# DNB Good Practice Information Security 2023

Framework id: `dnb_good_practice`. Financial Regulation. Publisher: De Nederlandsche Bank (DNB). Version: 2023. Region: Netherlands. Mapping licence: CC BY-SA 4.0.
Source text: https://www.dnb.nl/en/sector-information/open-book-supervision/open-book-supervision-themes/prudential-supervision/governance/qa-information-security/

Each line is a clause, the NIST SP 800-53 controls OSA maps to it, and OSA's estimate of how far those controls cover it.
Clause titles and coverage figures are OSA's own summaries and estimates. No line-by-line check against the source text is recorded for this framework, so quote the source, not this card.

## Clauses (58, average coverage 83%)
- DNB.1.1 Information security plan: PL-01, PL-02, PM-01, PM-09, PM-11, RA-01, SA-02 (82%)
- DNB.1.2 IT policies management: PL-01, AC-01, AT-01, AU-01, CA-01, CM-01, CP-01, IA-01, IR-01, MA-01, MP-01, PE-01, PS-01, RA-01, SA-01, SC-01, SI-01, SR-01 (88%)
- DNB.2.1 Enterprise Information architecture model: PL-08, PM-07, SA-08, SA-17 (68%)
- DNB.2.2 Data classification scheme: RA-02, AC-16, MP-04, SC-16 (85%)
- DNB.3.1 Monitor future trends and regulations: PM-15, PM-16, SI-05, RA-03 (55%)
- DNB.3.2 Technology standards: CM-02, CM-06, CM-07, SA-04, SA-08, PL-08 (75%)
- DNB.4.1 IT risk management framework: PM-09, PM-28, RA-01, RA-02, RA-03, PM-08, PM-11 (80%)
- DNB.4.2 Risk assessment: RA-03, RA-05, RA-07, RA-09, PM-09, PM-28 (85%)
- DNB.4.3 Maintenance and monitoring of a risk action plan: PM-04, PM-09, RA-07, CA-05, PM-03 (82%)
- DNB.5.1 Responsibility for risk, security and compliance: PM-02, PM-01, PM-29, PS-01, PS-07, PL-01 (78%)
- DNB.5.2 Management of information security: PM-01, PM-02, PM-03, PM-05, PM-06, PL-01, PM-14 (80%)
- DNB.6.1 Data and system ownership: PM-05, AC-16, RA-02, CM-08, PL-02 (72%)
- DNB.7.1 Segregation of duties: AC-05, AC-06, CM-05, PS-02 (90%)
- DNB.8.1 Personnel recruitment and retention: PS-02, PS-03, PS-01, PM-12 (68%)
- DNB.8.2 Personnel competences: AT-02, AT-03, PM-13, PM-14, PM-12 (75%)
- DNB.8.3 Dependence upon individuals: CP-02, PM-12, PM-13, PS-02 (52%)
- DNB.8.4 Personnel clearance procedures: PS-03, PS-06, PS-07, PS-01 (90%)
- DNB.8.5 Job change and termination: PS-04, PS-05, AC-02, PE-02 (92%)
- DNB.9.1 Knowledge transfer to end users: AT-02, AT-06, PL-04 (80%)
- DNB.9.2 Knowledge transfer to operations and support staff: AT-03, AT-04, PM-13, PM-14 (78%)
- DNB.9.3 Employee awareness: AT-02, AT-06, PM-12, PM-14 (88%)
- DNB.10.1 Change standards and procedures: CM-01, CM-03, CM-04, CM-05, SA-10 (90%)
- DNB.10.2 Impact assessment, prioritisation and authorisation: CM-04, CM-03, RA-03, RA-07 (88%)
- DNB.10.3 Test environment: CM-04, SA-11, SC-32, CM-02 (78%)
- DNB.10.4 Testing of changes: CM-04, SA-11, CA-02, SA-15 (88%)
- DNB.10.5 Promotion to production: CM-03, CM-05, CM-02, SA-10 (85%)
- DNB.11.1 IT continuity plans: CP-01, CP-02, CP-07, CP-08, CP-10, PM-08, PM-11 (88%)
- DNB.11.2 Testing of the IT continuity plan: CP-03, CP-04, IR-03, PM-14 (90%)
