),IF(LEFT(AA175,1)=\"-\",REPLACE(AA175,1,1,tech!$H$2),AA175),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG175<>\"\",LEFT(AG175,1)<>\"#\"),IF(LEFT(AG175,1)=\"-\",REPLACE(AG175,1,1,tech!$H$2),AG175),\"\")","v":""},"|","It provides assurance that the expected controls are active and working as intended.","Certificate management is periodically reviewed and updated","Guidance","2.2.6.GY",{"$f":"IF(AND(AM175<>\"\",LEFT(AM175,1)<>\"#\"),IF(LEFT(AM175,1)=\"-\",REPLACE(AM175,1,1,tech!$H$2),AM175),\"\")","v":"It provides assurance that the expected controls are active and working as intended."},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS175<>\"\",LEFT(AS175,1)<>\"#\"),IF(LEFT(AS175,1)=\"-\",REPLACE(AS175,1,1,tech!$H$2),AS175),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY175<>\"\",LEFT(AY175,1)<>\"#\"),IF(LEFT(AY175,1)=\"-\",REPLACE(AY175,1,1,tech!$H$2),AY175),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE175<>\"\",LEFT(BE175,1)<>\"#\"),IF(LEFT(BE175,1)=\"-\",REPLACE(BE175,1,1,tech!$H$2),BE175),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK175<>\"\",LEFT(BK175,1)<>\"#\"),IF(LEFT(BK175,1)=\"-\",REPLACE(BK175,1,1,tech!$H$2),BK175),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ175<>\"\",LEFT(BQ175,1)<>\"#\"),IF(LEFT(BQ175,1)=\"-\",REPLACE(BQ175,1,1,tech!$H$2),BQ175),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW175<>\"\",LEFT(BW175,1)<>\"#\"),IF(LEFT(BW175,1)=\"-\",REPLACE(BW175,1,1,tech!$H$2),BW175),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC175<>\"\",LEFT(CC175,1)<>\"#\"),IF(LEFT(CC175,1)=\"-\",REPLACE(CC175,1,1,tech!$H$2),CC175),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI175<>\"\",LEFT(CI175,1)<>\"#\"),IF(LEFT(CI175,1)=\"-\",REPLACE(CI175,1,1,tech!$H$2),CI175),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO175<>\"\",LEFT(CO175,1)<>\"#\"),IF(LEFT(CO175,1)=\"-\",REPLACE(CO175,1,1,tech!$H$2),CO175),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O176<>\"\",LEFT(O176,1)<>\"#\"),IF(LEFT(O176,1)=\"-\",REPLACE(O176,1,1,tech!$H$2),O176),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U176<>\"\",LEFT(U176,1)<>\"#\"),IF(LEFT(U176,1)=\"-\",REPLACE(U176,1,1,tech!$H$2),U176),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA176<>\"\",LEFT(AA176,1)<>\"#\"),IF(LEFT(AA176,1)=\"-\",REPLACE(AA176,1,1,tech!$H$2),AA176),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG176<>\"\",LEFT(AG176,1)<>\"#\"),IF(LEFT(AG176,1)=\"-\",REPLACE(AG176,1,1,tech!$H$2),AG176),\"\")","v":""},"|",null,"Certificate management is periodically reviewed and updated","Guidance","2.2.6.GX",{"$f":"IF(AND(AM176<>\"\",LEFT(AM176,1)<>\"#\"),IF(LEFT(AM176,1)=\"-\",REPLACE(AM176,1,1,tech!$H$2),AM176),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS176<>\"\",LEFT(AS176,1)<>\"#\"),IF(LEFT(AS176,1)=\"-\",REPLACE(AS176,1,1,tech!$H$2),AS176),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY176<>\"\",LEFT(AY176,1)<>\"#\"),IF(LEFT(AY176,1)=\"-\",REPLACE(AY176,1,1,tech!$H$2),AY176),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE176<>\"\",LEFT(BE176,1)<>\"#\"),IF(LEFT(BE176,1)=\"-\",REPLACE(BE176,1,1,tech!$H$2),BE176),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK176<>\"\",LEFT(BK176,1)<>\"#\"),IF(LEFT(BK176,1)=\"-\",REPLACE(BK176,1,1,tech!$H$2),BK176),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ176<>\"\",LEFT(BQ176,1)<>\"#\"),IF(LEFT(BQ176,1)=\"-\",REPLACE(BQ176,1,1,tech!$H$2),BQ176),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW176<>\"\",LEFT(BW176,1)<>\"#\"),IF(LEFT(BW176,1)=\"-\",REPLACE(BW176,1,1,tech!$H$2),BW176),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC176<>\"\",LEFT(CC176,1)<>\"#\"),IF(LEFT(CC176,1)=\"-\",REPLACE(CC176,1,1,tech!$H$2),CC176),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI176<>\"\",LEFT(CI176,1)<>\"#\"),IF(LEFT(CI176,1)=\"-\",REPLACE(CI176,1,1,tech!$H$2),CI176),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO176<>\"\",LEFT(CO176,1)<>\"#\"),IF(LEFT(CO176,1)=\"-\",REPLACE(CO176,1,1,tech!$H$2),CO176),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O177<>\"\",LEFT(O177,1)<>\"#\"),IF(LEFT(O177,1)=\"-\",REPLACE(O177,1,1,tech!$H$2),O177),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U177<>\"\",LEFT(U177,1)<>\"#\"),IF(LEFT(U177,1)=\"-\",REPLACE(U177,1,1,tech!$H$2),U177),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA177<>\"\",LEFT(AA177,1)<>\"#\"),IF(LEFT(AA177,1)=\"-\",REPLACE(AA177,1,1,tech!$H$2),AA177),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG177<>\"\",LEFT(AG177,1)<>\"#\"),IF(LEFT(AG177,1)=\"-\",REPLACE(AG177,1,1,tech!$H$2),AG177),\"\")","v":""},"|","#### Assessment",{"$f":"IF(AND(LEFT(AM177,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AM177,\" \"))=3,0)),_xlfn.TEXTAFTER(AM177,\" \"),AN176)","v":"Certificate management is periodically reviewed and updated"},"Assessment","2.2.6.AX",{"$f":"IF(AND(AM177<>\"\",LEFT(AM177,1)<>\"#\"),IF(LEFT(AM177,1)=\"-\",REPLACE(AM177,1,1,tech!$H$2),AM177),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(AS177,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AS177,\" \"))=3,0)),_xlfn.TEXTAFTER(AS177,\" \"),AT176)","v":"Infrastructure activities are periodically reviewed"},"References","2.3.5.RX",{"$f":"IF(AND(AS177<>\"\",LEFT(AS177,1)<>\"#\"),IF(LEFT(AS177,1)=\"-\",REPLACE(AS177,1,1,tech!$H$2),AS177),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(AY177,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AY177,\" \"))=3,0)),_xlfn.TEXTAFTER(AY177,\" \"),AZ176)","v":"Change management and agility is periodically reviewed"},"References","2.4.5.RX",{"$f":"IF(AND(AY177<>\"\",LEFT(AY177,1)<>\"#\"),IF(LEFT(AY177,1)=\"-\",REPLACE(AY177,1,1,tech!$H$2),AY177),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(BE177,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BE177,\" \"))=3,0)),_xlfn.TEXTAFTER(BE177,\" \"),BF176)","v":"Continual review and improvement"},"References","3.1.6.RX",{"$f":"IF(AND(BE177<>\"\",LEFT(BE177,1)<>\"#\"),IF(LEFT(BE177,1)=\"-\",REPLACE(BE177,1,1,tech!$H$2),BE177),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(BK177,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BK177,\" \"))=3,0)),_xlfn.TEXTAFTER(BK177,\" \"),BL176)","v":"Adoption and application of open standards"},"References","3.2.3.RX",{"$f":"IF(AND(BK177<>\"\",LEFT(BK177,1)<>\"#\"),IF(LEFT(BK177,1)=\"-\",REPLACE(BK177,1,1,tech!$H$2),BK177),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(BQ177,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BQ177,\" \"))=3,0)),_xlfn.TEXTAFTER(BQ177,\" \"),BR176)","v":"Review of events and logs is periodically performed"},"References","3.3.6.RX",{"$f":"IF(AND(BQ177<>\"\",LEFT(BQ177,1)<>\"#\"),IF(LEFT(BQ177,1)=\"-\",REPLACE(BQ177,1,1,tech!$H$2),BQ177),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(BW177,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BW177,\" \"))=3,0)),_xlfn.TEXTAFTER(BW177,\" \"),BX176)","v":"Incidents and exceptions handling"},"References","3.4.3.RX",{"$f":"IF(AND(BW177<>\"\",LEFT(BW177,1)<>\"#\"),IF(LEFT(BW177,1)=\"-\",REPLACE(BW177,1,1,tech!$H$2),BW177),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(CC177,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CC177,\" \"))=3,0)),_xlfn.TEXTAFTER(CC177,\" \"),CD176)","v":"Resources are periodically reviewed"},"References","4.1.4.RX",{"$f":"IF(AND(CC177<>\"\",LEFT(CC177,1)<>\"#\"),IF(LEFT(CC177,1)=\"-\",REPLACE(CC177,1,1,tech!$H$2),CC177),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(CI177,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CI177,\" \"))=3,0)),_xlfn.TEXTAFTER(CI177,\" \"),CJ176)","v":"Periodically review knowledge"},"References","4.2.5.RX",{"$f":"IF(AND(CI177<>\"\",LEFT(CI177,1)<>\"#\"),IF(LEFT(CI177,1)=\"-\",REPLACE(CI177,1,1,tech!$H$2),CI177),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(CO177,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CO177,\" \"))=3,0)),_xlfn.TEXTAFTER(CO177,\" \"),CP176)","v":"Timely communication of important information"},"References","4.3.4.RX",{"$f":"IF(AND(CO177<>\"\",LEFT(CO177,1)<>\"#\"),IF(LEFT(CO177,1)=\"-\",REPLACE(CO177,1,1,tech!$H$2),CO177),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O178<>\"\",LEFT(O178,1)<>\"#\"),IF(LEFT(O178,1)=\"-\",REPLACE(O178,1,1,tech!$H$2),O178),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U178<>\"\",LEFT(U178,1)<>\"#\"),IF(LEFT(U178,1)=\"-\",REPLACE(U178,1,1,tech!$H$2),U178),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA178<>\"\",LEFT(AA178,1)<>\"#\"),IF(LEFT(AA178,1)=\"-\",REPLACE(AA178,1,1,tech!$H$2),AA178),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG178<>\"\",LEFT(AG178,1)<>\"#\"),IF(LEFT(AG178,1)=\"-\",REPLACE(AG178,1,1,tech!$H$2),AG178),\"\")","v":""},"|",null,"Certificate management is periodically reviewed and updated","Assessment","2.2.6.AX",{"$f":"IF(AND(AM178<>\"\",LEFT(AM178,1)<>\"#\"),IF(LEFT(AM178,1)=\"-\",REPLACE(AM178,1,1,tech!$H$2),AM178),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS178<>\"\",LEFT(AS178,1)<>\"#\"),IF(LEFT(AS178,1)=\"-\",REPLACE(AS178,1,1,tech!$H$2),AS178),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY178<>\"\",LEFT(AY178,1)<>\"#\"),IF(LEFT(AY178,1)=\"-\",REPLACE(AY178,1,1,tech!$H$2),AY178),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE178<>\"\",LEFT(BE178,1)<>\"#\"),IF(LEFT(BE178,1)=\"-\",REPLACE(BE178,1,1,tech!$H$2),BE178),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK178<>\"\",LEFT(BK178,1)<>\"#\"),IF(LEFT(BK178,1)=\"-\",REPLACE(BK178,1,1,tech!$H$2),BK178),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ178<>\"\",LEFT(BQ178,1)<>\"#\"),IF(LEFT(BQ178,1)=\"-\",REPLACE(BQ178,1,1,tech!$H$2),BQ178),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW178<>\"\",LEFT(BW178,1)<>\"#\"),IF(LEFT(BW178,1)=\"-\",REPLACE(BW178,1,1,tech!$H$2),BW178),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC178<>\"\",LEFT(CC178,1)<>\"#\"),IF(LEFT(CC178,1)=\"-\",REPLACE(CC178,1,1,tech!$H$2),CC178),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI178<>\"\",LEFT(CI178,1)<>\"#\"),IF(LEFT(CI178,1)=\"-\",REPLACE(CI178,1,1,tech!$H$2),CI178),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO178<>\"\",LEFT(CO178,1)<>\"#\"),IF(LEFT(CO178,1)=\"-\",REPLACE(CO178,1,1,tech!$H$2),CO178),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O179<>\"\",LEFT(O179,1)<>\"#\"),IF(LEFT(O179,1)=\"-\",REPLACE(O179,1,1,tech!$H$2),O179),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U179<>\"\",LEFT(U179,1)<>\"#\"),IF(LEFT(U179,1)=\"-\",REPLACE(U179,1,1,tech!$H$2),U179),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA179<>\"\",LEFT(AA179,1)<>\"#\"),IF(LEFT(AA179,1)=\"-\",REPLACE(AA179,1,1,tech!$H$2),AA179),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG179<>\"\",LEFT(AG179,1)<>\"#\"),IF(LEFT(AG179,1)=\"-\",REPLACE(AG179,1,1,tech!$H$2),AG179),\"\")","v":""},"|","* Documented process for reviewing the certificate management process and systems","Certificate management is periodically reviewed and updated","Assessment","2.2.6.AY",{"$f":"IF(AND(AM179<>\"\",LEFT(AM179,1)<>\"#\"),IF(LEFT(AM179,1)=\"-\",REPLACE(AM179,1,1,tech!$H$2),AM179),\"\")","v":"* Documented process for reviewing the certificate management process and systems"},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS179<>\"\",LEFT(AS179,1)<>\"#\"),IF(LEFT(AS179,1)=\"-\",REPLACE(AS179,1,1,tech!$H$2),AS179),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY179<>\"\",LEFT(AY179,1)<>\"#\"),IF(LEFT(AY179,1)=\"-\",REPLACE(AY179,1,1,tech!$H$2),AY179),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE179<>\"\",LEFT(BE179,1)<>\"#\"),IF(LEFT(BE179,1)=\"-\",REPLACE(BE179,1,1,tech!$H$2),BE179),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK179<>\"\",LEFT(BK179,1)<>\"#\"),IF(LEFT(BK179,1)=\"-\",REPLACE(BK179,1,1,tech!$H$2),BK179),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ179<>\"\",LEFT(BQ179,1)<>\"#\"),IF(LEFT(BQ179,1)=\"-\",REPLACE(BQ179,1,1,tech!$H$2),BQ179),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW179<>\"\",LEFT(BW179,1)<>\"#\"),IF(LEFT(BW179,1)=\"-\",REPLACE(BW179,1,1,tech!$H$2),BW179),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC179<>\"\",LEFT(CC179,1)<>\"#\"),IF(LEFT(CC179,1)=\"-\",REPLACE(CC179,1,1,tech!$H$2),CC179),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI179<>\"\",LEFT(CI179,1)<>\"#\"),IF(LEFT(CI179,1)=\"-\",REPLACE(CI179,1,1,tech!$H$2),CI179),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO179<>\"\",LEFT(CO179,1)<>\"#\"),IF(LEFT(CO179,1)=\"-\",REPLACE(CO179,1,1,tech!$H$2),CO179),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O180<>\"\",LEFT(O180,1)<>\"#\"),IF(LEFT(O180,1)=\"-\",REPLACE(O180,1,1,tech!$H$2),O180),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U180<>\"\",LEFT(U180,1)<>\"#\"),IF(LEFT(U180,1)=\"-\",REPLACE(U180,1,1,tech!$H$2),U180),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA180<>\"\",LEFT(AA180,1)<>\"#\"),IF(LEFT(AA180,1)=\"-\",REPLACE(AA180,1,1,tech!$H$2),AA180),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG180<>\"\",LEFT(AG180,1)<>\"#\"),IF(LEFT(AG180,1)=\"-\",REPLACE(AG180,1,1,tech!$H$2),AG180),\"\")","v":""},"|","* Ability to implement updates to certificate management system","Certificate management is periodically reviewed and updated","Assessment","2.2.6.AY",{"$f":"IF(AND(AM180<>\"\",LEFT(AM180,1)<>\"#\"),IF(LEFT(AM180,1)=\"-\",REPLACE(AM180,1,1,tech!$H$2),AM180),\"\")","v":"* Ability to implement updates to certificate management system"},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS180<>\"\",LEFT(AS180,1)<>\"#\"),IF(LEFT(AS180,1)=\"-\",REPLACE(AS180,1,1,tech!$H$2),AS180),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY180<>\"\",LEFT(AY180,1)<>\"#\"),IF(LEFT(AY180,1)=\"-\",REPLACE(AY180,1,1,tech!$H$2),AY180),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE180<>\"\",LEFT(BE180,1)<>\"#\"),IF(LEFT(BE180,1)=\"-\",REPLACE(BE180,1,1,tech!$H$2),BE180),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK180<>\"\",LEFT(BK180,1)<>\"#\"),IF(LEFT(BK180,1)=\"-\",REPLACE(BK180,1,1,tech!$H$2),BK180),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ180<>\"\",LEFT(BQ180,1)<>\"#\"),IF(LEFT(BQ180,1)=\"-\",REPLACE(BQ180,1,1,tech!$H$2),BQ180),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW180<>\"\",LEFT(BW180,1)<>\"#\"),IF(LEFT(BW180,1)=\"-\",REPLACE(BW180,1,1,tech!$H$2),BW180),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC180<>\"\",LEFT(CC180,1)<>\"#\"),IF(LEFT(CC180,1)=\"-\",REPLACE(CC180,1,1,tech!$H$2),CC180),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI180<>\"\",LEFT(CI180,1)<>\"#\"),IF(LEFT(CI180,1)=\"-\",REPLACE(CI180,1,1,tech!$H$2),CI180),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO180<>\"\",LEFT(CO180,1)<>\"#\"),IF(LEFT(CO180,1)=\"-\",REPLACE(CO180,1,1,tech!$H$2),CO180),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O181<>\"\",LEFT(O181,1)<>\"#\"),IF(LEFT(O181,1)=\"-\",REPLACE(O181,1,1,tech!$H$2),O181),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U181<>\"\",LEFT(U181,1)<>\"#\"),IF(LEFT(U181,1)=\"-\",REPLACE(U181,1,1,tech!$H$2),U181),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA181<>\"\",LEFT(AA181,1)<>\"#\"),IF(LEFT(AA181,1)=\"-\",REPLACE(AA181,1,1,tech!$H$2),AA181),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG181<>\"\",LEFT(AG181,1)<>\"#\"),IF(LEFT(AG181,1)=\"-\",REPLACE(AG181,1,1,tech!$H$2),AG181),\"\")","v":""},"|","* Document management system and validation of review","Certificate management is periodically reviewed and updated","Assessment","2.2.6.AY",{"$f":"IF(AND(AM181<>\"\",LEFT(AM181,1)<>\"#\"),IF(LEFT(AM181,1)=\"-\",REPLACE(AM181,1,1,tech!$H$2),AM181),\"\")","v":"* Document management system and validation of review"},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS181<>\"\",LEFT(AS181,1)<>\"#\"),IF(LEFT(AS181,1)=\"-\",REPLACE(AS181,1,1,tech!