Oversight and Governance
OG-WRL-014

Systems Security Management

Responsible for managing the cybersecurity of a program, organization, system, or enclave.

  • T1019: Determine special needs of cyber-physical systems
  • T1020: Determine the operational and safety impacts of cybersecurity lapses
  • T1022: Review enterprise information technology (IT) goals and objectives
  • T1023: Identify critical technology procurement requirements
  • T1026: Determine procurement requirements
  • T1052: Integrate black-box security testing tools into quality assurance processes
  • T1056: Acquire resources to support cybersecurity program goals and objectives
  • T1057: Conduct an effective enterprise continuity of operations program
  • T1058: Advise senior management on risk levels and security posture
  • T1059: Perform cost/benefit analyses of cybersecurity programs, policies, processes, systems, and elements
  • T1060: Advise senior management on organizational cybersecurity efforts
  • T1061: Advise senior leadership and authorizing official of changes affecting the organization's cybersecurity posture
  • T1086: Collect and maintain system cybersecurity report data
  • T1087: Create system cybersecurity reports
  • T1088: Communicate the value of cybersecurity to organizational stakeholders
  • T1113: Develop the enterprise continuity of operations strategy
  • T1114: Establish the enterprise continuity of operations program
  • T1178: Determine if security improvement actions are evaluated, validated, and implemented as required
  • T1180: Determine if cybersecurity inspections, tests, and reviews are coordinated for the network environment
  • T1181: Determine if cybersecurity requirements are integrated into continuity planning
  • T1182: Determine if security engineering is used when acquiring or developing protection and detection capabilities
  • T1183: Determine if protection and detection capabilities are consistent with organization-level cybersecurity architecture
  • T1186: Establish enterprise information security architecture
  • T1188: Determine if baseline security safeguards are appropriately installed
  • T1201: Determine implications of new and upgraded technologies to the cybersecurity program
  • T1221: Disseminate incident and other Computer Network Defense (CND) information
  • T1222: Determine security requirements for new information technologies
  • T1223: Determine security requirements for new operational technologies
  • T1224: Determine impact of noncompliance on organizational risk levels
  • T1225: Determine impact of noncompliance on effectiveness of the enterprise's cybersecurity program
  • T1226: Align cybersecurity priorities with organizational security strategy
  • T1227: Manage cybersecurity budget, staffing, and contracting
  • T1233: Monitor cybersecurity data sources
  • T1234: Develop Computer Network Defense (CND) guidance for organizational stakeholders
  • T1235: Manage threat and target analysis
  • T1236: Manage the production of threat information
  • T1238: Determine the effectiveness of enterprise cybersecurity safeguards
  • T1245: Oversee the cybersecurity training and awareness program
  • T1246: Establish Security Assessment and Authorization processes
  • T1247: Develop computer environment cybersecurity plans and requirements
  • T1284: Develop standard operating procedures for secure network system operations
  • T1285: Distribute standard operating procedures
  • T1286: Maintain standard operating procedures
  • T1291: Advise stakeholders on the development of continuity of operations plans
  • T1293: Advise on security requirements to be included in statements of work
  • T1295: Provide cybersecurity awareness and training
  • T1298: Communicate situational awareness information to leadership
  • T1300: Report cybersecurity incidents
  • T1304: Recommend organizational cybersecurity resource allocations
  • T1307: Develop cybersecurity policy recommendations
  • T1308: Coordinate cybersecurity policy review and approval processes
  • T1310: Implement protective or corrective measures when a cybersecurity incident or vulnerability is discovered
  • T1317: Determine if appropriate threat mitigation actions have been taken
  • T1321: Manage computing environment system operations
  • T1335: Promote cybersecurity awareness to management
  • T1336: Verify the inclusion of sound cybersecurity principles in the organization's vision and goals
  • T1342: Oversee policy standards and implementation strategy development
  • T1343: Provide cybersecurity guidance to organizational risk governance processes
  • T1344: Determine if procurement activities sufficiently address supply chain risks
  • T1345: Recommend improvements to procurement activities to address cybersecurity requirements
  • T1354: Identify system cybersecurity requirements
  • T1355: Determine if vulnerability remediation plans are in place
  • T1356: Develop vulnerability remediation plans
  • T1357: Determine if cybersecurity requirements have been successfully implemented
  • T1358: Determine the effectiveness of organizational cybersecurity policies and procedures
  • T1368: Support cybersecurity compliance activities
  • T1369: Determine if acquisitions, procurement, and outsourcing efforts address cybersecurity requirements
  • T1373: Determine organizational compliance
  • T1374: Forecast ongoing service demands
  • T1375: Conduct periodic reviews of security assumptions
  • T1376: Develop critical infrastructure protection policies and procedures
  • T1377: Implement critical infrastructure protection policies and procedures
  • T1476: Promote awareness of cybersecurity policy and strategy among management
  • T1586: Conduct cybersecurity risk assessments
  • T1601: Advise stakeholders on enterprise cybersecurity risk management
  • T1602: Advise stakeholders on supply chain risk management