{"text_format":"3","workbook":"xlsx","n_sheets":3,"sheets":["Tool","Report","Source"],"not_rendered":{"charts":1},"read":"whole","date_system":"1900"}

{"sheet":"Tool","index":0,"n_rows":101,"n_cols":14,"rows_kept":101,"merged":[[2,2,3,2],[2,4,3,4],[2,6,3,6],[2,8,3,8],[7,2,9,8],[7,12,9,13],[10,2,10,4],[10,6,10,8],[10,12,10,13],[11,2,11,4],[11,6,11,8],[11,12,13,13],[20,2,20,4],[20,6,20,8],[21,2,21,4],[21,6,21,8],[31,2,33,8],[31,12,33,13],[34,2,34,4],[34,6,34,8],[34,12,34,13],[35,2,35,4],[35,6,35,8],[35,12,37,13],[44,2,44,4],[44,6,44,8],[45,2,45,4],[45,6,45,8],[55,2,57,8],[55,12,57,13],[58,2,58,4],[58,6,58,8],[58,12,58,13],[59,2,59,4],[59,6,59,8],[59,12,61,13],[68,2,68,4],[68,6,68,8],[69,2,69,4],[69,6,69,8],[79,2,81,8],[79,12,81,13],[82,2,82,4],[82,6,82,8],[82,12,82,13],[83,2,83,4],[83,6,83,8],[83,12,85,13],[92,2,92,4],[93,2,93,4]]}
[]
[]
[null,null,"Assessed\nuse-case:",null,"Cool PKI 2023",null,"Overall maturity:",null,{"$f":"Report!E8","v":"Basic"}]
[]
[]
[]
[]
[null,null,"1. Governance",{"$nulls":9},"Statistics"]
[]
[]
[null,null,"1.1. Strategy and vision",{"$nulls":3},"1.2. Policies and documentation",{"$nulls":5},"Module maturity:"]
[null,null,"Responsible for the PKI management and strategy. Includes alignment with organizational goals and requirements, risk management, and policy decisions.",{"$nulls":3},"Formal policies and practice statements for supported PKI services and use-cases. Formal management of agreements between parties involved in the PKI.",{"$nulls":5},{"$f":"Report!E56","v":"Advanced"}]
[null,null,6,6,"Not evaluated",null,3,6,"Not evaluated"]
[{"$nulls":3},7,"Not Applicable",null,null,7,"Not Applicable"]
[{"$nulls":3},1,{"$f":"VLOOKUP(_xlfn.CONCAT($C$11,\"-\",D15),Source!$B$4:$D$78,3,0)","v":"There are no leadership responsibilities and vision defined. The design is managed ad-hoc."},null,null,1,{"$f":"VLOOKUP(_xlfn.CONCAT($G$11,\"-\",H15),Source!$B$4:$D$78,3,0)","v":"There are no or limited policies and documentation."},{"$nulls":3},"G1",{"$f":"Report!B62","v":"Not Applicable"}]
[{"$nulls":3},2,{"$f":"VLOOKUP(_xlfn.CONCAT($C$11,\"-\",D16),Source!$B$4:$D$78,3,0)","v":"Basic vision has been developed but not followed. The scope and business drivers are not fully documented and understood."},null,null,2,{"$f":"VLOOKUP(_xlfn.CONCAT($G$11,\"-\",H16),Source!$B$4:$D$78,3,0)","v":"The scope of policies is defined. Documented policies are not in the full scope and are not fully implemented and followed."},{"$nulls":3},"G2",{"$f":"Report!B67","v":"Advanced"}]
[{"$nulls":3},3,{"$f":"VLOOKUP(_xlfn.CONCAT($C$11,\"-\",D17),Source!$B$4:$D$78,3,0)","v":"There is a responsible sponsor of the PKI. Strategy has been defined and approved."},null,null,3,{"$f":"VLOOKUP(_xlfn.CONCAT($G$11,\"-\",H17),Source!$B$4:$D$78,3,0)","v":"Documentation and policies are in the full scope implemented, including CP and CPS."},{"$nulls":3},"G3",{"$f":"Report!B72","v":"Managed"}]
[{"$nulls":3},4,{"$f":"VLOOKUP(_xlfn.CONCAT($C$11,\"-\",D18),Source!$B$4:$D$78,3,0)","v":"Strategy and vision are followed and regularly measured to improve. The scope, business drivers, and design are documented and reviewed regularly."},null,null,4,{"$f":"VLOOKUP(_xlfn.CONCAT($G$11,\"-\",H18),Source!$B$4:$D$78,3,0)","v":"Disclosure of information contains all relevant policies and documentation. CP and CPS are published and available. There is a documentation management in place that covers the policies and documentation."},{"$nulls":3},"G4",{"$f":"Report!B77","v":"Optimized"}]
[{"$nulls":3},5,{"$f":"VLOOKUP(_xlfn.CONCAT($C$11,\"-\",D19),Source!$B$4:$D$78,3,0)","v":"Strategy and vision are fully in line with the organizational strategy and helps business to achieve future development through continuous improvement."},null,null,5,{"$f":"VLOOKUP(_xlfn.CONCAT($G$11,\"-\",H19),Source!$B$4:$D$78,3,0)","v":"Policies are periodically reviewed and updated according to the changes in the PKI and its environment, and organizational strategy and goals. Policies are followed and enforced, communicated and understood."}]
[]
[null,null,"1.3. Compliance",{"$nulls":3},"1.4. Processes and procedures"]
[null,null,"Adherence to standards and applicable regulations and requirements for the PKI and trust services. Standards and regulations may be internal or external, country specific or purpose specific.",{"$nulls":3},"Processes and procedures related to PKI management tasks and operational activities. This includes also the supply chain procedures and processes that includes acceptance or receipt of the HW and SW related to the PKI."]
[null,null,4,6,"Not evaluated",null,5,6,"Not evaluated"]
[{"$nulls":3},7,"Not Applicable",null,null,7,"Not Applicable"]
[{"$nulls":3},1,{"$f":"VLOOKUP(_xlfn.CONCAT($C$21,\"-\",D25),Source!$B$4:$D$78,3,0)","v":"There is no compliance program in place. The organization is not aware of the relevant laws, regulations, and standards, and is exposed to significant risks."},null,null,1,{"$f":"VLOOKUP(_xlfn.CONCAT($G$21,\"-\",H25),Source!$B$4:$D$78,3,0)","v":"Processes and procedures are not formally defined and documented. Ad-hoc reactions to the events."}]
[{"$nulls":3},2,{"$f":"VLOOKUP(_xlfn.CONCAT($C$21,\"-\",D26),Source!$B$4:$D$78,3,0)","v":"The compliance responsibility is established and assigned. The organization is aware of the relevant laws, regulations, and standards that should be followed."},null,null,2,{"$f":"VLOOKUP(_xlfn.CONCAT($G$21,\"-\",H26),Source!$B$4:$D$78,3,0)","v":"Processes and procedures are formally defined and documented, but not in the full scope and fully implemented and followed."}]
[{"$nulls":3},3,{"$f":"VLOOKUP(_xlfn.CONCAT($C$21,\"-\",D27),Source!$B$4:$D$78,3,0)","v":"Compliance policy is defined, implemented, and communicated. Compliance program is established."},null,null,3,{"$f":"VLOOKUP(_xlfn.CONCAT($G$21,\"-\",H27),Source!$B$4:$D$78,3,0)","v":"The scope of the processes and procedures covers entire PKI implementation and policies, and is documented and followed."}]
[{"$nulls":3},4,{"$f":"VLOOKUP(_xlfn.CONCAT($C$21,\"-\",D28),Source!$B$4:$D$78,3,0)","v":"Compliance program and policy is established and maintained by responsible personnel. Procedures are in place and followed to ensure compliance with relevant laws, regulations, and standards."},null,null,4,{"$f":"VLOOKUP(_xlfn.CONCAT($G$21,\"-\",H28),Source!$B$4:$D$78,3,0)","v":"The evidence from the processes and procedures is collected and maintained. Recurring activities are defined and executed by responsible roles."}]
[{"$nulls":3},5,{"$f":"VLOOKUP(_xlfn.CONCAT($C$21,\"-\",D29),Source!$B$4:$D$78,3,0)","v":"Organization is aware of the relevant laws, regulations, and standards and is able to demonstrate compliance over the time. Compliance program is continuously maintained and improved."},null,null,5,{"$f":"VLOOKUP(_xlfn.CONCAT($G$21,\"-\",H29),Source!$B$4:$D$78,3,0)","v":"The processes and procedures, that are aligned with policies and organizational goals, are reviewed and updated on a regular basis. Evidence is properly managed and controlled."}]
[]
[]
[null,null,"2. Management",{"$nulls":9},"Statistics"]
[]
[]
[null,null,"2.1. Key Management",{"$nulls":3},"2.2. Certificate Management",{"$nulls":5},"Module maturity:"]
[null,null,"Key management policy and procedures related to PKI cryptographic keys and its lifecycle. Inventory of cryptographic keys. Secure and trusted key ceremonies. Key escrow and key recovery if applicable.",{"$nulls":3},"Certificate management policy and lifecycle. Inventory of certificates. Definition of the certificate profiles and supported states of the certificate including the transitions between the states. Proper validation fo the certificates.",{"$nulls":5},{"$f":"Report!E83","v":"Basic"}]
[null,null,4,6,"Not evaluated",null,4,6,"Not evaluated"]
[{"$nulls":3},7,"Not Applicable",null,null,7,"Not Applicable"]
[{"$nulls":3},1,{"$f":"VLOOKUP(_xlfn.CONCAT($C$35,\"-\",D39),Source!$B$4:$D$78,3,0)","v":"No key management is defined. There are no key management responsibilities defined and assigned."},null,null,1,{"$f":"VLOOKUP(_xlfn.CONCAT($G$35,\"-\",H39),Source!$B$4:$D$78,3,0)","v":"Certificates are ad-hoc managed, without proper control and always reactive. Inventory is not available."},{"$nulls":3},"M1",{"$f":"Report!B89","v":"Managed"}]
[{"$nulls":3},2,{"$f":"VLOOKUP(_xlfn.CONCAT($C$35,\"-\",D40),Source!$B$4:$D$78,3,0)","v":"Responsibilities and roles for key management are defined. Key management is managed ad-hoc and there is no documentation and inventory of cryptographic keys maintained."},null,null,2,{"$f":"VLOOKUP(_xlfn.CONCAT($G$35,\"-\",H40),Source!$B$4:$D$78,3,0)","v":"Certificates are managed, but not according to industry standards and regulations. Inventory of certificates is not maintained."},{"$nulls":3},"M2",{"$f":"Report!B94","v":"Managed"}]
