{"text_format":"1","workbook":"xlsx","n_sheets":15,"sheets":["Introduction","Guidelines","references","Profile and Scope","Targets","Weightings","Content","Assessment - Phase 1","Assessment - Phase 2","Assessment - Phase 3","Aggregated Results","Results - Phase 1","Results - Phase 2","Results - Phase 3","MMAT ref"],"not_rendered":{"charts":1,"images":9,"macros":1,"external_links":0,"defined_names":54,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Introduction","index":0,"n_rows":87,"n_cols":4,"rows_kept":87,"cut":false,"hidden":false,"merged":[[78,1,79,11],[82,1,82,11],[73,1,74,11],[1,3,4,15],[11,1,15,11],[17,1,20,11],[21,1,23,11],[28,1,31,11],[39,1,41,11],[33,1,35,11]]}
[]
[null,null,null,"Cyber Security Incident Response \nDetailed Maturity Assessment Tool"]
[]
[]
[]
[]
[]
[null,"Introduction"]
[]
[null,"Overview"]
[]
[null,"Many organisations are extremely concerned about potential and actual cyber security attacks, both on their own organisations and in ones similar to them. Dealing with cyber security incidents – particularly sophisticated cyber security attacks – can be a very difficult task, even for the most advanced organisations. Your organisation should therefore develop an appropriate cyber security incident response capability, which will enable you to adopt a systematic, structured approach to cyber security incident response."]
[]
[]
[]
[]
[]
[null,"Your cyber security incident response capability should consist of appropriately skilled people guided by well-designed, repeatable processes and effective use of relevant technologies that will enable you to conduct a thorough investigation and successfully eradicate adversaries who are deeply embedded in your environment."]
[]
[]
[]
[null,"However, many organisations do not know their state of readiness to be able to respond to a cyber security incident in a fast, effective manner. One of the best ways to help determine this is to measure the level of maturity of your cyber security incident response capability in terms of:"]
[]
[]
[]
[null,null,"• People, process, technology and information"]
[null,null,"• Preparedness, response and follow up activities"]
[]
[null,"This assessment tool provides a mechanism for carrying out an assessment of the level of maturity an organisation has for their cyber security incident response capability at a detailed level. It can be used to assess your state of readiness in being able to respond to a cyber security incident in a fast, effective and secure manner."]
[]
[]
[]
[]
[null,"Note: There is also a High-level Maturity Assessment Tool available, which allows an assessment to be made to determine the level of maturity of your cyber security incident response capability at a high level, based on a simple selection of the level of maturity for each of the 15 steps."]
[]
[]
[]
[null,"Cyber Security Incident response process"]
[]
[null,"This tool provides an assessment against a maturity model that is based on the 15 steps within the 3 phase Cyber Security Incident response process presented in the CREST Cyber Security Incident Response Guide, as shown in the diagram below."]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Instructions on how the tool works and how it can be used can be found on the Guidelines worksheet."]
[]
[null,"Acknowledgements"]
[]
[null,"CREST would like to extend its special thanks to those CREST member organisations and third parties who took part in interviews, participated in the workshop or completed questionnaires."]
[]
[]
[null,"Warning"]
[]
[null,"This Guide has been produced with care and to the best of our ability. However, CREST accepts no responsibility for any problems or incidents arising from its use."]
[]
[]
[null,"Credits"]
[]
[null,"This tool has been developed for CREST by "]
[]
[]
[null,"© CREST 2014"]

{"sheet":"Guidelines","index":1,"n_rows":80,"n_cols":4,"rows_kept":80,"cut":false,"hidden":false,"merged":[[59,1,61,11],[63,1,66,11],[68,1,70,11],[72,1,74,11],[79,1,80,11],[76,1,77,11],[54,1,57,11],[43,1,46,11],[50,1,52,11],[1,3,4,15],[39,1,42,11],[11,1,13,11],[15,1,17,11],[34,1,37,11]]}
[]
[null,null,null,"Cyber Security Incident Response \nDetailed Maturity Assessment Tool"]
[]
[]
[]
[]
[]
[null,"Guidelines"]
[]
[null,"Maturity model"]
[]
[null,"To deal with a cyber security incident quickly and effectively you will need to build an appropriate cyber security incident response capability, the maturity of which can be assessed against an appropriate maturity model by using this assessment tool."]
[]
[]
[]
[null,"The maturity model used in this tool is based on a traditional, proven model shown below. This model can be used to determine the level of maturity of an organisation cyber security incident response capability, ranging from 1 (least effective) to 5 (most effective)."]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Different types of organisation will require different levels of maturity in cyber security incident response. For example, a small company operating in the retail business will not have the same requirement – or ability – to respond to cyber security incidents in the same way as a major corporate organisation in the finance sector – or a government department. "]
[]
[]
[]
[]
[null,"Consequently, the level of maturity your organisation has in cyber security incident response should be reviewed in context and compared to your actual requirements for such a capability. The maturity of your organisation can then be compared with other similar organisation to help determine if the level of maturity is appropriate. "]
[]
[]
[]
[null,"Note: The maturity of the cyber security incident response capability can play a significant role in determining the level of third-party involvement required during a breach investigation and eradication event. Organisations with mature cyber security incident response capabilities may conduct most of their operations in-house, while those who are less mature may depend entirely on third parties."]
[]
[]
[]
[]
[null,"How to use the tool"]
[]
[null,"This tool enables a detailed assessment to be made about the level of maturity of your cyber security incident response capability, based on the response given to a series of detailed questions associated with each of the 15 steps. "]
[]
[]
[]
[null,"A weighting factor can be set to give the results to particular questions more importance than others. The answers to the questions are then used by the tool to generate the relevant levels of maturity for each of the steps, based on a carefully designed algorithm that takes account of both the level of response to each question and the question's given weighting."]
[]
[]
[]
[]
[null,"Step 1 - Complete the details for the environment being assessed in the Profile and Scope worksheet using the text boxes and drop-down lists provided. The name entered for Name of Area of Assessment will automatically appear on the four Results worksheets."]
[]
[]
[]
[null,"Step 2 - Select the target level of maturity required for the environment being assessed (Basic, Important or Critical) by clicking on the appropriate option button in the Targets worksheet. One of four target profiles can be chosen, and the associated maturity level for each step can be modified by editing the values in the right-hand table. The default profile is Basic."]
[]
[]
[]
[]
[null,"Note: You can assign greater importance to the results of particular questions by modifying their weighting factors using the drop-down lists on the Weightings worksheet. However, the default settings for each weighting factor have been carefully pre-assigned by CREST, so typically these would not need to be changed."]
[]
[]
[]
[null,"Step 3 - Carry out the assessment for each of the three phases by answering the questions in the corresponding Assessment worksheets. Details of any supporting evidence for your responses should be documented in the Evidence supplied column and any additional comments recorded in the Comments column. "]
[]
[]
[]
[null,"Step 4 - Review a summary of the results using the Aggregated Results worksheet to gain a high level picture of the overall level of maturity for the environment assessed."]
[]
[]
[null,"Step 5 - Investigate results at a detailed level by using the appropriate Results worksheet to understand the level of maturity for particular topics or questions."]

{"sheet":"references","index":2,"n_rows":49,"n_cols":23,"rows_kept":49,"cut":false,"hidden":true,"merged":[]}
["Not yet answered",null,1,2,3,4,5,6,7,8,9,null,"Not yet answered",null,null,22,null,null,"x 1",1,{"$f":"S1","v":"x 1"},"Level","Weighting"]
["Level 1 - Initial",null,"Not Yet answered","Level 1 - Initial","Level 2 - Established","Level 3 - Business Enabling","Level 4 - Quantitatively Managed","Level 5 - Optimised","Don't know","Not applicable","Question not selected",null,"Level 1 - Initial",null,null,null,null,null,"x 2",2,{"$f":"S2","v":"x 2"},"Level 1",1]
["Level 2 - Established",null,"Null",1,2,3,4,5,1,"Null","Null",null,"Level 2 - Established",null,null,null,null,null,"x 3",3,"x 3","Level 2",2]
["Level 3 - Business Enabling",null,null,null,null,null,null,null,null,null,null,null,"Level 3 - Business Enabling",null,null,null,null,null,"x 4",4,"x 4","Level 3",3]
["Level 4 - Quantitatively Managed",null,null,null,null,null,null,null,null,null,null,null,"Level 4 - Quantitatively Managed",null,null,null,null,null,"x 5",5,"x 5","Level 4",4]
["Level 5 - Optimised",null,null,null,null,null,null,null,null,null,null,null,"Level 5 - Optimised",null,null,null,null,null,null,null,null,"Level 5",5]
["Don't know"]
["Not applicable"]
["Question not selected",null,null,null,null,null,null,null,null,null,null,null,"No"]
[null,null,null,null,null,null,null,null,null,null,null,null,"Yes"]
["Level 1 - Initial",null,null,null,null,"Level 1 -\nInitial"]
["Level 2 - Established",null,null,null,null,"Level 2 -\nEstablished",null,null,null,null,null,1,"Not yet answered",{"$f":"\"\"","v":""}]
["Level 3 - Business Enabling",null,null,null,null,"Level 3 -\nBusiness Enabling",null,null,null,null,null,2,"No",0]
["Level 4 - Quantitatively Managed",null,null,null,null,"Level 4 -\nQuantitatively Managed",null,null,null,null,null,3,"Partly",1]
["Level 5 - Optimised",null,null,null,null,"Level 5 -\nOptimised",null,null,null,null,null,4,"Mostly",2]
[null,null,null,null,null,null,null,null,null,null,null,5,"Fully",3]
["x 1",null,1,2,3,4,5,null,null,null,null,6,"Don't know",0]
["x 2",null,"x 1","x 2","x 3","x 4","x 5",null,null,null,null,7,"Not selected",{"$f":"\"\"","v":""}]
["x 3",null,1,2,3,4,5]
[]
[]
[]
["Systems"]
["Web presence",null,null,null,null,"Merchant banking",null,null,null,null,"Whole organisation"]
["Mobile devices",null,null,null,null,"Retail banking",null,null,null,null,"Region"]
["Third-party applications",null,null,null,null,"Investment banking",null,null,null,null,"Business unit"]
["Outsourced systems",null,null,null,null,"Card services",null,null,null,null,"Web application"]
["Other",null,null,null,null,"Other banking services",null,null,null,null,"Infrastructure"]
[null,null,null,null,null,"Other financial services"]
[null,null,null,null,null,"Agriculture, Forestry, Fishing and Hunting"]
[null,null,null,null,null,"Mining, Quarrying, and Oil and Gas Extraction"]
[null,null,null,null,null,"Utilities"]
[null,null,null,null,null,"Construction"]
[null,null,null,null,null,"Manufacturing"]
[null,null,null,null,null,"Wholesale Trade"]
[null,null,null,null,null,"Retail Trade"]
[null,null,null,null,null,"Transportation and Warehousing"]
[null,null,null,null,null,"Information"]
[null,null,null,null,null,"Insurance"]
[null,null,null,null,null,"Real Estate and Rental and Leasing"]
[null,null,null,null,null,"Professional, Scientific, and Technical Services"]
[null,null,null,null,null,"Management of Companies and Enterprises"]
[null,null,null,null,null,"Administrative and Support and Waste Management and Remediation Services"]
[null,null,null,null,null,"Educational Services"]
[null,null,null,null,null,"Health Care and Social Assistance"]
[null,null,null,null,null,"Arts, Entertainment, and Recreation"]
[null,null,null,null,null,"Accommodation and Food Services"]
[null,null,null,null,null,"Other Services (except Public Administration)"]
[null,null,null,null,null,"Public Administration"]

{"sheet":"Profile and Scope","index":3,"n_rows":45,"n_cols":10,"rows_kept":45,"cut":false,"hidden":false,"merged":[[0,4,0,6],[41,5,41,6],[44,5,44,6],[35,5,35,6],[4,5,4,6],[7,5,7,6],[10,5,10,6],[26,5,26,6],[29,5,29,6],[32,5,32,6],[19,5,19,6]]}
[null,null,null,null,"Cyber Security Incident Response \nDetailed Maturity Assessment Tool"]
[]
[null,null,null,null,"Scope of assessment     All fields marked * MUST be completed"]
[]
[null,null,null,null,"Name of area of assessment *"]
[]
[]
[null,null,null,null,"Business unit (or equivalent) *"]
[]
[]
[null,null,null,null,"Organisation *"]
[]
[]
[null,null,null,null,"Sector *"]
[]
[]
[null,null,null,null,"Scope of assessment *"]
[]
[]
[null,null,null,null,"Key components",null,null,null,null,1]
[]
[null,null,null,null,"Respondent details"]
[]
[null,null,null,null,"Date of assessment *"]
[]
[]
[null,null,null,null,"Name of respondent *"]
[]
[]
[null,null,null,null,"Role or position *"]
[]
[]
[null,null,null,null,"Department *"]
[]
[]
[null,null,null,null,"Organisation *"]
[]
[]
[null,null,null,null,"Type of assessment *"]
[]
[]
[null,null,null,null,"Qualifications of assessor - CREST *"]
[]
[]
[null,null,null,null,"Qualifications of assessor - other *"]

{"sheet":"Targets","index":4,"n_rows":21,"n_cols":17,"rows_kept":21,"cut":false,"hidden":false,"merged":[[1,4,1,5],[0,3,0,14]]}
[null,null,null,"Target level configuration"]
[null,null,"Cyber Security Incident Response","Cyber Security Incident Response","Target maturity (1 to 5)"]
[null,"CSIR",{"$f":"VLOOKUP(B3,'MMAT ref'!A:E,2,FALSE)","v":{"$error":"#N/A"}},{"$f":"B3&\" - \"&C3","v":{"$error":"#N/A"}},{"$f":"F3","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(B3,'MMAT ref'!A:F,6,FALSE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'MMAT ref'!AE1","v":1},{"$f":"VLOOKUP(B4,'MMAT ref'!AE:AG,3,FALSE)","v":"Prepare"},{"$f":"VLOOKUP(B4,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C4","v":"Phase 1 - Prepare"},null,null,null,null,null,null,null,true,null,"Basic","Important","Critical","Custom"]
[null,{"$f":"'MMAT ref'!AE2","v":"1.1"},{"$f":"VLOOKUP(B5,'MMAT ref'!AE:AG,3,FALSE)","v":"Criticality assessment"},{"$f":"VLOOKUP(B5,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C5","v":"Step 1 - Criticality assessment"},{"$f":"F5","v":2},2,null,null,null,null,null,false,null,2,3,4,1]
[null,{"$f":"'MMAT ref'!AE3","v":"1.2"},{"$f":"VLOOKUP(B6,'MMAT ref'!AE:AG,3,FALSE)","v":"Threat analysis"},{"$f":"VLOOKUP(B6,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C6","v":"Step 2 - Threat analysis"},{"$f":"F6","v":2},2,null,null,null,null,null,false,null,2,3,4,1]
[null,{"$f":"'MMAT ref'!AE4","v":"1.3"},{"$f":"VLOOKUP(B7,'MMAT ref'!AE:AG,3,FALSE)","v":"People, Process, Technology and Information"},{"$f":"VLOOKUP(B7,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C7","v":"Step 3 - People, Process, Technology and Information"},{"$f":"F7","v":2},2,null,null,null,null,null,false,null,2,3,4,1]
[null,{"$f":"'MMAT ref'!AE5","v":"1.4"},{"$f":"VLOOKUP(B8,'MMAT ref'!AE:AG,3,FALSE)","v":"Control environment"},{"$f":"VLOOKUP(B8,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C8","v":"Step 4 - Control environment"},2,2,null,null,null,null,null,null,null,2,3,4,1]
[null,{"$f":"'MMAT ref'!AE6","v":"1.5"},{"$f":"VLOOKUP(B9,'MMAT ref'!AE:AG,3,FALSE)","v":"Maturity assessment"},{"$f":"VLOOKUP(B9,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C9","v":"Step 5 - Maturity assessment"},2,2,null,null,null,null,null,null,null,2,3,4,1]
[null,{"$f":"'MMAT ref'!AE7","v":2},{"$f":"VLOOKUP(B10,'MMAT ref'!AE:AG,3,FALSE)","v":"Respond"},{"$f":"VLOOKUP(B10,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C10","v":"Phase 2 - Respond"}]
[null,{"$f":"'MMAT ref'!AE8","v":"2.1"},{"$f":"VLOOKUP(B11,'MMAT ref'!AE:AG,3,FALSE)","v":"Identification"},{"$f":"VLOOKUP(B11,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C11","v":"Step 1 - Identification"},2,2,null,null,null,null,null,null,null,2,3,4,1]
[null,{"$f":"'MMAT ref'!AE9","v":"2.2"},{"$f":"VLOOKUP(B12,'MMAT ref'!AE:AG,3,FALSE)","v":"Investigation"},{"$f":"VLOOKUP(B12,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C12","v":"Step 2 - Investigation"},2,2,null,null,null,null,null,null,null,2,3,4,1]
[null,{"$f":"'MMAT ref'!AE10","v":"2.3"},{"$f":"VLOOKUP(B13,'MMAT ref'!AE:AG,3,FALSE)","v":"Action"},{"$f":"VLOOKUP(B13,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C13","v":"Step 3 - Action"},2,2,null,null,null,null,null,null,null,2,3,4,1]
[null,{"$f":"'MMAT ref'!AE11","v":"2.4"},{"$f":"VLOOKUP(B14,'MMAT ref'!AE:AG,3,FALSE)","v":"Recovery"},{"$f":"VLOOKUP(B14,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C14","v":"Step 4 - Recovery"},2,2,null,null,null,null,null,null,null,2,3,4,1]
[null,{"$f":"'MMAT ref'!AE12","v":3},{"$f":"VLOOKUP(B15,'MMAT ref'!AE:AG,3,FALSE)","v":"Follow up"},{"$f":"VLOOKUP(B15,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C15","v":"Phase 3 - Follow up"}]
[null,{"$f":"'MMAT ref'!AE13","v":"3.1"},{"$f":"VLOOKUP(B16,'MMAT ref'!AE:AG,3,FALSE)","v":"Incident investigation"},{"$f":"VLOOKUP(B16,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C16","v":"Step 1 - Incident investigation"},2,2,null,null,null,null,null,null,null,2,3,4,1]
[null,{"$f":"'MMAT ref'!AE14","v":"3.2"},{"$f":"VLOOKUP(B17,'MMAT ref'!AE:AG,3,FALSE)","v":"Reporting"},{"$f":"VLOOKUP(B17,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C17","v":"Step 2 - Reporting"},2,2,null,null,null,null,null,null,null,2,3,4,1]
[null,{"$f":"'MMAT ref'!AE15","v":"3.3"},{"$f":"VLOOKUP(B18,'MMAT ref'!AE:AG,3,FALSE)","v":"Post incident review"},{"$f":"VLOOKUP(B18,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C18","v":"Step 3 - Post incident review"},2,2,null,null,null,null,null,null,null,2,3,4,1]
[null,{"$f":"'MMAT ref'!AE16","v":"3.4"},{"$f":"VLOOKUP(B19,'MMAT ref'!AE:AG,3,FALSE)","v":"Lessons learned"},{"$f":"VLOOKUP(B19,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C19","v":"Step 4 - Lessons learned"},2,2,null,null,null,null,null,null,null,2,3,4,1]
[null,{"$f":"'MMAT ref'!AE17","v":"3.5"},{"$f":"VLOOKUP(B20,'MMAT ref'!AE:AG,3,FALSE)","v":"Updating"},{"$f":"VLOOKUP(B20,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C20","v":"Step 5 - Updating"},2,2,null,null,null,null,null,null,null,2,3,4,1]
[null,{"$f":"'MMAT ref'!AE18","v":"3.6"},{"$f":"VLOOKUP(B21,'MMAT ref'!AE:AG,3,FALSE)","v":"Trend analysis"},{"$f":"VLOOKUP(B21,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C21","v":"Step 6 - Trend analysis"},2,2,null,null,null,null,null,null,null,2,3,4,1]

{"sheet":"Weightings","index":5,"n_rows":652,"n_cols":25,"rows_kept":652,"cut":false,"hidden":false,"merged":[[1,5,4,5]]}
[]
[null,null,null,null,null,"Weighting configuration"]
[null,null,null,null,null,null,null,null,"Level 1 (%)","Level 2 (%)","Level 3 (%)","Level 4 (%)","Level 5 (%)"]
[null,null,null,null,null,null,null,null,"0-8","9-30","31-70","71-92","93-100",null,null,null,null,null,{"$f":"VALUE(TRIM(LEFT(I4,FIND(\"-\",I4)-1)))","v":0},{"$f":"VALUE(TRIM(LEFT(J4,FIND(\"-\",J4)-1)))","v":9},31,71,93]
[null,null,null,null,null,null,null,null,"Level 1","Level 2","Level 3","Level 4","Level 5",null,null,null,null,null,"Level 1","Level 2","Level 3","Level 4","Level 5"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,2,3,4,5]
["Order","FullQ","Type",null,null,null,"Weighting"]
[1,{"$f":"VLOOKUP(A8,contentref,2,FALSE)","v":1},{"$f":"VLOOKUP(A8,contentref,15,FALSE)","v":1},null,{"$f":"IF(C8=1,\"Phase \"&B8,IF(C8=2,\"Step \"&VLOOKUP(A8,contentref,4,FALSE),B8))","v":"Phase 1"},{"$f":"VLOOKUP(A8,contentref,7,FALSE)","v":"Prepare"},null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"E8","v":"Phase 1"},null,null,"",{"$f":"VLOOKUP(A8,contentref,8,FALSE)","v":""},{"$f":"VLOOKUP(W8,weighting_response_reverse,2,FALSE)","v":{"$error":"#N/A"}}]