$H$2),AS181),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY181<>\"\",LEFT(AY181,1)<>\"#\"),IF(LEFT(AY181,1)=\"-\",REPLACE(AY181,1,1,tech!$H$2),AY181),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE181<>\"\",LEFT(BE181,1)<>\"#\"),IF(LEFT(BE181,1)=\"-\",REPLACE(BE181,1,1,tech!$H$2),BE181),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK181<>\"\",LEFT(BK181,1)<>\"#\"),IF(LEFT(BK181,1)=\"-\",REPLACE(BK181,1,1,tech!$H$2),BK181),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ181<>\"\",LEFT(BQ181,1)<>\"#\"),IF(LEFT(BQ181,1)=\"-\",REPLACE(BQ181,1,1,tech!$H$2),BQ181),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW181<>\"\",LEFT(BW181,1)<>\"#\"),IF(LEFT(BW181,1)=\"-\",REPLACE(BW181,1,1,tech!$H$2),BW181),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC181<>\"\",LEFT(CC181,1)<>\"#\"),IF(LEFT(CC181,1)=\"-\",REPLACE(CC181,1,1,tech!$H$2),CC181),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI181<>\"\",LEFT(CI181,1)<>\"#\"),IF(LEFT(CI181,1)=\"-\",REPLACE(CI181,1,1,tech!$H$2),CI181),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO181<>\"\",LEFT(CO181,1)<>\"#\"),IF(LEFT(CO181,1)=\"-\",REPLACE(CO181,1,1,tech!$H$2),CO181),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O182<>\"\",LEFT(O182,1)<>\"#\"),IF(LEFT(O182,1)=\"-\",REPLACE(O182,1,1,tech!$H$2),O182),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U182<>\"\",LEFT(U182,1)<>\"#\"),IF(LEFT(U182,1)=\"-\",REPLACE(U182,1,1,tech!$H$2),U182),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA182<>\"\",LEFT(AA182,1)<>\"#\"),IF(LEFT(AA182,1)=\"-\",REPLACE(AA182,1,1,tech!$H$2),AA182),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG182<>\"\",LEFT(AG182,1)<>\"#\"),IF(LEFT(AG182,1)=\"-\",REPLACE(AG182,1,1,tech!$H$2),AG182),\"\")","v":""},"|",null,"Certificate management is periodically reviewed and updated","Assessment","2.2.6.AX",{"$f":"IF(AND(AM182<>\"\",LEFT(AM182,1)<>\"#\"),IF(LEFT(AM182,1)=\"-\",REPLACE(AM182,1,1,tech!$H$2),AM182),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS182<>\"\",LEFT(AS182,1)<>\"#\"),IF(LEFT(AS182,1)=\"-\",REPLACE(AS182,1,1,tech!$H$2),AS182),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY182<>\"\",LEFT(AY182,1)<>\"#\"),IF(LEFT(AY182,1)=\"-\",REPLACE(AY182,1,1,tech!$H$2),AY182),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE182<>\"\",LEFT(BE182,1)<>\"#\"),IF(LEFT(BE182,1)=\"-\",REPLACE(BE182,1,1,tech!$H$2),BE182),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK182<>\"\",LEFT(BK182,1)<>\"#\"),IF(LEFT(BK182,1)=\"-\",REPLACE(BK182,1,1,tech!$H$2),BK182),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ182<>\"\",LEFT(BQ182,1)<>\"#\"),IF(LEFT(BQ182,1)=\"-\",REPLACE(BQ182,1,1,tech!$H$2),BQ182),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW182<>\"\",LEFT(BW182,1)<>\"#\"),IF(LEFT(BW182,1)=\"-\",REPLACE(BW182,1,1,tech!$H$2),BW182),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC182<>\"\",LEFT(CC182,1)<>\"#\"),IF(LEFT(CC182,1)=\"-\",REPLACE(CC182,1,1,tech!$H$2),CC182),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI182<>\"\",LEFT(CI182,1)<>\"#\"),IF(LEFT(CI182,1)=\"-\",REPLACE(CI182,1,1,tech!$H$2),CI182),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO182<>\"\",LEFT(CO182,1)<>\"#\"),IF(LEFT(CO182,1)=\"-\",REPLACE(CO182,1,1,tech!$H$2),CO182),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O183<>\"\",LEFT(O183,1)<>\"#\"),IF(LEFT(O183,1)=\"-\",REPLACE(O183,1,1,tech!$H$2),O183),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U183<>\"\",LEFT(U183,1)<>\"#\"),IF(LEFT(U183,1)=\"-\",REPLACE(U183,1,1,tech!$H$2),U183),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA183<>\"\",LEFT(AA183,1)<>\"#\"),IF(LEFT(AA183,1)=\"-\",REPLACE(AA183,1,1,tech!$H$2),AA183),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG183<>\"\",LEFT(AG183,1)<>\"#\"),IF(LEFT(AG183,1)=\"-\",REPLACE(AG183,1,1,tech!$H$2),AG183),\"\")","v":""},"|","#### References","Certificate management is periodically reviewed and updated","References","2.2.6.RX",{"$f":"IF(AND(AM183<>\"\",LEFT(AM183,1)<>\"#\"),IF(LEFT(AM183,1)=\"-\",REPLACE(AM183,1,1,tech!$H$2),AM183),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS183<>\"\",LEFT(AS183,1)<>\"#\"),IF(LEFT(AS183,1)=\"-\",REPLACE(AS183,1,1,tech!$H$2),AS183),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY183<>\"\",LEFT(AY183,1)<>\"#\"),IF(LEFT(AY183,1)=\"-\",REPLACE(AY183,1,1,tech!$H$2),AY183),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE183<>\"\",LEFT(BE183,1)<>\"#\"),IF(LEFT(BE183,1)=\"-\",REPLACE(BE183,1,1,tech!$H$2),BE183),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK183<>\"\",LEFT(BK183,1)<>\"#\"),IF(LEFT(BK183,1)=\"-\",REPLACE(BK183,1,1,tech!$H$2),BK183),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ183<>\"\",LEFT(BQ183,1)<>\"#\"),IF(LEFT(BQ183,1)=\"-\",REPLACE(BQ183,1,1,tech!$H$2),BQ183),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW183<>\"\",LEFT(BW183,1)<>\"#\"),IF(LEFT(BW183,1)=\"-\",REPLACE(BW183,1,1,tech!$H$2),BW183),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC183<>\"\",LEFT(CC183,1)<>\"#\"),IF(LEFT(CC183,1)=\"-\",REPLACE(CC183,1,1,tech!$H$2),CC183),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI183<>\"\",LEFT(CI183,1)<>\"#\"),IF(LEFT(CI183,1)=\"-\",REPLACE(CI183,1,1,tech!$H$2),CI183),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO183<>\"\",LEFT(CO183,1)<>\"#\"),IF(LEFT(CO183,1)=\"-\",REPLACE(CO183,1,1,tech!$H$2),CO183),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O184<>\"\",LEFT(O184,1)<>\"#\"),IF(LEFT(O184,1)=\"-\",REPLACE(O184,1,1,tech!$H$2),O184),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U184<>\"\",LEFT(U184,1)<>\"#\"),IF(LEFT(U184,1)=\"-\",REPLACE(U184,1,1,tech!$H$2),U184),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA184<>\"\",LEFT(AA184,1)<>\"#\"),IF(LEFT(AA184,1)=\"-\",REPLACE(AA184,1,1,tech!$H$2),AA184),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG184<>\"\",LEFT(AG184,1)<>\"#\"),IF(LEFT(AG184,1)=\"-\",REPLACE(AG184,1,1,tech!$H$2),AG184),\"\")","v":""},"|",null,"Certificate management is periodically reviewed and updated","References","2.2.6.RX",{"$f":"IF(AND(AM184<>\"\",LEFT(AM184,1)<>\"#\"),IF(LEFT(AM184,1)=\"-\",REPLACE(AM184,1,1,tech!$H$2),AM184),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS184<>\"\",LEFT(AS184,1)<>\"#\"),IF(LEFT(AS184,1)=\"-\",REPLACE(AS184,1,1,tech!$H$2),AS184),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY184<>\"\",LEFT(AY184,1)<>\"#\"),IF(LEFT(AY184,1)=\"-\",REPLACE(AY184,1,1,tech!$H$2),AY184),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE184<>\"\",LEFT(BE184,1)<>\"#\"),IF(LEFT(BE184,1)=\"-\",REPLACE(BE184,1,1,tech!$H$2),BE184),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK184<>\"\",LEFT(BK184,1)<>\"#\"),IF(LEFT(BK184,1)=\"-\",REPLACE(BK184,1,1,tech!$H$2),BK184),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ184<>\"\",LEFT(BQ184,1)<>\"#\"),IF(LEFT(BQ184,1)=\"-\",REPLACE(BQ184,1,1,tech!$H$2),BQ184),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW184<>\"\",LEFT(BW184,1)<>\"#\"),IF(LEFT(BW184,1)=\"-\",REPLACE(BW184,1,1,tech!$H$2),BW184),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC184<>\"\",LEFT(CC184,1)<>\"#\"),IF(LEFT(CC184,1)=\"-\",REPLACE(CC184,1,1,tech!$H$2),CC184),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI184<>\"\",LEFT(CI184,1)<>\"#\"),IF(LEFT(CI184,1)=\"-\",REPLACE(CI184,1,1,tech!$H$2),CI184),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO184<>\"\",LEFT(CO184,1)<>\"#\"),IF(LEFT(CO184,1)=\"-\",REPLACE(CO184,1,1,tech!$H$2),CO184),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O185<>\"\",LEFT(O185,1)<>\"#\"),IF(LEFT(O185,1)=\"-\",REPLACE(O185,1,1,tech!$H$2),O185),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U185<>\"\",LEFT(U185,1)<>\"#\"),IF(LEFT(U185,1)=\"-\",REPLACE(U185,1,1,tech!$H$2),U185),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA185<>\"\",LEFT(AA185,1)<>\"#\"),IF(LEFT(AA185,1)=\"-\",REPLACE(AA185,1,1,tech!$H$2),AA185),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG185<>\"\",LEFT(AG185,1)<>\"#\"),IF(LEFT(AG185,1)=\"-\",REPLACE(AG185,1,1,tech!$H$2),AG185),\"\")","v":""},"|","- [ISO/IEC 27001 and related standards](https://www.iso.org/isoiec-27001-information-security.html)","Certificate management is periodically reviewed and updated","References","2.2.6.RY",{"$f":"IF(AND(AM185<>\"\",LEFT(AM185,1)<>\"#\"),IF(LEFT(AM185,1)=\"-\",REPLACE(AM185,1,1,tech!$H$2),AM185),\"\")","v":"• [ISO/IEC 27001 and related standards](https://www.iso.org/isoiec-27001-information-security.html)"},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS185<>\"\",LEFT(AS185,1)<>\"#\"),IF(LEFT(AS185,1)=\"-\",REPLACE(AS185,1,1,tech!$H$2),AS185),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY185<>\"\",LEFT(AY185,1)<>\"#\"),IF(LEFT(AY185,1)=\"-\",REPLACE(AY185,1,1,tech!$H$2),AY185),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE185<>\"\",LEFT(BE185,1)<>\"#\"),IF(LEFT(BE185,1)=\"-\",REPLACE(BE185,1,1,tech!$H$2),BE185),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK185<>\"\",LEFT(BK185,1)<>\"#\"),IF(LEFT(BK185,1)=\"-\",REPLACE(BK185,1,1,tech!$H$2),BK185),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ185<>\"\",LEFT(BQ185,1)<>\"#\"),IF(LEFT(BQ185,1)=\"-\",REPLACE(BQ185,1,1,tech!$H$2),BQ185),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW185<>\"\",LEFT(BW185,1)<>\"#\"),IF(LEFT(BW185,1)=\"-\",REPLACE(BW185,1,1,tech!$H$2),BW185),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC185<>\"\",LEFT(CC185,1)<>\"#\"),IF(LEFT(CC185,1)=\"-\",REPLACE(CC185,1,1,tech!$H$2),CC185),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI185<>\"\",LEFT(CI185,1)<>\"#\"),IF(LEFT(CI185,1)=\"-\",REPLACE(CI185,1,1,tech!$H$2),CI185),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO185<>\"\",LEFT(CO185,1)<>\"#\"),IF(LEFT(CO185,1)=\"-\",REPLACE(CO185,1,1,tech!$H$2),CO185),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O186<>\"\",LEFT(O186,1)<>\"#\"),IF(LEFT(O186,1)=\"-\",REPLACE(O186,1,1,tech!$H$2),O186),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U186<>\"\",LEFT(U186,1)<>\"#\"),IF(LEFT(U186,1)=\"-\",REPLACE(U186,1,1,tech!$H$2),U186),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA186<>\"\",LEFT(AA186,1)<>\"#\"),IF(LEFT(AA186,1)=\"-\",REPLACE(AA186,1,1,tech!$H$2),AA186),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG186<>\"\",LEFT(AG186,1)<>\"#\"),IF(LEFT(AG186,1)=\"-\",REPLACE(AG186,1,1,tech!$H$2),AG186),\"\")","v":""},"|",null,"Certificate management is periodically reviewed and updated","References","2.2.6.RX",{"$f":"IF(AND(AM186<>\"\",LEFT(AM186,1)<>\"#\"),IF(LEFT(AM186,1)=\"-\",REPLACE(AM186,1,1,tech!$H$2),AM186),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS186<>\"\",LEFT(AS186,1)<>\"#\"),IF(LEFT(AS186,1)=\"-\",REPLACE(AS186,1,1,tech!$H$2),AS186),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY186<>\"\",LEFT(AY186,1)<>\"#\"),IF(LEFT(AY186,1)=\"-\",REPLACE(AY186,1,1,tech!$H$2),AY186),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE186<>\"\",LEFT(BE186,1)<>\"#\"),IF(LEFT(BE186,1)=\"-\",REPLACE(BE186,1,1,tech!$H$2),BE186),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK186<>\"\",LEFT(BK186,1)<>\"#\"),IF(LEFT(BK186,1)=\"-\",REPLACE(BK186,1,1,tech!$H$2),BK186),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ186<>\"\",LEFT(BQ186,1)<>\"#\"),IF(LEFT(BQ186,1)=\"-\",REPLACE(BQ186,1,1,tech!$H$2),BQ186),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW186<>\"\",LEFT(BW186,1)<>\"#\"),IF(LEFT(BW186,1)=\"-\",REPLACE(BW186,1,1,tech!$H$2),BW186),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC186<>\"\",LEFT(CC186,1)<>\"#\"),IF(LEFT(CC186,1)=\"-\",REPLACE(CC186,1,1,tech!$H$2),CC186),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI186<>\"\",LEFT(CI186,1)<>\"#\"),IF(LEFT(CI186,1)=\"-\",REPLACE(CI186,1,1,tech!$H$2),CI186),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO186<>\"\",LEFT(CO186,1)<>\"#\"),IF(LEFT(CO186,1)=\"-\",REPLACE(CO186,1,1,tech!$H$2),CO186),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O187<>\"\",LEFT(O187,1)<>\"#\"),IF(LEFT(O187,1)=\"-\",REPLACE(O187,1,1,tech!$H$2),O187),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U187<>\"\",LEFT(U187,1)<>\"#\"),IF(LEFT(U187,1)=\"-\",REPLACE(U187,1,1,tech!$H$2),U187),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA187<>\"\",LEFT(AA187,1)<>\"#\"),IF(LEFT(AA187,1)=\"-\",REPLACE(AA187,1,1,tech!$H$2),AA187),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG187<>\"\",LEFT(AG187,1)<>\"#\"),IF(LEFT(AG187,1)=\"-\",REPLACE(AG187,1,1,tech!$H$2),AG187),\"\")","v":""},"|","### Organizational PKI governance","Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM187<>\"\",LEFT(AM187,1)<>\"#\"),IF(LEFT(AM187,1)=\"-\",REPLACE(AM187,1,1,tech!$H$2),AM187),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS187<>\"\",LEFT(AS187,1)<>\"#\"),IF(LEFT(AS187,1)=\"-\",REPLACE(AS187,1,1,tech!$H$2),AS187),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY187<>\"\",LEFT(AY187,1)<>\"#\"),IF(LEFT(AY187,1)=\"-\",REPLACE(AY187,1,1,tech!$H$2),AY187),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE187<>\"\",LEFT(BE187,1)<>\"#\"),IF(LEFT(BE187,1)=\"-\",REPLACE(BE187,1,1,tech!$H$2),BE187),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK187<>\"\",LEFT(BK187,1)<>\"#\"),IF(LEFT(BK187,1)=\"-\",REPLACE(BK187,1,1,tech!$H$2),BK187),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ187<>\"\",LEFT(BQ187,1)<>\"#\"),IF(LEFT(BQ187,1)=\"-\",REPLACE(BQ187,1,1,tech!$H$2),BQ187),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW187<>\"\",LEFT(BW187,1)<>\"#\"),IF(LEFT(BW187,1)=\"-\",REPLACE(BW187,1,1,tech!$H$2),BW187),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC187<>\"\",LEFT(CC187,1)<>\"#\"),IF(LEFT(CC187,1)=\"-\",REPLACE(CC187,1,1,tech!$H$2),CC187),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI187<>\"\",LEFT(CI187,1)<>\"#\"),IF(LEFT(CI187,1)=\"-\",REPLACE(CI187,1,1,tech!$H$2),CI187),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO187<>\"\",LEFT(CO187,1)<>\"#\"),IF(LEFT(CO187,1)=\"-\",REPLACE(CO187,1,1,tech!$H$2),CO187),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O188<>\"\",LEFT(O188,1)<>\"#\"),IF(LEFT(O188,1)=\"-\",REPLACE(O188,1,1,tech!$H$2),O188),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U188<>\"\",LEFT(U188,1)<>\"#\"),IF(LEFT(U188,1)=\"-\",REPLACE(U188,1,1,tech!$H$2),U188),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA188<>\"\",LEFT(AA188,1)<>\"#\"),IF(LEFT(AA188,1)=\"-\",REPLACE(AA188,1,1,tech!$H$2),AA188),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG188<>\"\",LEFT(AG188,1)<>\"#\"),IF(LEFT(AG188,1)=\"-\",REPLACE(AG188,1,1,tech!$H$2),AG188),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM188<>\"\",LEFT(AM188,1)<>\"#\"),IF(LEFT(AM188,1)=\"-\",REPLACE(AM188,1,1,tech!$H$2),AM188),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS188<>\"\",LEFT(AS188,1)<>\"#\"),IF(LEFT(AS188,1)=\"-\",REPLACE(AS188,1,1,tech!$H$2),AS188),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY188<>\"\",LEFT(AY188,1)<>\"#\"),IF(LEFT(AY188,1)=\"-\",REPLACE(AY188,1,1,tech!$H$2),AY188),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE188<>\"\",LEFT(BE188,1)<>\"#\"),IF(LEFT(BE188,1)=\"-\",REPLACE(BE188,1,1,tech!$H$2),BE188),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK188<>\"\",LEFT(BK188,1)<>\"#\"),IF(LEFT(BK188,1)=\"-\",REPLACE(BK188,1,1,tech!$H$2),BK188),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ188<>\"\",LEFT(BQ188,1)<>\"#\"),IF(LEFT(BQ188,1)=\"-\",REPLACE(BQ188,1,1,tech!$H$2),BQ188),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW188<>\"\",LEFT(BW188,1)<>\"#\"),IF(LEFT(BW188,1)=\"-\",REPLACE(BW188,1,1,tech!$H$2),BW188),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC188<>\"\",LEFT(CC188,1)<>\"#\"),IF(LEFT(CC188,1)=\"-\",REPLACE(CC188,1,1,tech!$H$2),CC188),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI188<>\"\",LEFT(CI188,1)<>\"#\"),IF(LEFT(CI188,1)=\"-\",REPLACE(CI188,1,1,tech!