[{"$nulls":3},3,{"$f":"VLOOKUP(_xlfn.CONCAT($C$35,\"-\",D41),Source!$B$4:$D$78,3,0)","v":"Key management and lifecycle is documented and maintained. Inventory of cryptographic keys and devices is avaialble. Procedures are formally followed."},null,null,3,{"$f":"VLOOKUP(_xlfn.CONCAT($G$35,\"-\",H41),Source!$B$4:$D$78,3,0)","v":"Certificate profiles and attributes are documented and enforced. Certificate lifecycle management is documented and followed. Inventory of certificates is maintained with up-to-date information. Certificate management procedures and controls on are in place but not fully followed and understood."},{"$nulls":3},"M3",{"$f":"Report!B99","v":"Initial"}]
[{"$nulls":3},4,{"$f":"VLOOKUP(_xlfn.CONCAT($C$35,\"-\",D42),Source!$B$4:$D$78,3,0)","v":"Encryption and key management policies are documented, followed, and integrated in the organization. Inventory of cryptographic keys and devices is maintained and validated. Responsibilities and roles are assigned and aware of all processes and procedures."},null,null,4,{"$f":"VLOOKUP(_xlfn.CONCAT($G$35,\"-\",H42),Source!$B$4:$D$78,3,0)","v":"Certificate profiles, attributes, cipher suites, and tooling is properly documented and applied in the organization. Certificate management procedures are well designed and followed to maintain up-to-date inventory of certificates, including its state and location."},{"$nulls":3},"M4",{"$f":"Report!B104","v":"Initial"}]
[{"$nulls":3},5,{"$f":"VLOOKUP(_xlfn.CONCAT($C$35,\"-\",D43),Source!$B$4:$D$78,3,0)","v":"Key management is periodically reviewed and updated. Inventory of cryptographic keys and devices is complete, maintained and frequently validated. Process and procedures are formally approved, integrated and followed in the organization."},null,null,5,{"$f":"VLOOKUP(_xlfn.CONCAT($G$35,\"-\",H43),Source!$B$4:$D$78,3,0)","v":"Certificate lifecycle is properly documented and maintained. Up-to-date inventory is available and periodically updated according to defined procedures and certificate management controls. Discovery of certificates is often executed to provide assurance of the inventory completeness. Certificate management is integrated with the organizational governance."}]
[]
[null,null,"2.3. Infrastructure Management",{"$nulls":3},"2.4. Change Management and Agility"]
[null,null,"Availability of the PKI services, infrastructure setup to achieve availability goals. PKI continuity testing and infrastructure recovery. Infrastructure security controls.",{"$nulls":3},"Secure and controlled process for the change management. Formal process to request changes in the PKI, approval, staging, roll-back."]
[null,null,1,6,"Not evaluated",null,1,6,"Not evaluated"]
[{"$nulls":3},7,"Not Applicable",null,null,7,"Not Applicable"]
[{"$nulls":3},1,{"$f":"VLOOKUP(_xlfn.CONCAT($C$45,\"-\",D49),Source!$B$4:$D$78,3,0)","v":"Flat network with no segmentation. No separation of environments. No network vulnerability management. No infrastructure recovery objectives. No periodic review of infrastructure activities."},null,null,1,{"$f":"VLOOKUP(_xlfn.CONCAT($G$45,\"-\",H49),Source!$B$4:$D$78,3,0)","v":"Change management is not defined and agility is not considered and applied."}]
[{"$nulls":3},2,{"$f":"VLOOKUP(_xlfn.CONCAT($C$45,\"-\",D50),Source!$B$4:$D$78,3,0)","v":"Network and deployment infrastructure is documented and known by the infrastructure team."},null,null,2,{"$f":"VLOOKUP(_xlfn.CONCAT($G$45,\"-\",H50),Source!$B$4:$D$78,3,0)","v":"Change management does not have documented and followed structure and is often ad-hoc. Agility is not formally cosnidered, however, it is applied in some cases."}]
[{"$nulls":3},3,{"$f":"VLOOKUP(_xlfn.CONCAT($C$45,\"-\",D51),Source!$B$4:$D$78,3,0)","v":"Infrastructure is documented and managed. Network vulnerability management is implemented. Responsibility for infrastructure is defined and approved by the management."},null,null,3,{"$f":"VLOOKUP(_xlfn.CONCAT($G$45,\"-\",H51),Source!$B$4:$D$78,3,0)","v":"Processes for change management and agility are defined and designed to support the PKI implementation. The procedures and not always followed."}]
[{"$nulls":3},4,{"$f":"VLOOKUP(_xlfn.CONCAT($C$45,\"-\",D52),Source!$B$4:$D$78,3,0)","v":"The infrastructure is properly design, documented, and maintained, including procedures for vulnerability management, recovery and continuity."},null,null,4,{"$f":"VLOOKUP(_xlfn.CONCAT($G$45,\"-\",H52),Source!$B$4:$D$78,3,0)","v":"Change management is integrated with the organizational change management process. Requirements for the agility are identified and implemented. Procedures are followed and monitored."}]
[{"$nulls":3},5,{"$f":"VLOOKUP(_xlfn.CONCAT($C$45,\"-\",D53),Source!$B$4:$D$78,3,0)","v":"Processes and procedures are formally followed and periodically reviewed. The infrastructure is properly designed, documented, and maintained by responsible personnel and integrated into the overall organizational strategy."},null,null,5,{"$f":"VLOOKUP(_xlfn.CONCAT($G$45,\"-\",H53),Source!$B$4:$D$78,3,0)","v":"Approved change management policy and agility processes are followed and monitored. It is continuously improved and adapted to the changes."}]
[]
[]
[null,null,"3. Operations",{"$nulls":9},"Statistics"]
[]
[]
[null,null,"3.1. Resilience",{"$nulls":3},"3.2. Interoperability",{"$nulls":5},"Module maturity:"]
[null,null,"Quickly respond to potential attack and unavailability of the PKI services or other related resources.",{"$nulls":3},"Interoperability between applications, implementations, and technologies. Application of interoperable protocols and standards. Transparency and vendor lock avoidance strategy.",{"$nulls":5},{"$f":"Report!E110","v":"Initial"}]
[null,null,1,6,"Not evaluated",null,1,6,"Not evaluated"]
[{"$nulls":3},7,"Not Applicable",null,null,7,"Not Applicable"]
[{"$nulls":3},1,{"$f":"VLOOKUP(_xlfn.CONCAT($C$59,\"-\",D63),Source!$B$4:$D$78,3,0)","v":"There is no resilience strategy or requirements in place."},null,null,1,{"$f":"VLOOKUP(_xlfn.CONCAT($G$59,\"-\",H63),Source!$B$4:$D$78,3,0)","v":"There is no interoperability strategy or requirements."},{"$nulls":3},"O1",{"$f":"Report!B116","v":"Initial"}]
[{"$nulls":3},2,{"$f":"VLOOKUP(_xlfn.CONCAT($C$59,\"-\",D64),Source!$B$4:$D$78,3,0)","v":"Risk assessment and business impact analysis is performed. Results are documented and used to develop resilience strategy, however, the strategy is not fully defined and implemented."},null,null,2,{"$f":"VLOOKUP(_xlfn.CONCAT($G$59,\"-\",H64),Source!$B$4:$D$78,3,0)","v":"Interoperability strategy is not completely defined and formal. Some integration guidance is available but not maintained."},{"$nulls":3},"O2",{"$f":"Report!B121","v":"Initial"}]
[{"$nulls":3},3,{"$f":"VLOOKUP(_xlfn.CONCAT($C$59,\"-\",D65),Source!$B$4:$D$78,3,0)","v":"Resilience strategy is defined and implemented. Business continuity planning and disaster recovery is executed on a regular basis."},null,null,3,{"$f":"VLOOKUP(_xlfn.CONCAT($G$59,\"-\",H65),Source!$B$4:$D$78,3,0)","v":"Interoperability strategy is defined and integrated within the infrastructure, covering all necessary components."},{"$nulls":3},"O3",{"$f":"Report!B126","v":"Initial"}]
[{"$nulls":3},4,{"$f":"VLOOKUP(_xlfn.CONCAT($C$59,\"-\",D66),Source!$B$4:$D$78,3,0)","v":"The infrastructure resilience is often proven and tested through the competence management and results are used to improve the resilience planning and documentation."},null,null,4,{"$f":"VLOOKUP(_xlfn.CONCAT($G$59,\"-\",H66),Source!$B$4:$D$78,3,0)","v":"Interoperability strategy is defined, integrated and maintained, with open standards and protocols applied to avoid vendor lock-in."},{"$nulls":3},"O4",{"$f":"Report!B131","v":"Initial"}]
[{"$nulls":3},5,{"$f":"VLOOKUP(_xlfn.CONCAT($C$59,\"-\",D67),Source!$B$4:$D$78,3,0)","v":"Analysis and assessment is regularly updated with the latest information and used to improve the resilience strategy. Incident response plans are tested and improved, including disaster recovery plans and procedures. Resilience is fully aligned with the organizational goals and policies."},null,null,5,{"$f":"VLOOKUP(_xlfn.CONCAT($G$59,\"-\",H67),Source!$B$4:$D$78,3,0)","v":"Interoperability requirements, strategy and guidance are well defined, integrated and maintained. Adoption of open standards and protocols is applied to avoid vendor lock-in, where possible. Interoperability is periodically tested and improved."}]
[]
[null,null,"3.3. Monitoring and Auditing",{"$nulls":3},"3.4. Automation"]
[null,null,"Measurement of the PKI metrics, collecting evidence, monitoring and alerting of relevant issues, including references to incident response management.",{"$nulls":3},"Automation of certificate lifecycle management. Technology and tools for the automation. Monitoring of automated certificate operations."]