[2,"1.1",2,null,"Step 1","Criticality assessment",null,null,null,null,null,null,null,null,null,null,null,null,null,"Step 1",null,null,"","",{"$error":"#N/A"}]
[3,"1.1.01",5,null,"1.1.01","Have you defined your critical information assets?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.01",null,null,1,1,"x 1"]
[4,"1.1.02",4,null,"1.1.02","Does your defined set of critical information assets include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.02",null,null,"N/A","N/A",{"$error":"#N/A"}]
[5,"1.1.02a",6,null,"1.1.02a","Important business applications?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.02a",null,null,3,3,"x 3"]
[6,"1.1.02b",6,null,"1.1.02b","Key systems and networks (infrastructure)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.02b",null,null,3,3,"x 3"]
[7,"1.1.02c",6,null,"1.1.02c","Confidential data?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.02c",null,null,3,3,"x 3"]
[8,"1.1.03",4,null,"1.1.03","Is the criticality of these assets:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.03",null,null,"N/A","N/A",{"$error":"#N/A"}]
[9,"1.1.03a",6,null,"1.1.03a","Defined in a structured, systematic manner?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.03a",null,null,3,3,"x 3"]
[10,"1.1.03b",6,null,"1.1.03b","Based on an analysis of their strategic or monetary value?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.03b",null,null,3,3,"x 3"]
[11,"1.1.04",4,null,"1.1.04","Have you identified:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.04",null,null,"N/A","N/A",{"$error":"#N/A"}]
[12,"1.1.04a",6,null,"1.1.04a","Where your critical systems are physically located in your organisation and in third party organisations?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.04a",null,null,4,4,"x 4"]
[13,"1.1.04b",6,null,"1.1.04b","On which systems your confidential information is stored or processed (eg on servers, devices and in the cloud)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.04b",null,null,4,4,"x 4"]
[14,"1.1.05",5,null,"1.1.05","Have you assigned responsibility for protecting your critical assets to capable, named individuals?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.05",null,null,5,5,"x 5"]
[15,"1.1.06",5,null,"1.1.06","Do you conduct business impact assessments of your critical assets (either individually or in aggregate) to determine the likely (or actual) level of business impact caused if your organisation was hit by a cyber security incident?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.06",null,null,3,3,"x 3"]
[16,"1.1.07",4,null,"1.1.07","Do your business impact assessments determine the level of business impact if:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.07",null,null,"N/A","N/A",{"$error":"#N/A"}]
[17,"1.1.07a",6,null,"1.1.07a","Sensitive or other confidential information was disclosed to unauthorised parties?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.07a",null,null,3,3,"x 3"]
[18,"1.1.07b",6,null,"1.1.07b","Important information was compromised (eg key data is inaccurate or wrongly processed)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.07b",null,null,3,3,"x 3"]
[19,"1.1.07c",6,null,"1.1.07c","Critical systems or infrastructure were no longer available?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.07c",null,null,3,3,"x 3"]
[20,"1.1.08",4,null,"1.1.08","Do your business impact assessments cover all relevant types of business consequences that could affect your organisation, including:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.08",null,null,"N/A","N/A",{"$error":"#N/A"}]
[21,"1.1.08a",6,null,"1.1.08a","Potential or actual financial loss?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.08a",null,null,4,4,"x 4"]
[22,"1.1.08b",6,null,"1.1.08b","Compliance implications (eg fines, business restrictions or other penalties)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.08b",null,null,4,4,"x 4"]
[23,"1.1.08c",6,null,"1.1.08c","Damage to reputation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.08c",null,null,4,4,"x 4"]
[24,"1.1.08d",6,null,"1.1.08d","Loss of management control?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.08d",null,null,4,4,"x 4"]
[25,"1.1.08e",6,null,"1.1.08e","Impaired growth?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.1.08e",null,null,4,4,"x 4"]
[26,"1.2",2,null,"Step 2","Threat analysis",null,null,null,null,null,null,null,null,null,null,null,null,null,"Step 2",null,null,"","",{"$error":"#N/A"}]
[27,"1.2.01",5,null,"1.2.01","Do you analyse cyber security threats and associated vulnerabilities?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.01",null,null,1,1,"x 1"]
[28,"1.2.02",4,null,"1.2.02","Is your cyber security threat analysis:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.02",null,null,"N/A","N/A",{"$error":"#N/A"}]
[29,"1.2.02a",6,null,"1.2.02a","Carried out in a structured, systematic manner?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.02a",null,null,3,3,"x 3"]
[30,"1.2.02b",6,null,"1.2.02b","Conducted on a regular basis?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.02b",null,null,2,2,"x 2"]
[31,"1.2.02c",6,null,"1.2.02c","Linked to a knowledge base of known attack types and attack agents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.02c",null,null,4,4,"x 4"]
[32,"1.2.03",5,null,"1.2.03","Does your cyber security threat analysis give you a good understanding of the level of threat to your organisation from different types of cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.03",null,null,4,4,"x 4"]
[33,"1.2.04",4,null,"1.2.04","Does your threat analysis focus on:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.04",null,null,"N/A","N/A",{"$error":"#N/A"}]
[34,"1.2.04a",6,null,"1.2.04a","The cyber security landscape relevant to your organisation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.04a",null,null,4,4,"x 4"]
[35,"1.2.04b",6,null,"1.2.04b","Relevant sources of threats (eg organised crime syndicates, state-sponsored organisations, extremist groups, hacktivists, insiders – or a combination of these)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.04b",null,null,4,4,"x 4"]
[36,"1.2.04c",6,null,"1.2.04c","Which cyber security threats are most likely to affect your critical information assets?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.04c",null,null,4,4,"x 4"]
[37,"1.2.04d",6,null,"1.2.04d","Vulnerabilities to each particular cyber security threat (eg control weaknesses or special circumstances)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.04d",null,null,3,3,"x 3"]
[38,"1.2.04e",6,null,"1.2.04e","Possible threat vectors for attacks to exploit (eg Internet downloads, unauthorised USB sticks, misconfigured systems, inappropriate access, or collusion)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.04e",null,null,4,4,"x 4"]
[39,"1.2.04f",6,null,"1.2.04f","The technical infrastructure that supports your critical assets?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.04f",null,null,3,3,"x 3"]
[40,"1.2.05",4,null,"1.2.05","Does your cyber security threat analysis address all stages of a cyber security attack, including:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.05",null,null,"N/A","N/A",{"$error":"#N/A"}]
[41,"1.2.05a",6,null,"1.2.05a","Reconnaissance (gaining information about a target individual or organisation for use in a future cyber-attack)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.05a",null,null,5,5,"x 5"]
[42,"1.2.05b",6,null,"1.2.05b","Disruption (eg to a business, system or service)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.05b",null,null,2,2,"x 2"]
[43,"1.2.05c",6,null,"1.2.05c","Extraction (eg obtaining money, sensitive information or user credentials from the target)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.05c",null,null,3,3,"x 3"]
[44,"1.2.05d",6,null,"1.2.05d","Manipulation (eg adding, changing or deleting key information)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.05d",null,null,3,3,"x 3"]
[45,"1.2.06",4,null,"1.2.06","Does your cyber security threat analysis cover:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.06",null,null,"N/A","N/A",{"$error":"#N/A"}]
[46,"1.2.06a",6,null,"1.2.06a","The ‘attacker kill chain’ (ie reconnaissance, weaponize, deliver, exploit, install, command & control and act on objectives)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.06a",null,null,5,5,"x 5"]
[47,"1.2.06b",6,null,"1.2.06b","Both the attacker and defender aspects of an attack?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.06b",null,null,5,5,"x 5"]
[48,"1.2.07",4,null,"1.2.07","Do you put your cyber security threat analysis into context, based on a solid understanding of:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.07",null,null,"N/A","N/A",{"$error":"#N/A"}]
[49,"1.2.07a",6,null,"1.2.07a","The nature of your business, business strategy, business processes and risk appetite?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.07a",null,null,5,5,"x 5"]
[50,"1.2.07b",6,null,"1.2.07b","Key dependencies your organisation has; for example on people, technology, suppliers, partners and the environment in which you operate?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.07b",null,null,5,5,"x 5"]
[51,"1.2.07c",6,null,"1.2.07c","The assets which are most likely to be targeted, such as infrastructure, money, intellectual property or people – and the computer systems that support them?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.07c",null,null,5,5,"x 5"]
[52,"1.2.08",5,null,"1.2.08","Does your threat analysis include information from cyber security threat intelligence sources?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.08",null,null,4,4,"x 4"]
[53,"1.2.09",4,null,"1.2.09","Do your cyber security threat intelligence sources include information:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.09",null,null,"N/A","N/A",{"$error":"#N/A"}]
[54,"1.2.09a",6,null,"1.2.09a","You have specially compiled in your own organisation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.09a",null,null,4,4,"x 4"]
[55,"1.2.09b",6,null,"1.2.09b","Obtained from the government, collaborative groups, competitors or CERTs and vendors)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.09b",null,null,4,4,"x 4"]
[56,"1.2.09c",6,null,"1.2.09c","Purchased from reputable vendors?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.09c",null,null,5,5,"x 5"]
[57,"1.2.10",5,null,"1.2.10","Does your threat analysis include actionable cyber security threat intelligence, enabling positive changes to be made immediately?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.10",null,null,5,5,"x 5"]
[58,"1.2.11",5,null,"1.2.11","Do you perform realistic simulations of possible cyber security incidents (eg by carrying out scenario testing)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.11",null,null,4,4,"x 4"]
[59,"1.2.12",4,null,"1.2.12","Do you make scenario testing more effective by ensuring it includes:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.12",null,null,"N/A","N/A",{"$error":"#N/A"}]
[60,"1.2.12a",6,null,"1.2.12a","Simulating a real attack as closely as possible?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.12a",null,null,5,5,"x 5"]
[61,"1.2.12b",6,null,"1.2.12b","Evaluating situational awareness and applicability to your organisation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.12b",null,null,5,5,"x 5"]
[62,"1.2.12c",6,null,"1.2.12c","Initiating a fictional (but realistic) attack internally and assessing how well you can respond to it?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.12c",null,null,5,5,"x 5"]
[63,"1.2.13",4,null,"1.2.13","Do you carry out cyber security scenarios:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.13",null,null,"N/A","N/A",{"$error":"#N/A"}]
[64,"1.2.13a",6,null,"1.2.13a","That result in different outcomes such as unavailability, data theft and data/systems corruption?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.13a",null,null,5,5,"x 5"]
[65,{"$f":"VLOOKUP(A72,contentref,2,FALSE)","v":"1.2.13b"},{"$f":"VLOOKUP(A72,contentref,15,FALSE)","v":6},null,{"$f":"IF(C72=1,\"Phase \"&B72,IF(C72=2,\"Step \"&VLOOKUP(A72,contentref,4,FALSE),B72))","v":"1.2.13b"},{"$f":"VLOOKUP(A72,contentref,7,FALSE)","v":"Where your systems and/or data have suffered integrity loss?"},null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"E72","v":"1.2.13b"},null,null,5,{"$f":"VLOOKUP(A72,contentref,8,FALSE)","v":5},{"$f":"VLOOKUP(W72,weighting_response_reverse,2,FALSE)","v":"x 5"}]
[66,"1.2.14",5,null,"1.2.14","Do you carry out periodic scenario-based training, helping to ensure that relevant individuals understand their role and prepare them to handle cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.14",null,null,4,4,"x 4"]
[67,"1.2.15",5,null,"1.2.15","Does this scenario-based training work through a series of attack scenarios fine-tuned to the threats and vulnerabilities your organisation face?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.15",null,null,5,5,"x 5"]
[68,"1.2.16",5,null,"1.2.16","Do you evaluate newly emerging methods of conducting more advanced cyber security threat analysis to help improve the effectiveness of your cyber security threat analysis?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.2.16",null,null,5,5,"x 5"]
[69,"1.3",2,null,"Step 3","People, Process, Technology and Information",null,null,null,null,null,null,null,null,null,null,null,null,null,"Step 3",null,null,"","",{"$error":"#N/A"}]
[70,"",3,null,"","People",null,null,null,null,null,null,null,null,null,null,null,null,null,"",null,null,"","",{"$error":"#N/A"}]
[71,"1.3.01",5,null,"1.3.01","Do you have a point of contact for handling cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.01",null,null,1,1,"x 1"]
[72,"1.3.02",4,null,"1.3.02","Have all employees been:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.02",null,null,"N/A","N/A",{"$error":"#N/A"}]
[73,"1.3.02a",6,null,"1.3.02a","Made aware of the risk from cyber security attacks",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.02a",null,null,2,2,"x 2"]
[74,"1.3.02b",6,null,"1.3.02b","Briefed on how to report actual and suspected cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.02b",null,null,1,1,"x 1"]
[75,"1.3.02c",6,null,"1.3.02c","Shown how to help reduce the likelihood and frequency of these attacks?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.02c",null,null,2,2,"x 2"]
[76,"1.3.03",5,null,"1.3.03","Do you have a cyber security incident response team?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.03",null,null,2,2,"x 2"]
[77,"1.3.04",4,null,"1.3.04","Does your cyber security incident response team understand the:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.04",null,null,"N/A","N/A",{"$error":"#N/A"}]
[78,"1.3.04a",6,null,"1.3.04a","Key concepts of cyber security incident response (eg drivers, definitions, approaches)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.04a",null,null,2,2,"x 2"]
[79,"1.3.04b",6,null,"1.3.04b","Requirements for reporting certain types of cyber security incident?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.04b",null,null,2,2,"x 2"]
[80,"1.3.05",4,null,"1.3.05","Is your cyber security incident response team:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.05",null,null,"N/A","N/A",{"$error":"#N/A"}]
[81,"1.3.05a",6,null,"1.3.05a","Supported by key stakeholders, such as senior management, the PR department, HR, Legal, IT and business unit management",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.05a",null,null,2,2,"x 2"]
[82,"1.3.05b",6,null,"1.3.05b","Given the authority to confiscate or disconnect equipment and monitor suspicious activity",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.05b",null,null,3,3,"x 3"]
[83,"1.3.05c",6,null,"1.3.05c","Able to undertake external communications and information sharing (eg what can be shared with whom, when, and over what channels)",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.05c",null,null,3,3,"x 3"]
[84,"1.3.05d",6,null,"1.3.05d","Clear about escalation points in the cyber security incident management process",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.05d",null,null,2,2,"x 2"]
[85,"1.3.06",4,null,"1.3.06","Is your cyber security incident response team empowered – without fear of blame or recrimination - to:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.06",null,null,"N/A","N/A",{"$error":"#N/A"}]
[86,"1.3.06a",6,null,"1.3.06a","Escalate the problem to management in a timely manner?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.06a",null,null,3,3,"x 3"]
[87,"1.3.06b",6,null,"1.3.06b","Explain the possible consequences of the cyber security incident – and its potential impact on the business?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.06b",null,null,3,3,"x 3"]
[88,"1.3.06c",6,null,"1.3.06c","Get relevant outsiders involved?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.06c",null,null,3,3,"x 3"]
[89,"1.3.07",4,null,"1.3.07","Does your cyber security incident response team have access to individuals (internal and external) who have a deep understanding about:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.07",null,null,"N/A","N/A",{"$error":"#N/A"}]
[90,"1.3.07a",6,null,"1.3.07a","How to carry out sophisticated cyber security incident investigations quickly and effectively",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.07a",null,null,4,4,"x 4"]
[91,"1.3.07b",6,null,"1.3.07b","The different types of cyber security attacker (and how they operate)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.07b",null,null,3,3,"x 3"]
[92,"1.3.07c",6,null,"1.3.07c","Advanced persistent threats?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.07c",null,null,4,4,"x 4"]
[93,"1.3.07d",6,null,"1.3.07d","Methods of compromising systems?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.07d",null,null,3,3,"x 3"]
[94,"1.3.07e",6,null,"1.3.07e","Sophisticated analysis of malware?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.07e",null,null,5,5,"x 5"]
[95,"1.3.07f",6,null,"1.3.07f","Forensics?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.07f",null,null,5,5,"x 5"]
[96,"1.3.08",5,null,"1.3.08","Does your cyber security incident team have a cyber security incident response toolkit to help investigations?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.08",null,null,4,4,"x 4"]
[97,"1.3.09",4,null,"1.3.09","Does your cyber security incident response toolkit include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.09",null,null,"N/A","N/A",{"$error":"#N/A"}]
[98,"1.3.09a",6,null,"1.3.09a","A suitable method for recording all aspects of the incident, ideally using a template to ensure a consistent, comprehensive approach?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.09a",null,null,4,4,"x 4"]
[99,"1.3.09b",6,null,"1.3.09b","Contact details of all key stakeholders, such as internal and external investigators, technical specialist, suppliers, legal resources, human resources, public relations and business management?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.09b",null,null,3,3,"x 3"]
[100,"1.3.09c",6,null,"1.3.09c","Incident analysis resources: such as port lists; packet sniffers and protocol analysers; documentation for security systems (eg IDS, SIEM, malware protection); network diagrams; and a list of critical assets.",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.09c",null,null,5,5,"x 5"]
[101,"1.3.09d",6,null,"1.3.09d","Forensic imaging tools (eg an imaging laptop; encrypted disks for image storage; mobile phone; digital camera / recorder; portable printer; removable media with trusted versions of programs; and evidence gathering accessories)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.09d",null,null,5,5,"x 5"]
