Intelligence
Platform
Northgate Union BankFictional bank · synthetic data
Powered by Mesh API
Search
Jump to a page or a control
Jump to a page or a control
Common control set on NIST CSF 2.0
28 controls, each mapped once to every framework it serves. 13 evidenced, 8 partial, 7 gaps.
| ID | Control | Status |
|---|---|---|
| GV-01 | Information security program is Board-approved Office of the CISO | EvidencedHigh |
| GV-02 | Every AI system is inventoried and observable Office of the CISO | GapCritical |
| GV-03 | Material outsourcing and cloud providers are assessed Vendor Risk | EvidencedMedium |
| ID-01 | Asset inventory matches the network IT Operations | PartialHigh |
| ID-02 | Vulnerabilities are fixed within the bank's standard Infrastructure Security | PartialHigh |
| ID-03 | External penetration test every year Office of the CISO | EvidencedHigh |
| ID-04 | Threat intelligence is received and shared Security Operations | PartialMedium |
| ID-05 | Cyber risk assessment is current IT Risk | EvidencedMedium |
| PR-01 | Privileged accounts are vaulted and attributable Identity and Access | GapCritical |
| PR-02 | Phishing-resistant MFA for privileged access Identity and Access | PartialCritical |
| PR-03 | AFASA customer authentication and fraud controls Digital Channels | PartialCritical |
| PR-04 | Access is recertified to least privilege Identity and Access | PartialHigh |
| PR-05 | Data at rest is encrypted Data Protection | EvidencedHigh |
| PR-06 | Cardholder and SWIFT zones are segmented Network Security | GapCritical |
| PR-07 | Security changes follow approved change records Infrastructure Security | GapHigh |
| PR-08 | Endpoint protection runs on every host Endpoint Security | PartialCritical |
| PR-09 | Prompts leaving the bank are inspected Data Protection | GapHigh |
| PR-10 | Staff and customers are trained to spot scams Security Awareness | EvidencedMedium |
| PR-11 | Data in transit is encrypted Network Security | EvidencedHigh |
| DE-01 | Security logs are kept for the required period Security Operations | GapHigh |
| DE-02 | A 24x7 SOC monitors the estate Security Operations | EvidencedHigh |
| DE-03 | AI-enabled defences are in use Security Operations | EvidencedMedium |
| DE-04 | Daily log review is performed and recorded Security Operations | PartialMedium |
| DE-05 | Fraud monitoring runs in real time on every channel Fraud Management | EvidencedCritical |
| RS-01 | Incidents reach BSP within 2 hours Security Operations | EvidencedCritical |
| RS-02 | Response is measured and partly automated Security Operations | EvidencedMedium |
| RC-01 | Backups are immutable and succeed Technology Resilience | EvidencedHigh |
| RC-02 | Restores are tested every year Technology Resilience | GapHigh |
28 of 28 controls. Status is set by a rule over the evidence: any contradicting item makes a gap, any partial or stale item makes it partial.