$H$2),CI188),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO188<>\"\",LEFT(CO188,1)<>\"#\"),IF(LEFT(CO188,1)=\"-\",REPLACE(CO188,1,1,tech!$H$2),CO188),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O189<>\"\",LEFT(O189,1)<>\"#\"),IF(LEFT(O189,1)=\"-\",REPLACE(O189,1,1,tech!$H$2),O189),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U189<>\"\",LEFT(U189,1)<>\"#\"),IF(LEFT(U189,1)=\"-\",REPLACE(U189,1,1,tech!$H$2),U189),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA189<>\"\",LEFT(AA189,1)<>\"#\"),IF(LEFT(AA189,1)=\"-\",REPLACE(AA189,1,1,tech!$H$2),AA189),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG189<>\"\",LEFT(AG189,1)<>\"#\"),IF(LEFT(AG189,1)=\"-\",REPLACE(AG189,1,1,tech!$H$2),AG189),\"\")","v":""},"|","#### Guidance","Organizational PKI governance","Guidance","2.2.7.GX",{"$f":"IF(AND(AM189<>\"\",LEFT(AM189,1)<>\"#\"),IF(LEFT(AM189,1)=\"-\",REPLACE(AM189,1,1,tech!$H$2),AM189),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS189<>\"\",LEFT(AS189,1)<>\"#\"),IF(LEFT(AS189,1)=\"-\",REPLACE(AS189,1,1,tech!$H$2),AS189),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY189<>\"\",LEFT(AY189,1)<>\"#\"),IF(LEFT(AY189,1)=\"-\",REPLACE(AY189,1,1,tech!$H$2),AY189),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE189<>\"\",LEFT(BE189,1)<>\"#\"),IF(LEFT(BE189,1)=\"-\",REPLACE(BE189,1,1,tech!$H$2),BE189),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK189<>\"\",LEFT(BK189,1)<>\"#\"),IF(LEFT(BK189,1)=\"-\",REPLACE(BK189,1,1,tech!$H$2),BK189),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ189<>\"\",LEFT(BQ189,1)<>\"#\"),IF(LEFT(BQ189,1)=\"-\",REPLACE(BQ189,1,1,tech!$H$2),BQ189),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW189<>\"\",LEFT(BW189,1)<>\"#\"),IF(LEFT(BW189,1)=\"-\",REPLACE(BW189,1,1,tech!$H$2),BW189),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC189<>\"\",LEFT(CC189,1)<>\"#\"),IF(LEFT(CC189,1)=\"-\",REPLACE(CC189,1,1,tech!$H$2),CC189),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI189<>\"\",LEFT(CI189,1)<>\"#\"),IF(LEFT(CI189,1)=\"-\",REPLACE(CI189,1,1,tech!$H$2),CI189),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO189<>\"\",LEFT(CO189,1)<>\"#\"),IF(LEFT(CO189,1)=\"-\",REPLACE(CO189,1,1,tech!$H$2),CO189),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O190<>\"\",LEFT(O190,1)<>\"#\"),IF(LEFT(O190,1)=\"-\",REPLACE(O190,1,1,tech!$H$2),O190),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U190<>\"\",LEFT(U190,1)<>\"#\"),IF(LEFT(U190,1)=\"-\",REPLACE(U190,1,1,tech!$H$2),U190),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA190<>\"\",LEFT(AA190,1)<>\"#\"),IF(LEFT(AA190,1)=\"-\",REPLACE(AA190,1,1,tech!$H$2),AA190),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG190<>\"\",LEFT(AG190,1)<>\"#\"),IF(LEFT(AG190,1)=\"-\",REPLACE(AG190,1,1,tech!$H$2),AG190),\"\")","v":""},"|",null,"Organizational PKI governance",{"$f":"IF(AND(LEFT(AM190,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AM190,\" \"))=4,0)),_xlfn.TEXTAFTER(AM190,\" \"),AO189)","v":"Guidance"},"2.2.7.GX",{"$f":"IF(AND(AM190<>\"\",LEFT(AM190,1)<>\"#\"),IF(LEFT(AM190,1)=\"-\",REPLACE(AM190,1,1,tech!$H$2),AM190),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed",{"$f":"IF(AND(LEFT(AS190,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AS190,\" \"))=4,0)),_xlfn.TEXTAFTER(AS190,\" \"),AU189)","v":"References"},"2.3.5.RX",{"$f":"IF(AND(AS190<>\"\",LEFT(AS190,1)<>\"#\"),IF(LEFT(AS190,1)=\"-\",REPLACE(AS190,1,1,tech!$H$2),AS190),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed",{"$f":"IF(AND(LEFT(AY190,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AY190,\" \"))=4,0)),_xlfn.TEXTAFTER(AY190,\" \"),BA189)","v":"References"},"2.4.5.RX",{"$f":"IF(AND(AY190<>\"\",LEFT(AY190,1)<>\"#\"),IF(LEFT(AY190,1)=\"-\",REPLACE(AY190,1,1,tech!$H$2),AY190),\"\")","v":""},"|",null,"Continual review and improvement",{"$f":"IF(AND(LEFT(BE190,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BE190,\" \"))=4,0)),_xlfn.TEXTAFTER(BE190,\" \"),BG189)","v":"References"},"3.1.6.RX",{"$f":"IF(AND(BE190<>\"\",LEFT(BE190,1)<>\"#\"),IF(LEFT(BE190,1)=\"-\",REPLACE(BE190,1,1,tech!$H$2),BE190),\"\")","v":""},"|",null,"Adoption and application of open standards",{"$f":"IF(AND(LEFT(BK190,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BK190,\" \"))=4,0)),_xlfn.TEXTAFTER(BK190,\" \"),BM189)","v":"References"},"3.2.3.RX",{"$f":"IF(AND(BK190<>\"\",LEFT(BK190,1)<>\"#\"),IF(LEFT(BK190,1)=\"-\",REPLACE(BK190,1,1,tech!$H$2),BK190),\"\")","v":""},"|",null,"Review of events and logs is periodically performed",{"$f":"IF(AND(LEFT(BQ190,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BQ190,\" \"))=4,0)),_xlfn.TEXTAFTER(BQ190,\" \"),BS189)","v":"References"},"3.3.6.RX",{"$f":"IF(AND(BQ190<>\"\",LEFT(BQ190,1)<>\"#\"),IF(LEFT(BQ190,1)=\"-\",REPLACE(BQ190,1,1,tech!$H$2),BQ190),\"\")","v":""},"|",null,"Incidents and exceptions handling",{"$f":"IF(AND(LEFT(BW190,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(BW190,\" \"))=4,0)),_xlfn.TEXTAFTER(BW190,\" \"),BY189)","v":"References"},"3.4.3.RX",{"$f":"IF(AND(BW190<>\"\",LEFT(BW190,1)<>\"#\"),IF(LEFT(BW190,1)=\"-\",REPLACE(BW190,1,1,tech!$H$2),BW190),\"\")","v":""},"|",null,"Resources are periodically reviewed",{"$f":"IF(AND(LEFT(CC190,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CC190,\" \"))=4,0)),_xlfn.TEXTAFTER(CC190,\" \"),CE189)","v":"References"},"4.1.4.RX",{"$f":"IF(AND(CC190<>\"\",LEFT(CC190,1)<>\"#\"),IF(LEFT(CC190,1)=\"-\",REPLACE(CC190,1,1,tech!$H$2),CC190),\"\")","v":""},"|",null,"Periodically review knowledge",{"$f":"IF(AND(LEFT(CI190,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CI190,\" \"))=4,0)),_xlfn.TEXTAFTER(CI190,\" \"),CK189)","v":"References"},"4.2.5.RX",{"$f":"IF(AND(CI190<>\"\",LEFT(CI190,1)<>\"#\"),IF(LEFT(CI190,1)=\"-\",REPLACE(CI190,1,1,tech!$H$2),CI190),\"\")","v":""},"|",null,"Timely communication of important information",{"$f":"IF(AND(LEFT(CO190,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(CO190,\" \"))=4,0)),_xlfn.TEXTAFTER(CO190,\" \"),CQ189)","v":"References"},"4.3.4.RX",{"$f":"IF(AND(CO190<>\"\",LEFT(CO190,1)<>\"#\"),IF(LEFT(CO190,1)=\"-\",REPLACE(CO190,1,1,tech!$H$2),CO190),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O191<>\"\",LEFT(O191,1)<>\"#\"),IF(LEFT(O191,1)=\"-\",REPLACE(O191,1,1,tech!$H$2),O191),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U191<>\"\",LEFT(U191,1)<>\"#\"),IF(LEFT(U191,1)=\"-\",REPLACE(U191,1,1,tech!$H$2),U191),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA191<>\"\",LEFT(AA191,1)<>\"#\"),IF(LEFT(AA191,1)=\"-\",REPLACE(AA191,1,1,tech!$H$2),AA191),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG191<>\"\",LEFT(AG191,1)<>\"#\"),IF(LEFT(AG191,1)=\"-\",REPLACE(AG191,1,1,tech!$H$2),AG191),\"\")","v":""},"|","Large organizations commonly have several PKI systems spread out in the organization. Some can be consolidated, but in many cases different PKI silos exists for good reasons. Having a central governance of PKIs across the organization will help to maintain best practices, ensure secure PKI operations, re-use PKI knowledge in the organization, ensure consistent profiles and avoid unnecessary duplication of effort.","Organizational PKI governance","Guidance","2.2.7.GY",{"$f":"IF(AND(AM191<>\"\",LEFT(AM191,1)<>\"#\"),IF(LEFT(AM191,1)=\"-\",REPLACE(AM191,1,1,tech!$H$2),AM191),\"\")","v":"Large organizations commonly have several PKI systems spread out in the organization. Some can be consolidated, but in many cases different PKI silos exists for good reasons. Having a central governance of PKIs across the organization will help to maintain best practices, ensure secure PKI operations, re-use PKI knowledge in the organization, ensure consistent profiles and avoid unnecessary duplication of effort."},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS191<>\"\",LEFT(AS191,1)<>\"#\"),IF(LEFT(AS191,1)=\"-\",REPLACE(AS191,1,1,tech!$H$2),AS191),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY191<>\"\",LEFT(AY191,1)<>\"#\"),IF(LEFT(AY191,1)=\"-\",REPLACE(AY191,1,1,tech!$H$2),AY191),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE191<>\"\",LEFT(BE191,1)<>\"#\"),IF(LEFT(BE191,1)=\"-\",REPLACE(BE191,1,1,tech!$H$2),BE191),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK191<>\"\",LEFT(BK191,1)<>\"#\"),IF(LEFT(BK191,1)=\"-\",REPLACE(BK191,1,1,tech!$H$2),BK191),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ191<>\"\",LEFT(BQ191,1)<>\"#\"),IF(LEFT(BQ191,1)=\"-\",REPLACE(BQ191,1,1,tech!$H$2),BQ191),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW191<>\"\",LEFT(BW191,1)<>\"#\"),IF(LEFT(BW191,1)=\"-\",REPLACE(BW191,1,1,tech!$H$2),BW191),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC191<>\"\",LEFT(CC191,1)<>\"#\"),IF(LEFT(CC191,1)=\"-\",REPLACE(CC191,1,1,tech!$H$2),CC191),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI191<>\"\",LEFT(CI191,1)<>\"#\"),IF(LEFT(CI191,1)=\"-\",REPLACE(CI191,1,1,tech!$H$2),CI191),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO191<>\"\",LEFT(CO191,1)<>\"#\"),IF(LEFT(CO191,1)=\"-\",REPLACE(CO191,1,1,tech!$H$2),CO191),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O192<>\"\",LEFT(O192,1)<>\"#\"),IF(LEFT(O192,1)=\"-\",REPLACE(O192,1,1,tech!$H$2),O192),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U192<>\"\",LEFT(U192,1)<>\"#\"),IF(LEFT(U192,1)=\"-\",REPLACE(U192,1,1,tech!$H$2),U192),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA192<>\"\",LEFT(AA192,1)<>\"#\"),IF(LEFT(AA192,1)=\"-\",REPLACE(AA192,1,1,tech!$H$2),AA192),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG192<>\"\",LEFT(AG192,1)<>\"#\"),IF(LEFT(AG192,1)=\"-\",REPLACE(AG192,1,1,tech!$H$2),AG192),\"\")","v":""},"|",null,"Organizational PKI governance","Guidance","2.2.7.GX",{"$f":"IF(AND(AM192<>\"\",LEFT(AM192,1)<>\"#\"),IF(LEFT(AM192,1)=\"-\",REPLACE(AM192,1,1,tech!$H$2),AM192),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS192<>\"\",LEFT(AS192,1)<>\"#\"),IF(LEFT(AS192,1)=\"-\",REPLACE(AS192,1,1,tech!$H$2),AS192),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY192<>\"\",LEFT(AY192,1)<>\"#\"),IF(LEFT(AY192,1)=\"-\",REPLACE(AY192,1,1,tech!$H$2),AY192),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE192<>\"\",LEFT(BE192,1)<>\"#\"),IF(LEFT(BE192,1)=\"-\",REPLACE(BE192,1,1,tech!$H$2),BE192),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK192<>\"\",LEFT(BK192,1)<>\"#\"),IF(LEFT(BK192,1)=\"-\",REPLACE(BK192,1,1,tech!$H$2),BK192),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ192<>\"\",LEFT(BQ192,1)<>\"#\"),IF(LEFT(BQ192,1)=\"-\",REPLACE(BQ192,1,1,tech!$H$2),BQ192),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW192<>\"\",LEFT(BW192,1)<>\"#\"),IF(LEFT(BW192,1)=\"-\",REPLACE(BW192,1,1,tech!$H$2),BW192),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC192<>\"\",LEFT(CC192,1)<>\"#\"),IF(LEFT(CC192,1)=\"-\",REPLACE(CC192,1,1,tech!$H$2),CC192),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI192<>\"\",LEFT(CI192,1)<>\"#\"),IF(LEFT(CI192,1)=\"-\",REPLACE(CI192,1,1,tech!$H$2),CI192),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO192<>\"\",LEFT(CO192,1)<>\"#\"),IF(LEFT(CO192,1)=\"-\",REPLACE(CO192,1,1,tech!$H$2),CO192),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O193<>\"\",LEFT(O193,1)<>\"#\"),IF(LEFT(O193,1)=\"-\",REPLACE(O193,1,1,tech!$H$2),O193),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U193<>\"\",LEFT(U193,1)<>\"#\"),IF(LEFT(U193,1)=\"-\",REPLACE(U193,1,1,tech!$H$2),U193),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA193<>\"\",LEFT(AA193,1)<>\"#\"),IF(LEFT(AA193,1)=\"-\",REPLACE(AA193,1,1,tech!$H$2),AA193),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG193<>\"\",LEFT(AG193,1)<>\"#\"),IF(LEFT(AG193,1)=\"-\",REPLACE(AG193,1,1,tech!$H$2),AG193),\"\")","v":""},"|","#### Assessment","Organizational PKI governance","Assessment","2.2.7.AX",{"$f":"IF(AND(AM193<>\"\",LEFT(AM193,1)<>\"#\"),IF(LEFT(AM193,1)=\"-\",REPLACE(AM193,1,1,tech!$H$2),AM193),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS193<>\"\",LEFT(AS193,1)<>\"#\"),IF(LEFT(AS193,1)=\"-\",REPLACE(AS193,1,1,tech!$H$2),AS193),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY193<>\"\",LEFT(AY193,1)<>\"#\"),IF(LEFT(AY193,1)=\"-\",REPLACE(AY193,1,1,tech!$H$2),AY193),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE193<>\"\",LEFT(BE193,1)<>\"#\"),IF(LEFT(BE193,1)=\"-\",REPLACE(BE193,1,1,tech!$H$2),BE193),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK193<>\"\",LEFT(BK193,1)<>\"#\"),IF(LEFT(BK193,1)=\"-\",REPLACE(BK193,1,1,tech!$H$2),BK193),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ193<>\"\",LEFT(BQ193,1)<>\"#\"),IF(LEFT(BQ193,1)=\"-\",REPLACE(BQ193,1,1,tech!$H$2),BQ193),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW193<>\"\",LEFT(BW193,1)<>\"#\"),IF(LEFT(BW193,1)=\"-\",REPLACE(BW193,1,1,tech!$H$2),BW193),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC193<>\"\",LEFT(CC193,1)<>\"#\"),IF(LEFT(CC193,1)=\"-\",REPLACE(CC193,1,1,tech!$H$2),CC193),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI193<>\"\",LEFT(CI193,1)<>\"#\"),IF(LEFT(CI193,1)=\"-\",REPLACE(CI193,1,1,tech!$H$2),CI193),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO193<>\"\",LEFT(CO193,1)<>\"#\"),IF(LEFT(CO193,1)=\"-\",REPLACE(CO193,1,1,tech!$H$2),CO193),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O194<>\"\",LEFT(O194,1)<>\"#\"),IF(LEFT(O194,1)=\"-\",REPLACE(O194,1,1,tech!$H$2),O194),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U194<>\"\",LEFT(U194,1)<>\"#\"),IF(LEFT(U194,1)=\"-\",REPLACE(U194,1,1,tech!$H$2),U194),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA194<>\"\",LEFT(AA194,1)<>\"#\"),IF(LEFT(AA194,1)=\"-\",REPLACE(AA194,1,1,tech!$H$2),AA194),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG194<>\"\",LEFT(AG194,1)<>\"#\"),IF(LEFT(AG194,1)=\"-\",REPLACE(AG194,1,1,tech!$H$2),AG194),\"\")","v":""},"|",null,"Organizational PKI governance","Assessment","2.2.7.AX",{"$f":"IF(AND(AM194<>\"\",LEFT(AM194,1)<>\"#\"),IF(LEFT(AM194,1)=\"-\",REPLACE(AM194,1,1,tech!$H$2),AM194),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS194<>\"\",LEFT(AS194,1)<>\"#\"),IF(LEFT(AS194,1)=\"-\",REPLACE(AS194,1,1,tech!$H$2),AS194),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY194<>\"\",LEFT(AY194,1)<>\"#\"),IF(LEFT(AY194,1)=\"-\",REPLACE(AY194,1,1,tech!$H$2),AY194),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE194<>\"\",LEFT(BE194,1)<>\"#\"),IF(LEFT(BE194,1)=\"-\",REPLACE(BE194,1,1,tech!$H$2),BE194),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK194<>\"\",LEFT(BK194,1)<>\"#\"),IF(LEFT(BK194,1)=\"-\",REPLACE(BK194,1,1,tech!$H$2),BK194),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ194<>\"\",LEFT(BQ194,1)<>\"#\"),IF(LEFT(BQ194,1)=\"-\",REPLACE(BQ194,1,1,tech!$H$2),BQ194),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW194<>\"\",LEFT(BW194,1)<>\"#\"),IF(LEFT(BW194,1)=\"-\",REPLACE(BW194,1,1,tech!$H$2),BW194),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC194<>\"\",LEFT(CC194,1)<>\"#\"),IF(LEFT(CC194,1)=\"-\",REPLACE(CC194,1,1,tech!$H$2),CC194),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI194<>\"\",LEFT(CI194,1)<>\"#\"),IF(LEFT(CI194,1)=\"-\",REPLACE(CI194,1,1,tech!$H$2),CI194),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO194<>\"\",LEFT(CO194,1)<>\"#\"),IF(LEFT(CO194,1)=\"-\",REPLACE(CO194,1,1,tech!$H$2),CO194),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O195<>\"\",LEFT(O195,1)<>\"#\"),IF(LEFT(O195,1)=\"-\",REPLACE(O195,1,1,tech!$H$2),O195),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U195<>\"\",LEFT(U195,1)<>\"#\"),IF(LEFT(U195,1)=\"-\",REPLACE(U195,1,1,tech!$H$2),U195),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA195<>\"\",LEFT(AA195,1)<>\"#\"),IF(LEFT(AA195,1)=\"-\",REPLACE(AA195,1,1,tech!$H$2),AA195),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG195<>\"\",LEFT(AG195,1)<>\"#\"),IF(LEFT(AG195,1)=\"-\",REPLACE(AG195,1,1,tech!