[null,null,1,6,"Not evaluated",null,1,6,"Not evaluated"]
[{"$nulls":3},7,"Not Applicable",null,null,7,"Not Applicable"]
[{"$nulls":3},1,{"$f":"VLOOKUP(_xlfn.CONCAT($C$69,\"-\",D73),Source!$B$4:$D$78,3,0)","v":"There is no or limited monitoring and auditing capabilities in place."},null,null,1,{"$f":"VLOOKUP(_xlfn.CONCAT($G$69,\"-\",H73),Source!$B$4:$D$78,3,0)","v":"No automation in place."}]
[{"$nulls":3},2,{"$f":"VLOOKUP(_xlfn.CONCAT($C$69,\"-\",D74),Source!$B$4:$D$78,3,0)","v":"Logs are collected, however, they are not reviewed, nor correlated with other records."},null,null,2,{"$f":"VLOOKUP(_xlfn.CONCAT($G$69,\"-\",H74),Source!$B$4:$D$78,3,0)","v":"Automation is used for some tasks, however, it is not described and it is not reliable or repeatable."}]
[{"$nulls":3},3,{"$f":"VLOOKUP(_xlfn.CONCAT($C$69,\"-\",D75),Source!$B$4:$D$78,3,0)","v":"Documeneted requirements for monitoring and auditing are defined and implemented. Logs are centrally collected and correlated with other records."},null,null,3,{"$f":"VLOOKUP(_xlfn.CONCAT($G$69,\"-\",H75),Source!$B$4:$D$78,3,0)","v":"Automation is used for most of the tasks, where it makes sense. Automation is described but not monitoring or audited."}]
[{"$nulls":3},4,{"$f":"VLOOKUP(_xlfn.CONCAT($C$69,\"-\",D76),Source!$B$4:$D$78,3,0)","v":"Centrally collected logs are reviewed and monitored periodically according to documented policy and requirements. Audit trail can be constructed for critical events from audit logs."},null,null,4,{"$f":"VLOOKUP(_xlfn.CONCAT($G$69,\"-\",H76),Source!$B$4:$D$78,3,0)","v":"Automation is used for all tasks, where it makes sense. Automation is described, followed and monitored or audited."}]
[{"$nulls":3},5,{"$f":"VLOOKUP(_xlfn.CONCAT($C$69,\"-\",D77),Source!$B$4:$D$78,3,0)","v":"Monitoring and auditing requirements are periodically reviewed and improved. Documented policy and system requirements are in place and followed. Critical events are immediately alerted and resolved according to incident response plans."},null,null,5,{"$f":"VLOOKUP(_xlfn.CONCAT($G$69,\"-\",H77),Source!$B$4:$D$78,3,0)","v":"Automation is analyzed and designed to apply the best practices. Automation is described, followed, monitored, and audited. Procedures are in place to handle exceptions and incidents related to automation."}]
[]
[]
[null,null,"4. Resources",{"$nulls":9},"Statistics"]
[]
[]
[null,null,"4.1. Sourcing",{"$nulls":3},"4.2. Knowledge and Training",{"$nulls":5},"Module maturity:"]
[null,null,"Availability of skilled resources to manage PKI. Processes and procedures to maintain the required resources in time, monitoring of the skills.",{"$nulls":3},"Education of people and continuously gathering required knowledge and skills to manage PKI. Training plans and improvement.",{"$nulls":5},{"$f":"Report!E137","v":"Initial"}]
[null,null,1,6,"Not evaluated",null,3,6,"Not evaluated"]
[{"$nulls":3},7,"Not Applicable",null,null,7,"Not Applicable"]
[{"$nulls":3},1,{"$f":"VLOOKUP(_xlfn.CONCAT($C$83,\"-\",D87),Source!$B$4:$D$78,3,0)","v":"The resources needed for the PKI are not defined and documented. There is a risk of unavailable resources causing the PKI to be unavailable."},null,null,1,{"$f":"VLOOKUP(_xlfn.CONCAT($G$83,\"-\",H87),Source!$B$4:$D$78,3,0)","v":"There is no training plan or education plan for the PKI personnel."},{"$nulls":3},"R1",{"$f":"Report!B143","v":"Initial"}]
[{"$nulls":3},2,{"$f":"VLOOKUP(_xlfn.CONCAT($C$83,\"-\",D88),Source!$B$4:$D$78,3,0)","v":"Resource are identified and documented. The resources and their specification are not clearly defined, which can lead to misuse of resources."},null,null,2,{"$f":"VLOOKUP(_xlfn.CONCAT($G$83,\"-\",H88),Source!$B$4:$D$78,3,0)","v":"Training plan is defined, however, there is no responsibility for the execution of the plan."},{"$nulls":3},"R2",{"$f":"Report!B148","v":"Advanced"}]
[{"$nulls":3},3,{"$f":"VLOOKUP(_xlfn.CONCAT($C$83,\"-\",D89),Source!$B$4:$D$78,3,0)","v":"Resources are identified, documented, and clearly defined. The capacity of resources is aligned with the PKI scope and use-case(s)."},null,null,3,{"$f":"VLOOKUP(_xlfn.CONCAT($G$83,\"-\",H89),Source!$B$4:$D$78,3,0)","v":"Training plan is defined and integrated in the organization. PKI personnel are aware of the training plan and their responsibilities."},{"$nulls":3},"R3",{"$f":"Report!B153","v":"Initial"}]
[{"$nulls":3},4,{"$f":"VLOOKUP(_xlfn.CONCAT($C$83,\"-\",D90),Source!$B$4:$D$78,3,0)","v":"Resources are identified, documented, and clearly defined. Resource management process ensures that the resources are available when needed."},null,null,4,{"$f":"VLOOKUP(_xlfn.CONCAT($G$83,\"-\",H90),Source!$B$4:$D$78,3,0)","v":"Training plan is defined, maintained and integrated in the organization. It is executed and requirements on the knowledge and proficiency are monitored."}]
[{"$nulls":3},5,{"$f":"VLOOKUP(_xlfn.CONCAT($C$83,\"-\",D91),Source!$B$4:$D$78,3,0)","v":"Resources are periodically reviewed and updated to ensure that the required capacity is available and aligned with the PKI scope and organization strategy."},null,null,5,{"$f":"VLOOKUP(_xlfn.CONCAT($G$83,\"-\",H91),Source!$B$4:$D$78,3,0)","v":"Training plan is periodically reviewed and updated. Education plan is defined and maintained. PKI personnel are aware of the training plan and their responsibilities that are fully aligned with the PKI policies and procedures."}]
[]
[null,null,"4.3. Awareness"]
[null,null,"Providing awareness about the PKI in the organization and its purpose. Awareness how to apply the PKI in a trusted and secure way."]
[null,null,1,6,"Not evaluated"]
[{"$nulls":3},7,"Not Applicable"]
[{"$nulls":3},1,{"$f":"VLOOKUP(_xlfn.CONCAT($C$93,\"-\",D97),Source!$B$4:$D$78,3,0)","v":"No awareness is provided. No program is established."}]
[{"$nulls":3},2,{"$f":"VLOOKUP(_xlfn.CONCAT($C$93,\"-\",D98),Source!$B$4:$D$78,3,0)","v":"Incomplete awareness plan is defined, and it is not often followed and communicated. It is mainly ad-hoc and not maintained, without proper planning and monitoring."}]
[{"$nulls":3},3,{"$f":"VLOOKUP(_xlfn.CONCAT($C$93,\"-\",D99),Source!$B$4:$D$78,3,0)","v":"The awareness plan is defined, followed and communicated to all PKI participants. The awareness is not integrated in the organization and is not periodically reviewed and improved."}]
[{"$nulls":3},4,{"$f":"VLOOKUP(_xlfn.CONCAT($C$93,\"-\",D100),Source!$B$4:$D$78,3,0)","v":"The awareness program is designed to support the PKI participants. The awareness plan is defined, followed and communicated to all PKI participants. It is maintained and monitored over the time."}]
[{"$nulls":3},5,{"$f":"VLOOKUP(_xlfn.CONCAT($C$93,\"-\",D101),Source!$B$4:$D$78,3,0)","v":"Information is disclosed and properly communicated to all PKI participant according to the awareness plan. The awareness plan is well designed and continuously improved. Participant are properly informed about important information and how to behave."}]

{"sheet":"Report","index":1,"n_rows":153,"n_cols":10,"rows_kept":153,"merged":[[1,1,2,9],[3,2,4,8],[6,1,6,4],[7,4,9,6],[12,1,12,2],[13,1,14,1],[13,2,14,3],[13,4,14,5],[13,6,14,7],[13,8,14,9],[15,1,16,1],[15,2,16,3],[15,4,16,5],[15,6,16,7],[15,8,16,9],[17,1,20,1],[17,2,18,3],[17,4,18,5],[17,6,18,7],[17,8,18,9],[52,1,53,4],[52,8,53,9],[54,4,54,6],[55,4,56,6],[58,1,58,9],[59,1,59,9],[61,1,61,2],[61,3,61,9],[63,1,63,9],[64,1,64,9],[66,1,66,2],[66,3,66,9],[68,1,68,9],[69,1,69,9],[71,1,71,2],[71,3,71,9],[73,1,73,9],[74,1,74,9],[76,1,76,2],[76,3,76,9],[79,1,80,4],[79,8,80,9],[81,4,81,6],[82,4,83,6],[85,1,85,9],[86,1,86,9],[88,1,88,2],[88,3,88,9],[90,1,90,9],[91,1,91,9],[93,1,93,2],[93,3,93,9],[95,1,95,9],[96,1,96,9],[98,1,98,2],[98,3,98,9],[100,1,100,9],[101,1,101,9],[103,1,103,2],[103,3,103,9],[106,1,107,4],[108,4,108,6],[108,7,108,9],[109,4,110,6],[109,8,110,9],[112,1,112,9],[113,1,113,9],[115,1,115,2],[115,3,115,9],[117,1,117,9],[118,1,118,9],[120,1,120,2],[120,3,120,9],[122,1,122,9],[123,1,123,9],[125,1,125,2],[125,3,125,9],[127,1,127,9],[128,1,128,9],[130,1,130,2],[130,3,130,9],[133,1,134,4],[133,8,134,9],[135,4,135,6],[136,4,137,6],[139,1,139,9],[140,1,140,9],[142,1,142,2],[142,3,142,9],[144,1,144,9],[145,1,145,9],[147,1,147,2],[147,3,147,9],[149,1,149,9],[150,1,150,9],[152,1,152,2],[152,3,152,9]]}
[]
[null,"PKI Maturity - Self Assessment results"]
[]
[null,null,{"$f":"Tool!E3","v":"Cool PKI 2023"}]
[]
[]
[null,"Overall reached maturity of use-case:"]
[{"$nulls":4},{"$f":"VLOOKUP(TRUNC(SUM(G61,G66,G71,G76,G88,G93,G98,G103,G115,G120,G125,G130,G142,G147,G152)/(F61+F66+F71+F76+F88+F93+F98+F103+F115+F120+F125+F130+F142+F147+F152),0),Source!$B$81:$C$85,2,0)","v":"Basic"}]
[]
[]
[null,"Number of applicable categories:",{"$nulls":3},{"$f":"_xlfn.CONCAT((15-H61-H66-H71-H76-H88-H93-H98-H103-H115-H120-H125-H130-H142-H147-H152),\" of 15\")","v":"14 of 15"}]
[]
[null,"Module results"]
[null,"Module",{"$f":"B53","v":"1. Governance"},null,{"$f":"B80","v":"2. Management"},null,{"$f":"B107","v":"3. Operations"},null,{"$f":"B134","v":"4. Resources"}]
[]
[null,"Maturity",{"$f":"E56","v":"Advanced"},null,{"$f":"E83","v":"Basic"},null,{"$f":"E110","v":"Initial"},null,{"$f":"E137","v":"Initial"}]
[]
[null,"Applicable categories",{"$f":"_xlfn.CONCAT((4-H61-H66-H71-H76),\" of 4\")","v":"3 of 4"},null,{"$f":"_xlfn.CONCAT((4-H88-H93-H98-H103),\" of 4\")","v":"4 of 4"},null,{"$f":"_xlfn.CONCAT((4-H115-H120-H125-H130),\" of 4\")","v":"4 of 4"},null,{"$f":"_xlfn.CONCAT((3-H142-H147-H152),\" of 3\")","v":"3 of 3"}]
[]
[null,null,"G1","G2","M1","M2","O1","O2","R1","R2"]
[null,null,"G3","G4","M3","M4","O3","O4","R3"]
{"$rows_empty":31}
[null,{"$f":"Tool!C8","v":"1. Governance"}]
[]
[{"$nulls":4},"Reached maturity of module:"]
[{"$nulls":4},{"$f":"IF(SUM(G61,G66,G71,G76)=0,\"\",VLOOKUP(TRUNC(SUM(G61,G66,G71,G76)/(F61+F66+F71+F76),0),Source!$B$81:$C$85,2,0))","v":"Advanced"}]
[]
[]
[null,{"$f":"Tool!C11","v":"1.1. Strategy and vision"}]
[null,{"$f":"Tool!C12","v":"Responsible for the PKI management and strategy. Includes alignment with organizational goals and requirements, risk management, and policy decisions."}]
[null,"Evaluation:",null,{"$f":"Tool!C13","v":6},{"$f":"IF(D61>5,0,D61)","v":0},{"$f":"IF(E61=0,0,VLOOKUP(B59,Source!$S$4:$T$19,2,0))","v":0},{"$f":"E61*F61","v":0},{"$f":"IF(D61=6,1,0)","v":1}]
[null,{"$f":"IF(D61=0,Source!$C$86,VLOOKUP(D61,Source!$B$81:$C$87,2,0))","v":"Not Applicable"},null,{"$f":"IF(OR(D61=0,D61=6,D61=7),VLOOKUP(D61,Source!$B$81:$D$88,3,0),VLOOKUP(_xlfn.CONCAT(B59,\"-\",D61),Source!$B$4:$D$78,3,0))","v":"The category has been evaluated as \"Not Applicable\" in terms of this self-assessment."}]
[]