[102,"1.3.09e",6,null,"1.3.09e","Physical tools (eg screwdrivers, Allen keys, wire cutters, evidence bags, gloves and torch)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.09e",null,null,4,4,"x 4"]
[103,"",3,null,"","Process",null,null,null,null,null,null,null,null,null,null,null,null,null,"",null,null,"","",{"$error":"#N/A"}]
[104,"1.3.10",4,null,"1.3.10","Do you have:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.10",null,null,"N/A","N/A",{"$error":"#N/A"}]
[105,"1.3.10a",6,null,"1.3.10a","Policies, processes, plans or methodologies to help you respond to cyber security incidents effectively?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.10a",null,null,1,1,"x 1"]
[106,"1.3.10b",6,null,"1.3.10b","A formal cyber security incident response process?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.10b",null,null,1,1,"x 1"]
[107,"1.3.10c",6,null,"1.3.10c","A strategic approach for handling cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.10c",null,null,3,3,"x 3"]
[108,"1.3.11",4,null,"1.3.11","Does your cyber security incident response strategy include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.11",null,null,"N/A","N/A",{"$error":"#N/A"}]
[109,"1.3.11a",6,null,"1.3.11a","Identifying the key components of an effective cyber security incident response process?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.11a",null,null,4,4,"x 4"]
[110,"1.3.11b",6,null,"1.3.11b","Aligning cyber security incident response with business continuity plans and arrangements?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.11b",null,null,5,5,"x 5"]
[111,"1.3.11c",6,null,"1.3.11c","Addressing arrangements corporate-wide (including third parties, where needed)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.11c",null,null,5,5,"x 5"]
[112,"1.3.11d",6,null,"1.3.11d","Providing sufficient funding and resources to deal with cyber security incidents effectively?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.11d",null,null,5,5,"x 5"]
[113,"1.3.11e",6,null,"1.3.11e","Appointing individuals in advance who have sufficient decision-making authority to take action fast in an emergency situation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.11e",null,null,4,4,"x 4"]
[114,"1.3.11f",6,null,"1.3.11f","Determining what activities should be outsourced to an external cyber security incident response specialist",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.11f",null,null,4,4,"x 4"]
[115,"1.3.11g",6,null,"1.3.11g","Developing criteria upon which to base selection of the right cyber security incident response providers, ensuring value for money?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.11g",null,null,4,4,"x 4"]
[116,"1.3.11h",6,null,"1.3.11h","Evaluating the benefits offered by appropriately certified cyber security incident response providers?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.11h",null,null,4,4,"x 4"]
[117,"1.3.12",4,null,"1.3.12","Does your cyber security incident response process take account of:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.12",null,null,"N/A","N/A",{"$error":"#N/A"}]
[118,"1.3.12a",6,null,"1.3.12a","Definitions required to support the Triage element of the cyber security incident process (eg to define what criteria re required to classify and prioritise incidents)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.12a",null,null,4,4,"x 4"]
[119,"1.3.12b",6,null,"1.3.12b","Advice and guidance provided on government websites, such as the CESG Top ten steps to cyber security and GovCertUK incident response guidelines?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.12b",null,null,3,3,"x 3"]
[120,"1.3.12c",6,null,"1.3.12c","Publicly available traditional or cyber security specific incident response guides, such as the NIST Computer Security Handling Guide (Special Publication 800-61), the Responding to targeted cyber attacks report from ISACA (collaborating with E&Y) and the CREST Cyber Security Incident Response Guide?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.12c",null,null,3,3,"x 3"]
[121,"1.3.13",4,null,"1.3.13","Does your cyber security incident response process cover all stage of an investigation, which includes:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.13",null,null,"N/A","N/A",{"$error":"#N/A"}]
[122,"1.3.13a",6,null,"1.3.13a","Identifying cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.13a",null,null,2,2,"x 2"]
[123,"1.3.13b",6,null,"1.3.13b","Investigating the situation (including triage)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.13b",null,null,2,2,"x 2"]
[124,"1.3.13c",6,null,"1.3.13c","Taking appropriate action (eg contain incident and eradicate cause)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.13c",null,null,2,2,"x 2"]
[125,"1.3.13d",6,null,"1.3.13d","Recovering systems, data and connectivity?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.13d",null,null,2,2,"x 2"]
[126,"1.3.14",4,null,"1.3.14","Does your cyber security incident response process state:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.14",null,null,"N/A","N/A",{"$error":"#N/A"}]
[127,"1.3.14a",6,null,"1.3.14a","Who should be responsible for each step?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.14a",null,null,2,2,"x 2"]
[128,"1.3.14b",6,null,"1.3.14b","How it should be carried out?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.14b",null,null,2,2,"x 2"]
[129,{"$f":"VLOOKUP(A136,contentref,2,FALSE)","v":"1.3.14c"},{"$f":"VLOOKUP(A136,contentref,15,FALSE)","v":6},null,{"$f":"IF(C136=1,\"Phase \"&B136,IF(C136=2,\"Step \"&VLOOKUP(A136,contentref,4,FALSE),B136))","v":"1.3.14c"},{"$f":"VLOOKUP(A136,contentref,7,FALSE)","v":"Who to contact for support?"},null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"E136","v":"1.3.14c"},null,null,2,{"$f":"VLOOKUP(A136,contentref,8,FALSE)","v":2},{"$f":"VLOOKUP(W136,weighting_response_reverse,2,FALSE)","v":"x 2"}]
[130,"1.3.15",5,null,"1.3.15","Does your cyber security incident response process include pre-agreed response actions (eg using attack play-books) for particular situations",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.15",null,null,5,5,"x 5"]
[131,"1.3.16",4,null,"1.3.16","Is your cyber security incident response process integrated with:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.16",null,null,"N/A","N/A",{"$error":"#N/A"}]
[132,"1.3.16a",6,null,"1.3.16a","Relevant day-to-day third parties (eg suppliers, partners and customers)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.16a",null,null,2,2,"x 2"]
[133,"1.3.16b",6,null,"1.3.16b","Specialist third party security experts, such as outsourced security services (eg security device management) to Managed Security Services Providers (MSSP) or a Security Operations Centre (SOC)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.16b",null,null,2,2,"x 2"]
[134,"1.3.16c",6,null,"1.3.16c","Human Resources (HR), if prosecution is likely or the culprit is suspected to be internal?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.16c",null,null,2,2,"x 2"]
[135,"1.3.16d",6,null,"1.3.16d","Legal counsel and Public Relations (PR)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.16d",null,null,2,2,"x 2"]
[136,"1.3.17",4,null,"1.3.17","Does your cyber security incident response process address important security requirements during the investigation, which includes:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.17",null,null,"N/A","N/A",{"$error":"#N/A"}]
[137,"1.3.17a",6,null,"1.3.17a","Maintaining the integrity of your most important data in a compromised environment)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.17a",null,null,4,4,"x 4"]
[138,"1.3.17b",6,null,"1.3.17b","Preventing (or reducing) unauthorised disclosure of confidential information?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.17b",null,null,4,4,"x 4"]
[139,"1.3.17c",6,null,"1.3.17c","Complying with data privacy or data protection requirements (eg reporting the loss of personal data)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.17c",null,null,3,3,"x 3"]
[140,"1.3.17d",6,null,"1.3.17d","Monitoring new (and existing) vulnerabilities during the cyber security attack?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.17d",null,null,4,4,"x 4"]
[141,"1.3.18",4,null,"1.3.18","Has your cyber security incident response process been:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.18",null,null,"N/A","N/A",{"$error":"#N/A"}]
[142,"1.3.18a",6,null,"1.3.18a","Signed off by appropriate management?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.18a",null,null,2,2,"x 2"]
[143,"1.3.18b",6,null,"1.3.18b","Kept up to date?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.18b",null,null,2,2,"x 2"]
[144,"1.3.18c",6,null,"1.3.18c","Reviewed on a regular basis?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.18c",null,null,2,2,"x 2"]
[145,"1.3.19",4,null,"1.3.19","Does your cyber security incident response process enable you to respond to a cyber security incident:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.19",null,null,"N/A","N/A",{"$error":"#N/A"}]
[146,"1.3.19a",6,null,"1.3.19a","Quickly (ie within critical timescales)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.19a",null,null,4,4,"x 4"]
[147,"1.3.19b",6,null,"1.3.19b","Effectively (ensuring that all services have been restored to working order)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.19b",null,null,4,4,"x 4"]
[148,"1.3.19c",6,null,"1.3.19c","In a consistent manner?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.19c",null,null,4,4,"x 4"]
[149,"1.3.20",4,null,"1.3.20","Does your cyber security incident response process enable you to:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.20",null,null,"N/A","N/A",{"$error":"#N/A"}]
[150,"1.3.20a",6,null,"1.3.20a","Cope with many different scenarios?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.20a",null,null,4,4,"x 4"]
[151,"1.3.20b",6,null,"1.3.20b","Proactively implement and adapt approaches as needed?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.20b",null,null,5,5,"x 5"]
[152,"1.3.21",4,null,"1.3.21","Is your cyber security incident response process tested:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.21",null,null,"N/A","N/A",{"$error":"#N/A"}]
[153,"1.3.21a",6,null,"1.3.21a","Thoroughly using a range of different scenarios?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.21a",null,null,3,3,"x 3"]
[154,"1.3.21b",6,null,"1.3.21b","On a regular basis?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.21b",null,null,2,2,"x 2"]
[155,"1.3.21c",6,null,"1.3.21c","In conjunction with relevant third parties?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.21c",null,null,4,4,"x 4"]
[156,"1.3.22",5,null,"1.3.22","Do you analyse the results of these tests?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.22",null,null,4,4,"x 4"]
[157,"1.3.23",5,null,"1.3.23","Do you address weaknesses identified during these tests?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.23",null,null,4,4,"x 4"]
[158,"",3,null,"","Technology",null,null,null,null,null,null,null,null,null,null,null,null,null,"",null,null,"","",{"$error":"#N/A"}]
[159,"1.3.23",5,null,"1.3.23","Do you have technical arrangements to support cyber security incident response?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.23",null,null,1,1,"x 1"]
[160,"1.3.24",4,null,"1.3.24","Do your technical arrangements for supporting cyber security incident response provide you (and any relevant third parties) with sufficient understanding of:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.24",null,null,"N/A","N/A",{"$error":"#N/A"}]
[161,"1.3.24a",6,null,"1.3.24a","Your IT infrastructure?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.24a",null,null,3,3,"x 3"]
[162,"1.3.24b",6,null,"1.3.24b","The topology of your networks (eg via a suitable network diagram)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.24b",null,null,3,3,"x 3"]
[163,"1.3.25",4,null,"1.3.25","Do your technical arrangements for supporting cyber security incident response include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.25",null,null,"N/A","N/A",{"$error":"#N/A"}]
[164,"1.3.25a",6,null,"1.3.25a","An appropriate set of incident response tools?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.25a",null,null,3,3,"x 3"]
[165,"1.3.25b",6,null,"1.3.25b","Implementing technical controls like firewalls, mail filters and intrusion detection systems (IDS) or data loss prevention (DLP) technology?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.25b",null,null,4,4,"x 4"]
[166,"1.3.25c",6,null,"1.3.25c","Logging the right events and turning on the appropriate logging features?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.25c",null,null,3,3,"x 3"]
[167,"1.3.25d",6,null,"1.3.25d","Maintaining sufficient historical data (eg because logs are overwritten or you do not have sufficient storage space)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.25d",null,null,4,4,"x 4"]
[168,"1.3.25e",6,null,"1.3.25e","Deploying other suitable technical controls, as required, such as patching?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.25e",null,null,3,3,"x 3"]
[169,"1.3.25f",6,null,"1.3.25f","Identifying your Internet points of presence (‘touch points’)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.25f",null,null,4,4,"x 4"]
[170,"1.3.26",5,null,"1.3.26","Do your technical arrangements for support cyber security incident response provide you with enough relevant knowledge to conduct a suitable investigation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.26",null,null,5,5,"x 5"]
[171,"",3,null,"","Information",null,null,null,null,null,null,null,null,null,null,null,null,null,"",null,null,"","",{"$error":"#N/A"}]
[172,"1.3.27",5,null,"1.3.27","Do you have information readily available that will help the cyber security incident response team (including third party experts) to respond quickly and effectively?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.27",null,null,3,3,"x 3"]
[173,"1.3.28",4,null,"1.3.28","Does this information include relevant details about:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.28",null,null,"N/A","N/A",{"$error":"#N/A"}]
[174,"1.3.28a",6,null,"1.3.28a","Business management (eg what the business does, main point(s) of contact, approach to business impact assessment)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.28a",null,null,3,3,"x 3"]
[175,"1.3.28b",6,null,"1.3.28b","IT infrastructure (eg network diagrams, system architecture and layout)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.28b",null,null,3,3,"x 3"]
[176,"1.3.28c",6,null,"1.3.28c","Data (eg what type of information is processed, where and how)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.28c",null,null,3,3,"x 3"]
[177,"1.3.28d",6,null,"1.3.28d","Event logging (eg what types of data and events are logged; on which systems; how and when; as well as how this data is collated and analysed)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.28d",null,null,3,3,"x 3"]
[178,"1.3.29",4,null,"1.3.29","In the event of a cyber security incident are you able to quickly get relevant information from:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.29",null,null,"N/A","N/A",{"$error":"#N/A"}]
[179,"1.3.29a",6,null,"1.3.29a","Technical security specialists?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.29a",null,null,3,3,"x 3"]
[180,"1.3.29b",6,null,"1.3.29b","Relevant business representatives?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.29b",null,null,3,3,"x 3"]
[181,"1.3.29c",6,null,"1.3.29c","Your Crisis Management Team?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.29c",null,null,3,3,"x 3"]
[182,"1.3.29d",6,null,"1.3.29d","Legal or HR specialists?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.29d",null,null,3,3,"x 3"]
[183,"1.3.30",4,null,"1.3.30","In the event of a cyber security incident are you able to:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.30",null,null,"N/A","N/A",{"$error":"#N/A"}]
[184,"1.3.30a",6,null,"1.3.30a","Gain fast access to facilities at your outsourced service providers (ie access to premises or equipment)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.30a",null,null,5,5,"x 5"]
[185,"1.3.30b",6,null,"1.3.30b","Obtain essential supporting information (eg event logs) from all your third party suppliers (eg cloud service suppliers, infrastructure outsourcers and managed service providers) in a timely and suitable manner?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.30b",null,null,5,5,"x 5"]
[186,"1.3.30c",6,null,"1.3.30c","Contact relevant people in third parties who would be impacted if your organisation had to operate in a degraded capacity?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.3.30c",null,null,4,4,"x 4"]
[187,"1.4",2,null,"Step 4","Control environment",null,null,null,null,null,null,null,null,null,null,null,null,null,"Step 4",null,null,"","",{"$error":"#N/A"}]
[188,"1.4.01",5,null,"1.4.01","Do you have a set of controls to help reduce the frequency and impact of cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.01",null,null,1,1,"x 1"]
[189,"1.4.02",4,null,"1.4.02","Does your control set include basic controls to help support cyber security incident investigations, including:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.02",null,null,"N/A","N/A",{"$error":"#N/A"}]
[190,"1.4.02a",6,null,"1.4.02a","Information classification, labelling and handling techniques?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.02a",null,null,2,2,"x 2"]
[191,"1.4.02b",6,null,"1.4.02b","Access control arrangements?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.02b",null,null,2,2,"x 2"]
[192,"1.4.02c",6,null,"1.4.02c","Patch management?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.02c",null,null,2,2,"x 2"]
[193,{"$f":"VLOOKUP(A200,contentref,2,FALSE)","v":"1.4.02d"},{"$f":"VLOOKUP(A200,contentref,15,FALSE)","v":6},null,{"$f":"IF(C200=1,\"Phase \"&B200,IF(C200=2,\"Step \"&VLOOKUP(A200,contentref,4,FALSE),B200))","v":"1.4.02d"},{"$f":"VLOOKUP(A200,contentref,7,FALSE)","v":"Firewalls?"},null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"E200","v":"1.4.02d"},null,null,2,{"$f":"VLOOKUP(A200,contentref,8,FALSE)","v":2},{"$f":"VLOOKUP(W200,weighting_response_reverse,2,FALSE)","v":"x 2"}]
[194,"1.4.02e",6,null,"1.4.02e","Malware protection?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.02e",null,null,2,2,"x 2"]
[195,"1.4.02f",6,null,"1.4.02f","‘Secure’ configuration of servers and connected devices?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.02f",null,null,2,2,"x 2"]
[196,"1.4.02g",6,null,"1.4.02g","Backups?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.02g",null,null,2,2,"x 2"]
[197,"1.4.03",4,null,"1.4.03","Is your cyber security control set:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.03",null,null,"N/A","N/A",{"$error":"#N/A"}]
[198,"1.4.03a",6,null,"1.4.03a","Based on a formal cyber security framework, such as the SANS top 20 cyber security controls or the CESG 10 Steps to Cyber Security or PAS 55?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.03a",null,null,3,3,"x 3"]
[199,"1.4.03b",6,null,"1.4.03b","Signed-off by senior management?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.03b",null,null,2,2,"x 2"]
[200,"1.4.03c",6,null,"1.4.03c","Kept-up-to date?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.03c",null,null,2,2,"x 2"]
[201,"1.4.03d",6,null,"1.4.03d","Monitored for effectiveness?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.03d",null,null,3,3,"x 3"]
[202,"1.4.03e",6,null,"1.4.03e","Reviewed on a regular basis?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.03e",null,null,2,2,"x 2"]
[203,"1.4.04",5,null,"1.4.04","Do you provide internet access through a central corporate gateway, rather than locally?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.04",null,null,4,4,"x 4"]
