NIST CSF 2.0, IdentifyID.RA-05

Base your risk analysis on at least technological, human, ICT supply-chain and location-related risks (Section 3).

Where you are designated and notified as a critical-infrastructure operator or manager, renew a complete risk analysis of your critical infrastructure at least every six months and designate a cybersecurity focal point, a designation this vocabulary does not separately express.

Account for your own needs and security requirements, current European and international standards where relevant, the cost of the measures, their proportionality to your risk exposure and to the likelihood and severity of a cyber incident including its societal and economic impact, and a systemic, comprehensive approach that protects both the systems and their physical environment.

Conduct regular cybersecurity risk assessments and impact analyses, participate in the Administration's annual National Cybersecurity Risk Survey and supply the information it requests, and obtain and renew a cyber audit certificate and a cybersecurity inspection-and-evaluation certificate from the Administration, taking appropriate corrective action within the time the Administration sets on any gap the audit or inspection finds.

Identify the elements of your organization exposed to information security risks and your interfaces with other organizations, assign each information security risk with a potential impact on aviation safety a level under a predefined classification, and review and update the assessment when the elements, the interfaces, the information used or the lessons from incidents change (points IS.D.OR.205(a) to (d)).

Perform cybersecurity risk management for all assets in your high-impact and critical-impact perimeters every three years, in four phases: context establishment, cybersecurity risk assessment at entity level, cybersecurity risk treatment and cybersecurity risk acceptance (Article 26(1) and (2)).

Identify the elements of your organization exposed to information security risks and your interfaces with other organizations, assign each information security risk with a potential impact on aviation safety a level under a predefined classification, and review and update the assessment when the elements, the interfaces, the information used or the lessons from incidents change (points IS.I.OR.205(a) to (d)).

Ensure a level of security of your network and information systems appropriate to the risks posed when you implement the requirements, taking due account of your exposure to risks, your size, the likelihood of occurrence of incidents and their severity, including their societal and economic impact (Article 2(2)).

Establish a risk management framework, perform and document risk assessments, and establish, implement and monitor a risk treatment plan, reviewing the assessment results and the plan at planned intervals and at least annually (points 2.1.1 and 2.1.4).

Identify, assess and manage the risks to the network and information systems you use in your operations or to provide your services, and act to prevent or minimise an incident's impact on your operations, their continuity, the recipients of your services and other services.

Identify the risks that threaten the security of the networks and information systems you use to provide your services in the European Union, and take the necessary and proportionate technical and organisational measures to manage those risks, prevent an incident from compromising your networks and systems, and minimise its impact, so as to guarantee the continuity of your services.

At the high tier, conduct a data security risk assessment and a penetration test of the database's systems at least once every 18 months, and hold a quarterly internal discussion of security incidents.

Designate one or more employees to maintain the WISP; identify and assess foreseeable internal and external risks to personal information and evaluate whether your safeguards limit them; train employees; discipline violations; cut off a terminated employee's access to records; restrict and secure physical access to records; review the WISP's scope at least annually or after a material change in business practice; document your response to any security-breach incident; and select only third-party service providers capable of maintaining appropriate security measures, requiring those measures by contract.

As passed by the Senate, a person (any private entity) or agency (a Michigan state government unit) that owns, possesses, collects, or accesses personal information must implement and maintain reasonable security procedures: designate a security coordinator, identify internal and external risks, include appropriate safeguards addressing those risks, assess the safeguards' effectiveness, contractually require every service provider to maintain safeguards conforming to the NIST Cybersecurity Framework 2.0 or another industry-standard framework, and evaluate and adjust the procedures for changed circumstances.

Absent that safe harbor, develop, implement, and maintain a data security program with reasonable administrative safeguards (a designated coordinator, a risk assessment, employee training, vetted service-provider contracts, and periodic adjustment), reasonable technical safeguards (assessing network and software design risk, detecting and responding to attacks, and testing controls), and reasonable physical safeguards (securing storage and disposal and limiting access during and after collection).

Build the program as a reasonable security program, a designated coordinator, procedures to detect, prevent and respond to a breach, employee training, and periodic risk assessments of network and software design, information handling, and data storage and disposal, adjusted as circumstances change, or have it reasonably conform to a current named framework: NIST SP 800-171; NIST SP 800-53 and 800-53A; the FedRAMP Security Assessment Framework; the CIS Critical Security Controls; the ISO/IEC 27000 family; the HIPAA Security Rule or Gramm-Leach-Bliley Title V regulations for information those regimes cover; or the PCI Data Security Standard for payment card information.

Identify the critical elements of the vehicle type, perform an exhaustive risk assessment, and protect the vehicle type against the risks identified with proportionate mitigations that include the relevant mitigations of Annex 5, Parts B and C (paragraphs 7.3.3 and 7.3.4).