[null,{"$f":"Tool!G11","v":"1.2. Policies and documentation"}]
[null,{"$f":"Tool!G12","v":"Formal policies and practice statements for supported PKI services and use-cases. Formal management of agreements between parties involved in the PKI."}]
[null,"Evaluation:",null,{"$f":"Tool!G13","v":3},{"$f":"IF(D66>5,0,D66)","v":3},{"$f":"IF(E66=0,0,VLOOKUP(B64,Source!$S$4:$T$19,2,0))","v":"4"},{"$f":"E66*F66","v":12},{"$f":"IF(D66=6,1,0)","v":0}]
[null,{"$f":"IF(D66=0,Source!$C$86,VLOOKUP(D66,Source!$B$81:$C$87,2,0))","v":"Advanced"},null,{"$f":"IF(OR(D66=0,D66=6,D66=7),VLOOKUP(D66,Source!$B$81:$D$88,3,0),VLOOKUP(_xlfn.CONCAT(B64,\"-\",D66),Source!$B$4:$D$78,3,0))","v":"Documentation and policies are in the full scope implemented, including CP and CPS."}]
[]
[null,{"$f":"Tool!C21","v":"1.3. Compliance"}]
[null,{"$f":"Tool!C22","v":"Adherence to standards and applicable regulations and requirements for the PKI and trust services. Standards and regulations may be internal or external, country specific or purpose specific."}]
[null,"Evaluation:",null,{"$f":"Tool!C23","v":4},{"$f":"IF(D71>5,0,D71)","v":4},{"$f":"IF(E71=0,0,VLOOKUP(B69,Source!$S$4:$T$19,2,0))","v":"2"},{"$f":"E71*F71","v":8},{"$f":"IF(D71=6,1,0)","v":0}]
[null,{"$f":"IF(D71=0,Source!$C$86,VLOOKUP(D71,Source!$B$81:$C$87,2,0))","v":"Managed"},null,{"$f":"IF(OR(D71=0,D71=6,D71=7),VLOOKUP(D71,Source!$B$81:$D$88,3,0),VLOOKUP(_xlfn.CONCAT(B69,\"-\",D71),Source!$B$4:$D$78,3,0))","v":"Compliance program and policy is established and maintained by responsible personnel. Procedures are in place and followed to ensure compliance with relevant laws, regulations, and standards."}]
[]
[null,{"$f":"Tool!G21","v":"1.4. Processes and procedures"}]
[null,{"$f":"Tool!G22","v":"Processes and procedures related to PKI management tasks and operational activities. This includes also the supply chain procedures and processes that includes acceptance or receipt of the HW and SW related to the PKI."}]
[null,"Evaluation:",null,{"$f":"Tool!G23","v":5},{"$f":"IF(D76>5,0,D76)","v":5},{"$f":"IF(E76=0,0,VLOOKUP(B74,Source!$S$4:$T$19,2,0))","v":"3"},{"$f":"E76*F76","v":15},{"$f":"IF(D76=6,1,0)","v":0}]
[null,{"$f":"IF(D76=0,Source!$C$86,VLOOKUP(D76,Source!$B$81:$C$87,2,0))","v":"Optimized"},null,{"$f":"IF(OR(D76=0,D76=6,D76=7),VLOOKUP(D76,Source!$B$81:$D$88,3,0),VLOOKUP(_xlfn.CONCAT(B74,\"-\",D76),Source!$B$4:$D$78,3,0))","v":"The processes and procedures, that are aligned with policies and organizational goals, are reviewed and updated on a regular basis. Evidence is properly managed and controlled."}]
[]
[]
[null,{"$f":"Tool!C32","v":"2. Management"}]
[]
[{"$nulls":4},"Reached maturity of module:"]
[{"$nulls":4},{"$f":"IF(SUM(G88,G93,G98,G103)=0,\"\",VLOOKUP(TRUNC(SUM(G88,G93,G98,G103)/(F88+F93+F98+F103),0),Source!$B$81:$C$85,2,0))","v":"Basic"}]
[]
[]
[null,{"$f":"Tool!C35","v":"2.1. Key Management"}]
[null,{"$f":"Tool!C36","v":"Key management policy and procedures related to PKI cryptographic keys and its lifecycle. Inventory of cryptographic keys. Secure and trusted key ceremonies. Key escrow and key recovery if applicable."}]
[null,"Evaluation:",null,{"$f":"Tool!C37","v":4},{"$f":"IF(D88>5,0,D88)","v":4},{"$f":"IF(E88=0,0,VLOOKUP(B86,Source!$S$4:$T$19,2,0))","v":"4"},{"$f":"E88*F88","v":16},{"$f":"IF(D88=6,1,0)","v":0}]
[null,{"$f":"IF(D88=0,Source!$C$86,VLOOKUP(D88,Source!$B$81:$C$87,2,0))","v":"Managed"},null,{"$f":"IF(OR(D88=0,D88=6,D88=7),VLOOKUP(D88,Source!$B$81:$D$88,3,0),VLOOKUP(_xlfn.CONCAT(B86,\"-\",D88),Source!$B$4:$D$78,3,0))","v":"Encryption and key management policies are documented, followed, and integrated in the organization. Inventory of cryptographic keys and devices is maintained and validated. Responsibilities and roles are assigned and aware of all processes and procedures."}]
[]
[null,{"$f":"Tool!G35","v":"2.2. Certificate Management"}]
[null,{"$f":"Tool!G36","v":"Certificate management policy and lifecycle. Inventory of certificates. Definition of the certificate profiles and supported states of the certificate including the transitions between the states. Proper validation fo the certificates."}]
[null,"Evaluation:",null,{"$f":"Tool!G37","v":4},{"$f":"IF(D93>5,0,D93)","v":4},{"$f":"IF(E93=0,0,VLOOKUP(B91,Source!$S$4:$T$19,2,0))","v":"4"},{"$f":"E93*F93","v":16},{"$f":"IF(D93=6,1,0)","v":0}]
[null,{"$f":"IF(D93=0,Source!$C$86,VLOOKUP(D93,Source!$B$81:$C$87,2,0))","v":"Managed"},null,{"$f":"IF(OR(D93=0,D93=6,D93=7),VLOOKUP(D93,Source!$B$81:$D$88,3,0),VLOOKUP(_xlfn.CONCAT(B91,\"-\",D93),Source!$B$4:$D$78,3,0))","v":"Certificate profiles, attributes, cipher suites, and tooling is properly documented and applied in the organization. Certificate management procedures are well designed and followed to maintain up-to-date inventory of certificates, including its state and location."}]
[]
[null,{"$f":"Tool!C45","v":"2.3. Infrastructure Management"}]
[null,{"$f":"Tool!C46","v":"Availability of the PKI services, infrastructure setup to achieve availability goals. PKI continuity testing and infrastructure recovery. Infrastructure security controls."}]
[null,"Evaluation:",null,{"$f":"Tool!C47","v":1},{"$f":"IF(D98>5,0,D98)","v":1},{"$f":"IF(E98=0,0,VLOOKUP(B96,Source!$S$4:$T$19,2,0))","v":"2"},{"$f":"E98*F98","v":2},{"$f":"IF(D98=6,1,0)","v":0}]
[null,{"$f":"IF(D98=0,Source!$C$86,VLOOKUP(D98,Source!$B$81:$C$87,2,0))","v":"Initial"},null,{"$f":"IF(OR(D98=0,D98=6,D98=7),VLOOKUP(D98,Source!$B$81:$D$88,3,0),VLOOKUP(_xlfn.CONCAT(B96,\"-\",D98),Source!$B$4:$D$78,3,0))","v":"Flat network with no segmentation. No separation of environments. No network vulnerability management. No infrastructure recovery objectives. No periodic review of infrastructure activities."}]
[]
[null,{"$f":"Tool!G45","v":"2.4. Change Management and Agility"}]
[null,{"$f":"Tool!G46","v":"Secure and controlled process for the change management. Formal process to request changes in the PKI, approval, staging, roll-back."}]
[null,"Evaluation:",null,{"$f":"Tool!G47","v":1},{"$f":"IF(D103>5,0,D103)","v":1},{"$f":"IF(E103=0,0,VLOOKUP(B101,Source!$S$4:$T$19,2,0))","v":"3"},{"$f":"E103*F103","v":3},{"$f":"IF(D103=6,1,0)","v":0}]
[null,{"$f":"IF(D103=0,Source!$C$86,VLOOKUP(D103,Source!$B$81:$C$87,2,0))","v":"Initial"},null,{"$f":"IF(OR(D103=0,D103=6,D103=7),VLOOKUP(D103,Source!$B$81:$D$88,3,0),VLOOKUP(_xlfn.CONCAT(B101,\"-\",D103),Source!$B$4:$D$78,3,0))","v":"Change management is not defined and agility is not considered and applied."}]
[]
[]
[null,{"$f":"Tool!C56","v":"3. Operations"}]
[]
[{"$nulls":4},"Reached maturity of module:"]
[{"$nulls":4},{"$f":"IF(SUM(G115,G120,G125,G130)=0,\"\",VLOOKUP(TRUNC(SUM(G115,G120,G125,G130)/(F115+F120+F125+F130),0),Source!$B$81:$C$85,2,0))","v":"Initial"}]
[]
[]
[null,{"$f":"Tool!C59","v":"3.1. Resilience"}]
[null,{"$f":"Tool!C60","v":"Quickly respond to potential attack and unavailability of the PKI services or other related resources."}]
[null,"Evaluation:",null,{"$f":"Tool!C61","v":1},{"$f":"IF(D115>5,0,D115)","v":1},{"$f":"IF(E115=0,0,VLOOKUP(B113,Source!$S$4:$T$19,2,0))","v":"4"},{"$f":"E115*F115","v":4},{"$f":"IF(D115=6,1,0)","v":0}]
[null,{"$f":"IF(D115=0,Source!$C$86,VLOOKUP(D115,Source!$B$81:$C$87,2,0))","v":"Initial"},null,{"$f":"IF(OR(D115=0,D115=6,D115=7),VLOOKUP(D115,Source!$B$81:$D$88,3,0),VLOOKUP(_xlfn.CONCAT(B113,\"-\",D115),Source!$B$4:$D$78,3,0))","v":"There is no resilience strategy or requirements in place."}]
[]
[null,{"$f":"Tool!G59","v":"3.2. Interoperability"}]
[null,{"$f":"Tool!G60","v":"Interoperability between applications, implementations, and technologies. Application of interoperable protocols and standards. Transparency and vendor lock avoidance strategy."}]
[null,"Evaluation:",null,{"$f":"Tool!G61","v":1},{"$f":"IF(D120>5,0,D120)","v":1},{"$f":"IF(E120=0,0,VLOOKUP(B118,Source!$S$4:$T$19,2,0))","v":"2"},{"$f":"E120*F120","v":2},{"$f":"IF(D120=6,1,0)","v":0}]
[null,{"$f":"IF(D120=0,Source!$C$86,VLOOKUP(D120,Source!$B$81:$C$87,2,0))","v":"Initial"},null,{"$f":"IF(OR(D120=0,D120=6,D120=7),VLOOKUP(D120,Source!$B$81:$D$88,3,0),VLOOKUP(_xlfn.CONCAT(B118,\"-\",D120),Source!$B$4:$D$78,3,0))","v":"There is no interoperability strategy or requirements."}]
[]
[null,{"$f":"Tool!C69","v":"3.3. Monitoring and Auditing"}]
[null,{"$f":"Tool!C70","v":"Measurement of the PKI metrics, collecting evidence, monitoring and alerting of relevant issues, including references to incident response management."}]
[null,"Evaluation:",null,{"$f":"Tool!C71","v":1},{"$f":"IF(D125>5,0,D125)","v":1},{"$f":"IF(E125=0,0,VLOOKUP(B123,Source!$S$4:$T$19,2,0))","v":"2"},{"$f":"E125*F125","v":2},{"$f":"IF(D125=6,1,0)","v":0}]
[null,{"$f":"IF(D125=0,Source!$C$86,VLOOKUP(D125,Source!$B$81:$C$87,2,0))","v":"Initial"},null,{"$f":"IF(OR(D125=0,D125=6,D125=7),VLOOKUP(D125,Source!$B$81:$D$88,3,0),VLOOKUP(_xlfn.CONCAT(B123,\"-\",D125),Source!$B$4:$D$78,3,0))","v":"There is no or limited monitoring and auditing capabilities in place."}]
[]
[null,{"$f":"Tool!G69","v":"3.4. Automation"}]
[null,{"$f":"Tool!G70","v":"Automation of certificate lifecycle management. Technology and tools for the automation. Monitoring of automated certificate operations."}]
[null,"Evaluation:",null,{"$f":"Tool!G71","v":1},{"$f":"IF(D130>5,0,D130)","v":1},{"$f":"IF(E130=0,0,VLOOKUP(B128,Source!$S$4:$T$19,2,0))","v":"2"},{"$f":"E130*F130","v":2},{"$f":"IF(D130=6,1,0)","v":0}]
[null,{"$f":"IF(D130=0,Source!$C$86,VLOOKUP(D130,Source!$B$81:$C$87,2,0))","v":"Initial"},null,{"$f":"IF(OR(D130=0,D130=6,D130=7),VLOOKUP(D130,Source!$B$81:$D$88,3,0),VLOOKUP(_xlfn.CONCAT(B128,\"-\",D130),Source!$B$4:$D$78,3,0))","v":"No automation in place."}]
[]
[]
[null,{"$f":"Tool!C80","v":"4. Resources"}]
[]
[{"$nulls":4},"Reached maturity of module:"]
[{"$nulls":4},{"$f":"IF(SUM(G142,G147,G152)=0,\"\",VLOOKUP(TRUNC(SUM(G142,G147,G152)/(F142+F147+F152),0),Source!$B$81:$C$85,2,0))","v":"Initial"}]
[]
[]
[null,{"$f":"Tool!C83","v":"4.1. Sourcing"}]
[null,{"$f":"Tool!C84","v":"Availability of skilled resources to manage PKI. Processes and procedures to maintain the required resources in time, monitoring of the skills."}]
[null,"Evaluation:",null,{"$f":"Tool!C85","v":1},{"$f":"IF(D142>5,0,D142)","v":1},{"$f":"IF(E142=0,0,VLOOKUP(B140,Source!$S$4:$T$19,2,0))","v":"4"},{"$f":"E142*F142","v":4},{"$f":"IF(D142=6,1,0)","v":0}]
[null,{"$f":"IF(D142=0,Source!$C$86,VLOOKUP(D142,Source!$B$81:$C$87,2,0))","v":"Initial"},null,{"$f":"IF(OR(D142=0,D142=6,D142=7),VLOOKUP(D142,Source!$B$81:$D$88,3,0),VLOOKUP(_xlfn.CONCAT(B140,\"-\",D142),Source!$B$4:$D$78,3,0))","v":"The resources needed for the PKI are not defined and documented. There is a risk of unavailable resources causing the PKI to be unavailable."}]