[204,"1.4.05",5,null,"1.4.05","Do you deploy technical security monitoring tools?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.05",null,null,3,3,"x 3"]
[205,"1.4.06",4,null,"1.4.06","Do your technical security monitoring tools include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.06",null,null,"N/A","N/A",{"$error":"#N/A"}]
[206,"1.4.06a",6,null,"1.4.06a","Intrusion prevention systems (IPS)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.06a",null,null,4,4,"x 4"]
[207,"1.4.06b",6,null,"1.4.06b","Intrusion detection systems (IDS)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.06b",null,null,4,4,"x 4"]
[208,"1.4.06c",6,null,"1.4.06c","Data loss preventions (DLP) systems?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.06c",null,null,3,3,"x 3"]
[209,"1.4.06d",6,null,"1.4.06d","A searchable incident event repository (SIEM)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.06d",null,null,4,4,"x 4"]
[210,"1.4.06e",6,null,"1.4.06e","Commercial APT prevention tools?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.06e",null,null,5,5,"x 5"]
[211,"1.4.07",5,null,"1.4.07","Is your cyber security control set supplemented by specialised cyber security controls?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.07",null,null,4,4,"x 4"]
[212,"1.4.08",4,null,"1.4.08","Do your specialised cyber security controls include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.08",null,null,"N/A","N/A",{"$error":"#N/A"}]
[213,"1.4.08a",6,null,"1.4.08a","Multi factor authentication - something you know (eg a User ID and password) and something you have (eg an access, bank or smart card)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.08a",null,null,4,4,"x 4"]
[214,"1.4.08b",6,null,"1.4.08b","Digital certificates used to “sign” code from a vendor so that the code can be trusted?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.08b",null,null,4,4,"x 4"]
[215,"1.4.08c",6,null,"1.4.08c","Whitelisting (defining all acceptable ports, addresses or similar – and preventing all other access) or blacklisting (preventing access from specific sites, or addresses)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.08c",null,null,4,4,"x 4"]
[216,"1.4.09",5,null,"1.4.09","Is your cyber security control set supplemented by advanced cyber security controls?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.09",null,null,5,5,"x 5"]
[217,"1.4.10",4,null,"1.4.10","Do your advanced cyber security controls include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.10",null,null,"N/A","N/A",{"$error":"#N/A"}]
[218,"1.4.10a",6,null,"1.4.10a","Continuous monitoring (eg via a Security Operations centre (SOC)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.10a",null,null,5,5,"x 5"]
[219,"1.4.10b",6,null,"1.4.10b","Proactive APT assessments?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.10b",null,null,5,5,"x 5"]
[220,"1.4.10c",6,null,"1.4.10c","Outbound gateway consolidation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.10c",null,null,5,5,"x 5"]
[221,"1.4.10d",6,null,"1.4.10d","System virtualisation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.10d",null,null,5,5,"x 5"]
[222,"1.4.10e",6,null,"1.4.10e","Sensitive network or data segregation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.10e",null,null,5,5,"x 5"]
[223,"1.4.10f",6,null,"1.4.10f","Counterintelligence operations?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.10f",null,null,5,5,"x 5"]
[224,"1.4.11",4,null,"1.4.11","Does your cyber security control set help you to:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.11",null,null,"N/A","N/A",{"$error":"#N/A"}]
[225,"1.4.11a",6,null,"1.4.11a","Make it more difficult for attackers to be successful?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.11a",null,null,4,4,"x 4"]
[226,"1.4.11b",6,null,"1.4.11b","Detect that a cyber security attack is being planned - or is already underway?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.4.11b",null,null,4,4,"x 4"]
[227,"1.5",2,null,"Step 5","Maturity assessment",null,null,null,null,null,null,null,null,null,null,null,null,null,"Step 5",null,null,"","",{"$error":"#N/A"}]
[228,"1.5.01",5,null,"1.5.01","Have you created an organisation-specific definition of the term “cyber security incident” so that the scope of the term is clear?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.01",null,null,3,3,"x 3"]
[229,"1.5.02",4,null,"1.5.02","Does your definition of the term “cyber security incident” take account of the:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.02",null,null,"N/A","N/A",{"$error":"#N/A"}]
[230,"1.5.02a",6,null,"1.5.02a","Different types of cyber security incident (eg hacking, malware or social engineering)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.02a",null,null,3,3,"x 3"]
[231,"1.5.02b",6,null,"1.5.02b","Sources of cyber security incidents (eg petty criminals, insiders, hacktivists, an organised crime syndicate, extremist group or state-sponsored body)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.02b",null,null,3,3,"x 3"]
[232,"1.5.02c",6,null,"1.5.02c","Basic cyber security incidents (eg minor crime, localised disruption and theft)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.02c",null,null,3,3,"x 3"]
[233,"1.5.02d",6,null,"1.5.02d","Sophisticated cyber security attacks (eg major organised crime, widespread disruption, critical damage to national infrastructure and even warfare)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.02d",null,null,3,3,"x 3"]
[234,"1.5.02e",6,null,"1.5.02e","Difference between a cyber security and a traditional IT or information security incident (if any)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.02e",null,null,4,4,"x 4"]
[235,"1.5.03",5,null,"1.5.03","Do you maintain an appropriate cyber security incident response capability?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.03",null,null,2,2,"x 2"]
[236,"1.5.04",4,null,"1.5.04","Does your cyber security incident response capability include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.04",null,null,"N/A","N/A",{"$error":"#N/A"}]
[237,"1.5.04a",6,null,"1.5.04a","Appointing a cyber security incident response team (internal and / or external) and determining what services they should provide?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.04a",null,null,2,2,"x 2"]
[238,"1.5.04b",6,null,"1.5.04b","Raising awareness about the need for an effective cyber security response capability?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.04b",null,null,2,2,"x 2"]
[239,"1.5.04c",6,null,"1.5.04c","Developing a consistent, repeatable cyber security incident response process or methodology for handling cyber security incidents (or suspected incidents) as they occur, so that the appropriate actions are taken?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.04c",null,null,3,3,"x 3"]
[240,"1.5.04d",6,null,"1.5.04d","Making effective use of relevant technologies?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.04d",null,null,3,3,"x 3"]
[241,"1.5.04e",6,null,"1.5.04e","Ensuring that cyber security incidents are properly followed up once they have been responded to effectively?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.04e",null,null,3,3,"x 3"]
[242,"1.5.05",5,null,"1.5.05","Have you obtained senior management commitment for your cyber security incident response capability?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.05",null,null,4,4,"x 4"]
[243,"1.5.06",4,null,"1.5.06","Does senior management commitment include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.06",null,null,"N/A","N/A",{"$error":"#N/A"}]
[244,"1.5.06a",6,null,"1.5.06a","Providing sufficient funding and resources to deal with cyber security incidents effectively?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.06a",null,null,5,5,"x 5"]
[245,"1.5.06b",6,null,"1.5.06b","Determining whether to establish a specialised cyber security incident response capability or integrate cyber security incidents into existing incident management systems?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.06b",null,null,5,5,"x 5"]
[246,"1.5.06c",6,null,"1.5.06c","Finding appropriate external sources and levels of guidance to help you prepare for a cyber security incident",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.06c",null,null,5,5,"x 5"]
[247,"1.5.07",5,null,"1.5.07","Do you know your state of readiness to be able to respond to a cyber security incident in a fast, effective manner?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.07",null,null,4,4,"x 4"]
[248,"1.5.08",5,null,"1.5.08","Do you determine the requirements you have for your cyber security incident response capability?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.08",null,null,3,3,"x 3"]
[249,"1.5.09",4,null,"1.5.09","Do you measure the level of maturity of your cyber security incident response capability in terms of:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.09",null,null,"N/A","N/A",{"$error":"#N/A"}]
[250,"1.5.09a",6,null,"1.5.09a","People (eg an incident response team or individual, technical experts, fast access to decision-makers, representation from key suppliers)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.09a",null,null,4,4,"x 4"]
[251,"1.5.09b",6,null,"1.5.09b","Process (eg knowing what to do, how to do it and when to do it – when detecting, containing, eradicating or recovering from a cyber security incident)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.09b",null,null,4,4,"x 4"]
[252,"1.5.09c",6,null,"1.5.09c","Technology (eg knowing their network topology, providing the right event logs)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.09c",null,null,4,4,"x 4"]
[253,"1.5.09d",6,null,"1.5.09d","Information (eg having information close to hand about business operations and priorities; critical assets; and key dependencies, such as on third parties, important locations or where relevant information resides)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.09d",null,null,4,4,"x 4"]
[254,"1.5.09e",6,null,"1.5.09e","Preparedness, response and follow up activities?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.09e",null,null,4,4,"x 4"]
[255,"1.5.09f",6,null,"1.5.09f","Ability to adopt a systematic, structured approach to cyber security incident response?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.09f",null,null,4,4,"x 4"]
[256,"1.5.10",4,null,"1.5.10","Do you compare the maturity of your cyber security incident response capability:",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.10",null,null,"N/A","N/A",{"$error":"#N/A"}]
[257,{"$f":"VLOOKUP(A264,contentref,2,FALSE)","v":"1.5.10a"},{"$f":"VLOOKUP(A264,contentref,15,FALSE)","v":6},null,{"$f":"IF(C264=1,\"Phase \"&B264,IF(C264=2,\"Step \"&VLOOKUP(A264,contentref,4,FALSE),B264))","v":"1.5.10a"},{"$f":"VLOOKUP(A264,contentref,7,FALSE)","v":"To your requirements for such a capability?"},null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"E264","v":"1.5.10a"},null,null,5,{"$f":"VLOOKUP(A264,contentref,8,FALSE)","v":5},{"$f":"VLOOKUP(W264,weighting_response_reverse,2,FALSE)","v":"x 5"}]
[258,"1.5.10b",6,null,"1.5.10b","With similar organisation to help determine if this level of maturity is appropriate for your organisation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.10b",null,null,5,5,"x 5"]
[259,"1.5.11",5,null,"1.5.11","Does the make-up of your your cyber security incident response capability take into account what can and cannot be done with the time, resources and money available?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.11",null,null,5,5,"x 5"]
[260,"1.5.12",5,null,"1.5.12","Do you continually review the internal capabilities and capacity of your cyber security incident response team?",null,null,null,null,null,null,null,null,null,null,null,null,null,"1.5.12",null,null,4,4,"x 4"]
[261,2,1,null,"Phase 2","Respond",null,null,null,null,null,null,null,null,null,null,null,null,null,"Phase 2",null,null,"","",{"$error":"#N/A"}]
[262,"2.1",2,null,"Step 1","Identification",null,null,null,null,null,null,null,null,null,null,null,null,null,"Step 1",null,null,"","",{"$error":"#N/A"}]
[263,"2.1.01",5,null,"2.1.01","Do you identify suspected cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.01",null,null,1,1,"x 1"]
[264,"2.1.02",4,null,"2.1.02","Do you inform users that they should:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.02",null,null,"N/A","N/A",{"$error":"#N/A"}]
[265,"2.1.02a",6,null,"2.1.02a","Report all suspected cyber security breaches to a central point (eg information failures; loss of services; detection of malicious code; denial of service attacks; errors from incomplete or inaccurate business data)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.02a",null,null,1,1,"x 1"]
[266,"2.1.02b",6,null,"2.1.02b","Note all important details (eg type of breach, messages on screen, and details of unusual occurrences)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.02b",null,null,2,2,"x 2"]
[267,"2.1.02c",6,null,"2.1.02c","Restrain from attempting to take remedial actions themselves?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.02c",null,null,2,2,"x 2"]
[268,"2.1.03",5,null,"2.1.03","Do you identify cyber security incidents by analysing suspicious events reported by users to the IT help desk (or equivalent)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.03",null,null,2,2,"x 2"]
[269,"2.1.04",4,null,"2.1.04","Is this analysis based on:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.04",null,null,"N/A","N/A",{"$error":"#N/A"}]
[270,"2.1.04a",6,null,"2.1.04a","Comparing characteristics of the suspicious event to known ‘normal’ system and network behaviour?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.04a",null,null,4,4,"x 4"]
[271,"2.1.04b",6,null,"2.1.04b","A good working knowledge of what indictors of compromise (IOCs) would look like?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.04b",null,null,4,4,"x 4"]
[272,"2.1.05",4,null,"2.1.05","To help identify potential cyber security incidents do you monitor information from a variety of sources, including:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.05",null,null,"N/A","N/A",{"$error":"#N/A"}]
[273,"2.1.05a",6,null,"2.1.05a","System logs (eg operating system logs, service and application logs, network device logs and network flows)",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.05a",null,null,3,3,"x 3"]
[274,"2.1.05b",6,null,"2.1.05b","Alerts generated by technical security software (eg IDS, IPS, DLP, SIEM, antivirus and spam software), file integrity checking software, monitoring services (often provided by a third party)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.05b",null,null,4,4,"x 4"]
[275,"2.1.05c",6,null,"2.1.05c","Data provided by monitoring services or a Security Operations Centre (often provided by third parties)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.05c",null,null,5,5,"x 5"]
[276,"2.1.05d",6,null,"2.1.05d","Publicly available information (eg information on new exploits, information exchange groups, third party organisations, governments)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.05d",null,null,4,4,"x 4"]
[277,"2.1.05e",6,null,"2.1.05e","People from within your organisation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.05e",null,null,3,3,"x 3"]
[278,"2.1.05f",6,null,"2.1.05f","A variety of third parties (eg customers, suppliers, IT providers, ISPs, partners; government bodies)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.05f",null,null,3,3,"x 3"]
[279,"2.1.05g",6,null,"2.1.05g","Anomalies detected by audits, investigations or reviews?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.05g",null,null,3,3,"x 3"]
[280,"2.1.06",4,null,"2.1.06","Having identified a suspected cyber security incident, do you:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.06",null,null,"N/A","N/A",{"$error":"#N/A"}]
[281,"2.1.06a",6,null,"2.1.06a","Investigate different types of technical information, such as IP addresses?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.06a",null,null,4,4,"x 4"]
[282,"2.1.06b",6,null,"2.1.06b","Analyse all available information related to a potential cyber security incident?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.06b",null,null,3,3,"x 3"]
[283,"2.1.06c",6,null,"2.1.06c","Determine what has actually happened (eg a DDOS, malware attack, system hack, session hijack or data corruption)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.06c",null,null,3,3,"x 3"]
[284,"2.1.06d",6,null,"2.1.06d","Confirm that they have actually been subject to a cyber security attack or had a cyber-related breach (the unknown element)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.06d",null,null,3,3,"x 3"]
[285,"2.1.07",4,null,"2.1.07","When monitoring information from relevant technical sources, such as specialised security software (eg SIEM or IDS) do you:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.07",null,null,"N/A","N/A",{"$error":"#N/A"}]
[286,"2.1.07a",6,null,"2.1.07a","Monitor all relevant events?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.07a",null,null,4,4,"x 4"]
[287,"2.1.07b",6,null,"2.1.07b","Carry out monitoring regularly?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.07b",null,null,4,4,"x 4"]
[288,"2.1.07c",6,null,"2.1.07c","Carry out monitoring in an appropriate manner, focusing on finding anomalies?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.07c",null,null,4,4,"x 4"]
[289,"2.1.07d",6,null,"2.1.07d","Respond to alerts correctly (avoiding the risk of overlooking indicative alerts or over-reacting to benign alerts)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.07d",null,null,4,4,"x 4"]
[290,"2.1.07e",6,null,"2.1.07e","Aggregate what may seem like benign alerts into what is a coherent threat message?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.07e",null,null,5,5,"x 5"]
[291,"2.1.08",4,null,"2.1.08","Do you take additional steps to identify cyber security incidents by:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.08",null,null,"N/A","N/A",{"$error":"#N/A"}]
[292,"2.1.08a",6,null,"2.1.08a","Providing situational awareness (particularly through cyber intelligence)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.08a",null,null,5,5,"x 5"]
[293,"2.1.08b",6,null,"2.1.08b","Continuously monitoring events that could result in your organisation being affected by a cyber security incident?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.08b",null,null,5,5,"x 5"]
[294,"2.1.08c",6,null,"2.1.08c","Evaluating threat analytics (typically based on the threat model of the behaviour of attacks), helping to determine both symptoms and behaviour?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.08c",null,null,5,5,"x 5"]
[295,"2.1.08d",6,null,"2.1.08d","Performing specialised analysis of host assets, network data and attack files (eg malware)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.08d",null,null,5,5,"x 5"]
[296,"2.1.08e",6,null,"2.1.08e","Prioritising assets to be investigated?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.08e",null,null,5,5,"x 5"]
[297,"2.1.08f",6,null,"2.1.08f","Addressing unusual or novel problems (eg to do with bespoke file types or encryption)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.08f",null,null,5,5,"x 5"]
[298,"2.1.09",5,null,"2.1.09","Do you use security analytics?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.09",null,null,4,4,"x 4"]
[299,"2.1.10",4,null,"2.1.10","Does your security analytics include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.10",null,null,"N/A","N/A",{"$error":"#N/A"}]
[300,"2.1.10a",6,null,"2.1.10a","Testing for possible attackers or poor user behaviour (eg users opening ‘honey pot’ attachments, or similar)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.10a",null,null,5,5,"x 5"]