$H$2),AG195),\"\")","v":""},"|","* Documented PKIs used in the organization","Organizational PKI governance","Assessment","2.2.7.AY",{"$f":"IF(AND(AM195<>\"\",LEFT(AM195,1)<>\"#\"),IF(LEFT(AM195,1)=\"-\",REPLACE(AM195,1,1,tech!$H$2),AM195),\"\")","v":"* Documented PKIs used in the organization"},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS195<>\"\",LEFT(AS195,1)<>\"#\"),IF(LEFT(AS195,1)=\"-\",REPLACE(AS195,1,1,tech!$H$2),AS195),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY195<>\"\",LEFT(AY195,1)<>\"#\"),IF(LEFT(AY195,1)=\"-\",REPLACE(AY195,1,1,tech!$H$2),AY195),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE195<>\"\",LEFT(BE195,1)<>\"#\"),IF(LEFT(BE195,1)=\"-\",REPLACE(BE195,1,1,tech!$H$2),BE195),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK195<>\"\",LEFT(BK195,1)<>\"#\"),IF(LEFT(BK195,1)=\"-\",REPLACE(BK195,1,1,tech!$H$2),BK195),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ195<>\"\",LEFT(BQ195,1)<>\"#\"),IF(LEFT(BQ195,1)=\"-\",REPLACE(BQ195,1,1,tech!$H$2),BQ195),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW195<>\"\",LEFT(BW195,1)<>\"#\"),IF(LEFT(BW195,1)=\"-\",REPLACE(BW195,1,1,tech!$H$2),BW195),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC195<>\"\",LEFT(CC195,1)<>\"#\"),IF(LEFT(CC195,1)=\"-\",REPLACE(CC195,1,1,tech!$H$2),CC195),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI195<>\"\",LEFT(CI195,1)<>\"#\"),IF(LEFT(CI195,1)=\"-\",REPLACE(CI195,1,1,tech!$H$2),CI195),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO195<>\"\",LEFT(CO195,1)<>\"#\"),IF(LEFT(CO195,1)=\"-\",REPLACE(CO195,1,1,tech!$H$2),CO195),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O196<>\"\",LEFT(O196,1)<>\"#\"),IF(LEFT(O196,1)=\"-\",REPLACE(O196,1,1,tech!$H$2),O196),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U196<>\"\",LEFT(U196,1)<>\"#\"),IF(LEFT(U196,1)=\"-\",REPLACE(U196,1,1,tech!$H$2),U196),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA196<>\"\",LEFT(AA196,1)<>\"#\"),IF(LEFT(AA196,1)=\"-\",REPLACE(AA196,1,1,tech!$H$2),AA196),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG196<>\"\",LEFT(AG196,1)<>\"#\"),IF(LEFT(AG196,1)=\"-\",REPLACE(AG196,1,1,tech!$H$2),AG196),\"\")","v":""},"|","  * Different PKI technologies used","Organizational PKI governance","Assessment","2.2.7.AY",{"$f":"IF(AND(AM196<>\"\",LEFT(AM196,1)<>\"#\"),IF(LEFT(AM196,1)=\"-\",REPLACE(AM196,1,1,tech!$H$2),AM196),\"\")","v":"  * Different PKI technologies used"},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS196<>\"\",LEFT(AS196,1)<>\"#\"),IF(LEFT(AS196,1)=\"-\",REPLACE(AS196,1,1,tech!$H$2),AS196),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY196<>\"\",LEFT(AY196,1)<>\"#\"),IF(LEFT(AY196,1)=\"-\",REPLACE(AY196,1,1,tech!$H$2),AY196),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE196<>\"\",LEFT(BE196,1)<>\"#\"),IF(LEFT(BE196,1)=\"-\",REPLACE(BE196,1,1,tech!$H$2),BE196),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK196<>\"\",LEFT(BK196,1)<>\"#\"),IF(LEFT(BK196,1)=\"-\",REPLACE(BK196,1,1,tech!$H$2),BK196),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ196<>\"\",LEFT(BQ196,1)<>\"#\"),IF(LEFT(BQ196,1)=\"-\",REPLACE(BQ196,1,1,tech!$H$2),BQ196),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW196<>\"\",LEFT(BW196,1)<>\"#\"),IF(LEFT(BW196,1)=\"-\",REPLACE(BW196,1,1,tech!$H$2),BW196),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC196<>\"\",LEFT(CC196,1)<>\"#\"),IF(LEFT(CC196,1)=\"-\",REPLACE(CC196,1,1,tech!$H$2),CC196),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI196<>\"\",LEFT(CI196,1)<>\"#\"),IF(LEFT(CI196,1)=\"-\",REPLACE(CI196,1,1,tech!$H$2),CI196),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO196<>\"\",LEFT(CO196,1)<>\"#\"),IF(LEFT(CO196,1)=\"-\",REPLACE(CO196,1,1,tech!$H$2),CO196),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O197<>\"\",LEFT(O197,1)<>\"#\"),IF(LEFT(O197,1)=\"-\",REPLACE(O197,1,1,tech!$H$2),O197),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U197<>\"\",LEFT(U197,1)<>\"#\"),IF(LEFT(U197,1)=\"-\",REPLACE(U197,1,1,tech!$H$2),U197),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA197<>\"\",LEFT(AA197,1)<>\"#\"),IF(LEFT(AA197,1)=\"-\",REPLACE(AA197,1,1,tech!$H$2),AA197),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG197<>\"\",LEFT(AG197,1)<>\"#\"),IF(LEFT(AG197,1)=\"-\",REPLACE(AG197,1,1,tech!$H$2),AG197),\"\")","v":""},"|","  * Installed PKI instances","Organizational PKI governance","Assessment","2.2.7.AY",{"$f":"IF(AND(AM197<>\"\",LEFT(AM197,1)<>\"#\"),IF(LEFT(AM197,1)=\"-\",REPLACE(AM197,1,1,tech!$H$2),AM197),\"\")","v":"  * Installed PKI instances"},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS197<>\"\",LEFT(AS197,1)<>\"#\"),IF(LEFT(AS197,1)=\"-\",REPLACE(AS197,1,1,tech!$H$2),AS197),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY197<>\"\",LEFT(AY197,1)<>\"#\"),IF(LEFT(AY197,1)=\"-\",REPLACE(AY197,1,1,tech!$H$2),AY197),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE197<>\"\",LEFT(BE197,1)<>\"#\"),IF(LEFT(BE197,1)=\"-\",REPLACE(BE197,1,1,tech!$H$2),BE197),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK197<>\"\",LEFT(BK197,1)<>\"#\"),IF(LEFT(BK197,1)=\"-\",REPLACE(BK197,1,1,tech!$H$2),BK197),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ197<>\"\",LEFT(BQ197,1)<>\"#\"),IF(LEFT(BQ197,1)=\"-\",REPLACE(BQ197,1,1,tech!$H$2),BQ197),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW197<>\"\",LEFT(BW197,1)<>\"#\"),IF(LEFT(BW197,1)=\"-\",REPLACE(BW197,1,1,tech!$H$2),BW197),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC197<>\"\",LEFT(CC197,1)<>\"#\"),IF(LEFT(CC197,1)=\"-\",REPLACE(CC197,1,1,tech!$H$2),CC197),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI197<>\"\",LEFT(CI197,1)<>\"#\"),IF(LEFT(CI197,1)=\"-\",REPLACE(CI197,1,1,tech!$H$2),CI197),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO197<>\"\",LEFT(CO197,1)<>\"#\"),IF(LEFT(CO197,1)=\"-\",REPLACE(CO197,1,1,tech!$H$2),CO197),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O198<>\"\",LEFT(O198,1)<>\"#\"),IF(LEFT(O198,1)=\"-\",REPLACE(O198,1,1,tech!$H$2),O198),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U198<>\"\",LEFT(U198,1)<>\"#\"),IF(LEFT(U198,1)=\"-\",REPLACE(U198,1,1,tech!$H$2),U198),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA198<>\"\",LEFT(AA198,1)<>\"#\"),IF(LEFT(AA198,1)=\"-\",REPLACE(AA198,1,1,tech!$H$2),AA198),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG198<>\"\",LEFT(AG198,1)<>\"#\"),IF(LEFT(AG198,1)=\"-\",REPLACE(AG198,1,1,tech!$H$2),AG198),\"\")","v":""},"|","* Documented PKI best practices","Organizational PKI governance","Assessment","2.2.7.AY",{"$f":"IF(AND(AM198<>\"\",LEFT(AM198,1)<>\"#\"),IF(LEFT(AM198,1)=\"-\",REPLACE(AM198,1,1,tech!$H$2),AM198),\"\")","v":"* Documented PKI best practices"},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS198<>\"\",LEFT(AS198,1)<>\"#\"),IF(LEFT(AS198,1)=\"-\",REPLACE(AS198,1,1,tech!$H$2),AS198),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY198<>\"\",LEFT(AY198,1)<>\"#\"),IF(LEFT(AY198,1)=\"-\",REPLACE(AY198,1,1,tech!$H$2),AY198),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE198<>\"\",LEFT(BE198,1)<>\"#\"),IF(LEFT(BE198,1)=\"-\",REPLACE(BE198,1,1,tech!$H$2),BE198),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK198<>\"\",LEFT(BK198,1)<>\"#\"),IF(LEFT(BK198,1)=\"-\",REPLACE(BK198,1,1,tech!$H$2),BK198),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ198<>\"\",LEFT(BQ198,1)<>\"#\"),IF(LEFT(BQ198,1)=\"-\",REPLACE(BQ198,1,1,tech!$H$2),BQ198),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW198<>\"\",LEFT(BW198,1)<>\"#\"),IF(LEFT(BW198,1)=\"-\",REPLACE(BW198,1,1,tech!$H$2),BW198),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC198<>\"\",LEFT(CC198,1)<>\"#\"),IF(LEFT(CC198,1)=\"-\",REPLACE(CC198,1,1,tech!$H$2),CC198),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI198<>\"\",LEFT(CI198,1)<>\"#\"),IF(LEFT(CI198,1)=\"-\",REPLACE(CI198,1,1,tech!$H$2),CI198),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO198<>\"\",LEFT(CO198,1)<>\"#\"),IF(LEFT(CO198,1)=\"-\",REPLACE(CO198,1,1,tech!$H$2),CO198),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O199<>\"\",LEFT(O199,1)<>\"#\"),IF(LEFT(O199,1)=\"-\",REPLACE(O199,1,1,tech!$H$2),O199),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U199<>\"\",LEFT(U199,1)<>\"#\"),IF(LEFT(U199,1)=\"-\",REPLACE(U199,1,1,tech!$H$2),U199),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA199<>\"\",LEFT(AA199,1)<>\"#\"),IF(LEFT(AA199,1)=\"-\",REPLACE(AA199,1,1,tech!$H$2),AA199),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG199<>\"\",LEFT(AG199,1)<>\"#\"),IF(LEFT(AG199,1)=\"-\",REPLACE(AG199,1,1,tech!$H$2),AG199),\"\")","v":""},"|","  * Installation procedures to avoid re-learning the same issues in different parts of the organization","Organizational PKI governance","Assessment","2.2.7.AY",{"$f":"IF(AND(AM199<>\"\",LEFT(AM199,1)<>\"#\"),IF(LEFT(AM199,1)=\"-\",REPLACE(AM199,1,1,tech!$H$2),AM199),\"\")","v":"  * Installation procedures to avoid re-learning the same issues in different parts of the organization"},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS199<>\"\",LEFT(AS199,1)<>\"#\"),IF(LEFT(AS199,1)=\"-\",REPLACE(AS199,1,1,tech!$H$2),AS199),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY199<>\"\",LEFT(AY199,1)<>\"#\"),IF(LEFT(AY199,1)=\"-\",REPLACE(AY199,1,1,tech!$H$2),AY199),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE199<>\"\",LEFT(BE199,1)<>\"#\"),IF(LEFT(BE199,1)=\"-\",REPLACE(BE199,1,1,tech!$H$2),BE199),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK199<>\"\",LEFT(BK199,1)<>\"#\"),IF(LEFT(BK199,1)=\"-\",REPLACE(BK199,1,1,tech!$H$2),BK199),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ199<>\"\",LEFT(BQ199,1)<>\"#\"),IF(LEFT(BQ199,1)=\"-\",REPLACE(BQ199,1,1,tech!$H$2),BQ199),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW199<>\"\",LEFT(BW199,1)<>\"#\"),IF(LEFT(BW199,1)=\"-\",REPLACE(BW199,1,1,tech!$H$2),BW199),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC199<>\"\",LEFT(CC199,1)<>\"#\"),IF(LEFT(CC199,1)=\"-\",REPLACE(CC199,1,1,tech!$H$2),CC199),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI199<>\"\",LEFT(CI199,1)<>\"#\"),IF(LEFT(CI199,1)=\"-\",REPLACE(CI199,1,1,tech!$H$2),CI199),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO199<>\"\",LEFT(CO199,1)<>\"#\"),IF(LEFT(CO199,1)=\"-\",REPLACE(CO199,1,1,tech!$H$2),CO199),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O200<>\"\",LEFT(O200,1)<>\"#\"),IF(LEFT(O200,1)=\"-\",REPLACE(O200,1,1,tech!$H$2),O200),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U200<>\"\",LEFT(U200,1)<>\"#\"),IF(LEFT(U200,1)=\"-\",REPLACE(U200,1,1,tech!$H$2),U200),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA200<>\"\",LEFT(AA200,1)<>\"#\"),IF(LEFT(AA200,1)=\"-\",REPLACE(AA200,1,1,tech!$H$2),AA200),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG200<>\"\",LEFT(AG200,1)<>\"#\"),IF(LEFT(AG200,1)=\"-\",REPLACE(AG200,1,1,tech!$H$2),AG200),\"\")","v":""},"|","  * Configuration to ensure consistent and interoperable certificates where applicable","Organizational PKI governance","Assessment","2.2.7.AY",{"$f":"IF(AND(AM200<>\"\",LEFT(AM200,1)<>\"#\"),IF(LEFT(AM200,1)=\"-\",REPLACE(AM200,1,1,tech!$H$2),AM200),\"\")","v":"  * Configuration to ensure consistent and interoperable certificates where applicable"},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS200<>\"\",LEFT(AS200,1)<>\"#\"),IF(LEFT(AS200,1)=\"-\",REPLACE(AS200,1,1,tech!$H$2),AS200),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY200<>\"\",LEFT(AY200,1)<>\"#\"),IF(LEFT(AY200,1)=\"-\",REPLACE(AY200,1,1,tech!$H$2),AY200),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE200<>\"\",LEFT(BE200,1)<>\"#\"),IF(LEFT(BE200,1)=\"-\",REPLACE(BE200,1,1,tech!$H$2),BE200),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK200<>\"\",LEFT(BK200,1)<>\"#\"),IF(LEFT(BK200,1)=\"-\",REPLACE(BK200,1,1,tech!$H$2),BK200),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ200<>\"\",LEFT(BQ200,1)<>\"#\"),IF(LEFT(BQ200,1)=\"-\",REPLACE(BQ200,1,1,tech!$H$2),BQ200),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW200<>\"\",LEFT(BW200,1)<>\"#\"),IF(LEFT(BW200,1)=\"-\",REPLACE(BW200,1,1,tech!$H$2),BW200),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC200<>\"\",LEFT(CC200,1)<>\"#\"),IF(LEFT(CC200,1)=\"-\",REPLACE(CC200,1,1,tech!$H$2),CC200),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI200<>\"\",LEFT(CI200,1)<>\"#\"),IF(LEFT(CI200,1)=\"-\",REPLACE(CI200,1,1,tech!$H$2),CI200),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO200<>\"\",LEFT(CO200,1)<>\"#\"),IF(LEFT(CO200,1)=\"-\",REPLACE(CO200,1,1,tech!$H$2),CO200),\"\")","v":""},"|"]
[{"$nulls":15},{"$f":"IF(AND(LEFT(O201,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(O201,\" \"))=3,0)),_xlfn.TEXTAFTER(O201,\" \"),P200)","v":"Policies are periodically reviewed and updated"},{"$f":"IF(AND(LEFT(O201,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(O201,\" \"))=4,0)),_xlfn.TEXTAFTER(O201,\" \"),Q200)","v":"References"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(P201,$R$4:$S$13,2,0),\"\"),LEFT(Q201,1),IF(S201=\"\",IF(AND(S200<>\"\",S202<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"1.2.5.RX"},{"$f":"IF(AND(O201<>\"\",LEFT(O201,1)<>\"#\"),IF(LEFT(O201,1)=\"-\",REPLACE(O201,1,1,tech!$H$2),O201),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(U201,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(U201,\" \"))=3,0)),_xlfn.TEXTAFTER(U201,\" \"),V200)","v":"List of relevant laws, regulations, and standards, exist and is maintained"},{"$f":"IF(AND(LEFT(U201,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(U201,\" \"))=4,0)),_xlfn.TEXTAFTER(U201,\" \"),W200)","v":"References"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(V201,X$4:Y$13,2,0),\"\"),LEFT(W201,1),IF(Y201=\"\",IF(AND(Y200<>\"\",Y202<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"1.3.4.RX"},{"$f":"IF(AND(U201<>\"\",LEFT(U201,1)<>\"#\"),IF(LEFT(U201,1)=\"-\",REPLACE(U201,1,1,tech!$H$2),U201),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(AA201,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AA201,\" \"))=3,0)),_xlfn.TEXTAFTER(AA201,\" \"),AB200)","v":"Processes and procedures are reviewed and updated"},{"$f":"IF(AND(LEFT(AA201,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AA201,\" \"))=4,0)),_xlfn.TEXTAFTER(AA201,\" \"),AC200)","v":"References"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AB201,AD$4:AE$13,2,0),\"\"),LEFT(AC201,1),IF(AE201=\"\",IF(AND(AE200<>\"\",AE202<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"1.4.5.RX"},{"$f":"IF(AND(AA201<>\"\",LEFT(AA201,1)<>\"#\"),IF(LEFT(AA201,1)=\"-\",REPLACE(AA201,1,1,tech!$H$2),AA201),\"\")","v":""},"|",null,{"$f":"IF(AND(LEFT(AG201,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AG201,\" \"))=3,0)),_xlfn.TEXTAFTER(AG201,\" \"),AH200)","v":"Key management is periodically reviewed and updated"},{"$f":"IF(AND(LEFT(AG201,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AG201,\" \"))=4,0)),_xlfn.TEXTAFTER(AG201,\" \"),AI200)","v":"References"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AH201,AJ$4:AK$13,2,0),\"\"),LEFT(AI201,1),IF(AK201=\"\",IF(AND(AK200<>\"\",AK202<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"2.1.6.RX"},{"$f":"IF(AND(AG201<>\"\",LEFT(AG201,1)<>\"#\"),IF(LEFT(AG201,1)=\"-\",REPLACE(AG201,1,1,tech!$H$2),AG201),\"\")","v":""},"|","  * Security to maintain a security base line across the whole organization",{"$f":"IF(AND(LEFT(AM201,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AM201,\" \"))=3,0)),_xlfn.TEXTAFTER(AM201,\" \"),AN200)","v":"Organizational PKI governance"},{"$f":"IF(AND(LEFT(AM201,1)=\"#\",IFERROR(LEN(_xlfn.TEXTBEFORE(AM201,\" \"))=4,0)),_xlfn.TEXTAFTER(AM201,\" \"),AO200)","v":"Assessment"},{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AN201,AP$4:AQ$13,2,0),\"\"),LEFT(AO201,1),IF(AQ201=\"\",IF(AND(AQ200<>\"\",AQ202<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"2.2.7.AY"},{"$f":"IF(AND(AM201<>\"\",LEFT(AM201,1)<>\"#\"),IF(LEFT(AM201,1)=\"-\",REPLACE(AM201,1,1,tech!