- DNB.11.3 Offsite backup storage: CP-06, CP-09, MP-04, PE-17 (90%)
- DNB.11.4 Backup and restoration: CP-09, CP-10, CP-02, SI-13 (92%)
- DNB.12.1 Storage and retention arrangements: SI-12, AU-11, MP-04, MP-02 (72%)
- DNB.12.2 Disposal: MP-06, MP-08, MP-01, SI-12 (90%)
- DNB.12.3 Security requirements for data management: AC-03, AC-04, AC-16, SC-08, SC-28, MP-04, SI-12 (82%)
- DNB.13.1 Configuration repository and baseline: CM-02, CM-06, CM-08, CM-01 (92%)
- DNB.13.2 Identification and maintenance of configuration items: CM-08, CM-03, CM-02, CM-07 (88%)
- DNB.14.1 Monitoring and reporting of SLAs: SA-09, SA-04, PM-06, CA-07 (62%)
- DNB.14.2 Supplier risk management: SR-01, SR-02, SR-03, SR-05, SR-06, SA-04, SA-09 (85%)
- DNB.15.1 Security incident definition: IR-01, IR-02, IR-08, SI-05 (85%)
- DNB.15.2 Incident escalation: IR-04, IR-05, IR-06, IR-01, PM-12 (82%)
- DNB.16.1 Security testing, surveillance and monitoring: CA-02, CA-07, CA-08, SI-04, AU-06, RA-05 (90%)
- DNB.16.2 Monitoring of internal control framework: CA-02, CA-05, CA-07, PM-06, PM-14 (78%)
- DNB.16.3 Internal control of third parties: SA-09, SR-06, SR-03, CA-02, PS-07 (82%)
- DNB.16.4 Evaluation of compliance with external requirements: CA-02, CA-06, PM-06, PM-01, PM-15 (65%)
- DNB.16.5 Independent assurance: CA-02, CA-06, CA-08, PM-14 (72%)
- DNB.17.1 Identity management: IA-01, IA-02, IA-04, IA-05, IA-08, IA-12 (90%)
- DNB.17.2 User account management: AC-02, AC-03, AC-05, AC-06, AC-07, IA-04, IA-05 (92%)
- DNB.18.1 Infrastructure resource protection and availability: SC-05, SC-07, CP-07, CP-08, AU-04, PE-09, PE-10, PE-11 (85%)
- DNB.18.2 Infrastructure maintenance: MA-01, MA-02, MA-03, MA-04, MA-05, MA-06 (92%)
- DNB.18.3 Cryptographic key management: SC-12, SC-13, SC-17, IA-07 (88%)
- DNB.18.4 Network security: SC-07, SC-08, AC-04, AC-17, SC-20, SC-21, SC-22, SC-23 (90%)
- DNB.18.5 Exchange of sensitive data: SC-08, SC-12, SC-13, AC-04, AC-21, SC-16 (85%)
- DNB.19.1 Malicious software prevention, detection and correction: SI-03, SI-04, SI-08, SC-44, SC-18 (92%)
- DNB.19.2 Vulnerability management: RA-05, SI-02, SI-05, RA-07, CM-06 (90%)
- DNB.19.3 Life cycle management: SA-22, SA-03, CM-08, PM-05, PL-02 (78%)
- DNB.20.1 Protection of security technology: SC-07, CM-06, CM-07, AC-03, AU-09, SC-42 (82%)
- DNB.21.1 Physical security measures: PE-01, PE-02, PE-03, PE-04, PE-05, PE-06, PE-08, PE-09 (90%)
- DNB.21.2 Physical access: PE-02, PE-03, PE-06, PE-07, PE-08 (90%)
- DNB.22.1 Penetration testing and ethical hacking: CA-08, CA-02, RA-05, SA-11 (85%)

## More
- A pattern's controls with their clauses in this framework: /api/v1/patterns/{id}/crosswalk?framework=dnb_good_practice
- Control-to-clause mappings as JSON: /api/v1/frameworks/dnb_good_practice?fields=mappings&per_page=100
- Rationale and gaps for each clause, as JSON: https://raw.githubusercontent.com/opensecurityarchitecture/osa-data/main/data/framework-coverage/dnb-good-practice.json
- Page for people: /frameworks/dnb-good-practice/