[301,"2.1.10b",6,null,"2.1.10b","Automated analytics platform (more than just a SIEM)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.10b",null,null,5,5,"x 5"]
[302,"2.1.10c",6,null,"2.1.10c","Evaluating threat analytics (typically based on the threat model of the behaviour of attacks), helping to determine both symptoms and behaviour?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.1.10c",null,null,5,5,"x 5"]
[303,"2.2",2,null,"Step 2","Investigation",null,null,null,null,null,null,null,null,null,null,null,null,null,"Step 2",null,null,"","",{"$error":"#N/A"}]
[304,"",3,null,"","Understanding",null,null,null,null,null,null,null,null,null,null,null,null,null,"",null,null,"","",{"$error":"#N/A"}]
[305,"2.2.01",5,null,"2.2.01","Do you take steps to investigate the cyber security incident?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.01",null,null,1,1,"x 1"]
[306,"2.2.02",4,null,"2.2.02","Does your investigation of the event include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.02",null,null,"N/A","N/A",{"$error":"#N/A"}]
[307,"2.2.02a",6,null,"2.2.02a","Establishing the objectives of the investigation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.02a",null,null,2,2,"x 2"]
[308,"2.2.02b",6,null,"2.2.02b","Performing detailed analysis of the cyber security incident?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.02b",null,null,2,2,"x 2"]
[309,"2.2.02c",6,null,"2.2.02c","Placing priority on the speed of investigation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.02c",null,null,3,3,"x 3"]
[310,"2.2.03",4,null,"2.2.03","Does your analysis of the cyber security incident include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.03",null,null,"N/A","N/A",{"$error":"#N/A"}]
[311,"2.2.03a",6,null,"2.2.03a","Identifying what systems, networks and information (assets) have been compromised?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.03a",null,null,2,2,"x 2"]
[312,"2.2.03b",6,null,"2.2.03b","Determining what information has been disclosed to unauthorised parties, stolen, deleted or corrupted?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.03b",null,null,3,3,"x 3"]
[313,"2.2.03c",6,null,"2.2.03c","Working out how it happened (eg how did the attacker gain entry to the system)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.03c",null,null,3,3,"x 3"]
[314,"2.2.03d",6,null,"2.2.03d","Finding out who did it (ie which threat agent or agents)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.03d",null,null,3,3,"x 3"]
[315,"2.2.03e",6,null,"2.2.03e","Determining why they did it, such as financial crime (eg fraud or extortion), theft of intellectual property, personal attack (eg revenge), or disruption to critical services?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.03e",null,null,3,3,"x 3"]
[316,"2.2.03f",6,null,"2.2.03f","Estimating the potential business impact of the cyber security incident?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.03f",null,null,3,3,"x 3"]
[317,"2.2.04",4,null,"2.2.04","Do your investigation determine what:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.04",null,null,"N/A","N/A",{"$error":"#N/A"}]
[318,"2.2.04a",6,null,"2.2.04a","Methodologies the attackers are using?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.04a",null,null,4,4,"x 4"]
[319,"2.2.04b",6,null,"2.2.04b","Who their target is for the attack (eg an individual, the whole organisation, your market sector or the government)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.04b",null,null,4,4,"x 4"]
[320,"2.2.05",5,null,"2.2.05","Do you have access to cyber threat intelligence?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.05",null,null,4,4,"x 4"]
[321,{"$f":"VLOOKUP(A328,contentref,2,FALSE)","v":"2.2.06"},{"$f":"VLOOKUP(A328,contentref,15,FALSE)","v":5},null,{"$f":"IF(C328=1,\"Phase \"&B328,IF(C328=2,\"Step \"&VLOOKUP(A328,contentref,4,FALSE),B328))","v":"2.2.06"},{"$f":"VLOOKUP(A328,contentref,7,FALSE)","v":"Does your cyber threat intelligence come from a variety of reputable sources, such as government, CERTS, collaborative groups or expert third parties?"},null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"E328","v":"2.2.06"},null,null,5,{"$f":"VLOOKUP(A328,contentref,8,FALSE)","v":5},{"$f":"VLOOKUP(W328,weighting_response_reverse,2,FALSE)","v":"x 5"}]
[322,"2.2.07",4,null,"2.2.07","Does your cyber threat intelligence help you to determine the attacker(s):",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.07",null,null,"N/A","N/A",{"$error":"#N/A"}]
[323,"2.2.07a",6,null,"2.2.07a","Capabilities (what can they actually do)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.07a",null,null,5,5,"x 5"]
[324,"2.2.07b",6,null,"2.2.07b","Motives (why are they attacking you)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.07b",null,null,5,5,"x 5"]
[325,"2.2.07c",6,null,"2.2.07c","Likely actions (eg their tactics, techniques and procedures)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.07c",null,null,5,5,"x 5"]
[326,"",3,null,"","Triage",null,null,null,null,null,null,null,null,null,null,null,null,null,"",null,null,"","",{"$error":"#N/A"}]
[327,"2.2.08",5,null,"2.2.08","Do you perform Triage on the cyber security incident in the early part of an investigation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.08",null,null,2,2,"x 2"]
[328,"2.2.09",4,null,"2.2.09","Do the actions you carry out as part of Triage include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.09",null,null,"N/A","N/A",{"$error":"#N/A"}]
[329,"2.2.09a",6,null,"2.2.09a","Classifying cyber security incidents (eg critical, significant, normal or negligible impact)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.09a",null,null,3,3,"x 3"]
[330,"2.2.09b",6,null,"2.2.09b","Prioritising these incidents (eg high, medium or low)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.09b",null,null,3,3,"x 3"]
[331,"2.2.09c",6,null,"2.2.09c","Assigning incidents to appropriate personnel in terms of their legitimacy, correctness, constituency origin, severity or impact?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.09c",null,null,3,3,"x 3"]
[332,"",3,null,"","First response",null,null,null,null,null,null,null,null,null,null,null,null,null,"",null,null,"","",{"$error":"#N/A"}]
[333,"2.2.10",5,null,"2.2.10","Do you have one or more named individuals (or a team) who are capable of dealing with the initial stages of cyber incident response (first responders)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.10",null,null,2,2,"x 2"]
[334,"2.2.11",4,null,"2.2.11","Are your first responders able to:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.11",null,null,"N/A","N/A",{"$error":"#N/A"}]
[335,"2.2.11a",6,null,"2.2.11a","Classify and prioritise cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.11a",null,null,2,2,"x 2"]
[336,"2.2.11b",6,null,"2.2.11b","Avoid taking the wrong initial action when a cyber security attack occurs (eg taking systems off the network or cleaning up systems, which could have a detrimental affect like alerting an attacker or destroying vital evidence)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.11b",null,null,3,3,"x 3"]
[337,"2.2.11c",6,null,"2.2.11c","Identify quickly when the scope and severity is beyond local or in-house skills?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.11c",null,null,3,3,"x 3"]
[338,"2.2.12",4,null,"2.2.12","Have arrangements to have been made in advance so that expert investigators:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.12",null,null,"N/A","N/A",{"$error":"#N/A"}]
[339,"2.2.12a",6,null,"2.2.12a","Are available at short notice?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.12a",null,null,4,4,"x 4"]
[340,"2.2.12b",6,null,"2.2.12b","Have enough prior information to be able to hit the ground running?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.12b",null,null,4,4,"x 4"]
[341,"2.2.13",5,null,"2.2.13","Are you able to quickly contact third parties that you may wish to get involved, such as technology forensics specialists, technology analysts (for example, database experts), information analysts (for example, accountants), legal experts and on-site police support?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.13",null,null,4,4,"x 4"]
[342,"2.2.14",5,null,"2.2.14","Do you have a crisis management team (or equivalent) to support serious cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.14",null,null,4,4,"x 4"]
[343,"2.2.15",4,null,"2.2.15","Are you able to manage the cyber security incident:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.15",null,null,"N/A","N/A",{"$error":"#N/A"}]
[344,"2.2.15a",6,null,"2.2.15a","Via one central point of contact?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.15a",null,null,3,3,"x 3"]
[345,"2.2.15b",6,null,"2.2.15b","From one central location?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.15b",null,null,3,3,"x 3"]
[346,"2.2.15c",6,null,"2.2.15c","In a specialised incident response location, such as a ‘war room’, if required?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.15c",null,null,5,5,"x 5"]
[347,"",3,null,"","Initial analysis",null,null,null,null,null,null,null,null,null,null,null,null,null,"",null,null,"","",{"$error":"#N/A"}]
[348,"2.2.16",5,null,"2.2.16","Do you perform initial analysis to determine the precise nature of the incident?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.16",null,null,3,3,"x 3"]
[349,"2.2.17",4,null,"2.2.17","Are your cyber security incident investigations:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.17",null,null,"N/A","N/A",{"$error":"#N/A"}]
[350,"2.2.17a",6,null,"2.2.17a","Evidence-driven, based on information gathered from corporate infrastructure or applications (typically event logs)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.17a",null,null,3,3,"x 3"]
[351,"2.2.17b",6,null,"2.2.17b","Intelligence driven, based on information gathered from: government agencies (eg CPNI), monitoring of internal resources, open source information or data provided internally?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.17b",null,null,5,5,"x 5"]
[352,"2.2.18",4,null,"2.2.18","Do your cyber security incident investigations include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.18",null,null,"N/A","N/A",{"$error":"#N/A"}]
[353,"2.2.18a",6,null,"2.2.18a","Considering all relevant event logs (eg logs generated by firewalls, web servers, traditional servers / workstations, business applications, email history and archives, network data, internet usage and building access)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.18a",null,null,2,2,"x 2"]
[354,"2.2.18b",6,null,"2.2.18b","Examining important alerts or suspicious events in logs or technical security monitoring systems (eg IDS, IPS, DLP or SIEM)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.18b",null,null,4,4,"x 4"]
[355,"2.2.18c",6,null,"2.2.18c","Correlating them with network data (including data from cloud service providers)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.18c",null,null,4,4,"x 4"]
[356,"2.2.18d",6,null,"2.2.18d","Comparing these pieces of information against threat intelligence?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.18d",null,null,5,5,"x 5"]
[357,"2.2.19",4,null,"2.2.19","Do you thoroughly investigate each possible trigger event including:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.19",null,null,"N/A","N/A",{"$error":"#N/A"}]
[358,"2.2.19a",6,null,"2.2.19a","Date/time?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.19a",null,null,4,4,"x 4"]
[359,"2.2.19b",6,null,"2.2.19b","Internet protocol (IP) address (internal or external)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.19b",null,null,4,4,"x 4"]
[360,"2.2.19c",6,null,"2.2.19c","Port (source or destination), domain and file (eg exe, .dll)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.19c",null,null,4,4,"x 4"]
[361,"2.2.19d",6,null,"2.2.19d","System (hardware vendor, operating system, applications, purpose, location)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.19d",null,null,4,4,"x 4"]
[362,"2.2.20",4,null,"2.2.20","Do you retain relevant logs:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.20",null,null,"N/A","N/A",{"$error":"#N/A"}]
[363,"2.2.20a",6,null,"2.2.20a","For as long as possible?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.20a",null,null,3,3,"x 3"]
[364,"2.2.20b",6,null,"2.2.20b","As part of an approved log retention policy?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.20b",null,null,3,3,"x 3"]
[365,"",3,null,"","Collaboration",null,null,null,null,null,null,null,null,null,null,null,null,null,"",null,null,"","",{"$error":"#N/A"}]
[366,"2.2.21",5,null,"2.2.21","Do you analyse the possible systemic nature of the attack?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.21",null,null,5,5,"x 5"]
[367,"2.2.22",4,null,"2.2.22","Does this analysis include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.22",null,null,"N/A","N/A",{"$error":"#N/A"}]
[368,"2.2.22a",6,null,"2.2.22a","Tying disparate events together into a coherent picture?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.22a",null,null,5,5,"x 5"]
[369,"2.2.22b",6,null,"2.2.22b","Linking events to possible related events in other organisations with which you are associated (eg other Banks if you are in the Banking sector)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.2.22b",null,null,5,5,"x 5"]
[370,"2.3",2,null,"Step 3","Action",null,null,null,null,null,null,null,null,null,null,null,null,null,"Step 3",null,null,"","",{"$error":"#N/A"}]
[371,"",3,null,"","Containment",null,null,null,null,null,null,null,null,null,null,null,null,null,"",null,null,"","",{"$error":"#N/A"}]
[372,"2.3.01",5,null,"2.3.01","Do you take steps to contain the damage being done by the cyber security incident?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.01",null,null,1,1,"x 1"]
[373,"2.3.02",4,null,"2.3.02","Does the objective of containment include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.02",null,null,"N/A","N/A",{"$error":"#N/A"}]
[374,"2.3.02a",6,null,"2.3.02a","Making best efforts to return to functionality as normal?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.02a",null,null,3,3,"x 3"]
[375,"2.3.02b",6,null,"2.3.02b","Returning to business as usual?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.02b",null,null,2,2,"x 2"]
[376,"2.3.02c",6,null,"2.3.02c","Continuing to analyse the incident?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.02c",null,null,3,3,"x 3"]
[377,"2.3.02d",6,null,"2.3.02d","Planning longer term remediation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.02d",null,null,3,3,"x 3"]
[378,"2.3.03",4,null,"2.3.03","Does containment include stopping it from spreading to other:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.03",null,null,"N/A","N/A",{"$error":"#N/A"}]
[379,"2.3.03a",6,null,"2.3.03a","Networks within your organisation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.03a",null,null,2,2,"x 2"]
[380,"2.3.03b",6,null,"2.3.03b","Networks beyond your organisation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.03b",null,null,2,2,"x 2"]
[381,"2.3.03c",6,null,"2.3.03c","Devices within your organisation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.03c",null,null,2,2,"x 2"]
[382,"2.3.03d",6,null,"2.3.03d","Devices beyond your organisation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.03d",null,null,2,2,"x 2"]
[383,"2.3.04",5,null,"2.3.04","Does containment include a number of concurrent actions aimed at reducing the immediate impact of the cyber security incident?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.04",null,null,3,3,"x 3"]
[384,"2.3.05",5,null,"2.3.05","Does containment include removing the attacker’s access to your systems?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.05",null,null,3,3,"x 3"]
[385,{"$f":"VLOOKUP(A392,contentref,2,FALSE)","v":"2.3.06"},{"$f":"VLOOKUP(A392,contentref,15,FALSE)","v":4},null,{"$f":"IF(C392=1,\"Phase \"&B392,IF(C392=2,\"Step \"&VLOOKUP(A392,contentref,4,FALSE),B392))","v":"2.3.06"},{"$f":"VLOOKUP(A392,contentref,7,FALSE)","v":"Do your methods of containment include:"},null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"E392","v":"2.3.06"},null,null,"N/A",{"$f":"VLOOKUP(A392,contentref,8,FALSE)","v":"N/A"},{"$f":"VLOOKUP(W392,weighting_response_reverse,2,FALSE)","v":{"$error":"#N/A"}}]
[386,"2.3.06a",6,null,"2.3.06a","Blocking (and logging) of unauthorised access?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.06a",null,null,3,3,"x 3"]
[387,"2.3.06b",6,null,"2.3.06b","Blocking malware sources (eg email addresses and websites)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.06b",null,null,3,3,"x 3"]
[388,"2.3.06c",6,null,"2.3.06c","Closing particular ports and mail servers?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.06c",null,null,3,3,"x 3"]
[389,"2.3.06d",6,null,"2.3.06d","Firewall filtering?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.06d",null,null,3,3,"x 3"]
[390,"2.3.06e",6,null,"2.3.06e","Relocating website home pages?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.06e",null,null,4,4,"x 4"]
[391,"2.3.06f",6,null,"2.3.06f","Isolating systems?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.06f",null,null,3,3,"x 3"]
[392,"2.3.06g",6,null,"2.3.06g","Taking back-ups?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.06g",null,null,3,3,"x 3"]
[393,"2.3.07",4,null,"2.3.07","Do you have separate containment strategies for different types of:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.07",null,null,"N/A","N/A",{"$error":"#N/A"}]
[394,"2.3.07a",6,null,"2.3.07a","Cyber security attack?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.07a",null,null,5,5,"x 5"]
[395,"2.3.07b",6,null,"2.3.07b","Sources of attack (the attack agent)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.07b",null,null,5,5,"x 5"]
[396,"2.3.08",5,null,"2.3.08","Do your containment strategies include clearly documented criteria to facilitate decision-making?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.08",null,null,5,5,"x 5"]
[397,"2.3.09",4,null,"2.3.09","Do your containment strategies include evaluating the:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.09",null,null,"N/A","N/A",{"$error":"#N/A"}]
[398,"2.3.09a",6,null,"2.3.09a","Potential damage to and theft of resources?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.09a",null,null,4,4,"x 4"]
[399,"2.3.09b",6,null,"2.3.09b","Need for evidence preservation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.09b",null,null,4,4,"x 4"]
[400,"2.3.09c",6,null,"2.3.09c","Service availability (eg network connectivity, services provided to external parties)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.09c",null,null,4,4,"x 4"]
[401,"2.3.09d",6,null,"2.3.09d","Time and resources needed to implement the strategy?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.09d",null,null,4,4,"x 4"]
[402,"2.3.09e",6,null,"2.3.09e","Effectiveness of the strategy (eg partial containment, full containment)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.09e",null,null,5,5,"x 5"]
[403,"2.3.09f",6,null,"2.3.09f","Duration of the solution (eg emergency workaround to be removed in four hours, temporary workaround to be removed in two weeks, permanent solution)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.09f",null,null,5,5,"x 5"]
[404,"2.3.10",4,null,"2.3.10","Does your approach to containing cyber security incidents include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.10",null,null,"N/A","N/A",{"$error":"#N/A"}]
[405,"2.3.10a",6,null,"2.3.10a","Identifying immediate actions to be performed (eg based on high risk assets, time dependant issues, business / commercial decisions)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.10a",null,null,4,4,"x 4"]