$H$2),AM201),\"\")","v":"  * Security to maintain a security base line across the whole organization"},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS201<>\"\",LEFT(AS201,1)<>\"#\"),IF(LEFT(AS201,1)=\"-\",REPLACE(AS201,1,1,tech!$H$2),AS201),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY201<>\"\",LEFT(AY201,1)<>\"#\"),IF(LEFT(AY201,1)=\"-\",REPLACE(AY201,1,1,tech!$H$2),AY201),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE201<>\"\",LEFT(BE201,1)<>\"#\"),IF(LEFT(BE201,1)=\"-\",REPLACE(BE201,1,1,tech!$H$2),BE201),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK201<>\"\",LEFT(BK201,1)<>\"#\"),IF(LEFT(BK201,1)=\"-\",REPLACE(BK201,1,1,tech!$H$2),BK201),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ201<>\"\",LEFT(BQ201,1)<>\"#\"),IF(LEFT(BQ201,1)=\"-\",REPLACE(BQ201,1,1,tech!$H$2),BQ201),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW201<>\"\",LEFT(BW201,1)<>\"#\"),IF(LEFT(BW201,1)=\"-\",REPLACE(BW201,1,1,tech!$H$2),BW201),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC201<>\"\",LEFT(CC201,1)<>\"#\"),IF(LEFT(CC201,1)=\"-\",REPLACE(CC201,1,1,tech!$H$2),CC201),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI201<>\"\",LEFT(CI201,1)<>\"#\"),IF(LEFT(CI201,1)=\"-\",REPLACE(CI201,1,1,tech!$H$2),CI201),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO201<>\"\",LEFT(CO201,1)<>\"#\"),IF(LEFT(CO201,1)=\"-\",REPLACE(CO201,1,1,tech!$H$2),CO201),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O202<>\"\",LEFT(O202,1)<>\"#\"),IF(LEFT(O202,1)=\"-\",REPLACE(O202,1,1,tech!$H$2),O202),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U202<>\"\",LEFT(U202,1)<>\"#\"),IF(LEFT(U202,1)=\"-\",REPLACE(U202,1,1,tech!$H$2),U202),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA202<>\"\",LEFT(AA202,1)<>\"#\"),IF(LEFT(AA202,1)=\"-\",REPLACE(AA202,1,1,tech!$H$2),AA202),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG202<>\"\",LEFT(AG202,1)<>\"#\"),IF(LEFT(AG202,1)=\"-\",REPLACE(AG202,1,1,tech!$H$2),AG202),\"\")","v":""},"|",null,"Organizational PKI governance","Assessment","2.2.7.AX",{"$f":"IF(AND(AM202<>\"\",LEFT(AM202,1)<>\"#\"),IF(LEFT(AM202,1)=\"-\",REPLACE(AM202,1,1,tech!$H$2),AM202),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS202<>\"\",LEFT(AS202,1)<>\"#\"),IF(LEFT(AS202,1)=\"-\",REPLACE(AS202,1,1,tech!$H$2),AS202),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY202<>\"\",LEFT(AY202,1)<>\"#\"),IF(LEFT(AY202,1)=\"-\",REPLACE(AY202,1,1,tech!$H$2),AY202),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE202<>\"\",LEFT(BE202,1)<>\"#\"),IF(LEFT(BE202,1)=\"-\",REPLACE(BE202,1,1,tech!$H$2),BE202),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK202<>\"\",LEFT(BK202,1)<>\"#\"),IF(LEFT(BK202,1)=\"-\",REPLACE(BK202,1,1,tech!$H$2),BK202),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ202<>\"\",LEFT(BQ202,1)<>\"#\"),IF(LEFT(BQ202,1)=\"-\",REPLACE(BQ202,1,1,tech!$H$2),BQ202),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW202<>\"\",LEFT(BW202,1)<>\"#\"),IF(LEFT(BW202,1)=\"-\",REPLACE(BW202,1,1,tech!$H$2),BW202),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC202<>\"\",LEFT(CC202,1)<>\"#\"),IF(LEFT(CC202,1)=\"-\",REPLACE(CC202,1,1,tech!$H$2),CC202),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI202<>\"\",LEFT(CI202,1)<>\"#\"),IF(LEFT(CI202,1)=\"-\",REPLACE(CI202,1,1,tech!$H$2),CI202),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO202<>\"\",LEFT(CO202,1)<>\"#\"),IF(LEFT(CO202,1)=\"-\",REPLACE(CO202,1,1,tech!$H$2),CO202),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O203<>\"\",LEFT(O203,1)<>\"#\"),IF(LEFT(O203,1)=\"-\",REPLACE(O203,1,1,tech!$H$2),O203),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U203<>\"\",LEFT(U203,1)<>\"#\"),IF(LEFT(U203,1)=\"-\",REPLACE(U203,1,1,tech!$H$2),U203),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA203<>\"\",LEFT(AA203,1)<>\"#\"),IF(LEFT(AA203,1)=\"-\",REPLACE(AA203,1,1,tech!$H$2),AA203),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG203<>\"\",LEFT(AG203,1)<>\"#\"),IF(LEFT(AG203,1)=\"-\",REPLACE(AG203,1,1,tech!$H$2),AG203),\"\")","v":""},"|","#### References","Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM203<>\"\",LEFT(AM203,1)<>\"#\"),IF(LEFT(AM203,1)=\"-\",REPLACE(AM203,1,1,tech!$H$2),AM203),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS203<>\"\",LEFT(AS203,1)<>\"#\"),IF(LEFT(AS203,1)=\"-\",REPLACE(AS203,1,1,tech!$H$2),AS203),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY203<>\"\",LEFT(AY203,1)<>\"#\"),IF(LEFT(AY203,1)=\"-\",REPLACE(AY203,1,1,tech!$H$2),AY203),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE203<>\"\",LEFT(BE203,1)<>\"#\"),IF(LEFT(BE203,1)=\"-\",REPLACE(BE203,1,1,tech!$H$2),BE203),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK203<>\"\",LEFT(BK203,1)<>\"#\"),IF(LEFT(BK203,1)=\"-\",REPLACE(BK203,1,1,tech!$H$2),BK203),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ203<>\"\",LEFT(BQ203,1)<>\"#\"),IF(LEFT(BQ203,1)=\"-\",REPLACE(BQ203,1,1,tech!$H$2),BQ203),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW203<>\"\",LEFT(BW203,1)<>\"#\"),IF(LEFT(BW203,1)=\"-\",REPLACE(BW203,1,1,tech!$H$2),BW203),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC203<>\"\",LEFT(CC203,1)<>\"#\"),IF(LEFT(CC203,1)=\"-\",REPLACE(CC203,1,1,tech!$H$2),CC203),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI203<>\"\",LEFT(CI203,1)<>\"#\"),IF(LEFT(CI203,1)=\"-\",REPLACE(CI203,1,1,tech!$H$2),CI203),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO203<>\"\",LEFT(CO203,1)<>\"#\"),IF(LEFT(CO203,1)=\"-\",REPLACE(CO203,1,1,tech!$H$2),CO203),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O204<>\"\",LEFT(O204,1)<>\"#\"),IF(LEFT(O204,1)=\"-\",REPLACE(O204,1,1,tech!$H$2),O204),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U204<>\"\",LEFT(U204,1)<>\"#\"),IF(LEFT(U204,1)=\"-\",REPLACE(U204,1,1,tech!$H$2),U204),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA204<>\"\",LEFT(AA204,1)<>\"#\"),IF(LEFT(AA204,1)=\"-\",REPLACE(AA204,1,1,tech!$H$2),AA204),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG204<>\"\",LEFT(AG204,1)<>\"#\"),IF(LEFT(AG204,1)=\"-\",REPLACE(AG204,1,1,tech!$H$2),AG204),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM204<>\"\",LEFT(AM204,1)<>\"#\"),IF(LEFT(AM204,1)=\"-\",REPLACE(AM204,1,1,tech!$H$2),AM204),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS204<>\"\",LEFT(AS204,1)<>\"#\"),IF(LEFT(AS204,1)=\"-\",REPLACE(AS204,1,1,tech!$H$2),AS204),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY204<>\"\",LEFT(AY204,1)<>\"#\"),IF(LEFT(AY204,1)=\"-\",REPLACE(AY204,1,1,tech!$H$2),AY204),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE204<>\"\",LEFT(BE204,1)<>\"#\"),IF(LEFT(BE204,1)=\"-\",REPLACE(BE204,1,1,tech!$H$2),BE204),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK204<>\"\",LEFT(BK204,1)<>\"#\"),IF(LEFT(BK204,1)=\"-\",REPLACE(BK204,1,1,tech!$H$2),BK204),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ204<>\"\",LEFT(BQ204,1)<>\"#\"),IF(LEFT(BQ204,1)=\"-\",REPLACE(BQ204,1,1,tech!$H$2),BQ204),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW204<>\"\",LEFT(BW204,1)<>\"#\"),IF(LEFT(BW204,1)=\"-\",REPLACE(BW204,1,1,tech!$H$2),BW204),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC204<>\"\",LEFT(CC204,1)<>\"#\"),IF(LEFT(CC204,1)=\"-\",REPLACE(CC204,1,1,tech!$H$2),CC204),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI204<>\"\",LEFT(CI204,1)<>\"#\"),IF(LEFT(CI204,1)=\"-\",REPLACE(CI204,1,1,tech!$H$2),CI204),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO204<>\"\",LEFT(CO204,1)<>\"#\"),IF(LEFT(CO204,1)=\"-\",REPLACE(CO204,1,1,tech!$H$2),CO204),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O205<>\"\",LEFT(O205,1)<>\"#\"),IF(LEFT(O205,1)=\"-\",REPLACE(O205,1,1,tech!$H$2),O205),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U205<>\"\",LEFT(U205,1)<>\"#\"),IF(LEFT(U205,1)=\"-\",REPLACE(U205,1,1,tech!$H$2),U205),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA205<>\"\",LEFT(AA205,1)<>\"#\"),IF(LEFT(AA205,1)=\"-\",REPLACE(AA205,1,1,tech!$H$2),AA205),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG205<>\"\",LEFT(AG205,1)<>\"#\"),IF(LEFT(AG205,1)=\"-\",REPLACE(AG205,1,1,tech!$H$2),AG205),\"\")","v":""},"|","N/A","Organizational PKI governance","References","2.2.7.RY",{"$f":"IF(AND(AM205<>\"\",LEFT(AM205,1)<>\"#\"),IF(LEFT(AM205,1)=\"-\",REPLACE(AM205,1,1,tech!$H$2),AM205),\"\")","v":"N/A"},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS205<>\"\",LEFT(AS205,1)<>\"#\"),IF(LEFT(AS205,1)=\"-\",REPLACE(AS205,1,1,tech!$H$2),AS205),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY205<>\"\",LEFT(AY205,1)<>\"#\"),IF(LEFT(AY205,1)=\"-\",REPLACE(AY205,1,1,tech!$H$2),AY205),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE205<>\"\",LEFT(BE205,1)<>\"#\"),IF(LEFT(BE205,1)=\"-\",REPLACE(BE205,1,1,tech!$H$2),BE205),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK205<>\"\",LEFT(BK205,1)<>\"#\"),IF(LEFT(BK205,1)=\"-\",REPLACE(BK205,1,1,tech!$H$2),BK205),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ205<>\"\",LEFT(BQ205,1)<>\"#\"),IF(LEFT(BQ205,1)=\"-\",REPLACE(BQ205,1,1,tech!$H$2),BQ205),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW205<>\"\",LEFT(BW205,1)<>\"#\"),IF(LEFT(BW205,1)=\"-\",REPLACE(BW205,1,1,tech!$H$2),BW205),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC205<>\"\",LEFT(CC205,1)<>\"#\"),IF(LEFT(CC205,1)=\"-\",REPLACE(CC205,1,1,tech!$H$2),CC205),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI205<>\"\",LEFT(CI205,1)<>\"#\"),IF(LEFT(CI205,1)=\"-\",REPLACE(CI205,1,1,tech!$H$2),CI205),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO205<>\"\",LEFT(CO205,1)<>\"#\"),IF(LEFT(CO205,1)=\"-\",REPLACE(CO205,1,1,tech!$H$2),CO205),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O206<>\"\",LEFT(O206,1)<>\"#\"),IF(LEFT(O206,1)=\"-\",REPLACE(O206,1,1,tech!$H$2),O206),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U206<>\"\",LEFT(U206,1)<>\"#\"),IF(LEFT(U206,1)=\"-\",REPLACE(U206,1,1,tech!$H$2),U206),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA206<>\"\",LEFT(AA206,1)<>\"#\"),IF(LEFT(AA206,1)=\"-\",REPLACE(AA206,1,1,tech!$H$2),AA206),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG206<>\"\",LEFT(AG206,1)<>\"#\"),IF(LEFT(AG206,1)=\"-\",REPLACE(AG206,1,1,tech!$H$2),AG206),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM206<>\"\",LEFT(AM206,1)<>\"#\"),IF(LEFT(AM206,1)=\"-\",REPLACE(AM206,1,1,tech!$H$2),AM206),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS206<>\"\",LEFT(AS206,1)<>\"#\"),IF(LEFT(AS206,1)=\"-\",REPLACE(AS206,1,1,tech!$H$2),AS206),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY206<>\"\",LEFT(AY206,1)<>\"#\"),IF(LEFT(AY206,1)=\"-\",REPLACE(AY206,1,1,tech!$H$2),AY206),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE206<>\"\",LEFT(BE206,1)<>\"#\"),IF(LEFT(BE206,1)=\"-\",REPLACE(BE206,1,1,tech!$H$2),BE206),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK206<>\"\",LEFT(BK206,1)<>\"#\"),IF(LEFT(BK206,1)=\"-\",REPLACE(BK206,1,1,tech!$H$2),BK206),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ206<>\"\",LEFT(BQ206,1)<>\"#\"),IF(LEFT(BQ206,1)=\"-\",REPLACE(BQ206,1,1,tech!$H$2),BQ206),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW206<>\"\",LEFT(BW206,1)<>\"#\"),IF(LEFT(BW206,1)=\"-\",REPLACE(BW206,1,1,tech!$H$2),BW206),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC206<>\"\",LEFT(CC206,1)<>\"#\"),IF(LEFT(CC206,1)=\"-\",REPLACE(CC206,1,1,tech!$H$2),CC206),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI206<>\"\",LEFT(CI206,1)<>\"#\"),IF(LEFT(CI206,1)=\"-\",REPLACE(CI206,1,1,tech!$H$2),CI206),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO206<>\"\",LEFT(CO206,1)<>\"#\"),IF(LEFT(CO206,1)=\"-\",REPLACE(CO206,1,1,tech!$H$2),CO206),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O207<>\"\",LEFT(O207,1)<>\"#\"),IF(LEFT(O207,1)=\"-\",REPLACE(O207,1,1,tech!$H$2),O207),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U207<>\"\",LEFT(U207,1)<>\"#\"),IF(LEFT(U207,1)=\"-\",REPLACE(U207,1,1,tech!$H$2),U207),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA207<>\"\",LEFT(AA207,1)<>\"#\"),IF(LEFT(AA207,1)=\"-\",REPLACE(AA207,1,1,tech!$H$2),AA207),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG207<>\"\",LEFT(AG207,1)<>\"#\"),IF(LEFT(AG207,1)=\"-\",REPLACE(AG207,1,1,tech!$H$2),AG207),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM207<>\"\",LEFT(AM207,1)<>\"#\"),IF(LEFT(AM207,1)=\"-\",REPLACE(AM207,1,1,tech!$H$2),AM207),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS207<>\"\",LEFT(AS207,1)<>\"#\"),IF(LEFT(AS207,1)=\"-\",REPLACE(AS207,1,1,tech!$H$2),AS207),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY207<>\"\",LEFT(AY207,1)<>\"#\"),IF(LEFT(AY207,1)=\"-\",REPLACE(AY207,1,1,tech!$H$2),AY207),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE207<>\"\",LEFT(BE207,1)<>\"#\"),IF(LEFT(BE207,1)=\"-\",REPLACE(BE207,1,1,tech!$H$2),BE207),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK207<>\"\",LEFT(BK207,1)<>\"#\"),IF(LEFT(BK207,1)=\"-\",REPLACE(BK207,1,1,tech!$H$2),BK207),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ207<>\"\",LEFT(BQ207,1)<>\"#\"),IF(LEFT(BQ207,1)=\"-\",REPLACE(BQ207,1,1,tech!$H$2),BQ207),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW207<>\"\",LEFT(BW207,1)<>\"#\"),IF(LEFT(BW207,1)=\"-\",REPLACE(BW207,1,1,tech!$H$2),BW207),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC207<>\"\",LEFT(CC207,1)<>\"#\"),IF(LEFT(CC207,1)=\"-\",REPLACE(CC207,1,1,tech!$H$2),CC207),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI207<>\"\",LEFT(CI207,1)<>\"#\"),IF(LEFT(CI207,1)=\"-\",REPLACE(CI207,1,1,tech!$H$2),CI207),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO207<>\"\",LEFT(CO207,1)<>\"#\"),IF(LEFT(CO207,1)=\"-\",REPLACE(CO207,1,1,tech!$H$2),CO207),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O208<>\"\",LEFT(O208,1)<>\"#\"),IF(LEFT(O208,1)=\"-\",REPLACE(O208,1,1,tech!$H$2),O208),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U208<>\"\",LEFT(U208,1)<>\"#\"),IF(LEFT(U208,1)=\"-\",REPLACE(U208,1,1,tech!$H$2),U208),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA208<>\"\",LEFT(AA208,1)<>\"#\"),IF(LEFT(AA208,1)=\"-\",REPLACE(AA208,1,1,tech!$H$2),AA208),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG208<>\"\",LEFT(AG208,1)<>\"#\"),IF(LEFT(AG208,1)=\"-\",REPLACE(AG208,1,1,tech!$H$2),AG208),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM208<>\"\",LEFT(AM208,1)<>\"#\"),IF(LEFT(AM208,1)=\"-\",REPLACE(AM208,1,1,tech!$H$2),AM208),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AT208,AV$4:AW$13,2,0),\"\"),LEFT(AU208,1),IF(AW208=\"\",IF(AND(AW207<>\"\",AW209<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"2.3.5.RX"},{"$f":"IF(AND(AS208<>\"\",LEFT(AS208,1)<>\"#\"),IF(LEFT(AS208,1)=\"-\",REPLACE(AS208,1,1,tech!$H$2),AS208),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(AZ208,BB$4:BC$13,2,0),\"\"),LEFT(BA208,1),IF(BC208=\"\",IF(AND(BC207<>\"\",BC209<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"2.4.5.RX"},{"$f":"IF(AND(AY208<>\"\",LEFT(AY208,1)<>\"#\"),IF(LEFT(AY208,1)=\"-\",REPLACE(AY208,1,1,tech!$H$2),AY208),\"\")","v":""},"|",null,"Continual review and improvement","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BF208,BH$4:BI$13,2,0),\"\"),LEFT(BG208,1),IF(BI208=\"\",IF(AND(BI207<>\"\",BI209<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"3.1.6.RX"},{"$f":"IF(AND(BE208<>\"\",LEFT(BE208,1)<>\"#\"),IF(LEFT(BE208,1)=\"-\",REPLACE(BE208,1,1,tech!