COS-01 Technical safeguards
Deploy risk-derived technical controls that promptly detect and respond to irregular inbound or outbound traffic patterns and distributed denial of service attacks, feeding their output into a SIEM so correlated events c
4
artefacts
3
held by a system
0
at each review
easy
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Risk analysis output that drove selection of the protective measures deployed · Policy repository / GRC workspace
- Denial of service mitigation configuration together with its activation thresholds · Cloud console / configuration management
- Correlation rule set plus one worked alert showing the response taken · SIEM / log platform
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Inventory of network protection sources currently feeding the security event platform · Policy repository / GRC workspace
First move
Automate the pull from your Policy repository / GRC workspace. Version-controlled policy set with approval metadata; review dates tracked as records, not a calendar note.
Common gaps auditors find
- Traffic anomaly sensors installed while their telemetry never reaches the event platform
- Mitigation thresholds left at vendor defaults with no reference to measured traffic baselines
- Detections raised outside office hours with nobody rostered to receive them
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCOM-04 Information on information security performance and management assessment of the ISMS · COS-02 Security requirements for connections in the Cloud Service Provider's network