[406,"2.3.10b",6,null,"2.3.10b","Ensuring that actions can be performed safely (eg by avoiding actions that can hamper response strategies, such as ‘seize and replace’)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.10b",null,null,4,4,"x 4"]
[407,"2.3.10c",6,null,"2.3.10c","Minimising the risk that an attacker will respond/escalate?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.10c",null,null,4,4,"x 4"]
[408,"2.3.10d",6,null,"2.3.10d","Determining whether findings identified during the investigation are critical?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.10d",null,null,4,4,"x 4"]
[409,"2.3.10e",6,null,"2.3.10e","Reacting to critical findings during the investigation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.10e",null,null,5,5,"x 5"]
[410,"2.3.10f",6,null,"2.3.10f","Duration of the solution (eg emergency workaround to be removed in four hours, temporary workaround to be removed in two weeks, permanent solution)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.10f",null,null,5,5,"x 5"]
[411,"2.3.11",4,null,"2.3.11","Does your approach to containing cyber security incidents include analysing:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.11",null,null,"N/A","N/A",{"$error":"#N/A"}]
[412,"2.3.11a",6,null,"2.3.11a","Events in relation to the ‘attacker kill chain’ (ie reconnaissance, weaponize, deliver, exploit, install, command & control and act on objectives)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.11a",null,null,5,5,"x 5"]
[413,"2.3.11b",6,null,"2.3.11b","Both the attacker and defender aspects of an attack?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.11b",null,null,5,5,"x 5"]
[414,"",3,null,"","Eradication",null,null,null,null,null,null,null,null,null,null,null,null,null,"",null,null,"","",{"$error":"#N/A"}]
[415,"2.3.12",5,null,"2.3.12","Do you take steps to eliminate the cause of the cyber security incident (eradication)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.12",null,null,2,2,"x 2"]
[416,"2.3.13",4,null,"2.3.13","Does eradication include (where necessary):",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.13",null,null,"N/A","N/A",{"$error":"#N/A"}]
[417,"2.3.13a",6,null,"2.3.13a","Removing the attack from the network?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.13a",null,null,3,3,"x 3"]
[418,"2.3.13b",6,null,"2.3.13b","Deleting malware?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.13b",null,null,3,3,"x 3"]
[419,"2.3.13c",6,null,"2.3.13c","Disabling breached user accounts?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.13c",null,null,3,3,"x 3"]
[420,"2.3.13d",6,null,"2.3.13d","Identifying vulnerabilities that were exploited?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.13d",null,null,3,3,"x 3"]
[421,"2.3.13e",6,null,"2.3.13e","Mitigating vulnerabilities that were exploited?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.13e",null,null,4,4,"x 4"]
[422,"2.3.14",4,null,"2.3.14","Does the eradication process include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.14",null,null,"N/A","N/A",{"$error":"#N/A"}]
[423,"2.3.14a",6,null,"2.3.14a","Identifying all affected hosts within your organisation, so that they can be remediated?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.14a",null,null,3,3,"x 3"]
[424,"2.3.14b",6,null,"2.3.14b","Identifying all affected hosts beyond your organisation, so that they can be remediated?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.14b",null,null,5,5,"x 5"]
[425,"2.3.14c",6,null,"2.3.14c","Carrying out malware analysis?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.14c",null,null,5,5,"x 5"]
[426,"2.3.14d",6,null,"2.3.14d","Checking for any response from the attacker to your actions?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.14d",null,null,5,5,"x 5"]
[427,"2.3.14e",6,null,"2.3.14e","Developing a response (preferably in advance) if the attacker uses a different method of attack?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.14e",null,null,5,5,"x 5"]
[428,"2.3.14f",6,null,"2.3.14f","Allowing sufficient time to ensure that the network is secure and that there is no response from the attacker?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.14f",null,null,3,3,"x 3"]
[429,"2.3.15",5,null,"2.3.15","Do you produce an eradication plan?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.15",null,null,3,3,"x 3"]
[430,"2.3.16",5,null,"2.3.16","Is the eradication plan executed with speed and precision?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.16",null,null,4,4,"x 4"]
[431,"2.3.17",4,null,"2.3.17","Does the eradication plan enable actions to be taken to prevent attackers:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.17",null,null,"N/A","N/A",{"$error":"#N/A"}]
[432,"2.3.17a",6,null,"2.3.17a","Sensing they have been discovered once eradication is underway?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.17a",null,null,5,5,"x 5"]
[433,"2.3.17b",6,null,"2.3.17b","Re-establishing a base and entrenching themselves into the network again?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.17b",null,null,5,5,"x 5"]
[434,"2.3.17c",6,null,"2.3.17c","Continuing the attack during eradication?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.17c",null,null,5,5,"x 5"]
[435,"2.3.17d",6,null,"2.3.17d","Avoiding identification during eradication?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.17d",null,null,5,5,"x 5"]
[436,"",3,null,"","Evidence",null,null,null,null,null,null,null,null,null,null,null,null,null,"",null,null,"","",{"$error":"#N/A"}]
[437,"2.3.18",5,null,"2.3.18","Do you take steps to preserve evidence when dealing with the cyber security?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.18",null,null,2,2,"x 2"]
[438,"2.3.19",5,null,"2.3.19","Do you have a formal process for handling evidence when dealing with the cyber security?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.19",null,null,3,3,"x 3"]
[439,"2.3.20",4,null,"2.3.20","Does your process for handling evidence include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.20",null,null,"N/A","N/A",{"$error":"#N/A"}]
[440,"2.3.20a",6,null,"2.3.20a","Allowing for admissibility of evidence (whether or not the evidence can be used in court)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.20a",null,null,3,3,"x 3"]
[441,"2.3.20b",6,null,"2.3.20b","Allowing for weight of evidence (the quality and completeness of evidence)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.20b",null,null,3,3,"x 3"]
[442,"2.3.20c",6,null,"2.3.20c","Adherence to an approved set of guidelines, such as the Association of Chief Police Officers (ACPO) Guidelines on Computer Evidence (ACPO)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.20c",null,null,3,3,"x 3"]
[443,"2.3.20d",6,null,"2.3.20d","Complying with relevant laws?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.20d",null,null,3,3,"x 3"]
[444,"2.3.21",4,null,"2.3.21","Does your process for handling evidence explicitly include complying with the:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.21",null,null,"N/A","N/A",{"$error":"#N/A"}]
[445,"2.3.21a",6,null,"2.3.21a","Police and Criminal evidence act 1984 (PACE)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.21a",null,null,3,3,"x 3"]
[446,"2.3.21b",6,null,"2.3.21b","Data Protection Act 1988?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.21b",null,null,3,3,"x 3"]
[447,"2.3.21c",6,null,"2.3.21c","Computer Misuse Act 1990?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.21c",null,null,3,3,"x 3"]
[448,"2.3.21d",6,null,"2.3.21d","Regulation of Investigatory Powers 2000 (RIPA)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.21d",null,null,3,3,"x 3"]
[449,{"$f":"VLOOKUP(A456,contentref,2,FALSE)","v":"2.3.22"},{"$f":"VLOOKUP(A456,contentref,15,FALSE)","v":4},null,{"$f":"IF(C456=1,\"Phase \"&B456,IF(C456=2,\"Step \"&VLOOKUP(A456,contentref,4,FALSE),B456))","v":"2.3.22"},{"$f":"VLOOKUP(A456,contentref,7,FALSE)","v":"When handling evidence do you maintain a chain of evidence for:"},null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"E456","v":"2.3.22"},null,null,"N/A",{"$f":"VLOOKUP(A456,contentref,8,FALSE)","v":"N/A"},{"$f":"VLOOKUP(W456,weighting_response_reverse,2,FALSE)","v":{"$error":"#N/A"}}]
[450,"2.3.22a",6,null,"2.3.22a","Paper-based information?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.22a",null,null,3,3,"x 3"]
[451,"2.3.22b",6,null,"2.3.22b","Electronic information?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.22b",null,null,3,3,"x 3"]
[452,"2.3.23",5,null,"2.3.23","Do you keep a detailed written log of every action taken during the investigation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.23",null,null,3,3,"x 3"]
[453,"2.3.24",4,null,"2.3.24","Does this action log include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.24",null,null,"N/A","N/A",{"$error":"#N/A"}]
[454,"2.3.24a",6,null,"2.3.24a","Identifying information (eg the location, serial number, model number, hostname, media access control (MAC) addresses, and IP addresses of a computer)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.24a",null,null,4,4,"x 4"]
[455,"2.3.24b",6,null,"2.3.24b","Showing who did what, where, when, how and to what?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.24b",null,null,4,4,"x 4"]
[456,"2.3.24c",6,null,"2.3.24c","Identifying where, when and how certain actions were taken by the perpetrators, such as command and control; exfiltration?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.24c",null,null,4,4,"x 4"]
[457,"2.3.24d",6,null,"2.3.24d","Name, title, and phone number of each individual who collected or handled the evidence during the investigation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.24d",null,null,4,4,"x 4"]
[458,"2.3.24e",6,null,"2.3.24e","Time and date (including time zone) of each occurrence of evidence handling?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.24e",null,null,4,4,"x 4"]
[459,"2.3.24f",6,null,"2.3.24f","Locations where the evidence was stored?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.24f",null,null,4,4,"x 4"]
[460,"2.3.25",4,null,"2.3.25","Does the content of the action log enable:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.25",null,null,"N/A","N/A",{"$error":"#N/A"}]
[461,"2.3.25a",6,null,"2.3.25a","Clear and precise evidence to be referred to at a later date?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.25a",null,null,5,5,"x 5"]
[462,"2.3.25b",6,null,"2.3.25b","The sequence of events and actions taken to be repeated by opposition experts, if required?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.25b",null,null,5,5,"x 5"]
[463,"2.3.26",4,null,"2.3.26","When gathering data for a potential prosecution, do you ensure that:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.26",null,null,"N/A","N/A",{"$error":"#N/A"}]
[464,"2.3.26a",6,null,"2.3.26a","Any systems under investigation are not turned off until an expert decision on the risk of doing so has been made?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.26a",null,null,5,5,"x 5"]
[465,"2.3.26b",6,null,"2.3.26b","Analysis is not performed on a live system under investigation before a forensically safe image has been taken?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.26b",null,null,5,5,"x 5"]
[466,"2.3.27",4,null,"2.3.27","When supporting forensic work, do you ensure that:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.27",null,null,"N/A","N/A",{"$error":"#N/A"}]
[467,"2.3.27a",6,null,"2.3.27a","Forensic work is only being performed on copies of the evidential material (eg using imaging technology)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.27a",null,null,5,5,"x 5"]
[468,"2.3.27b",6,null,"2.3.27b","The integrity of all evidential material is protected?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.3.27b",null,null,5,5,"x 5"]
[469,"2.4",2,null,"Step 4","Recovery",null,null,null,null,null,null,null,null,null,null,null,null,null,"Step 4",null,null,"","",{"$error":"#N/A"}]
[470,"",3,null,"","Objectives",null,null,null,null,null,null,null,null,null,null,null,null,null,"",null,null,"","",{"$error":"#N/A"}]
[471,"2.4.01",5,null,"2.4.01","Do you take steps to recover from a cyber security incident quickly and effectively?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.01",null,null,1,1,"x 1"]
[472,"2.4.02",4,null,"2.4.02","Do your objectives for recovering from a cyber security incident cover immediate business requirements, including:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.02",null,null,"N/A","N/A",{"$error":"#N/A"}]
[473,"2.4.02a",6,null,"2.4.02a","Restoring systems to normal operation as soon as possible?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.02a",null,null,2,2,"x 2"]
[474,"2.4.02b",6,null,"2.4.02b","Confirming that the systems are functioning normally?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.02b",null,null,2,2,"x 2"]
[475,"2.4.02c",6,null,"2.4.02c","Restricting the amount of financial loss?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.02c",null,null,3,3,"x 3"]
[476,"2.4.02d",6,null,"2.4.02d","Protecting the reputation of your organisation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.02d",null,null,3,3,"x 3"]
[477,"2.4.02e",6,null,"2.4.02e","Protecting confidential information?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.02e",null,null,3,3,"x 3"]
[478,"2.4.02f",6,null,"2.4.02f","Complying with legal and regulatory requirements (eg PCI / DSS, NERC, ISO 27001, HIPAA or FISMA)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.02f",null,null,3,3,"x 3"]
[479,"2.4.02g",6,null,"2.4.02g","Limiting liabilities if things go wrong - or if there is a court case (ie take ‘reasonable’ precautions)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.02g",null,null,3,3,"x 3"]
[480,"2.4.02h",6,null,"2.4.02h","Providing assurance to third parties that everything is under control?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.02h",null,null,3,3,"x 3"]
[481,"2.4.03",4,null,"2.4.03","Do your objectives for recovering from a cyber security incident cover wider implications for reducing the likelihood of future attacks, including:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.03",null,null,"N/A","N/A",{"$error":"#N/A"}]
[482,"2.4.03a",6,null,"2.4.03a","Remediating vulnerabilities to prevent similar incidents occurring?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.03a",null,null,2,2,"x 2"]
[483,"2.4.03b",6,null,"2.4.03b","Addressing similar weaknesses in your cyber security controls enterprise-wide and beyond?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.03b",null,null,2,2,"x 2"]
[484,"2.4.03c",6,null,"2.4.03c","Reducing the frequency and impact of future security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.03c",null,null,3,3,"x 3"]
[485,"2.4.03d",6,null,"2.4.03d","Proactively responding to the attack (eg by closing channels or 'attacking the attacker')?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.03d",null,null,5,5,"x 5"]
[486,"2.4.03e",6,null,"2.4.03e","Closing down any criminal operation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.03e",null,null,5,5,"x 5"]
[487,"2.4.03f",6,null,"2.4.03f","Punishing offenders (eg prosecuting criminals, exposing national saboteurs and disciplining insiders?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.03f",null,null,4,4,"x 4"]
[488,"",3,null,"","Recovery Plan",null,null,null,null,null,null,null,null,null,null,null,null,null,"",null,null,"","",{"$error":"#N/A"}]
[489,"2.4.04",5,null,"2.4.04","Do you have a formal recovery plan for recovering from a cyber security incident?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.04",null,null,2,2,"x 2"]
[490,"2.4.05",4,null,"2.4.05","Does your recovery plan enable you to recover from a cyber security incident:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.05",null,null,"N/A","N/A",{"$error":"#N/A"}]
[491,"2.4.05a",6,null,"2.4.05a","Quickly (ie within critical timescales)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.05a",null,null,3,3,"x 3"]
[492,"2.4.05b",6,null,"2.4.05b","Effectively (ensuring that all services have been restored to working order)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.05b",null,null,3,3,"x 3"]
[493,"2.4.05c",6,null,"2.4.05c","In a consistent manner?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.05c",null,null,3,3,"x 3"]
[494,"2.4.06",4,null,"2.4.06","Does your recovery plan cover basic recovery techniques including:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.06",null,null,"N/A","N/A",{"$error":"#N/A"}]
[495,"2.4.06a",6,null,"2.4.06a","Rebuilding infected systems (often from known ‘clean’ sources)",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.06a",null,null,2,2,"x 2"]
[496,"2.4.06b",6,null,"2.4.06b","Reconnecting networks",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.06b",null,null,2,2,"x 2"]
[497,"2.4.06c",6,null,"2.4.06c","Restoring, recreating or correcting information?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.06c",null,null,2,2,"x 2"]
[498,"2.4.06d",6,null,"2.4.06d","Documenting changes made to the infrastructure?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.06d",null,null,2,2,"x 2"]
[499,"2.4.06e",6,null,"2.4.06e","Dealing with parts of your systems or networks that cannot be recovered?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.06e",null,null,2,2,"x 2"]
[500,"2.4.07",4,null,"2.4.07","Does your recovery plan cover additional recovery techniques including:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.07",null,null,"N/A","N/A",{"$error":"#N/A"}]
[501,"2.4.07a",6,null,"2.4.07a","Replacing compromised files with clean versions?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.07a",null,null,3,3,"x 3"]
[502,"2.4.07b",6,null,"2.4.07b","Removing temporary constraints imposed during the containment period?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.07b",null,null,3,3,"x 3"]
[503,"2.4.07c",6,null,"2.4.07c","Resetting passwords on compromised accounts?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.07c",null,null,3,3,"x 3"]
[504,"2.4.07d",6,null,"2.4.07d","Installing patches, changing passwords and tightening network perimeter security, such as firewall rulesets?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.07d",null,null,4,4,"x 4"]
[505,"2.4.07e",6,null,"2.4.07e","Testing systems thoroughly – including security controls?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.07e",null,null,4,4,"x 4"]
[506,"2.4.07f",6,null,"2.4.07f","Confirming the integrity of business systems and controls?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.07f",null,null,3,3,"x 3"]
[507,"2.4.07g",6,null,"2.4.07g","Announcing the resumption of business services to all relevant stakeholders?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.07g",null,null,3,3,"x 3"]
[508,"2.4.08",4,null,"2.4.08","Is your recovery plan:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.08",null,null,"N/A","N/A",{"$error":"#N/A"}]
[509,"2.4.08a",6,null,"2.4.08a","Linked to the nature of the attack",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.08a",null,null,5,5,"x 5"]
[510,"2.4.08b",6,null,"2.4.08b","Based on a risk-based approach to recovery?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.08b",null,null,5,5,"x 5"]
[511,"2.4.08c",6,null,"2.4.08c","Designed to prevent exacerbating current risks caused by the incident or introducing new risks?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.08c",null,null,5,5,"x 5"]
[512,"",3,null,"","Validation",null,null,null,null,null,null,null,null,null,null,null,null,null,"",null,null,"","",{"$error":"#N/A"}]
[513,{"$f":"VLOOKUP(A520,contentref,2,FALSE)","v":"2.4.09"},{"$f":"VLOOKUP(A520,contentref,15,FALSE)","v":4},null,{"$f":"IF(C520=1,\"Phase \"&B520,IF(C520=2,\"Step \"&VLOOKUP(A520,contentref,4,FALSE),B520))","v":"2.4.09"},{"$f":"VLOOKUP(A520,contentref,7,FALSE)","v":"Do you validate that systems are operating normally again by:"},null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"E520","v":"2.4.09"},null,null,"N/A",{"$f":"VLOOKUP(A520,contentref,8,FALSE)","v":"N/A"},{"$f":"VLOOKUP(W520,weighting_response_reverse,2,FALSE)","v":{"$error":"#N/A"}}]