$H$2),BE208),\"\")","v":""},"|",null,"Adoption and application of open standards","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BL208,BN$4:BO$13,2,0),\"\"),LEFT(BM208,1),IF(BO208=\"\",IF(AND(BO207<>\"\",BO209<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"3.2.3.RX"},{"$f":"IF(AND(BK208<>\"\",LEFT(BK208,1)<>\"#\"),IF(LEFT(BK208,1)=\"-\",REPLACE(BK208,1,1,tech!$H$2),BK208),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BR208,BT$4:BU$13,2,0),\"\"),LEFT(BS208,1),IF(BU208=\"\",IF(AND(BU207<>\"\",BU209<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"3.3.6.RX"},{"$f":"IF(AND(BQ208<>\"\",LEFT(BQ208,1)<>\"#\"),IF(LEFT(BQ208,1)=\"-\",REPLACE(BQ208,1,1,tech!$H$2),BQ208),\"\")","v":""},"|",null,"Incidents and exceptions handling","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(BX208,BZ$4:CA$13,2,0),\"\"),LEFT(BY208,1),IF(CA208=\"\",IF(AND(CA207<>\"\",CA209<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"3.4.3.RX"},{"$f":"IF(AND(BW208<>\"\",LEFT(BW208,1)<>\"#\"),IF(LEFT(BW208,1)=\"-\",REPLACE(BW208,1,1,tech!$H$2),BW208),\"\")","v":""},"|",null,"Resources are periodically reviewed","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(CD208,CF$4:CG$13,2,0),\"\"),LEFT(CE208,1),IF(CG208=\"\",IF(AND(CG207<>\"\",CG209<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"4.1.4.RX"},{"$f":"IF(AND(CC208<>\"\",LEFT(CC208,1)<>\"#\"),IF(LEFT(CC208,1)=\"-\",REPLACE(CC208,1,1,tech!$H$2),CC208),\"\")","v":""},"|",null,"Periodically review knowledge","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(CJ208,CL$4:CM$13,2,0),\"\"),LEFT(CK208,1),IF(CM208=\"\",IF(AND(CM207<>\"\",CM209<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"4.2.5.RX"},{"$f":"IF(AND(CI208<>\"\",LEFT(CI208,1)<>\"#\"),IF(LEFT(CI208,1)=\"-\",REPLACE(CI208,1,1,tech!$H$2),CI208),\"\")","v":""},"|",null,"Timely communication of important information","References",{"$f":"_xlfn.CONCAT(IFERROR(VLOOKUP(CP208,CR$4:CS$13,2,0),\"\"),LEFT(CQ208,1),IF(CS208=\"\",IF(AND(CS207<>\"\",CS209<>\"\"),\"Y\",\"X\"),\"Y\"))","v":"4.3.4.RX"},{"$f":"IF(AND(CO208<>\"\",LEFT(CO208,1)<>\"#\"),IF(LEFT(CO208,1)=\"-\",REPLACE(CO208,1,1,tech!$H$2),CO208),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O209<>\"\",LEFT(O209,1)<>\"#\"),IF(LEFT(O209,1)=\"-\",REPLACE(O209,1,1,tech!$H$2),O209),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U209<>\"\",LEFT(U209,1)<>\"#\"),IF(LEFT(U209,1)=\"-\",REPLACE(U209,1,1,tech!$H$2),U209),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA209<>\"\",LEFT(AA209,1)<>\"#\"),IF(LEFT(AA209,1)=\"-\",REPLACE(AA209,1,1,tech!$H$2),AA209),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG209<>\"\",LEFT(AG209,1)<>\"#\"),IF(LEFT(AG209,1)=\"-\",REPLACE(AG209,1,1,tech!$H$2),AG209),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM209<>\"\",LEFT(AM209,1)<>\"#\"),IF(LEFT(AM209,1)=\"-\",REPLACE(AM209,1,1,tech!$H$2),AM209),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS209<>\"\",LEFT(AS209,1)<>\"#\"),IF(LEFT(AS209,1)=\"-\",REPLACE(AS209,1,1,tech!$H$2),AS209),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY209<>\"\",LEFT(AY209,1)<>\"#\"),IF(LEFT(AY209,1)=\"-\",REPLACE(AY209,1,1,tech!$H$2),AY209),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE209<>\"\",LEFT(BE209,1)<>\"#\"),IF(LEFT(BE209,1)=\"-\",REPLACE(BE209,1,1,tech!$H$2),BE209),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK209<>\"\",LEFT(BK209,1)<>\"#\"),IF(LEFT(BK209,1)=\"-\",REPLACE(BK209,1,1,tech!$H$2),BK209),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ209<>\"\",LEFT(BQ209,1)<>\"#\"),IF(LEFT(BQ209,1)=\"-\",REPLACE(BQ209,1,1,tech!$H$2),BQ209),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW209<>\"\",LEFT(BW209,1)<>\"#\"),IF(LEFT(BW209,1)=\"-\",REPLACE(BW209,1,1,tech!$H$2),BW209),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC209<>\"\",LEFT(CC209,1)<>\"#\"),IF(LEFT(CC209,1)=\"-\",REPLACE(CC209,1,1,tech!$H$2),CC209),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI209<>\"\",LEFT(CI209,1)<>\"#\"),IF(LEFT(CI209,1)=\"-\",REPLACE(CI209,1,1,tech!$H$2),CI209),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO209<>\"\",LEFT(CO209,1)<>\"#\"),IF(LEFT(CO209,1)=\"-\",REPLACE(CO209,1,1,tech!$H$2),CO209),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O210<>\"\",LEFT(O210,1)<>\"#\"),IF(LEFT(O210,1)=\"-\",REPLACE(O210,1,1,tech!$H$2),O210),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U210<>\"\",LEFT(U210,1)<>\"#\"),IF(LEFT(U210,1)=\"-\",REPLACE(U210,1,1,tech!$H$2),U210),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA210<>\"\",LEFT(AA210,1)<>\"#\"),IF(LEFT(AA210,1)=\"-\",REPLACE(AA210,1,1,tech!$H$2),AA210),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG210<>\"\",LEFT(AG210,1)<>\"#\"),IF(LEFT(AG210,1)=\"-\",REPLACE(AG210,1,1,tech!$H$2),AG210),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM210<>\"\",LEFT(AM210,1)<>\"#\"),IF(LEFT(AM210,1)=\"-\",REPLACE(AM210,1,1,tech!$H$2),AM210),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS210<>\"\",LEFT(AS210,1)<>\"#\"),IF(LEFT(AS210,1)=\"-\",REPLACE(AS210,1,1,tech!$H$2),AS210),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY210<>\"\",LEFT(AY210,1)<>\"#\"),IF(LEFT(AY210,1)=\"-\",REPLACE(AY210,1,1,tech!$H$2),AY210),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE210<>\"\",LEFT(BE210,1)<>\"#\"),IF(LEFT(BE210,1)=\"-\",REPLACE(BE210,1,1,tech!$H$2),BE210),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK210<>\"\",LEFT(BK210,1)<>\"#\"),IF(LEFT(BK210,1)=\"-\",REPLACE(BK210,1,1,tech!$H$2),BK210),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ210<>\"\",LEFT(BQ210,1)<>\"#\"),IF(LEFT(BQ210,1)=\"-\",REPLACE(BQ210,1,1,tech!$H$2),BQ210),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW210<>\"\",LEFT(BW210,1)<>\"#\"),IF(LEFT(BW210,1)=\"-\",REPLACE(BW210,1,1,tech!$H$2),BW210),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC210<>\"\",LEFT(CC210,1)<>\"#\"),IF(LEFT(CC210,1)=\"-\",REPLACE(CC210,1,1,tech!$H$2),CC210),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI210<>\"\",LEFT(CI210,1)<>\"#\"),IF(LEFT(CI210,1)=\"-\",REPLACE(CI210,1,1,tech!$H$2),CI210),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO210<>\"\",LEFT(CO210,1)<>\"#\"),IF(LEFT(CO210,1)=\"-\",REPLACE(CO210,1,1,tech!$H$2),CO210),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O211<>\"\",LEFT(O211,1)<>\"#\"),IF(LEFT(O211,1)=\"-\",REPLACE(O211,1,1,tech!$H$2),O211),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U211<>\"\",LEFT(U211,1)<>\"#\"),IF(LEFT(U211,1)=\"-\",REPLACE(U211,1,1,tech!$H$2),U211),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA211<>\"\",LEFT(AA211,1)<>\"#\"),IF(LEFT(AA211,1)=\"-\",REPLACE(AA211,1,1,tech!$H$2),AA211),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG211<>\"\",LEFT(AG211,1)<>\"#\"),IF(LEFT(AG211,1)=\"-\",REPLACE(AG211,1,1,tech!$H$2),AG211),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM211<>\"\",LEFT(AM211,1)<>\"#\"),IF(LEFT(AM211,1)=\"-\",REPLACE(AM211,1,1,tech!$H$2),AM211),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS211<>\"\",LEFT(AS211,1)<>\"#\"),IF(LEFT(AS211,1)=\"-\",REPLACE(AS211,1,1,tech!$H$2),AS211),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY211<>\"\",LEFT(AY211,1)<>\"#\"),IF(LEFT(AY211,1)=\"-\",REPLACE(AY211,1,1,tech!$H$2),AY211),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE211<>\"\",LEFT(BE211,1)<>\"#\"),IF(LEFT(BE211,1)=\"-\",REPLACE(BE211,1,1,tech!$H$2),BE211),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK211<>\"\",LEFT(BK211,1)<>\"#\"),IF(LEFT(BK211,1)=\"-\",REPLACE(BK211,1,1,tech!$H$2),BK211),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ211<>\"\",LEFT(BQ211,1)<>\"#\"),IF(LEFT(BQ211,1)=\"-\",REPLACE(BQ211,1,1,tech!$H$2),BQ211),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW211<>\"\",LEFT(BW211,1)<>\"#\"),IF(LEFT(BW211,1)=\"-\",REPLACE(BW211,1,1,tech!$H$2),BW211),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC211<>\"\",LEFT(CC211,1)<>\"#\"),IF(LEFT(CC211,1)=\"-\",REPLACE(CC211,1,1,tech!$H$2),CC211),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI211<>\"\",LEFT(CI211,1)<>\"#\"),IF(LEFT(CI211,1)=\"-\",REPLACE(CI211,1,1,tech!$H$2),CI211),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO211<>\"\",LEFT(CO211,1)<>\"#\"),IF(LEFT(CO211,1)=\"-\",REPLACE(CO211,1,1,tech!$H$2),CO211),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O212<>\"\",LEFT(O212,1)<>\"#\"),IF(LEFT(O212,1)=\"-\",REPLACE(O212,1,1,tech!$H$2),O212),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U212<>\"\",LEFT(U212,1)<>\"#\"),IF(LEFT(U212,1)=\"-\",REPLACE(U212,1,1,tech!$H$2),U212),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA212<>\"\",LEFT(AA212,1)<>\"#\"),IF(LEFT(AA212,1)=\"-\",REPLACE(AA212,1,1,tech!$H$2),AA212),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG212<>\"\",LEFT(AG212,1)<>\"#\"),IF(LEFT(AG212,1)=\"-\",REPLACE(AG212,1,1,tech!$H$2),AG212),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM212<>\"\",LEFT(AM212,1)<>\"#\"),IF(LEFT(AM212,1)=\"-\",REPLACE(AM212,1,1,tech!$H$2),AM212),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS212<>\"\",LEFT(AS212,1)<>\"#\"),IF(LEFT(AS212,1)=\"-\",REPLACE(AS212,1,1,tech!$H$2),AS212),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY212<>\"\",LEFT(AY212,1)<>\"#\"),IF(LEFT(AY212,1)=\"-\",REPLACE(AY212,1,1,tech!$H$2),AY212),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE212<>\"\",LEFT(BE212,1)<>\"#\"),IF(LEFT(BE212,1)=\"-\",REPLACE(BE212,1,1,tech!$H$2),BE212),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK212<>\"\",LEFT(BK212,1)<>\"#\"),IF(LEFT(BK212,1)=\"-\",REPLACE(BK212,1,1,tech!$H$2),BK212),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ212<>\"\",LEFT(BQ212,1)<>\"#\"),IF(LEFT(BQ212,1)=\"-\",REPLACE(BQ212,1,1,tech!$H$2),BQ212),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW212<>\"\",LEFT(BW212,1)<>\"#\"),IF(LEFT(BW212,1)=\"-\",REPLACE(BW212,1,1,tech!$H$2),BW212),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC212<>\"\",LEFT(CC212,1)<>\"#\"),IF(LEFT(CC212,1)=\"-\",REPLACE(CC212,1,1,tech!$H$2),CC212),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI212<>\"\",LEFT(CI212,1)<>\"#\"),IF(LEFT(CI212,1)=\"-\",REPLACE(CI212,1,1,tech!$H$2),CI212),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO212<>\"\",LEFT(CO212,1)<>\"#\"),IF(LEFT(CO212,1)=\"-\",REPLACE(CO212,1,1,tech!$H$2),CO212),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O213<>\"\",LEFT(O213,1)<>\"#\"),IF(LEFT(O213,1)=\"-\",REPLACE(O213,1,1,tech!$H$2),O213),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U213<>\"\",LEFT(U213,1)<>\"#\"),IF(LEFT(U213,1)=\"-\",REPLACE(U213,1,1,tech!$H$2),U213),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA213<>\"\",LEFT(AA213,1)<>\"#\"),IF(LEFT(AA213,1)=\"-\",REPLACE(AA213,1,1,tech!$H$2),AA213),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG213<>\"\",LEFT(AG213,1)<>\"#\"),IF(LEFT(AG213,1)=\"-\",REPLACE(AG213,1,1,tech!$H$2),AG213),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM213<>\"\",LEFT(AM213,1)<>\"#\"),IF(LEFT(AM213,1)=\"-\",REPLACE(AM213,1,1,tech!$H$2),AM213),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS213<>\"\",LEFT(AS213,1)<>\"#\"),IF(LEFT(AS213,1)=\"-\",REPLACE(AS213,1,1,tech!$H$2),AS213),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY213<>\"\",LEFT(AY213,1)<>\"#\"),IF(LEFT(AY213,1)=\"-\",REPLACE(AY213,1,1,tech!$H$2),AY213),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE213<>\"\",LEFT(BE213,1)<>\"#\"),IF(LEFT(BE213,1)=\"-\",REPLACE(BE213,1,1,tech!$H$2),BE213),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK213<>\"\",LEFT(BK213,1)<>\"#\"),IF(LEFT(BK213,1)=\"-\",REPLACE(BK213,1,1,tech!$H$2),BK213),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ213<>\"\",LEFT(BQ213,1)<>\"#\"),IF(LEFT(BQ213,1)=\"-\",REPLACE(BQ213,1,1,tech!$H$2),BQ213),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW213<>\"\",LEFT(BW213,1)<>\"#\"),IF(LEFT(BW213,1)=\"-\",REPLACE(BW213,1,1,tech!$H$2),BW213),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC213<>\"\",LEFT(CC213,1)<>\"#\"),IF(LEFT(CC213,1)=\"-\",REPLACE(CC213,1,1,tech!$H$2),CC213),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI213<>\"\",LEFT(CI213,1)<>\"#\"),IF(LEFT(CI213,1)=\"-\",REPLACE(CI213,1,1,tech!$H$2),CI213),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO213<>\"\",LEFT(CO213,1)<>\"#\"),IF(LEFT(CO213,1)=\"-\",REPLACE(CO213,1,1,tech!$H$2),CO213),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O214<>\"\",LEFT(O214,1)<>\"#\"),IF(LEFT(O214,1)=\"-\",REPLACE(O214,1,1,tech!$H$2),O214),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U214<>\"\",LEFT(U214,1)<>\"#\"),IF(LEFT(U214,1)=\"-\",REPLACE(U214,1,1,tech!$H$2),U214),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA214<>\"\",LEFT(AA214,1)<>\"#\"),IF(LEFT(AA214,1)=\"-\",REPLACE(AA214,1,1,tech!$H$2),AA214),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG214<>\"\",LEFT(AG214,1)<>\"#\"),IF(LEFT(AG214,1)=\"-\",REPLACE(AG214,1,1,tech!$H$2),AG214),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM214<>\"\",LEFT(AM214,1)<>\"#\"),IF(LEFT(AM214,1)=\"-\",REPLACE(AM214,1,1,tech!$H$2),AM214),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS214<>\"\",LEFT(AS214,1)<>\"#\"),IF(LEFT(AS214,1)=\"-\",REPLACE(AS214,1,1,tech!$H$2),AS214),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY214<>\"\",LEFT(AY214,1)<>\"#\"),IF(LEFT(AY214,1)=\"-\",REPLACE(AY214,1,1,tech!$H$2),AY214),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE214<>\"\",LEFT(BE214,1)<>\"#\"),IF(LEFT(BE214,1)=\"-\",REPLACE(BE214,1,1,tech!$H$2),BE214),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK214<>\"\",LEFT(BK214,1)<>\"#\"),IF(LEFT(BK214,1)=\"-\",REPLACE(BK214,1,1,tech!$H$2),BK214),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ214<>\"\",LEFT(BQ214,1)<>\"#\"),IF(LEFT(BQ214,1)=\"-\",REPLACE(BQ214,1,1,tech!$H$2),BQ214),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW214<>\"\",LEFT(BW214,1)<>\"#\"),IF(LEFT(BW214,1)=\"-\",REPLACE(BW214,1,1,tech!$H$2),BW214),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC214<>\"\",LEFT(CC214,1)<>\"#\"),IF(LEFT(CC214,1)=\"-\",REPLACE(CC214,1,1,tech!$H$2),CC214),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI214<>\"\",LEFT(CI214,1)<>\"#\"),IF(LEFT(CI214,1)=\"-\",REPLACE(CI214,1,1,tech!$H$2),CI214),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO214<>\"\",LEFT(CO214,1)<>\"#\"),IF(LEFT(CO214,1)=\"-\",REPLACE(CO214,1,1,tech!$H$2),CO214),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O215<>\"\",LEFT(O215,1)<>\"#\"),IF(LEFT(O215,1)=\"-\",REPLACE(O215,1,1,tech!$H$2),O215),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U215<>\"\",LEFT(U215,1)<>\"#\"),IF(LEFT(U215,1)=\"-\",REPLACE(U215,1,1,tech!$H$2),U215),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA215<>\"\",LEFT(AA215,1)<>\"#\"),IF(LEFT(AA215,1)=\"-\",REPLACE(AA215,1,1,tech!$H$2),AA215),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG215<>\"\",LEFT(AG215,1)<>\"#\"),IF(LEFT(AG215,1)=\"-\",REPLACE(AG215,1,1,tech!$H$2),AG215),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM215<>\"\",LEFT(AM215,1)<>\"#\"),IF(LEFT(AM215,1)=\"-\",REPLACE(AM215,1,1,tech!$H$2),AM215),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS215<>\"\",LEFT(AS215,1)<>\"#\"),IF(LEFT(AS215,1)=\"-\",REPLACE(AS215,1,1,tech!$H$2),AS215),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY215<>\"\",LEFT(AY215,1)<>\"#\"),IF(LEFT(AY215,1)=\"-\",REPLACE(AY215,1,1,tech!$H$2),AY215),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE215<>\"\",LEFT(BE215,1)<>\"#\"),IF(LEFT(BE215,1)=\"-\",REPLACE(BE215,1,1,tech!$H$2),BE215),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK215<>\"\",LEFT(BK215,1)<>\"#\"),IF(LEFT(BK215,1)=\"-\",REPLACE(BK215,1,1,tech!$H$2),BK215),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ215<>\"\",LEFT(BQ215,1)<>\"#\"),IF(LEFT(BQ215,1)=\"-\",REPLACE(BQ215,1,1,tech!$H$2),BQ215),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW215<>\"\",LEFT(BW215,1)<>\"#\"),IF(LEFT(BW215,1)=\"-\",REPLACE(BW215,1,1,tech!