Control Framework Mappings

Gray Ghost Data Consultants aligns our security controls with industry-recognized frameworks to ensure comprehensive coverage and enable easier compliance assessments for our clients.

NIST Cybersecurity Framework (CSF)

We have mapped our controls to the NIST CSF core functions:

Identify (ID)

Subcategory	Control	Status
ID.AM-1	Physical devices and systems inventoried	✅ Implemented
ID.AM-2	Software platforms and applications inventoried	✅ Implemented
ID.AM-3	Data flows mapped	✅ Implemented
ID.AM-4	External information systems catalogued	✅ Implemented
ID.BE-1	Organization's role in supply chain identified	✅ Implemented
ID.GV-1	Security policy established	✅ Implemented
ID.GV-2	Cybersecurity roles coordinated with internal roles	✅ Implemented
ID.RA-1	Asset vulnerabilities identified and documented	✅ Implemented
ID.RA-5	Threats and vulnerabilities used for risk assessment	✅ Implemented
ID.RM-1	Risk management processes established	✅ Implemented

Protect (PR)

Subcategory	Control	Status
PR.AC-1	Identities and credentials managed	✅ Implemented
PR.AC-2	Physical access managed	✅ Implemented
PR.AC-3	Remote access managed	✅ Implemented
PR.AC-4	Access permissions managed (least privilege)	✅ Implemented
PR.AC-5	Network integrity protected	✅ Implemented
PR.AT-1	Users informed and trained	✅ Implemented
PR.DS-1	Data-at-rest protected	✅ Implemented
PR.DS-2	Data-in-transit protected	✅ Implemented
PR.DS-5	Protections against data leaks implemented	✅ Implemented
PR.IP-1	Configuration management implemented	✅ Implemented
PR.IP-9	Response and recovery plans in place	✅ Implemented
PR.IP-12	Vulnerability management plan developed	✅ Implemented

Detect (DE)

Subcategory	Control	Status
DE.AE-1	Baseline of network operations established	✅ Implemented
DE.AE-2	Detected events analyzed	✅ Implemented
DE.AE-3	Event data aggregated and correlated	✅ Implemented
DE.CM-1	Network monitored for security events	✅ Implemented
DE.CM-4	Malicious code detected	✅ Implemented
DE.CM-7	Monitoring for unauthorized activity	✅ Implemented
DE.CM-8	Vulnerability scans performed	✅ Implemented
DE.DP-4	Event detection communicated	✅ Implemented

Respond (RS)

Subcategory	Control	Status
RS.RP-1	Response plan executed	✅ Implemented
RS.CO-1	Personnel know their roles	✅ Implemented
RS.CO-2	Incidents reported	✅ Implemented
RS.CO-3	Information shared	✅ Implemented
RS.AN-1	Notifications from detection systems investigated	✅ Implemented
RS.AN-2	Impact of incidents understood	✅ Implemented
RS.MI-1	Incidents contained	✅ Implemented
RS.MI-2	Incidents mitigated	✅ Implemented
RS.IM-1	Response plans incorporate lessons learned	✅ Implemented

Recover (RC)

Subcategory	Control	Status
RC.RP-1	Recovery plan executed	✅ Implemented
RC.IM-1	Recovery plans incorporate lessons learned	✅ Implemented
RC.CO-1	Public relations managed	✅ Implemented
RC.CO-3	Recovery activities communicated	✅ Implemented

CIS Controls v8

We implement CIS Controls at Implementation Group 1 and 2 levels:

Implementation Group 1 (Essential)

Control	Description	Status
1	Inventory and Control of Enterprise Assets	✅
2	Inventory and Control of Software Assets	✅
3	Data Protection	✅
4	Secure Configuration	✅
5	Account Management	✅
6	Access Control Management	✅
7	Continuous Vulnerability Management	✅
8	Audit Log Management	✅
9	Email and Web Browser Protections	✅
10	Malware Defenses	✅
11	Data Recovery	✅
14	Security Awareness Training	✅
17	Incident Response Management	✅

Implementation Group 2 (Foundational)

Control	Description	Status
12	Network Infrastructure Management	✅
13	Network Monitoring and Defense	✅
15	Service Provider Management	✅
16	Application Software Security	✅
18	Penetration Testing	✅

Control Evidence

For compliance assessments, we can provide evidence for each control including:

• Policy documentation
• Technical configurations
• Screenshots and reports
• Audit logs
• Third-party assessment reports

Contact security@grayghostdata.com to request control evidence for your compliance needs.