[514,"2.4.09a",6,null,"2.4.09a","Carrying out an independent penetration test of the affected systems?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.09a",null,null,4,4,"x 4"]
[515,"2.4.09b",6,null,"2.4.09b","Undertaking a security controls assessment?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.09b",null,null,4,4,"x 4"]
[516,"2.4.10",4,null,"2.4.10","To help detect further attacks (or attempted attacks) do you:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.10",null,null,"N/A","N/A",{"$error":"#N/A"}]
[517,"2.4.10a",6,null,"2.4.10a","Retain cyber security threat intelligence (including network situational awareness)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.10a",null,null,5,5,"x 5"]
[518,"2.4.10b",6,null,"2.4.10b","Monitor the network over an extended time?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.10b",null,null,5,5,"x 5"]
[519,"2.4.11",4,null,"2.4.11","Once systems have been recovered and controls have been tested do you:",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.11",null,null,"N/A","N/A",{"$error":"#N/A"}]
[520,"2.4.11a",6,null,"2.4.11a","Provided stakeholders with a brief summary of what took place?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.11a",null,null,3,3,"x 3"]
[521,"2.4.11b",6,null,"2.4.11b","Brief stakeholders within a day or so of the event?",null,null,null,null,null,null,null,null,null,null,null,null,null,"2.4.11b",null,null,3,3,"x 3"]
[522,3,1,null,"Phase 3","Follow up",null,null,null,null,null,null,null,null,null,null,null,null,null,"Phase 3",null,null,"","",{"$error":"#N/A"}]
[523,"3.1",2,null,"Step 1","Incident investigation",null,null,null,null,null,null,null,null,null,null,null,null,null,"Step 1",null,null,"","",{"$error":"#N/A"}]
[524,"3.1.01",5,null,"3.1.01","Do you investigate cyber security incidents more thoroughly after they have been resolved?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.1.01",null,null,1,1,"x 1"]
[525,"3.1.02",5,null,"3.1.02","Is your investigation carried out in a structured, systematic manner?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.1.02",null,null,2,2,"x 2"]
[526,"3.1.03",5,null,"3.1.03","Do you perform problem cause analysis for cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.1.03",null,null,3,3,"x 3"]
[527,"3.1.04",5,null,"3.1.04","Does your problem cause analysis include using appropriate investigative techniques, such as:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.1.04",null,null,4,4,"x 4"]
[528,"3.1.05",5,null,"3.1.05","Do you carry out root cause identification for cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.1.05",null,null,3,3,"x 3"]
[529,"3.1.06",5,null,"3.1.06","Does your root cause identification include using appropriate investigative techniques, such as:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.1.06",null,null,4,4,"x 4"]
[530,"3.1.07",5,null,"3.1.07","Does your root cause identification help to identify previously unknown sources of cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.1.07",null,null,5,5,"x 5"]
[531,"3.1.08",5,null,"3.1.08","Do you quantify the business impact of cyber security incidents (eg in terms of financial, reputational, management or compliance impact)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.1.08",null,null,4,4,"x 4"]
[532,"3.1.09",5,null,"3.1.09","Do you carry out sufficient investigation to identify the perpetrators(s) of the cyber security incident, which may involve specialist support, such as from forensic investigators?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.1.09",null,null,5,5,"x 5"]
[533,"3.1.10",5,null,"3.1.10","Does your investigation cover events in relation to the ‘attacker kill chain’ (ie reconnaissance, weaponize, deliver, exploit, install, command & control and act on objectives)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.1.10",null,null,5,5,"x 5"]
[534,"3.1.11",5,null,"3.1.11","Does your investigation link to wider problem management activities, such as those used in service management (eg ITIL approach)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.1.11",null,null,5,5,"x 5"]
[535,"3.2",2,null,"Step 2","Reporting",null,null,null,null,null,null,null,null,null,null,null,null,null,"Step 2",null,null,"","",{"$error":"#N/A"}]
[536,"3.2.01",5,null,"3.2.01","Are cyber security incidents reported to relevant internal stakeholders (eg information security, corporate IT departments and business units)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.2.01",null,null,1,1,"x 1"]
[537,"3.2.02",4,null,"3.2.02","Are you aware of:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.2.02",null,null,"N/A","N/A",{"$error":"#N/A"}]
[538,"3.2.02a",6,null,"3.2.02a","Your regulatory and legal reporting requirements (eg mandatory reporting to particular authorities)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.2.02a",null,null,2,2,"x 2"]
[539,"3.2.02b",6,null,"3.2.02b","What types of cyber security incident need to be reported?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.2.02b",null,null,2,2,"x 2"]
[540,"3.2.02c",6,null,"3.2.02c","To which external body each type of cyber security incidents need to be reported?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.2.02c",null,null,2,2,"x 2"]
[541,"3.2.02d",6,null,"3.2.02d","The format in which cyber security incidents need to be reported?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.2.02d",null,null,2,2,"x 2"]
[542,"3.2.02e",6,null,"3.2.02e","The objectives of reporting cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.2.02e",null,null,2,2,"x 2"]
[543,"3.2.03",5,null,"3.2.03","Do you report targeted cyber security incidents, to required authorities, such as GovCertUK (the Government’s Computer Emergency Response Team)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.2.03",null,null,3,3,"x 3"]
[544,"3.2.04",5,null,"3.2.04","Do you notify required authorities, such as GovCertUK (the Government’s Computer Emergency Response Team) of any other (non-targeted) cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.2.04",null,null,3,3,"x 3"]
[545,"3.2.05",4,null,"3.2.05","When reporting cyber security incidents, do you provide:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.2.05",null,null,"N/A","N/A",{"$error":"#N/A"}]
[546,"3.2.05a",6,null,"3.2.05a","A full description of the nature of the incident, its history, and what actions were taken to recover?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.2.05a",null,null,4,4,"x 4"]
[547,"3.2.05b",6,null,"3.2.05b","A realistic estimate of the financial cost of the incident, as well as other impacts on the business, such as in terms of damage to reputation, loss of management control or impaired growth?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.2.05b",null,null,4,4,"x 4"]
[548,"3.2.05c",6,null,"3.2.05c","Recommendations regarding enhanced or additional controls required to prevent, detect, remediate or recover from cyber security incidents more effectively?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.2.05c",null,null,4,4,"x 4"]
[549,"3.2.06",5,null,"3.2.06","Do you voluntarily report cyber security incidents to important stakeholders, such as law enforcement agencies, specialised bodies (eg NIST, ENISA or CREST), regulatory bodies with particular market sectors (eg the FSA or Bank of England in Finance) or collaborative groups?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.2.06",null,null,5,5,"x 5"]
[550,"3.2.07",5,null,"3.2.07","Do you provide recommendations to external bodies regarding enhanced or additional controls required to prevent, detect, remediate or recover from cyber security incidents more effectively?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.2.07",null,null,5,5,"x 5"]
[551,"3.3",2,null,"Step 3","Post incident review",null,null,null,null,null,null,null,null,null,null,null,null,null,"Step 3",null,null,"","",{"$error":"#N/A"}]
[552,"3.3.01",5,null,"3.3.01","Do you carry out post incident reviews for particular cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.01",null,null,1,1,"x 1"]
[553,"3.3.02",5,null,"3.3.02","Is your post incident review process formalised (eg documented and approved)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.02",null,null,2,2,"x 2"]
[554,"3.3.03",4,null,"3.3.03","Do your post incident reviews include analysing the incident management process to determine:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.03",null,null,"N/A","N/A",{"$error":"#N/A"}]
[555,"3.3.03a",6,null,"3.3.03a","How quickly actions were taken to identify, respond to and recover from the incident?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.03a",null,null,3,3,"x 3"]
[556,"3.3.03b",6,null,"3.3.03b","How long attackers were in systems before detection?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.03b",null,null,5,5,"x 5"]
[557,"3.3.03c",6,null,"3.3.03c","What actions attackers took and planned to take",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.03c",null,null,5,5,"x 5"]
[558,"3.3.03d",6,null,"3.3.03d","The level of protection maintained over critical systems and confidential information during the incident?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.03d",null,null,4,4,"x 4"]
[559,"3.3.03e",6,null,"3.3.03e","How well staff and management performed in dealing with the incident?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.03e",null,null,3,3,"x 3"]
[560,"3.3.03f",6,null,"3.3.03f","If all key discussions and decisions conducted during the eradication event were well documented?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.03f",null,null,3,3,"x 3"]
[561,"3.3.03g",6,null,"3.3.03g","The effectiveness of procedures?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.03g",null,null,3,3,"x 3"]
[562,"3.3.03h",6,null,"3.3.03h","If any steps or actions taken might have inhibited the recovery?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.03h",null,null,3,3,"x 3"]
[563,"3.3.03i",6,null,"3.3.03i","If any unforeseen events could have been prevented?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.03i",null,null,3,3,"x 3"]
[564,"3.3.04",4,null,"3.3.04","Do your post incident reviews include informing possible future actions by evaluating:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.04",null,null,"N/A","N/A",{"$error":"#N/A"}]
[565,"3.3.04a",6,null,"3.3.04a","What the staff and management can do differently the next time a similar cyber security incident occurs?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.04a",null,null,3,3,"x 3"]
[566,"3.3.04b",6,null,"3.3.04b","How information sharing with other organisations can be improved?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.04b",null,null,3,3,"x 3"]
[567,"3.3.04c",6,null,"3.3.04c","What corrective actions can prevent similar incidents in the future?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.04c",null,null,3,3,"x 3"]
[568,"3.3.04d",6,null,"3.3.04d","Any precursors or indicators that should be watched for in the future to detect similar incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.04d",null,null,4,4,"x 4"]
[569,"3.3.04e",6,null,"3.3.04e","How results can be fed back into your risk assessment methodology?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.04e",null,null,4,4,"x 4"]
[570,"3.3.05",5,null,"3.3.05","Is a report produced from your post incident review?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.05",null,null,3,3,"x 3"]
[571,"3.3.06",5,null,"3.3.06","Are the results of your post implementation review report presented to all relevant stakeholders?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.06",null,null,4,4,"x 4"]
[572,"3.3.07",5,null,"3.3.07","Is your post incident review process evaluated on a regular basis to identify any improvements that can be made to it)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.3.07",null,null,4,4,"x 4"]
[573,"3.4",2,null,"Step 4","Lessons learned",null,null,null,null,null,null,null,null,null,null,null,null,null,"Step 4",null,null,"","",{"$error":"#N/A"}]
[574,"3.4.01",5,null,"3.4.01","Do you identify lessons learned from cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.01",null,null,1,1,"x 1"]
[575,"3.4.02",4,null,"3.4.02","Are lessons learned:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.02",null,null,"N/A","N/A",{"$error":"#N/A"}]
[576,"3.4.02a",6,null,"3.4.02a","Formally documented?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.02a",null,null,2,2,"x 2"]
[577,{"$f":"VLOOKUP(A584,contentref,2,FALSE)","v":"3.4.02b"},{"$f":"VLOOKUP(A584,contentref,15,FALSE)","v":6},null,{"$f":"IF(C584=1,\"Phase \"&B584,IF(C584=2,\"Step \"&VLOOKUP(A584,contentref,4,FALSE),B584))","v":"3.4.02b"},{"$f":"VLOOKUP(A584,contentref,7,FALSE)","v":"Communicated to relevant stakeholders?"},null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"E584","v":"3.4.02b"},null,null,2,{"$f":"VLOOKUP(A584,contentref,8,FALSE)","v":2},{"$f":"VLOOKUP(W584,weighting_response_reverse,2,FALSE)","v":"x 2"}]
[578,"3.4.02c",6,null,"3.4.02c","Built upon in the form of tangible actions?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.02c",null,null,3,3,"x 3"]
[579,"3.4.02d",6,null,"3.4.02d","Used to share both key issues and good practice across all areas of the business, not just within IT and cyber security teams?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.02d",null,null,4,4,"x 4"]
[580,"3.4.03",4,null,"3.4.03","Is communication to stakeholders about lessons learned:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.03",null,null,"N/A","N/A",{"$error":"#N/A"}]
[581,"3.4.03a",6,null,"3.4.03a","Clear and concise?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.03a",null,null,2,2,"x 2"]
[582,"3.4.03b",6,null,"3.4.03b","Focused on problem resolution and control improvement?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.03b",null,null,2,2,"x 2"]
[583,"3.4.04",4,null,"3.4.04","Is communication to stakeholders about lessons learned used to:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.04",null,null,"N/A","N/A",{"$error":"#N/A"}]
[584,"3.4.04a",6,null,"3.4.04a","Help identify any gaps that remain and proposed efforts to mitigate them?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.04a",null,null,2,2,"x 2"]
[585,"3.4.04b",6,null,"3.4.04b","Inform strategic security goals?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.04b",null,null,2,2,"x 2"]
[586,"3.4.05",5,null,"3.4.05","Are formal actions plans developed to help build on lessons learned?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.05",null,null,3,3,"x 3"]
[587,"3.4.06",4,null,"3.4.06","Do actions plans:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.06",null,null,"N/A","N/A",{"$error":"#N/A"}]
[588,"3.4.06a",6,null,"3.4.06a","Consider whether technical capability gaps contributed to the attacker’s success or whether people or process gaps were the main culprit?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.06a",null,null,3,3,"x 3"]
[589,"3.4.06b",6,null,"3.4.06b","Leverage lessons learned from the incident to become more resilient in the face of future cyber security attacks?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.06b",null,null,3,3,"x 3"]
[590,"3.4.07",4,null,"3.4.07","Do actions plans include projects or initiatives, technical and nontechnical that will help:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.07",null,null,"N/A","N/A",{"$error":"#N/A"}]
[591,"3.4.07a",6,null,"3.4.07a","Reduce an attacker’s chance of success?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.07a",null,null,3,3,"x 3"]
[592,"3.4.07b",6,null,"3.4.07b","Respond to an attacker’s activities more rapidly and effectively?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.07b",null,null,3,3,"x 3"]
[593,"3.4.08",4,null,"3.4.08","Is each action:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.08",null,null,"N/A","N/A",{"$error":"#N/A"}]
[594,"3.4.08a",6,null,"3.4.08a","Assigned to a named individual?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.08a",null,null,4,4,"x 4"]
[595,"3.4.08b",6,null,"3.4.08b","Given a suitable priority?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.08b",null,null,3,3,"x 3"]
[596,"3.4.08c",6,null,"3.4.08c","Allocated a completion date?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.08c",null,null,3,3,"x 3"]
[597,"3.4.08d",6,null,"3.4.08d","Monitored to ensure that it is being completed in a timely and effective manner?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.4.08d",null,null,4,4,"x 4"]
[598,"3.5",2,null,"Step 5","Updating",null,null,null,null,null,null,null,null,null,null,null,null,null,"Step 5",null,null,"","",{"$error":"#N/A"}]
[599,"3.5.01",5,null,"3.5.01","Following a cyber security incident, do you carry out any updates (eg to your cyber security incident response approaches, controls and related documents)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.01",null,null,1,1,"x 1"]
[600,"3.5.02",4,null,"3.5.02","Following a cyber security incident, do you update your:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.02",null,null,"N/A","N/A",{"$error":"#N/A"}]
[601,"3.5.02a",6,null,"3.5.02a","Cyber security incident management methodologies or processes?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.02a",null,null,2,2,"x 2"]
[602,"3.5.02b",6,null,"3.5.02b","Cyber security incident response plan?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.02b",null,null,2,2,"x 2"]
[603,"3.5.02c",6,null,"3.5.02c","Management controls (eg training and awareness)",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.02c",null,null,2,2,"x 2"]
[604,"3.5.02d",6,null,"3.5.02d","Technical controls (eg patching, configuring system logs, and use of intrusion prevention / detection tools)",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.02d",null,null,3,3,"x 3"]
[605,"3.5.02e",6,null,"3.5.02e","Roles and responsibilities for handling incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.02e",null,null,3,3,"x 3"]
[606,"3.5.03",5,null,"3.5.03","When updating controls, do you consider the attack vectors causing most concern, which often include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.03",null,null,5,5,"x 5"]
[607,"3.5.04",5,null,"3.5.04","When updating controls, do you:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.04",null,null,5,5,"x 5"]
[608,"3.5.04a",6,null,"3.5.04a","Consider their effectiveness in relation to events in the ‘attacker kill chain’ (ie reconnaissance, weaponize, deliver, exploit, install, command & control and act on objectives)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.04a",null,null,5,5,"x 5"]
[609,"3.5.04b",6,null,"3.5.04b","Review implications for tactical and short term security projects?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.04b",null,null,5,5,"x 5"]
[610,"3.5.05",4,null,"3.5.05","Following a cyber security incident, do you feed the results of incident analysis back into your:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.05",null,null,"N/A","N/A",{"$error":"#N/A"}]
[611,"3.5.05a",6,null,"3.5.05a","Risk assessment methodologies?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.05a",null,null,4,4,"x 4"]
[612,"3.5.05b",6,null,"3.5.05b","Cyber security threat analysis?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.05b",null,null,4,4,"x 4"]
[613,"3.5.05c",6,null,"3.5.05c","Business continuity or crisis management arrangements?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.05c",null,null,3,3,"x 3"]
[614,"3.5.05d",6,null,"3.5.05d","Contractual arrangements with third party suppliers?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.05d",null,null,5,5,"x 5"]