$H$2),BW215),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC215<>\"\",LEFT(CC215,1)<>\"#\"),IF(LEFT(CC215,1)=\"-\",REPLACE(CC215,1,1,tech!$H$2),CC215),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI215<>\"\",LEFT(CI215,1)<>\"#\"),IF(LEFT(CI215,1)=\"-\",REPLACE(CI215,1,1,tech!$H$2),CI215),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO215<>\"\",LEFT(CO215,1)<>\"#\"),IF(LEFT(CO215,1)=\"-\",REPLACE(CO215,1,1,tech!$H$2),CO215),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O216<>\"\",LEFT(O216,1)<>\"#\"),IF(LEFT(O216,1)=\"-\",REPLACE(O216,1,1,tech!$H$2),O216),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U216<>\"\",LEFT(U216,1)<>\"#\"),IF(LEFT(U216,1)=\"-\",REPLACE(U216,1,1,tech!$H$2),U216),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA216<>\"\",LEFT(AA216,1)<>\"#\"),IF(LEFT(AA216,1)=\"-\",REPLACE(AA216,1,1,tech!$H$2),AA216),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG216<>\"\",LEFT(AG216,1)<>\"#\"),IF(LEFT(AG216,1)=\"-\",REPLACE(AG216,1,1,tech!$H$2),AG216),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM216<>\"\",LEFT(AM216,1)<>\"#\"),IF(LEFT(AM216,1)=\"-\",REPLACE(AM216,1,1,tech!$H$2),AM216),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS216<>\"\",LEFT(AS216,1)<>\"#\"),IF(LEFT(AS216,1)=\"-\",REPLACE(AS216,1,1,tech!$H$2),AS216),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY216<>\"\",LEFT(AY216,1)<>\"#\"),IF(LEFT(AY216,1)=\"-\",REPLACE(AY216,1,1,tech!$H$2),AY216),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE216<>\"\",LEFT(BE216,1)<>\"#\"),IF(LEFT(BE216,1)=\"-\",REPLACE(BE216,1,1,tech!$H$2),BE216),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK216<>\"\",LEFT(BK216,1)<>\"#\"),IF(LEFT(BK216,1)=\"-\",REPLACE(BK216,1,1,tech!$H$2),BK216),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ216<>\"\",LEFT(BQ216,1)<>\"#\"),IF(LEFT(BQ216,1)=\"-\",REPLACE(BQ216,1,1,tech!$H$2),BQ216),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW216<>\"\",LEFT(BW216,1)<>\"#\"),IF(LEFT(BW216,1)=\"-\",REPLACE(BW216,1,1,tech!$H$2),BW216),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC216<>\"\",LEFT(CC216,1)<>\"#\"),IF(LEFT(CC216,1)=\"-\",REPLACE(CC216,1,1,tech!$H$2),CC216),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI216<>\"\",LEFT(CI216,1)<>\"#\"),IF(LEFT(CI216,1)=\"-\",REPLACE(CI216,1,1,tech!$H$2),CI216),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO216<>\"\",LEFT(CO216,1)<>\"#\"),IF(LEFT(CO216,1)=\"-\",REPLACE(CO216,1,1,tech!$H$2),CO216),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O217<>\"\",LEFT(O217,1)<>\"#\"),IF(LEFT(O217,1)=\"-\",REPLACE(O217,1,1,tech!$H$2),O217),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U217<>\"\",LEFT(U217,1)<>\"#\"),IF(LEFT(U217,1)=\"-\",REPLACE(U217,1,1,tech!$H$2),U217),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA217<>\"\",LEFT(AA217,1)<>\"#\"),IF(LEFT(AA217,1)=\"-\",REPLACE(AA217,1,1,tech!$H$2),AA217),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG217<>\"\",LEFT(AG217,1)<>\"#\"),IF(LEFT(AG217,1)=\"-\",REPLACE(AG217,1,1,tech!$H$2),AG217),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM217<>\"\",LEFT(AM217,1)<>\"#\"),IF(LEFT(AM217,1)=\"-\",REPLACE(AM217,1,1,tech!$H$2),AM217),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS217<>\"\",LEFT(AS217,1)<>\"#\"),IF(LEFT(AS217,1)=\"-\",REPLACE(AS217,1,1,tech!$H$2),AS217),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY217<>\"\",LEFT(AY217,1)<>\"#\"),IF(LEFT(AY217,1)=\"-\",REPLACE(AY217,1,1,tech!$H$2),AY217),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE217<>\"\",LEFT(BE217,1)<>\"#\"),IF(LEFT(BE217,1)=\"-\",REPLACE(BE217,1,1,tech!$H$2),BE217),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK217<>\"\",LEFT(BK217,1)<>\"#\"),IF(LEFT(BK217,1)=\"-\",REPLACE(BK217,1,1,tech!$H$2),BK217),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ217<>\"\",LEFT(BQ217,1)<>\"#\"),IF(LEFT(BQ217,1)=\"-\",REPLACE(BQ217,1,1,tech!$H$2),BQ217),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW217<>\"\",LEFT(BW217,1)<>\"#\"),IF(LEFT(BW217,1)=\"-\",REPLACE(BW217,1,1,tech!$H$2),BW217),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC217<>\"\",LEFT(CC217,1)<>\"#\"),IF(LEFT(CC217,1)=\"-\",REPLACE(CC217,1,1,tech!$H$2),CC217),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI217<>\"\",LEFT(CI217,1)<>\"#\"),IF(LEFT(CI217,1)=\"-\",REPLACE(CI217,1,1,tech!$H$2),CI217),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO217<>\"\",LEFT(CO217,1)<>\"#\"),IF(LEFT(CO217,1)=\"-\",REPLACE(CO217,1,1,tech!$H$2),CO217),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O218<>\"\",LEFT(O218,1)<>\"#\"),IF(LEFT(O218,1)=\"-\",REPLACE(O218,1,1,tech!$H$2),O218),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U218<>\"\",LEFT(U218,1)<>\"#\"),IF(LEFT(U218,1)=\"-\",REPLACE(U218,1,1,tech!$H$2),U218),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA218<>\"\",LEFT(AA218,1)<>\"#\"),IF(LEFT(AA218,1)=\"-\",REPLACE(AA218,1,1,tech!$H$2),AA218),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG218<>\"\",LEFT(AG218,1)<>\"#\"),IF(LEFT(AG218,1)=\"-\",REPLACE(AG218,1,1,tech!$H$2),AG218),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM218<>\"\",LEFT(AM218,1)<>\"#\"),IF(LEFT(AM218,1)=\"-\",REPLACE(AM218,1,1,tech!$H$2),AM218),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS218<>\"\",LEFT(AS218,1)<>\"#\"),IF(LEFT(AS218,1)=\"-\",REPLACE(AS218,1,1,tech!$H$2),AS218),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY218<>\"\",LEFT(AY218,1)<>\"#\"),IF(LEFT(AY218,1)=\"-\",REPLACE(AY218,1,1,tech!$H$2),AY218),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE218<>\"\",LEFT(BE218,1)<>\"#\"),IF(LEFT(BE218,1)=\"-\",REPLACE(BE218,1,1,tech!$H$2),BE218),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK218<>\"\",LEFT(BK218,1)<>\"#\"),IF(LEFT(BK218,1)=\"-\",REPLACE(BK218,1,1,tech!$H$2),BK218),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ218<>\"\",LEFT(BQ218,1)<>\"#\"),IF(LEFT(BQ218,1)=\"-\",REPLACE(BQ218,1,1,tech!$H$2),BQ218),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW218<>\"\",LEFT(BW218,1)<>\"#\"),IF(LEFT(BW218,1)=\"-\",REPLACE(BW218,1,1,tech!$H$2),BW218),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC218<>\"\",LEFT(CC218,1)<>\"#\"),IF(LEFT(CC218,1)=\"-\",REPLACE(CC218,1,1,tech!$H$2),CC218),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI218<>\"\",LEFT(CI218,1)<>\"#\"),IF(LEFT(CI218,1)=\"-\",REPLACE(CI218,1,1,tech!$H$2),CI218),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO218<>\"\",LEFT(CO218,1)<>\"#\"),IF(LEFT(CO218,1)=\"-\",REPLACE(CO218,1,1,tech!$H$2),CO218),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O219<>\"\",LEFT(O219,1)<>\"#\"),IF(LEFT(O219,1)=\"-\",REPLACE(O219,1,1,tech!$H$2),O219),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U219<>\"\",LEFT(U219,1)<>\"#\"),IF(LEFT(U219,1)=\"-\",REPLACE(U219,1,1,tech!$H$2),U219),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA219<>\"\",LEFT(AA219,1)<>\"#\"),IF(LEFT(AA219,1)=\"-\",REPLACE(AA219,1,1,tech!$H$2),AA219),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG219<>\"\",LEFT(AG219,1)<>\"#\"),IF(LEFT(AG219,1)=\"-\",REPLACE(AG219,1,1,tech!$H$2),AG219),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM219<>\"\",LEFT(AM219,1)<>\"#\"),IF(LEFT(AM219,1)=\"-\",REPLACE(AM219,1,1,tech!$H$2),AM219),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS219<>\"\",LEFT(AS219,1)<>\"#\"),IF(LEFT(AS219,1)=\"-\",REPLACE(AS219,1,1,tech!$H$2),AS219),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY219<>\"\",LEFT(AY219,1)<>\"#\"),IF(LEFT(AY219,1)=\"-\",REPLACE(AY219,1,1,tech!$H$2),AY219),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE219<>\"\",LEFT(BE219,1)<>\"#\"),IF(LEFT(BE219,1)=\"-\",REPLACE(BE219,1,1,tech!$H$2),BE219),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK219<>\"\",LEFT(BK219,1)<>\"#\"),IF(LEFT(BK219,1)=\"-\",REPLACE(BK219,1,1,tech!$H$2),BK219),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ219<>\"\",LEFT(BQ219,1)<>\"#\"),IF(LEFT(BQ219,1)=\"-\",REPLACE(BQ219,1,1,tech!$H$2),BQ219),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW219<>\"\",LEFT(BW219,1)<>\"#\"),IF(LEFT(BW219,1)=\"-\",REPLACE(BW219,1,1,tech!$H$2),BW219),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC219<>\"\",LEFT(CC219,1)<>\"#\"),IF(LEFT(CC219,1)=\"-\",REPLACE(CC219,1,1,tech!$H$2),CC219),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI219<>\"\",LEFT(CI219,1)<>\"#\"),IF(LEFT(CI219,1)=\"-\",REPLACE(CI219,1,1,tech!$H$2),CI219),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO219<>\"\",LEFT(CO219,1)<>\"#\"),IF(LEFT(CO219,1)=\"-\",REPLACE(CO219,1,1,tech!$H$2),CO219),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O220<>\"\",LEFT(O220,1)<>\"#\"),IF(LEFT(O220,1)=\"-\",REPLACE(O220,1,1,tech!$H$2),O220),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U220<>\"\",LEFT(U220,1)<>\"#\"),IF(LEFT(U220,1)=\"-\",REPLACE(U220,1,1,tech!$H$2),U220),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA220<>\"\",LEFT(AA220,1)<>\"#\"),IF(LEFT(AA220,1)=\"-\",REPLACE(AA220,1,1,tech!$H$2),AA220),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG220<>\"\",LEFT(AG220,1)<>\"#\"),IF(LEFT(AG220,1)=\"-\",REPLACE(AG220,1,1,tech!$H$2),AG220),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM220<>\"\",LEFT(AM220,1)<>\"#\"),IF(LEFT(AM220,1)=\"-\",REPLACE(AM220,1,1,tech!$H$2),AM220),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS220<>\"\",LEFT(AS220,1)<>\"#\"),IF(LEFT(AS220,1)=\"-\",REPLACE(AS220,1,1,tech!$H$2),AS220),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY220<>\"\",LEFT(AY220,1)<>\"#\"),IF(LEFT(AY220,1)=\"-\",REPLACE(AY220,1,1,tech!$H$2),AY220),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE220<>\"\",LEFT(BE220,1)<>\"#\"),IF(LEFT(BE220,1)=\"-\",REPLACE(BE220,1,1,tech!$H$2),BE220),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK220<>\"\",LEFT(BK220,1)<>\"#\"),IF(LEFT(BK220,1)=\"-\",REPLACE(BK220,1,1,tech!$H$2),BK220),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ220<>\"\",LEFT(BQ220,1)<>\"#\"),IF(LEFT(BQ220,1)=\"-\",REPLACE(BQ220,1,1,tech!$H$2),BQ220),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW220<>\"\",LEFT(BW220,1)<>\"#\"),IF(LEFT(BW220,1)=\"-\",REPLACE(BW220,1,1,tech!$H$2),BW220),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC220<>\"\",LEFT(CC220,1)<>\"#\"),IF(LEFT(CC220,1)=\"-\",REPLACE(CC220,1,1,tech!$H$2),CC220),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI220<>\"\",LEFT(CI220,1)<>\"#\"),IF(LEFT(CI220,1)=\"-\",REPLACE(CI220,1,1,tech!$H$2),CI220),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO220<>\"\",LEFT(CO220,1)<>\"#\"),IF(LEFT(CO220,1)=\"-\",REPLACE(CO220,1,1,tech!$H$2),CO220),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O221<>\"\",LEFT(O221,1)<>\"#\"),IF(LEFT(O221,1)=\"-\",REPLACE(O221,1,1,tech!$H$2),O221),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U221<>\"\",LEFT(U221,1)<>\"#\"),IF(LEFT(U221,1)=\"-\",REPLACE(U221,1,1,tech!$H$2),U221),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA221<>\"\",LEFT(AA221,1)<>\"#\"),IF(LEFT(AA221,1)=\"-\",REPLACE(AA221,1,1,tech!$H$2),AA221),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG221<>\"\",LEFT(AG221,1)<>\"#\"),IF(LEFT(AG221,1)=\"-\",REPLACE(AG221,1,1,tech!$H$2),AG221),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM221<>\"\",LEFT(AM221,1)<>\"#\"),IF(LEFT(AM221,1)=\"-\",REPLACE(AM221,1,1,tech!$H$2),AM221),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS221<>\"\",LEFT(AS221,1)<>\"#\"),IF(LEFT(AS221,1)=\"-\",REPLACE(AS221,1,1,tech!$H$2),AS221),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY221<>\"\",LEFT(AY221,1)<>\"#\"),IF(LEFT(AY221,1)=\"-\",REPLACE(AY221,1,1,tech!$H$2),AY221),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE221<>\"\",LEFT(BE221,1)<>\"#\"),IF(LEFT(BE221,1)=\"-\",REPLACE(BE221,1,1,tech!$H$2),BE221),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK221<>\"\",LEFT(BK221,1)<>\"#\"),IF(LEFT(BK221,1)=\"-\",REPLACE(BK221,1,1,tech!$H$2),BK221),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ221<>\"\",LEFT(BQ221,1)<>\"#\"),IF(LEFT(BQ221,1)=\"-\",REPLACE(BQ221,1,1,tech!$H$2),BQ221),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW221<>\"\",LEFT(BW221,1)<>\"#\"),IF(LEFT(BW221,1)=\"-\",REPLACE(BW221,1,1,tech!$H$2),BW221),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC221<>\"\",LEFT(CC221,1)<>\"#\"),IF(LEFT(CC221,1)=\"-\",REPLACE(CC221,1,1,tech!$H$2),CC221),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI221<>\"\",LEFT(CI221,1)<>\"#\"),IF(LEFT(CI221,1)=\"-\",REPLACE(CI221,1,1,tech!$H$2),CI221),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO221<>\"\",LEFT(CO221,1)<>\"#\"),IF(LEFT(CO221,1)=\"-\",REPLACE(CO221,1,1,tech!$H$2),CO221),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O222<>\"\",LEFT(O222,1)<>\"#\"),IF(LEFT(O222,1)=\"-\",REPLACE(O222,1,1,tech!$H$2),O222),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U222<>\"\",LEFT(U222,1)<>\"#\"),IF(LEFT(U222,1)=\"-\",REPLACE(U222,1,1,tech!$H$2),U222),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA222<>\"\",LEFT(AA222,1)<>\"#\"),IF(LEFT(AA222,1)=\"-\",REPLACE(AA222,1,1,tech!$H$2),AA222),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG222<>\"\",LEFT(AG222,1)<>\"#\"),IF(LEFT(AG222,1)=\"-\",REPLACE(AG222,1,1,tech!$H$2),AG222),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM222<>\"\",LEFT(AM222,1)<>\"#\"),IF(LEFT(AM222,1)=\"-\",REPLACE(AM222,1,1,tech!$H$2),AM222),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS222<>\"\",LEFT(AS222,1)<>\"#\"),IF(LEFT(AS222,1)=\"-\",REPLACE(AS222,1,1,tech!$H$2),AS222),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY222<>\"\",LEFT(AY222,1)<>\"#\"),IF(LEFT(AY222,1)=\"-\",REPLACE(AY222,1,1,tech!$H$2),AY222),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE222<>\"\",LEFT(BE222,1)<>\"#\"),IF(LEFT(BE222,1)=\"-\",REPLACE(BE222,1,1,tech!$H$2),BE222),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK222<>\"\",LEFT(BK222,1)<>\"#\"),IF(LEFT(BK222,1)=\"-\",REPLACE(BK222,1,1,tech!$H$2),BK222),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ222<>\"\",LEFT(BQ222,1)<>\"#\"),IF(LEFT(BQ222,1)=\"-\",REPLACE(BQ222,1,1,tech!$H$2),BQ222),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW222<>\"\",LEFT(BW222,1)<>\"#\"),IF(LEFT(BW222,1)=\"-\",REPLACE(BW222,1,1,tech!$H$2),BW222),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC222<>\"\",LEFT(CC222,1)<>\"#\"),IF(LEFT(CC222,1)=\"-\",REPLACE(CC222,1,1,tech!$H$2),CC222),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI222<>\"\",LEFT(CI222,1)<>\"#\"),IF(LEFT(CI222,1)=\"-\",REPLACE(CI222,1,1,tech!$H$2),CI222),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO222<>\"\",LEFT(CO222,1)<>\"#\"),IF(LEFT(CO222,1)=\"-\",REPLACE(CO222,1,1,tech!$H$2),CO222),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O223<>\"\",LEFT(O223,1)<>\"#\"),IF(LEFT(O223,1)=\"-\",REPLACE(O223,1,1,tech!$H$2),O223),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U223<>\"\",LEFT(U223,1)<>\"#\"),IF(LEFT(U223,1)=\"-\",REPLACE(U223,1,1,tech!$H$2),U223),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA223<>\"\",LEFT(AA223,1)<>\"#\"),IF(LEFT(AA223,1)=\"-\",REPLACE(AA223,1,1,tech!$H$2),AA223),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG223<>\"\",LEFT(AG223,1)<>\"#\"),IF(LEFT(AG223,1)=\"-\",REPLACE(AG223,1,1,tech!$H$2),AG223),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM223<>\"\",LEFT(AM223,1)<>\"#\"),IF(LEFT(AM223,1)=\"-\",REPLACE(AM223,1,1,tech!$H$2),AM223),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS223<>\"\",LEFT(AS223,1)<>\"#\"),IF(LEFT(AS223,1)=\"-\",REPLACE(AS223,1,1,tech!$H$2),AS223),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY223<>\"\",LEFT(AY223,1)<>\"#\"),IF(LEFT(AY223,1)=\"-\",REPLACE(AY223,1,1,tech!$H$2),AY223),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE223<>\"\",LEFT(BE223,1)<>\"#\"),IF(LEFT(BE223,1)=\"-\",REPLACE(BE223,1,1,tech!$H$2),BE223),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK223<>\"\",LEFT(BK223,1)<>\"#\"),IF(LEFT(BK223,1)=\"-\",REPLACE(BK223,1,1,tech!