[]
[null,{"$f":"Tool!G83","v":"4.2. Knowledge and Training"}]
[null,{"$f":"Tool!G84","v":"Education of people and continuously gathering required knowledge and skills to manage PKI. Training plans and improvement."}]
[null,"Evaluation:",null,{"$f":"Tool!G85","v":3},{"$f":"IF(D147>5,0,D147)","v":3},{"$f":"IF(E147=0,0,VLOOKUP(B145,Source!$S$4:$T$19,2,0))","v":"3"},{"$f":"E147*F147","v":9},{"$f":"IF(D147=6,1,0)","v":0}]
[null,{"$f":"IF(D147=0,Source!$C$86,VLOOKUP(D147,Source!$B$81:$C$87,2,0))","v":"Advanced"},null,{"$f":"IF(OR(D147=0,D147=6,D147=7),VLOOKUP(D147,Source!$B$81:$D$88,3,0),VLOOKUP(_xlfn.CONCAT(B145,\"-\",D147),Source!$B$4:$D$78,3,0))","v":"Training plan is defined and integrated in the organization. PKI personnel are aware of the training plan and their responsibilities."}]
[]
[null,{"$f":"Tool!C93","v":"4.3. Awareness"}]
[null,{"$f":"Tool!C94","v":"Providing awareness about the PKI in the organization and its purpose. Awareness how to apply the PKI in a trusted and secure way."}]
[null,"Evaluation:",null,{"$f":"Tool!C95","v":1},{"$f":"IF(D152>5,0,D152)","v":1},{"$f":"IF(E152=0,0,VLOOKUP(B150,Source!$S$4:$T$19,2,0))","v":"3"},{"$f":"E152*F152","v":3},{"$f":"IF(D152=6,1,0)","v":0}]
[null,{"$f":"IF(D152=0,Source!$C$86,VLOOKUP(D152,Source!$B$81:$C$87,2,0))","v":"Initial"},null,{"$f":"IF(OR(D152=0,D152=6,D152=7),VLOOKUP(D152,Source!$B$81:$D$88,3,0),VLOOKUP(_xlfn.CONCAT(B150,\"-\",D152),Source!$B$4:$D$78,3,0))","v":"No awareness is provided. No program is established."}]

{"sheet":"Source","index":2,"n_rows":88,"n_cols":20,"rows_kept":88,"hidden":true}
[]
[{"$nulls":3},"No text inserted"]
[null,"Category","Source","Text"]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$11,\"-\",Tool!D15)","v":"1.1. Strategy and vision-1"},"| **1 - Initial**   | There are no leadership responsibilities and vision defined. The design is managed ad-hoc.                                                              |",{"$f":"IF(C4=\"\",_xlfn.CONCAT(B4,\": \",$D$2),TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(C4,\"|\",2),\"|\")))","v":"There are no leadership responsibilities and vision defined. The design is managed ad-hoc."},null,"Go to","GitHub",{"$nulls":6},"Otázka","Value","Assessment",null,null,"Weight categories"]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$11,\"-\",Tool!D16)","v":"1.1. Strategy and vision-2"},"| **2 - Basic**     | Basic vision has been developed but not followed. The scope and business drivers are not fully documented and understood.                               |","Basic vision has been developed but not followed. The scope and business drivers are not fully documented and understood.",null,"Find required categroy and open the folder",{"$nulls":7},"G1",{"$f":"Tool!C13","v":6},{"$f":"IF(OR(O5=6,O5=7),0,O5)","v":0},null,null,"1.1. Strategy and vision","5"]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$11,\"-\",Tool!D17)","v":"1.1. Strategy and vision-3"},"| **3 - Advanced**  | There is a responsible sponsor of the PKI. Strategy has been defined and approved.                                                                      |","There is a responsible sponsor of the PKI. Strategy has been defined and approved.",null,"Open \"_index.md\" file",{"$nulls":7},"G2",{"$f":"Tool!G13","v":3},3,null,null,"1.2. Policies and documentation","4"]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$11,\"-\",Tool!D18)","v":"1.1. Strategy and vision-4"},"| **4 - Managed**   | Strategy and vision are followed and regularly measured to improve. The scope, business drivers, and design are documented and reviewed regularly.      |","Strategy and vision are followed and regularly measured to improve. The scope, business drivers, and design are documented and reviewed regularly.",null,"Go to \"Code\" tab",{"$nulls":7},"G3",{"$f":"Tool!C23","v":4},4,null,null,"1.3. Compliance","2"]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$11,\"-\",Tool!D19)","v":"1.1. Strategy and vision-5"},"| **5 - Optimized** | Strategy and vision are fully in line with the organizational strategy and helps business to achieve future development through continuous improvement. |","Strategy and vision are fully in line with the organizational strategy and helps business to achieve future development through continuous improvement.",null,"Find \"## Category maturity levels description\" chapter",{"$nulls":7},"G4",{"$f":"Tool!G23","v":5},5,null,null,"1.4. Processes and procedures","3"]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$11,\"-\",Tool!D15)","v":"1.2. Policies and documentation-1"},"| **1 - Initial**   | There are no or limited policies and documentation.                                                                                                                                                             |",{"$f":"IF(C9=\"\",_xlfn.CONCAT(B9,\": \",$D$2),TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(C9,\"|\",2),\"|\")))","v":"There are no or limited policies and documentation."},null,"Mark 5 rows of the table containing the description and copy it",{"$nulls":7},"M1",{"$f":"Tool!C37","v":4},4,null,null,"2.1. Key Management","4"]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$11,\"-\",Tool!D16)","v":"1.2. Policies and documentation-2"},"| **2 - Basic**     | The scope of policies is defined. Documented policies are not in the full scope and are not fully implemented and followed.                                                                                     |",{"$f":"IF(C10=\"\",_xlfn.CONCAT(B10,\": \",$D$2),TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(C10,\"|\",2),\"|\")))","v":"The scope of policies is defined. Documented policies are not in the full scope and are not fully implemented and followed."},{"$nulls":9},"M2",{"$f":"Tool!G37","v":4},4,null,null,"2.2. Certificate Management","4"]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$11,\"-\",Tool!D17)","v":"1.2. Policies and documentation-3"},"| **3 - Advanced**  | Documentation and policies are in the full scope implemented, including CP and CPS.                                                                                                                             |","Documentation and policies are in the full scope implemented, including CP and CPS.",null,"Step in the first cell of category in \"C\" column",{"$nulls":7},"M3",{"$f":"Tool!C47","v":1},1,null,null,"2.3. Infrastructure Management","2"]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$11,\"-\",Tool!D18)","v":"1.2. Policies and documentation-4"},"| **4 - Managed**   | Disclosure of information contains all relevant policies and documentation. CP and CPS are published and available. There is a documentation management in place that covers the policies and documentation.    |  ","Disclosure of information contains all relevant policies and documentation. CP and CPS are published and available. There is a documentation management in place that covers the policies and documentation.",null,"Paste it",{"$nulls":7},"M4",{"$f":"Tool!G47","v":1},1,null,null,"2.4. Change Management and Agility","3"]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$11,\"-\",Tool!D19)","v":"1.2. Policies and documentation-5"},"| **5 - Optimized** | Policies are periodically reviewed and updated according to the changes in the PKI and its environment, and organizational strategy and goals. Policies are followed and enforced, communicated and understood. |","Policies are periodically reviewed and updated according to the changes in the PKI and its environment, and organizational strategy and goals. Policies are followed and enforced, communicated and understood.",{"$nulls":9},"O1",{"$f":"Tool!C61","v":1},1,null,null,"3.1. Resilience","4"]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$21,\"-\",Tool!D15)","v":"1.3. Compliance-1"},"| **1 - Initial**   | There is no compliance program in place. The organization is not aware of the relevant laws, regulations, and standards, and is exposed to significant risks.                                   |","There is no compliance program in place. The organization is not aware of the relevant laws, regulations, and standards, and is exposed to significant risks.",{"$nulls":9},"O2",{"$f":"Tool!G61","v":1},1,null,null,"3.2. Interoperability","2"]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$21,\"-\",Tool!D16)","v":"1.3. Compliance-2"},"| **2 - Basic**     | The compliance responsibility is established and assigned. The organization is aware of the relevant laws, regulations, and standards that should be followed.                                  |","The compliance responsibility is established and assigned. The organization is aware of the relevant laws, regulations, and standards that should be followed.",{"$nulls":9},"O3",{"$f":"Tool!C71","v":1},1,null,null,"3.3. Monitoring and Auditing","2"]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$21,\"-\",Tool!D17)","v":"1.3. Compliance-3"},"| **3 - Advanced**  | Compliance policy is defined, implemented, and communicated. Compliance program is established.                                                                                                 |","Compliance policy is defined, implemented, and communicated. Compliance program is established.",{"$nulls":9},"O4",{"$f":"Tool!G71","v":1},1,null,null,"3.4. Automation","2"]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$21,\"-\",Tool!D18)","v":"1.3. Compliance-4"},"| **4 - Managed**   | Compliance program and policy is established and maintained by responsible personnel. Procedures are in place and followed to ensure compliance with relevant laws, regulations, and standards. |","Compliance program and policy is established and maintained by responsible personnel. Procedures are in place and followed to ensure compliance with relevant laws, regulations, and standards.",{"$nulls":9},"R1",{"$f":"Tool!C85","v":1},1,null,null,"4.1. Sourcing","4"]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$21,\"-\",Tool!D19)","v":"1.3. Compliance-5"},"| **5 - Optimized** | Organization is aware of the relevant laws, regulations, and standards and is able to demonstrate compliance over the time. Compliance program is continuously maintained and improved.         |","Organization is aware of the relevant laws, regulations, and standards and is able to demonstrate compliance over the time. Compliance program is continuously maintained and improved.",{"$nulls":9},"R2",{"$f":"Tool!G85","v":3},3,null,null,"4.2. Knowledge and Training","3"]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$21,\"-\",Tool!D15)","v":"1.4. Processes and procedures-1"},"| **1 - Initial**   | Processes and procedures are not formally defined and documented. Ad-hoc reactions to the events.                                                                                |","Processes and procedures are not formally defined and documented. Ad-hoc reactions to the events.",{"$nulls":9},"R3",{"$f":"Tool!C95","v":1},1,null,null,"4.3. Awareness","3"]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$21,\"-\",Tool!D16)","v":"1.4. Processes and procedures-2"},"| **2 - Basic**     | Processes and procedures are formally defined and documented, but not in the full scope and fully implemented and followed.                                                      |","Processes and procedures are formally defined and documented, but not in the full scope and fully implemented and followed."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$21,\"-\",Tool!D17)","v":"1.4. Processes and procedures-3"},"| **3 - Advanced**  | The scope of the processes and procedures covers entire PKI implementation and policies, and is documented and followed.                                                         |","The scope of the processes and procedures covers entire PKI implementation and policies, and is documented and followed."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$21,\"-\",Tool!D18)","v":"1.4. Processes and procedures-4"},"| **4 - Managed**   | The evidence from the processes and procedures is collected and maintained. Recurring activities are defined and executed by responsible roles.                                  |","The evidence from the processes and procedures is collected and maintained. Recurring activities are defined and executed by responsible roles."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$21,\"-\",Tool!D19)","v":"1.4. Processes and procedures-5"},"| **5 - Optimized** | The processes and procedures, that are aligned with policies and organizational goals, are reviewed and updated on a regular basis. Evidence is properly managed and controlled. |","The processes and procedures, that are aligned with policies and organizational goals, are reviewed and updated on a regular basis. Evidence is properly managed and controlled."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$35,\"-\",Tool!D15)","v":"2.1. Key Management-1"},"| **1 - Initial**   | No key management is defined. There are no key management responsibilities defined and assigned.                                                                                                                                                                 |","No key management is defined. There are no key management responsibilities defined and assigned."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$35,\"-\",Tool!D16)","v":"2.1. Key Management-2"},"| **2 - Basic**     | Responsibilities and roles for key management are defined. Key management is managed ad-hoc and there is no documentation and inventory of cryptographic keys maintained.                                                                                        |","Responsibilities and roles for key management are defined. Key management is managed ad-hoc and there is no documentation and inventory of cryptographic keys maintained."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$35,\"-\",Tool!D17)","v":"2.1. Key Management-3"},"| **3 - Advanced**  | Key management and lifecycle is documented and maintained. Inventory of cryptographic keys and devices is avaialble. Procedures are formally followed.                                                                                                           |","Key management and lifecycle is documented and maintained. Inventory of cryptographic keys and devices is avaialble. Procedures are formally followed."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$35,\"-\",Tool!D18)","v":"2.1. Key Management-4"},"| **4 - Managed**   | Encryption and key management policies are documented, followed, and integrated in the organization. Inventory of cryptographic keys and devices is maintained and validated. Responsibilities and roles are assigned and aware of all processes and procedures. |","Encryption and key management policies are documented, followed, and integrated in the organization. Inventory of cryptographic keys and devices is maintained and validated. Responsibilities and roles are assigned and aware of all processes and procedures."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$35,\"-\",Tool!D19)","v":"2.1. Key Management-5"},"| **5 - Optimized** | Key management is periodically reviewed and updated. Inventory of cryptographic keys and devices is complete, maintained and frequently validated. Process and procedures are formally approved, integrated and followed in the organization.                    |","Key management is periodically reviewed and updated. Inventory of cryptographic keys and devices is complete, maintained and frequently validated. Process and procedures are formally approved, integrated and followed in the organization."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$35,\"-\",Tool!D15)","v":"2.2. Certificate Management-1"},"| **1 - Initial**   | Certificates are ad-hoc managed, without proper control and always reactive. Inventory is not available.                                                                                                                                                                                                                                                              |","Certificates are ad-hoc managed, without proper control and always reactive. Inventory is not available."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$35,\"-\",Tool!D16)","v":"2.2. Certificate Management-2"},"| **2 - Basic**     | Certificates are managed, but not according to industry standards and regulations. Inventory of certificates is not maintained.                                                                                                                                                                                                                                       |","Certificates are managed, but not according to industry standards and regulations. Inventory of certificates is not maintained."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$35,\"-\",Tool!D17)","v":"2.2. Certificate Management-3"},"| **3 - Advanced**  | Certificate profiles and attributes are documented and enforced. Certificate lifecycle management is documented and followed. Inventory of certificates is maintained with up-to-date information. Certificate management procedures and controls on are in place but not fully followed and understood.                                                              |","Certificate profiles and attributes are documented and enforced. Certificate lifecycle management is documented and followed. Inventory of certificates is maintained with up-to-date information. Certificate management procedures and controls on are in place but not fully followed and understood."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$35,\"-\",Tool!D18)","v":"2.2. Certificate Management-4"},"| **4 - Managed**   | Certificate profiles, attributes, cipher suites, and tooling is properly documented and applied in the organization. Certificate management procedures are well designed and followed to maintain up-to-date inventory of certificates, including its state and location.                                                                                             |","Certificate profiles, attributes, cipher suites, and tooling is properly documented and applied in the organization. Certificate management procedures are well designed and followed to maintain up-to-date inventory of certificates, including its state and location."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$35,\"-\",Tool!D19)","v":"2.2. Certificate Management-5"},"| **5 - Optimized** | Certificate lifecycle is properly documented and maintained. Up-to-date inventory is available and periodically updated according to defined procedures and certificate management controls. Discovery of certificates is often executed to provide assurance of the inventory completeness. Certificate management is integrated with the organizational governance. |","Certificate lifecycle is properly documented and maintained. Up-to-date inventory is available and periodically updated according to defined procedures and certificate management controls. Discovery of certificates is often executed to provide assurance of the inventory completeness. Certificate management is integrated with the organizational governance."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$45,\"-\",Tool!D15)","v":"2.3. Infrastructure Management-1"},"| **1 - Initial**   | Flat network with no segmentation. No separation of environments. No network vulnerability management. No infrastructure recovery objectives. No periodic review of infrastructure activities.                                  |","Flat network with no segmentation. No separation of environments. No network vulnerability management. No infrastructure recovery objectives. No periodic review of infrastructure activities."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$45,\"-\",Tool!D16)","v":"2.3. Infrastructure Management-2"},"| **2 - Basic**     | Network and deployment infrastructure is documented and known by the infrastructure team.                                                                                                                                       |","Network and deployment infrastructure is documented and known by the infrastructure team."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$45,\"-\",Tool!D17)","v":"2.3. Infrastructure Management-3"},"| **3 - Advanced**  | Infrastructure is documented and managed. Network vulnerability management is implemented. Responsibility for infrastructure is defined and approved by the management.                                                         |","Infrastructure is documented and managed. Network vulnerability management is implemented. Responsibility for infrastructure is defined and approved by the management."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$45,\"-\",Tool!D18)","v":"2.3. Infrastructure Management-4"},"| **4 - Managed**   | The infrastructure is properly design, documented, and maintained, including procedures for vulnerability management, recovery and continuity.                                                                                  |","The infrastructure is properly design, documented, and maintained, including procedures for vulnerability management, recovery and continuity."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$45,\"-\",Tool!D19)","v":"2.3. Infrastructure Management-5"},"| **5 - Optimized** | Processes and procedures are formally followed and periodically reviewed. The infrastructure is properly designed, documented, and maintained by responsible personnel and integrated into the overall organizational strategy. |","Processes and procedures are formally followed and periodically reviewed. The infrastructure is properly designed, documented, and maintained by responsible personnel and integrated into the overall organizational strategy."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$45,\"-\",Tool!D15)","v":"2.4. Change Management and Agility-1"},"| **1 - Initial**   | Change management is not defined and agility is not considered and applied.                                                                                                            |","Change management is not defined and agility is not considered and applied."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$45,\"-\",Tool!D16)","v":"2.4. Change Management and Agility-2"},"| **2 - Basic**     | Change management does not have documented and followed structure and is often ad-hoc. Agility is not formally cosnidered, however, it is applied in some cases.                       |","Change management does not have documented and followed structure and is often ad-hoc. Agility is not formally cosnidered, however, it is applied in some cases."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$45,\"-\",Tool!D17)","v":"2.4. Change Management and Agility-3"},"| **3 - Advanced**  | Processes for change management and agility are defined and designed to support the PKI implementation. The procedures and not always followed.                                        |","Processes for change management and agility are defined and designed to support the PKI implementation. The procedures and not always followed."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$45,\"-\",Tool!D18)","v":"2.4. Change Management and Agility-4"},"| **4 - Managed**   | Change management is integrated with the organizational change management process. Requirements for the agility are identified and implemented. Procedures are followed and monitored. |","Change management is integrated with the organizational change management process. Requirements for the agility are identified and implemented. Procedures are followed and monitored."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$45,\"-\",Tool!D19)","v":"2.4. Change Management and Agility-5"},"| **5 - Optimized** | Approved change management policy and agility processes are followed and monitored. It is continuously improved and adapted to the changes.                                            |","Approved change management policy and agility processes are followed and monitored. It is continuously improved and adapted to the changes."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$59,\"-\",Tool!D15)","v":"3.1. Resilience-1"},"| **1 - Initial**   | There is no resilience strategy or requirements in place.                                                                                                                                                                                                                                        |","There is no resilience strategy or requirements in place."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$59,\"-\",Tool!D16)","v":"3.1. Resilience-2"},"| **2 - Basic**     | Risk assessment and business impact analysis is performed. Results are documented and used to develop resilience strategy, however, the strategy is not fully defined and implemented.                                                                                                           |","Risk assessment and business impact analysis is performed. Results are documented and used to develop resilience strategy, however, the strategy is not fully defined and implemented."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$59,\"-\",Tool!D17)","v":"3.1. Resilience-3"},"| **3 - Advanced**  | Resilience strategy is defined and implemented. Business continuity planning and disaster recovery is executed on a regular basis.                                                                                                                                                               |","Resilience strategy is defined and implemented. Business continuity planning and disaster recovery is executed on a regular basis."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$59,\"-\",Tool!D18)","v":"3.1. Resilience-4"},"| **4 - Managed**   | The infrastructure resilience is often proven and tested through the competence management and results are used to improve the resilience planning and documentation.                                                                                                                            |","The infrastructure resilience is often proven and tested through the competence management and results are used to improve the resilience planning and documentation."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$59,\"-\",Tool!D19)","v":"3.1. Resilience-5"},"| **5 - Optimized** | Analysis and assessment is regularly updated with the latest information and used to improve the resilience strategy. Incident response plans are tested and improved, including disaster recovery plans and procedures. Resilience is fully aligned with the organizational goals and policies. | ","Analysis and assessment is regularly updated with the latest information and used to improve the resilience strategy. Incident response plans are tested and improved, including disaster recovery plans and procedures. Resilience is fully aligned with the organizational goals and policies."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$59,\"-\",Tool!D15)","v":"3.2. Interoperability-1"},"| **1 - Initial**   | There is no interoperability strategy or requirements.                                                                                                                                                                                               |","There is no interoperability strategy or requirements."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$59,\"-\",Tool!D16)","v":"3.2. Interoperability-2"},"| **2 - Basic**     | Interoperability strategy is not completely defined and formal. Some integration guidance is available but not maintained.                                                                                                                           |","Interoperability strategy is not completely defined and formal. Some integration guidance is available but not maintained."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$59,\"-\",Tool!D17)","v":"3.2. Interoperability-3"},"| **3 - Advanced**  | Interoperability strategy is defined and integrated within the infrastructure, covering all necessary components.                                                                                                                                    |","Interoperability strategy is defined and integrated within the infrastructure, covering all necessary components."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$59,\"-\",Tool!D18)","v":"3.2. Interoperability-4"},"| **4 - Managed**   | Interoperability strategy is defined, integrated and maintained, with open standards and protocols applied to avoid vendor lock-in.                                                                                                                  |","Interoperability strategy is defined, integrated and maintained, with open standards and protocols applied to avoid vendor lock-in."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$59,\"-\",Tool!D19)","v":"3.2. Interoperability-5"},"| **5 - Optimized** | Interoperability requirements, strategy and guidance are well defined, integrated and maintained. Adoption of open standards and protocols is applied to avoid vendor lock-in, where possible. Interoperability is periodically tested and improved. |","Interoperability requirements, strategy and guidance are well defined, integrated and maintained. Adoption of open standards and protocols is applied to avoid vendor lock-in, where possible. Interoperability is periodically tested and improved."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$69,\"-\",Tool!D15)","v":"3.3. Monitoring and Auditing-1"},"| **1 - Initial**   | There is no or limited monitoring and auditing capabilities in place.                                                                                                                                                                        |","There is no or limited monitoring and auditing capabilities in place."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$69,\"-\",Tool!D16)","v":"3.3. Monitoring and Auditing-2"},"| **2 - Basic**     | Logs are collected, however, they are not reviewed, nor correlated with other records.                                                                                                                                                       |","Logs are collected, however, they are not reviewed, nor correlated with other records."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$69,\"-\",Tool!D17)","v":"3.3. Monitoring and Auditing-3"},"| **3 - Advanced**  | Documeneted requirements for monitoring and auditing are defined and implemented. Logs are centrally collected and correlated with other records.                                                                                            | ","Documeneted requirements for monitoring and auditing are defined and implemented. Logs are centrally collected and correlated with other records."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$69,\"-\",Tool!D18)","v":"3.3. Monitoring and Auditing-4"},"| **4 - Managed**   | Centrally collected logs are reviewed and monitored periodically according to documented policy and requirements. Audit trail can be constructed for critical events from audit logs.                                                        |","Centrally collected logs are reviewed and monitored periodically according to documented policy and requirements. Audit trail can be constructed for critical events from audit logs."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$69,\"-\",Tool!D19)","v":"3.3. Monitoring and Auditing-5"},"| **5 - Optimized** | Monitoring and auditing requirements are periodically reviewed and improved. Documented policy and system requirements are in place and followed. Critical events are immediately alerted and resolved according to incident response plans. |","Monitoring and auditing requirements are periodically reviewed and improved. Documented policy and system requirements are in place and followed. Critical events are immediately alerted and resolved according to incident response plans."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$69,\"-\",Tool!D15)","v":"3.4. Automation-1"},"| **1 - Initial**   | No automation in place.                                                                                                                                                                                       |","No automation in place."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$69,\"-\",Tool!D16)","v":"3.4. Automation-2"},"| **2 - Basic**     | Automation is used for some tasks, however, it is not described and it is not reliable or repeatable.                                                                                                         |","Automation is used for some tasks, however, it is not described and it is not reliable or repeatable."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$69,\"-\",Tool!D17)","v":"3.4. Automation-3"},"| **3 - Advanced**  | Automation is used for most of the tasks, where it makes sense. Automation is described but not monitoring or audited.                                                                                        |","Automation is used for most of the tasks, where it makes sense. Automation is described but not monitoring or audited."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$69,\"-\",Tool!D18)","v":"3.4. Automation-4"},"| **4 - Managed**   | Automation is used for all tasks, where it makes sense. Automation is described, followed and monitored or audited.                                                                                           |","Automation is used for all tasks, where it makes sense. Automation is described, followed and monitored or audited."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$69,\"-\",Tool!D19)","v":"3.4. Automation-5"},"| **5 - Optimized** | Automation is analyzed and designed to apply the best practices. Automation is described, followed, monitored, and audited. Procedures are in place to handle exceptions and incidents related to automation. |","Automation is analyzed and designed to apply the best practices. Automation is described, followed, monitored, and audited. Procedures are in place to handle exceptions and incidents related to automation."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$83,\"-\",Tool!D15)","v":"4.1. Sourcing-1"},"| **1 - Initial**   | The resources needed for the PKI are not defined and documented. There is a risk of unavailable resources causing the PKI to be unavailable.                |","The resources needed for the PKI are not defined and documented. There is a risk of unavailable resources causing the PKI to be unavailable."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$83,\"-\",Tool!D16)","v":"4.1. Sourcing-2"},"| **2 - Basic**     | Resource are identified and documented. The resources and their specification are not clearly defined, which can lead to misuse of resources.               |","Resource are identified and documented. The resources and their specification are not clearly defined, which can lead to misuse of resources."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$83,\"-\",Tool!D17)","v":"4.1. Sourcing-3"},"| **3 - Advanced**  | Resources are identified, documented, and clearly defined. The capacity of resources is aligned with the PKI scope and use-case(s).                         |","Resources are identified, documented, and clearly defined. The capacity of resources is aligned with the PKI scope and use-case(s)."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$83,\"-\",Tool!D18)","v":"4.1. Sourcing-4"},"| **4 - Managed**   | Resources are identified, documented, and clearly defined. Resource management process ensures that the resources are available when needed.                |","Resources are identified, documented, and clearly defined. Resource management process ensures that the resources are available when needed."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$83,\"-\",Tool!D19)","v":"4.1. Sourcing-5"},"| **5 - Optimized** | Resources are periodically reviewed and updated to ensure that the required capacity is available and aligned with the PKI scope and organization strategy. |","Resources are periodically reviewed and updated to ensure that the required capacity is available and aligned with the PKI scope and organization strategy."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$83,\"-\",Tool!D15)","v":"4.2. Knowledge and Training-1"},"| **1 - Initial**   | There is no training plan or education plan for the PKI personnel.                                                                                                                                                                 |","There is no training plan or education plan for the PKI personnel."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$83,\"-\",Tool!D16)","v":"4.2. Knowledge and Training-2"},"| **2 - Basic**     | Training plan is defined, however, there is no responsibility for the execution of the plan.                                                                                                                                       |","Training plan is defined, however, there is no responsibility for the execution of the plan."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$83,\"-\",Tool!D17)","v":"4.2. Knowledge and Training-3"},"| **3 - Advanced**  | Training plan is defined and integrated in the organization. PKI personnel are aware of the training plan and their responsibilities.                                                                                              |                                    ","Training plan is defined and integrated in the organization. PKI personnel are aware of the training plan and their responsibilities."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$83,\"-\",Tool!D18)","v":"4.2. Knowledge and Training-4"},"| **4 - Managed**   | Training plan is defined, maintained and integrated in the organization. It is executed and requirements on the knowledge and proficiency are monitored.                                                                           |","Training plan is defined, maintained and integrated in the organization. It is executed and requirements on the knowledge and proficiency are monitored."]
[null,{"$f":"_xlfn.CONCAT(Tool!$G$83,\"-\",Tool!D19)","v":"4.2. Knowledge and Training-5"},"| **5 - Optimized** | Training plan is periodically reviewed and updated. Education plan is defined and maintained. PKI personnel are aware of the training plan and their responsibilities that are fully aligned with the PKI policies and procedures. |","Training plan is periodically reviewed and updated. Education plan is defined and maintained. PKI personnel are aware of the training plan and their responsibilities that are fully aligned with the PKI policies and procedures."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$93,\"-\",Tool!D15)","v":"4.3. Awareness-1"},"| **1 - Initial**   | No awareness is provided. No program is established.                                                                                                                                                                                                       |","No awareness is provided. No program is established."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$93,\"-\",Tool!D16)","v":"4.3. Awareness-2"},"| **2 - Basic**     | Incomplete awareness plan is defined, and it is not often followed and communicated. It is mainly ad-hoc and not maintained, without proper planning and monitoring.                                                                                       |",{"$f":"IF(C75=\"\",_xlfn.CONCAT(B75,\": \",$D$2),TRIM(_xlfn.TEXTBEFORE(_xlfn.TEXTAFTER(C75,\"|\",2),\"|\")))","v":"Incomplete awareness plan is defined, and it is not often followed and communicated. It is mainly ad-hoc and not maintained, without proper planning and monitoring."}]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$93,\"-\",Tool!D17)","v":"4.3. Awareness-3"},"| **3 - Advanced**  | The awareness plan is defined, followed and communicated to all PKI participants. The awareness is not integrated in the organization and is not periodically reviewed and improved.                                                                       |                               ","The awareness plan is defined, followed and communicated to all PKI participants. The awareness is not integrated in the organization and is not periodically reviewed and improved."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$93,\"-\",Tool!D18)","v":"4.3. Awareness-4"},"| **4 - Managed**   | The awareness program is designed to support the PKI participants. The awareness plan is defined, followed and communicated to all PKI participants. It is maintained and monitored over the time.                                                         | ","The awareness program is designed to support the PKI participants. The awareness plan is defined, followed and communicated to all PKI participants. It is maintained and monitored over the time."]
[null,{"$f":"_xlfn.CONCAT(Tool!$C$93,\"-\",Tool!D19)","v":"4.3. Awareness-5"},"| **5 - Optimized** | Information is disclosed and properly communicated to all PKI participant according to the awareness plan. The awareness plan is well designed and continuously improved. Participant are properly informed about important information and how to behave. | ","Information is disclosed and properly communicated to all PKI participant according to the awareness plan. The awareness plan is well designed and continuously improved. Participant are properly informed about important information and how to behave."]
[]
[]
[null,1,"Initial","def1"]
[null,2,"Basic","def2"]
[null,3,"Advanced","def3"]
[null,4,"Managed","def4"]
[null,5,"Optimized","def5"]
[null,7,"Not Evaluated","The category is not yet evaluated."]
[null,6,"Not Applicable","The category has been evaluated as \"Not Applicable\" in terms of this self-assessment."]
[null,0,"Not Evaluated","The category is not yet evaluated."]