$H$2),BK223),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ223<>\"\",LEFT(BQ223,1)<>\"#\"),IF(LEFT(BQ223,1)=\"-\",REPLACE(BQ223,1,1,tech!$H$2),BQ223),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW223<>\"\",LEFT(BW223,1)<>\"#\"),IF(LEFT(BW223,1)=\"-\",REPLACE(BW223,1,1,tech!$H$2),BW223),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC223<>\"\",LEFT(CC223,1)<>\"#\"),IF(LEFT(CC223,1)=\"-\",REPLACE(CC223,1,1,tech!$H$2),CC223),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI223<>\"\",LEFT(CI223,1)<>\"#\"),IF(LEFT(CI223,1)=\"-\",REPLACE(CI223,1,1,tech!$H$2),CI223),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO223<>\"\",LEFT(CO223,1)<>\"#\"),IF(LEFT(CO223,1)=\"-\",REPLACE(CO223,1,1,tech!$H$2),CO223),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O224<>\"\",LEFT(O224,1)<>\"#\"),IF(LEFT(O224,1)=\"-\",REPLACE(O224,1,1,tech!$H$2),O224),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U224<>\"\",LEFT(U224,1)<>\"#\"),IF(LEFT(U224,1)=\"-\",REPLACE(U224,1,1,tech!$H$2),U224),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA224<>\"\",LEFT(AA224,1)<>\"#\"),IF(LEFT(AA224,1)=\"-\",REPLACE(AA224,1,1,tech!$H$2),AA224),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG224<>\"\",LEFT(AG224,1)<>\"#\"),IF(LEFT(AG224,1)=\"-\",REPLACE(AG224,1,1,tech!$H$2),AG224),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM224<>\"\",LEFT(AM224,1)<>\"#\"),IF(LEFT(AM224,1)=\"-\",REPLACE(AM224,1,1,tech!$H$2),AM224),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS224<>\"\",LEFT(AS224,1)<>\"#\"),IF(LEFT(AS224,1)=\"-\",REPLACE(AS224,1,1,tech!$H$2),AS224),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY224<>\"\",LEFT(AY224,1)<>\"#\"),IF(LEFT(AY224,1)=\"-\",REPLACE(AY224,1,1,tech!$H$2),AY224),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE224<>\"\",LEFT(BE224,1)<>\"#\"),IF(LEFT(BE224,1)=\"-\",REPLACE(BE224,1,1,tech!$H$2),BE224),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK224<>\"\",LEFT(BK224,1)<>\"#\"),IF(LEFT(BK224,1)=\"-\",REPLACE(BK224,1,1,tech!$H$2),BK224),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ224<>\"\",LEFT(BQ224,1)<>\"#\"),IF(LEFT(BQ224,1)=\"-\",REPLACE(BQ224,1,1,tech!$H$2),BQ224),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW224<>\"\",LEFT(BW224,1)<>\"#\"),IF(LEFT(BW224,1)=\"-\",REPLACE(BW224,1,1,tech!$H$2),BW224),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC224<>\"\",LEFT(CC224,1)<>\"#\"),IF(LEFT(CC224,1)=\"-\",REPLACE(CC224,1,1,tech!$H$2),CC224),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI224<>\"\",LEFT(CI224,1)<>\"#\"),IF(LEFT(CI224,1)=\"-\",REPLACE(CI224,1,1,tech!$H$2),CI224),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO224<>\"\",LEFT(CO224,1)<>\"#\"),IF(LEFT(CO224,1)=\"-\",REPLACE(CO224,1,1,tech!$H$2),CO224),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O225<>\"\",LEFT(O225,1)<>\"#\"),IF(LEFT(O225,1)=\"-\",REPLACE(O225,1,1,tech!$H$2),O225),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U225<>\"\",LEFT(U225,1)<>\"#\"),IF(LEFT(U225,1)=\"-\",REPLACE(U225,1,1,tech!$H$2),U225),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA225<>\"\",LEFT(AA225,1)<>\"#\"),IF(LEFT(AA225,1)=\"-\",REPLACE(AA225,1,1,tech!$H$2),AA225),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG225<>\"\",LEFT(AG225,1)<>\"#\"),IF(LEFT(AG225,1)=\"-\",REPLACE(AG225,1,1,tech!$H$2),AG225),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM225<>\"\",LEFT(AM225,1)<>\"#\"),IF(LEFT(AM225,1)=\"-\",REPLACE(AM225,1,1,tech!$H$2),AM225),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS225<>\"\",LEFT(AS225,1)<>\"#\"),IF(LEFT(AS225,1)=\"-\",REPLACE(AS225,1,1,tech!$H$2),AS225),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY225<>\"\",LEFT(AY225,1)<>\"#\"),IF(LEFT(AY225,1)=\"-\",REPLACE(AY225,1,1,tech!$H$2),AY225),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE225<>\"\",LEFT(BE225,1)<>\"#\"),IF(LEFT(BE225,1)=\"-\",REPLACE(BE225,1,1,tech!$H$2),BE225),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK225<>\"\",LEFT(BK225,1)<>\"#\"),IF(LEFT(BK225,1)=\"-\",REPLACE(BK225,1,1,tech!$H$2),BK225),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ225<>\"\",LEFT(BQ225,1)<>\"#\"),IF(LEFT(BQ225,1)=\"-\",REPLACE(BQ225,1,1,tech!$H$2),BQ225),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW225<>\"\",LEFT(BW225,1)<>\"#\"),IF(LEFT(BW225,1)=\"-\",REPLACE(BW225,1,1,tech!$H$2),BW225),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC225<>\"\",LEFT(CC225,1)<>\"#\"),IF(LEFT(CC225,1)=\"-\",REPLACE(CC225,1,1,tech!$H$2),CC225),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI225<>\"\",LEFT(CI225,1)<>\"#\"),IF(LEFT(CI225,1)=\"-\",REPLACE(CI225,1,1,tech!$H$2),CI225),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO225<>\"\",LEFT(CO225,1)<>\"#\"),IF(LEFT(CO225,1)=\"-\",REPLACE(CO225,1,1,tech!$H$2),CO225),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O226<>\"\",LEFT(O226,1)<>\"#\"),IF(LEFT(O226,1)=\"-\",REPLACE(O226,1,1,tech!$H$2),O226),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U226<>\"\",LEFT(U226,1)<>\"#\"),IF(LEFT(U226,1)=\"-\",REPLACE(U226,1,1,tech!$H$2),U226),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA226<>\"\",LEFT(AA226,1)<>\"#\"),IF(LEFT(AA226,1)=\"-\",REPLACE(AA226,1,1,tech!$H$2),AA226),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG226<>\"\",LEFT(AG226,1)<>\"#\"),IF(LEFT(AG226,1)=\"-\",REPLACE(AG226,1,1,tech!$H$2),AG226),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM226<>\"\",LEFT(AM226,1)<>\"#\"),IF(LEFT(AM226,1)=\"-\",REPLACE(AM226,1,1,tech!$H$2),AM226),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS226<>\"\",LEFT(AS226,1)<>\"#\"),IF(LEFT(AS226,1)=\"-\",REPLACE(AS226,1,1,tech!$H$2),AS226),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY226<>\"\",LEFT(AY226,1)<>\"#\"),IF(LEFT(AY226,1)=\"-\",REPLACE(AY226,1,1,tech!$H$2),AY226),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE226<>\"\",LEFT(BE226,1)<>\"#\"),IF(LEFT(BE226,1)=\"-\",REPLACE(BE226,1,1,tech!$H$2),BE226),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK226<>\"\",LEFT(BK226,1)<>\"#\"),IF(LEFT(BK226,1)=\"-\",REPLACE(BK226,1,1,tech!$H$2),BK226),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ226<>\"\",LEFT(BQ226,1)<>\"#\"),IF(LEFT(BQ226,1)=\"-\",REPLACE(BQ226,1,1,tech!$H$2),BQ226),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW226<>\"\",LEFT(BW226,1)<>\"#\"),IF(LEFT(BW226,1)=\"-\",REPLACE(BW226,1,1,tech!$H$2),BW226),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC226<>\"\",LEFT(CC226,1)<>\"#\"),IF(LEFT(CC226,1)=\"-\",REPLACE(CC226,1,1,tech!$H$2),CC226),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI226<>\"\",LEFT(CI226,1)<>\"#\"),IF(LEFT(CI226,1)=\"-\",REPLACE(CI226,1,1,tech!$H$2),CI226),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO226<>\"\",LEFT(CO226,1)<>\"#\"),IF(LEFT(CO226,1)=\"-\",REPLACE(CO226,1,1,tech!$H$2),CO226),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O227<>\"\",LEFT(O227,1)<>\"#\"),IF(LEFT(O227,1)=\"-\",REPLACE(O227,1,1,tech!$H$2),O227),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U227<>\"\",LEFT(U227,1)<>\"#\"),IF(LEFT(U227,1)=\"-\",REPLACE(U227,1,1,tech!$H$2),U227),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA227<>\"\",LEFT(AA227,1)<>\"#\"),IF(LEFT(AA227,1)=\"-\",REPLACE(AA227,1,1,tech!$H$2),AA227),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG227<>\"\",LEFT(AG227,1)<>\"#\"),IF(LEFT(AG227,1)=\"-\",REPLACE(AG227,1,1,tech!$H$2),AG227),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM227<>\"\",LEFT(AM227,1)<>\"#\"),IF(LEFT(AM227,1)=\"-\",REPLACE(AM227,1,1,tech!$H$2),AM227),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS227<>\"\",LEFT(AS227,1)<>\"#\"),IF(LEFT(AS227,1)=\"-\",REPLACE(AS227,1,1,tech!$H$2),AS227),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY227<>\"\",LEFT(AY227,1)<>\"#\"),IF(LEFT(AY227,1)=\"-\",REPLACE(AY227,1,1,tech!$H$2),AY227),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE227<>\"\",LEFT(BE227,1)<>\"#\"),IF(LEFT(BE227,1)=\"-\",REPLACE(BE227,1,1,tech!$H$2),BE227),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK227<>\"\",LEFT(BK227,1)<>\"#\"),IF(LEFT(BK227,1)=\"-\",REPLACE(BK227,1,1,tech!$H$2),BK227),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ227<>\"\",LEFT(BQ227,1)<>\"#\"),IF(LEFT(BQ227,1)=\"-\",REPLACE(BQ227,1,1,tech!$H$2),BQ227),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW227<>\"\",LEFT(BW227,1)<>\"#\"),IF(LEFT(BW227,1)=\"-\",REPLACE(BW227,1,1,tech!$H$2),BW227),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC227<>\"\",LEFT(CC227,1)<>\"#\"),IF(LEFT(CC227,1)=\"-\",REPLACE(CC227,1,1,tech!$H$2),CC227),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI227<>\"\",LEFT(CI227,1)<>\"#\"),IF(LEFT(CI227,1)=\"-\",REPLACE(CI227,1,1,tech!$H$2),CI227),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO227<>\"\",LEFT(CO227,1)<>\"#\"),IF(LEFT(CO227,1)=\"-\",REPLACE(CO227,1,1,tech!$H$2),CO227),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O228<>\"\",LEFT(O228,1)<>\"#\"),IF(LEFT(O228,1)=\"-\",REPLACE(O228,1,1,tech!$H$2),O228),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U228<>\"\",LEFT(U228,1)<>\"#\"),IF(LEFT(U228,1)=\"-\",REPLACE(U228,1,1,tech!$H$2),U228),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA228<>\"\",LEFT(AA228,1)<>\"#\"),IF(LEFT(AA228,1)=\"-\",REPLACE(AA228,1,1,tech!$H$2),AA228),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG228<>\"\",LEFT(AG228,1)<>\"#\"),IF(LEFT(AG228,1)=\"-\",REPLACE(AG228,1,1,tech!$H$2),AG228),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM228<>\"\",LEFT(AM228,1)<>\"#\"),IF(LEFT(AM228,1)=\"-\",REPLACE(AM228,1,1,tech!$H$2),AM228),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS228<>\"\",LEFT(AS228,1)<>\"#\"),IF(LEFT(AS228,1)=\"-\",REPLACE(AS228,1,1,tech!$H$2),AS228),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY228<>\"\",LEFT(AY228,1)<>\"#\"),IF(LEFT(AY228,1)=\"-\",REPLACE(AY228,1,1,tech!$H$2),AY228),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE228<>\"\",LEFT(BE228,1)<>\"#\"),IF(LEFT(BE228,1)=\"-\",REPLACE(BE228,1,1,tech!$H$2),BE228),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK228<>\"\",LEFT(BK228,1)<>\"#\"),IF(LEFT(BK228,1)=\"-\",REPLACE(BK228,1,1,tech!$H$2),BK228),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ228<>\"\",LEFT(BQ228,1)<>\"#\"),IF(LEFT(BQ228,1)=\"-\",REPLACE(BQ228,1,1,tech!$H$2),BQ228),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW228<>\"\",LEFT(BW228,1)<>\"#\"),IF(LEFT(BW228,1)=\"-\",REPLACE(BW228,1,1,tech!$H$2),BW228),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC228<>\"\",LEFT(CC228,1)<>\"#\"),IF(LEFT(CC228,1)=\"-\",REPLACE(CC228,1,1,tech!$H$2),CC228),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI228<>\"\",LEFT(CI228,1)<>\"#\"),IF(LEFT(CI228,1)=\"-\",REPLACE(CI228,1,1,tech!$H$2),CI228),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO228<>\"\",LEFT(CO228,1)<>\"#\"),IF(LEFT(CO228,1)=\"-\",REPLACE(CO228,1,1,tech!$H$2),CO228),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O229<>\"\",LEFT(O229,1)<>\"#\"),IF(LEFT(O229,1)=\"-\",REPLACE(O229,1,1,tech!$H$2),O229),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U229<>\"\",LEFT(U229,1)<>\"#\"),IF(LEFT(U229,1)=\"-\",REPLACE(U229,1,1,tech!$H$2),U229),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA229<>\"\",LEFT(AA229,1)<>\"#\"),IF(LEFT(AA229,1)=\"-\",REPLACE(AA229,1,1,tech!$H$2),AA229),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG229<>\"\",LEFT(AG229,1)<>\"#\"),IF(LEFT(AG229,1)=\"-\",REPLACE(AG229,1,1,tech!$H$2),AG229),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM229<>\"\",LEFT(AM229,1)<>\"#\"),IF(LEFT(AM229,1)=\"-\",REPLACE(AM229,1,1,tech!$H$2),AM229),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS229<>\"\",LEFT(AS229,1)<>\"#\"),IF(LEFT(AS229,1)=\"-\",REPLACE(AS229,1,1,tech!$H$2),AS229),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY229<>\"\",LEFT(AY229,1)<>\"#\"),IF(LEFT(AY229,1)=\"-\",REPLACE(AY229,1,1,tech!$H$2),AY229),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE229<>\"\",LEFT(BE229,1)<>\"#\"),IF(LEFT(BE229,1)=\"-\",REPLACE(BE229,1,1,tech!$H$2),BE229),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK229<>\"\",LEFT(BK229,1)<>\"#\"),IF(LEFT(BK229,1)=\"-\",REPLACE(BK229,1,1,tech!$H$2),BK229),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ229<>\"\",LEFT(BQ229,1)<>\"#\"),IF(LEFT(BQ229,1)=\"-\",REPLACE(BQ229,1,1,tech!$H$2),BQ229),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW229<>\"\",LEFT(BW229,1)<>\"#\"),IF(LEFT(BW229,1)=\"-\",REPLACE(BW229,1,1,tech!$H$2),BW229),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC229<>\"\",LEFT(CC229,1)<>\"#\"),IF(LEFT(CC229,1)=\"-\",REPLACE(CC229,1,1,tech!$H$2),CC229),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI229<>\"\",LEFT(CI229,1)<>\"#\"),IF(LEFT(CI229,1)=\"-\",REPLACE(CI229,1,1,tech!$H$2),CI229),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO229<>\"\",LEFT(CO229,1)<>\"#\"),IF(LEFT(CO229,1)=\"-\",REPLACE(CO229,1,1,tech!$H$2),CO229),\"\")","v":""},"|"]
[{"$nulls":15},"Policies are periodically reviewed and updated","References","1.2.5.RX",{"$f":"IF(AND(O230<>\"\",LEFT(O230,1)<>\"#\"),IF(LEFT(O230,1)=\"-\",REPLACE(O230,1,1,tech!$H$2),O230),\"\")","v":""},"|",null,"List of relevant laws, regulations, and standards, exist and is maintained","References","1.3.4.RX",{"$f":"IF(AND(U230<>\"\",LEFT(U230,1)<>\"#\"),IF(LEFT(U230,1)=\"-\",REPLACE(U230,1,1,tech!$H$2),U230),\"\")","v":""},"|",null,"Processes and procedures are reviewed and updated","References","1.4.5.RX",{"$f":"IF(AND(AA230<>\"\",LEFT(AA230,1)<>\"#\"),IF(LEFT(AA230,1)=\"-\",REPLACE(AA230,1,1,tech!$H$2),AA230),\"\")","v":""},"|",null,"Key management is periodically reviewed and updated","References","2.1.6.RX",{"$f":"IF(AND(AG230<>\"\",LEFT(AG230,1)<>\"#\"),IF(LEFT(AG230,1)=\"-\",REPLACE(AG230,1,1,tech!$H$2),AG230),\"\")","v":""},"|",null,"Organizational PKI governance","References","2.2.7.RX",{"$f":"IF(AND(AM230<>\"\",LEFT(AM230,1)<>\"#\"),IF(LEFT(AM230,1)=\"-\",REPLACE(AM230,1,1,tech!$H$2),AM230),\"\")","v":""},"|",null,"Infrastructure activities are periodically reviewed","References","2.3.5.RX",{"$f":"IF(AND(AS230<>\"\",LEFT(AS230,1)<>\"#\"),IF(LEFT(AS230,1)=\"-\",REPLACE(AS230,1,1,tech!$H$2),AS230),\"\")","v":""},"|",null,"Change management and agility is periodically reviewed","References","2.4.5.RX",{"$f":"IF(AND(AY230<>\"\",LEFT(AY230,1)<>\"#\"),IF(LEFT(AY230,1)=\"-\",REPLACE(AY230,1,1,tech!$H$2),AY230),\"\")","v":""},"|",null,"Continual review and improvement","References","3.1.6.RX",{"$f":"IF(AND(BE230<>\"\",LEFT(BE230,1)<>\"#\"),IF(LEFT(BE230,1)=\"-\",REPLACE(BE230,1,1,tech!$H$2),BE230),\"\")","v":""},"|",null,"Adoption and application of open standards","References","3.2.3.RX",{"$f":"IF(AND(BK230<>\"\",LEFT(BK230,1)<>\"#\"),IF(LEFT(BK230,1)=\"-\",REPLACE(BK230,1,1,tech!$H$2),BK230),\"\")","v":""},"|",null,"Review of events and logs is periodically performed","References","3.3.6.RX",{"$f":"IF(AND(BQ230<>\"\",LEFT(BQ230,1)<>\"#\"),IF(LEFT(BQ230,1)=\"-\",REPLACE(BQ230,1,1,tech!$H$2),BQ230),\"\")","v":""},"|",null,"Incidents and exceptions handling","References","3.4.3.RX",{"$f":"IF(AND(BW230<>\"\",LEFT(BW230,1)<>\"#\"),IF(LEFT(BW230,1)=\"-\",REPLACE(BW230,1,1,tech!$H$2),BW230),\"\")","v":""},"|",null,"Resources are periodically reviewed","References","4.1.4.RX",{"$f":"IF(AND(CC230<>\"\",LEFT(CC230,1)<>\"#\"),IF(LEFT(CC230,1)=\"-\",REPLACE(CC230,1,1,tech!$H$2),CC230),\"\")","v":""},"|",null,"Periodically review knowledge","References","4.2.5.RX",{"$f":"IF(AND(CI230<>\"\",LEFT(CI230,1)<>\"#\"),IF(LEFT(CI230,1)=\"-\",REPLACE(CI230,1,1,tech!$H$2),CI230),\"\")","v":""},"|",null,"Timely communication of important information","References","4.3.4.RX",{"$f":"IF(AND(CO230<>\"\",LEFT(CO230,1)<>\"#\"),IF(LEFT(CO230,1)=\"-\",REPLACE(CO230,1,1,tech!$H$2),CO230),\"\")","v":""},"|"]