[615,"3.5.05e",6,null,"3.5.05e","Business intelligence initiatives?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.05e",null,null,5,5,"x 5"]
[616,"3.5.06",4,null,"3.5.06","Are updates carried out:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.06",null,null,"N/A","N/A",{"$error":"#N/A"}]
[617,"3.5.06a",6,null,"3.5.06a","Using a structured, systematic process?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.06a",null,null,3,3,"x 3"]
[618,"3.5.06b",6,null,"3.5.06b","In accordance with formally approved documentation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.06b",null,null,3,3,"x 3"]
[619,"3.5.07",5,null,"3.5.07","Following a cyber security incident, do you review your state of readiness for handling a cyber security incident?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.5.07",null,null,5,5,"x 5"]
[620,"3.6",2,null,"Step 6","Trend analysis",null,null,null,null,null,null,null,null,null,null,null,null,null,"Step 6",null,null,"","",{"$error":"#N/A"}]
[621,"3.6.01",5,null,"3.6.01","Do you maintain a central register of all cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.01",null,null,3,3,"x 3"]
[622,"3.6.02",5,null,"3.6.02","Does this register link with the risk registers used to record cyber risks?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.02",null,null,4,4,"x 4"]
[623,"3.6.03",4,null,"3.6.03","Do you analyse relevant cyber security incident data regularly (trend analysis) to help:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.03",null,null,"N/A","N/A",{"$error":"#N/A"}]
[624,"3.6.03a",6,null,"3.6.03a","Evaluate patterns and trends of cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.03a",null,null,4,4,"x 4"]
[625,"3.6.03b",6,null,"3.6.03b","Identify common factors that have influenced cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.03b",null,null,4,4,"x 4"]
[626,"3.6.03c",6,null,"3.6.03c","Determine the effectiveness of controls (eg which controls are better at preventing, detecting and delaying cyber security incidents or minimising their business impact)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.03c",null,null,3,3,"x 3"]
[627,"3.6.03d",6,null,"3.6.03d","Address attribution (eg their ability to bundle data together to produce meaningful conclusions)",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.03d",null,null,3,3,"x 3"]
[628,"3.6.03e",6,null,"3.6.03e","Understand the costs and impacts associated with cyber security incidents?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.03e",null,null,3,3,"x 3"]
[629,"3.6.04",4,null,"3.6.04","Does your analysis of cyber security incident data include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.04",null,null,"N/A","N/A",{"$error":"#N/A"}]
[630,"3.6.04a",6,null,"3.6.04a","Searching your archived data, as required?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.04a",null,null,4,4,"x 4"]
[631,"3.6.04b",6,null,"3.6.04b","Protecting your archived data, as it is often sensitive?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.04b",null,null,4,4,"x 4"]
[632,"3.6.05",5,null,"3.6.05","Does your trend analysis:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.05",null,null,5,5,"x 5"]
[633,"3.6.05a",6,null,"3.6.05a","Cover all types of technology, rather than just particular types or suppliers (ie it is technology agnostic)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.05a",null,null,3,3,"x 3"]
[634,"3.6.05b",6,null,"3.6.05b","Evaluate the mean time of cyber security incident investigations (ie how long each investigation took to identify, respond to and recover from incidents)",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.05b",null,null,5,5,"x 5"]
[635,"3.6.06",5,null,"3.6.06","Does your trend analysis include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.06",null,null,5,5,"x 5"]
[636,"3.6.06a",6,null,"3.6.06a","Looking for flaws across the entire organisation or over time, rather than just concentrating on what can be perceived as a single event?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.06a",null,null,4,4,"x 4"]
[637,"3.6.06b",6,null,"3.6.06b","Sharing information about your cyber security incidents with the wider community (eg in your markets sector, membership bodies, government and law enforcement)?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.06b",null,null,4,4,"x 4"]
[638,"3.6.07",4,null,"3.6.07","Do your objectives for sharing information include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.07",null,null,"N/A","N/A",{"$error":"#N/A"}]
[639,"3.6.07a",6,null,"3.6.07a","Gaining advice on reducing vulnerabilities in your organisation?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.07a",null,null,4,4,"x 4"]
[640,"3.6.07b",6,null,"3.6.07b","Learning how to configure systems to reduce the potential attack surface?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.07b",null,null,4,4,"x 4"]
[641,{"$f":"VLOOKUP(A648,contentref,2,FALSE)","v":"3.6.07c"},6,null,"3.6.07c","Getting hold of tools and services to help you fix problems?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.07c",null,null,3,3,"x 3"]
[642,"3.6.08",4,null,"3.6.08","Do these activities include:",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.08",null,null,"N/A","N/A",{"$error":"#N/A"}]
[643,"3.6.08a",6,null,"3.6.08a","Taking part in external events, such as by attending conferences, enrolling in training programmes and subscribing to specialised services?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.08a",null,null,4,4,"x 4"]
[644,"3.6.08b",6,null,"3.6.08b","Collaborating with relevant third parties, such as participating in information exchanges, contributing to scenario-based rehearsals and introducing two-way cyber security alert mechanisms?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.08b",null,null,5,5,"x 5"]
[645,"3.6.08c",6,null,"3.6.08c","Making use of the UK Government’s certified Cyber Incident Response (CIR) services?",null,null,null,null,null,null,null,null,null,null,null,null,null,"3.6.08c",null,null,5,5,"x 5"]

{"sheet":"Content","index":6,"n_rows":646,"n_cols":24,"rows_kept":646,"cut":false,"hidden":true,"merged":[[0,18,0,19]]}
["Order","FullQ","Phase/Step","Step","Q","subQ","Text","Weighting","Phase","Step","Sub-heading","Stub","Q","subQ","Type",null,null,null,"Check order",null,"Check weighting",null,1,"Phase"]
[1,{"$f":"R2","v":1},1,"","","","Prepare","",{"$f":"IF(AND(LEN(C2)=1,LEN(D2)=0),1,\"\")","v":1},{"$f":"IF(AND(LEN(C2)=1,LEN(D2)=1,LEN(E2)=0,LEN(F2)=0),2,\"\")","v":""},{"$f":"IF(AND(LEN(C2)=0,LEN(E2)=0),3,\"\")","v":""},{"$f":"IF(AND(LEN(C2)>0,LEN(D2>0),LEN(E2)>0,LEN(F2)=0,H2=\"N/A\"),4,\"\")","v":""},{"$f":"IF(AND(LEN(C2)>0,LEN(D2>0),LEN(E2)>0,LEN(F2)=0,H2>0,H2<6),5,\"\")","v":""},{"$f":"IF(AND(LEN(C2)>0,LEN(D2>0),LEN(E2)>0,LEN(F2)>0,H2>0,H2<6),6,\"\")","v":""},{"$f":"SUM(I2:N2)","v":1},null,{"$f":"IF(LEN(E2)>0,TEXT(E2,\"00\"),\"\")","v":""},{"$f":"IF(O2=1,C2,IF(O2=2,C2&\".\"&D2,IF(O2=3,\"\",IF(O2=4,C2&\".\"&D2&\".\"&Q2,IF(O2=5,C2&\".\"&D2&\".\"&Q2,IF(O2=6,C2&\".\"&D2&\".\"&Q2&F2,\"\"))))))","v":1},{"$f":"IF(O2=O1,IF(NOT(R2>R1),1,\"\"),\"\")","v":""},{"$f":"IF(NOT(R2>R1),1,\"\")","v":""},{"$f":"IF(O2<4,IF(LEN(H2)=0,\"\",1),IF(O2=4,IF(H2=\"N/A\",\"\",1),IF(AND(O2>4,O2<7),IF(AND(H2>0,H2<6),\"\",1),1)))","v":""},null,2,"Step"]
[2,{"$f":"R3","v":"1.1"},1,1,"","","Criticality assessment","","",2,"","","","",2,null,"","1.1","",{"$f":"IF(NOT(R3>R2),1,\"\")","v":""},{"$f":"IF(O3<4,IF(LEN(H3)=0,\"\",1),IF(O3=4,IF(H3=\"N/A\",\"\",1),IF(AND(O3>4,O3<7),IF(AND(H3>0,H3<6),\"\",1),1)))","v":""},null,3,"Sub-heading"]
[3,"1.1.01",1,1,1,"","Have you defined your critical information assets?",1,"","","","",5,"",5,null,"01","1.1.01","","","",null,4,"Stub"]
[4,"1.1.02",1,1,2,"","Does your defined set of critical information assets include:","N/A","","","",4,"","",4,null,"02","1.1.02","","","",null,5,"Q"]
[5,"1.1.02a",1,1,2,"a","Important business applications?",3,"","","","","",6,6,null,"02","1.1.02a","","","",null,6,"subQ"]
[6,"1.1.02b",1,1,2,"b","Key systems and networks (infrastructure)?",3,"","","","","",6,6,null,"02","1.1.02b","","",""]
[7,"1.1.02c",1,1,2,"c","Confidential data?",3,"","","","","",6,6,null,"02","1.1.02c","","",""]
[8,"1.1.03",1,1,3,"","Is the criticality of these assets:","N/A","","","",4,"","",4,null,"03","1.1.03","","",""]
[9,"1.1.03a",1,1,3,"a","Defined in a structured, systematic manner?",3,"","","","","",6,6,null,"03","1.1.03a","","",""]
[10,"1.1.03b",1,1,3,"b","Based on an analysis of their strategic or monetary value?",3,"","","","","",6,6,null,"03","1.1.03b","","",""]
[11,"1.1.04",1,1,4,"","Have you identified:","N/A","","","",4,"","",4,null,"04","1.1.04","","",""]
[12,"1.1.04a",1,1,4,"a","Where your critical systems are physically located in your organisation and in third party organisations?",4,"","","","","",6,6,null,"04","1.1.04a","","",""]
[13,"1.1.04b",1,1,4,"b","On which systems your confidential information is stored or processed (eg on servers, devices and in the cloud)?",4,"","","","","",6,6,null,"04","1.1.04b","","",""]
[14,"1.1.05",1,1,5,"","Have you assigned responsibility for protecting your critical assets to capable, named individuals?",5,"","","","",5,"",5,null,"05","1.1.05","","",""]
[15,"1.1.06",1,1,6,"","Do you conduct business impact assessments of your critical assets (either individually or in aggregate) to determine the likely (or actual) level of business impact caused if your organisation was hit by a cyber security incident?",3,"","","","",5,"",5,null,"06","1.1.06","","",""]
[16,"1.1.07",1,1,7,"","Do your business impact assessments determine the level of business impact if:","N/A","","","",4,"","",4,null,"07","1.1.07","","",""]
[17,"1.1.07a",1,1,7,"a","Sensitive or other confidential information was disclosed to unauthorised parties?",3,"","","","","",6,6,null,"07","1.1.07a","","",""]
[18,"1.1.07b",1,1,7,"b","Important information was compromised (eg key data is inaccurate or wrongly processed)?",3,"","","","","",6,6,null,"07","1.1.07b","","",""]
[19,"1.1.07c",1,1,7,"c","Critical systems or infrastructure were no longer available?",3,"","","","","",6,6,null,"07","1.1.07c","","",""]
[20,"1.1.08",1,1,8,"","Do your business impact assessments cover all relevant types of business consequences that could affect your organisation, including:","N/A","","","",4,"","",4,null,"08","1.1.08","","",""]
[21,"1.1.08a",1,1,8,"a","Potential or actual financial loss?",4,"","","","","",6,6,null,"08","1.1.08a","","",""]
[22,"1.1.08b",1,1,8,"b","Compliance implications (eg fines, business restrictions or other penalties)?",4,"","","","","",6,6,null,"08","1.1.08b","","",""]
[23,"1.1.08c",1,1,8,"c","Damage to reputation?",4,"","","","","",6,6,null,"08","1.1.08c","","",""]
[24,"1.1.08d",1,1,8,"d","Loss of management control?",4,"","","","","",6,6,null,"08","1.1.08d","","",""]
[25,"1.1.08e",1,1,8,"e","Impaired growth?",4,"","","","","",6,6,null,"08","1.1.08e","","",""]
[26,"1.2",1,2,"","","Threat analysis","","",2,"","","","",2,null,"","1.2",{"$f":"IF(O27=O26,IF(NOT(R27>R26),1,\"\"),\"\")","v":""},{"$f":"IF(NOT(R27>R26),1,\"\")","v":""},""]
[27,"1.2.01",1,2,1,"","Do you analyse cyber security threats and associated vulnerabilities?",1,"","","","",5,"",5,null,"01","1.2.01","","",""]
[28,"1.2.02",1,2,2,"","Is your cyber security threat analysis:","N/A","","","",4,"","",4,null,"02","1.2.02","","",""]
[29,"1.2.02a",1,2,2,"a","Carried out in a structured, systematic manner?",3,"","","","","",6,6,null,"02","1.2.02a","","",""]
[30,"1.2.02b",1,2,2,"b","Conducted on a regular basis?",2,"","","","","",6,6,null,"02","1.2.02b","","",""]
[31,"1.2.02c",1,2,2,"c","Linked to a knowledge base of known attack types and attack agents?",4,"","","","","",6,6,null,"02","1.2.02c","","",""]
[32,"1.2.03",1,2,3,"","Does your cyber security threat analysis give you a good understanding of the level of threat to your organisation from different types of cyber security incidents?",4,"","","","",5,"",5,null,"03","1.2.03","","",""]
[33,"1.2.04",1,2,4,"","Does your threat analysis focus on:","N/A","","","",4,"","",4,null,"04","1.2.04","","",""]
[34,"1.2.04a",1,2,4,"a","The cyber security landscape relevant to your organisation?",4,"","","","","",6,6,null,"04","1.2.04a","","",""]
[35,"1.2.04b",1,2,4,"b","Relevant sources of threats (eg organised crime syndicates, state-sponsored organisations, extremist groups, hacktivists, insiders – or a combination of these)?",4,"","","","","",6,6,null,"04","1.2.04b","","",""]
[36,"1.2.04c",1,2,4,"c","Which cyber security threats are most likely to affect your critical information assets?",4,"","","","","",6,6,null,"04","1.2.04c","","",""]
[37,"1.2.04d",1,2,4,"d","Vulnerabilities to each particular cyber security threat (eg control weaknesses or special circumstances)?",3,"","","","","",6,6,null,"04","1.2.04d","","",""]
[38,"1.2.04e",1,2,4,"e","Possible threat vectors for attacks to exploit (eg Internet downloads, unauthorised USB sticks, misconfigured systems, inappropriate access, or collusion)?",4,"","","","","",6,6,null,"04","1.2.04e","","",""]
[39,"1.2.04f",1,2,4,"f","The technical infrastructure that supports your critical assets?",3,"","","","","",6,6,null,"04","1.2.04f","","",""]
[40,"1.2.05",1,2,5,"","Does your cyber security threat analysis address all stages of a cyber security attack, including:","N/A","","","",4,"","",4,null,"05","1.2.05","","",""]
[41,"1.2.05a",1,2,5,"a","Reconnaissance (gaining information about a target individual or organisation for use in a future cyber-attack)?",5,"","","","","",6,6,null,"05","1.2.05a","","",""]
[42,"1.2.05b",1,2,5,"b","Disruption (eg to a business, system or service)?",2,"","","","","",6,6,null,"05","1.2.05b","","",""]
[43,"1.2.05c",1,2,5,"c","Extraction (eg obtaining money, sensitive information or user credentials from the target)?",3,"","","","","",6,6,null,"05","1.2.05c","","",""]
[44,"1.2.05d",1,2,5,"d","Manipulation (eg adding, changing or deleting key information)?",3,"","","","","",6,6,null,"05","1.2.05d","","",""]
[45,"1.2.06",1,2,6,"","Does your cyber security threat analysis cover:","N/A","","","",4,"","",4,null,"06","1.2.06","","",""]
[46,"1.2.06a",1,2,6,"a","The ‘attacker kill chain’ (ie reconnaissance, weaponize, deliver, exploit, install, command & control and act on objectives)?",5,"","","","","",6,6,null,"06","1.2.06a","","",""]
[47,"1.2.06b",1,2,6,"b","Both the attacker and defender aspects of an attack?",5,"","","","","",6,6,null,"06","1.2.06b","","",""]
[48,"1.2.07",1,2,7,"","Do you put your cyber security threat analysis into context, based on a solid understanding of:","N/A","","","",4,"","",4,null,"07","1.2.07","","",""]
[49,"1.2.07a",1,2,7,"a","The nature of your business, business strategy, business processes and risk appetite?",5,"","","","","",6,6,null,"07","1.2.07a","","",""]
[50,"1.2.07b",1,2,7,"b","Key dependencies your organisation has; for example on people, technology, suppliers, partners and the environment in which you operate?",5,"","","","","",6,6,null,"07","1.2.07b","","",""]
[51,"1.2.07c",1,2,7,"c","The assets which are most likely to be targeted, such as infrastructure, money, intellectual property or people – and the computer systems that support them?",5,"","","","","",6,6,null,"07","1.2.07c","","",""]
[52,"1.2.08",1,2,8,"","Does your threat analysis include information from cyber security threat intelligence sources?",4,"","","","",5,"",5,null,"08","1.2.08","","",""]
[53,"1.2.09",1,2,9,"","Do your cyber security threat intelligence sources include information:","N/A","","","",4,"","",4,null,"09","1.2.09","","",""]
[54,"1.2.09a",1,2,9,"a","You have specially compiled in your own organisation?",4,"","","","","",6,6,null,"09","1.2.09a","","",""]
[55,"1.2.09b",1,2,9,"b","Obtained from the government, collaborative groups, competitors or CERTs and vendors)?",4,"","","","","",6,6,null,"09","1.2.09b","","",""]
[56,"1.2.09c",1,2,9,"c","Purchased from reputable vendors?",5,"","","","","",6,6,null,"09","1.2.09c","","",""]
[57,"1.2.10",1,2,10,"","Does your threat analysis include actionable cyber security threat intelligence, enabling positive changes to be made immediately?",5,"","","","",5,"",5,null,"10","1.2.10","","",""]
[58,"1.2.11",1,2,11,"","Do you perform realistic simulations of possible cyber security incidents (eg by carrying out scenario testing)?",4,"","","","",5,"",5,null,"11","1.2.11","","",""]
[59,"1.2.12",1,2,12,"","Do you make scenario testing more effective by ensuring it includes:","N/A","","","",4,"","",4,null,"12","1.2.12","","",""]
[60,"1.2.12a",1,2,12,"a","Simulating a real attack as closely as possible?",5,"","","","","",6,6,null,"12","1.2.12a","","",""]
[61,"1.2.12b",1,2,12,"b","Evaluating situational awareness and applicability to your organisation?",5,"","","","","",6,6,null,"12","1.2.12b","","",""]
[62,"1.2.12c",1,2,12,"c","Initiating a fictional (but realistic) attack internally and assessing how well you can respond to it?",5,"","","","","",6,6,null,"12","1.2.12c","","",""]
[63,"1.2.13",1,2,13,"","Do you carry out cyber security scenarios:","N/A","","","",4,"","",4,null,"13","1.2.13","","",""]
[64,"1.2.13a",1,2,13,"a","That result in different outcomes such as unavailability, data theft and data/systems corruption?",5,{"$f":"IF(AND(LEN(C65)=1,LEN(D65)=0),1,\"\")","v":""},{"$f":"IF(AND(LEN(C65)=1,LEN(D65)=1,LEN(E65)=0,LEN(F65)=0),2,\"\")","v":""},{"$f":"IF(AND(LEN(C65)=0,LEN(E65)=0),3,\"\")","v":""},{"$f":"IF(AND(LEN(C65)>0,LEN(D65>0),LEN(E65)>0,LEN(F65)=0,H65=\"N/A\"),4,\"\")","v":""},{"$f":"IF(AND(LEN(C65)>0,LEN(D65>0),LEN(E65)>0,LEN(F65)=0,H65>0,H65<6),5,\"\")","v":""},{"$f":"IF(AND(LEN(C65)>0,LEN(D65>0),LEN(E65)>0,LEN(F65)>0,H65>0,H65<6),6,\"\")","v":6},{"$f":"SUM(I65:N65)","v":6},null,{"$f":"IF(LEN(E65)>0,TEXT(E65,\"00\"),\"\")","v":"13"},{"$f":"IF(O65=1,C65,IF(O65=2,C65&\".\"&D65,IF(O65=3,\"\",IF(O65=4,C65&\".\"&D65&\".\"&Q65,IF(O65=5,C65&\".\"&D65&\".\"&Q65,IF(O65=6,C65&\".\"&D65&\".\"&Q65&F65,\"\"))))))","v":"1.2.13a"},{"$f":"IF(O65=O64,IF(NOT(R65>R64),1,\"\"),\"\")","v":""},"",""]
[65,{"$f":"R66","v":"1.2.13b"},1,2,13,"b","Where your systems and/or data have suffered integrity loss?",5,"","","","","",6,6,null,"13","1.2.13b","",{"$f":"IF(NOT(R66>R65),1,\"\")","v":""},""]
[66,"1.2.14",1,2,14,"","Do you carry out periodic scenario-based training, helping to ensure that relevant individuals understand their role and prepare them to handle cyber security incidents?",4,"","","","",5,"",5,null,"14","1.2.14","","",{"$f":"IF(O67<4,IF(LEN(H67)=0,\"\",1),IF(O67=4,IF(H67=\"N/A\",\"\",1),IF(AND(O67>4,O67<7),IF(AND(H67>0,H67<6),\"\",1),1)))","v":""}]
[67,"1.2.15",1,2,15,"","Does this scenario-based training work through a series of attack scenarios fine-tuned to the threats and vulnerabilities your organisation face?",5,"","","","",5,"",5,null,"15","1.2.15","","",""]
[68,"1.2.16",1,2,16,"","Do you evaluate newly emerging methods of conducting more advanced cyber security threat analysis to help improve the effectiveness of your cyber security threat analysis?",5,"","","","",5,"",5,null,"16","1.2.16","","",""]
[69,"1.3",1,3,"","","People, Process, Technology and Information","","",2,"","","","",2,null,"","1.3",{"$f":"IF(O70=O69,IF(NOT(R70>R69),1,\"\"),\"\")","v":""},{"$f":"IF(NOT(R70>R69),1,\"\")","v":""},""]
[70,"","","","","","People","","","",3,"","","",3,null,"","","",1,""]
[71,"1.3.01",1,3,1,"","Do you have a point of contact for handling cyber security incidents?",1,"","","","",5,"",5,null,"01","1.3.01","","",""]
[72,"1.3.02",1,3,2,"","Have all employees been:","N/A","","","",4,"","",4,null,"02","1.3.02","","",""]
[73,"1.3.02a",1,3,2,"a","Made aware of the risk from cyber security attacks",2,"","","","","",6,6,null,"02","1.3.02a","","",""]
[74,"1.3.02b",1,3,2,"b","Briefed on how to report actual and suspected cyber security incidents?",1,"","","","","",6,6,null,"02","1.3.02b","","",""]
[75,"1.3.02c",1,3,2,"c","Shown how to help reduce the likelihood and frequency of these attacks?",2,"","","","","",6,6,null,"02","1.3.02c","","",""]
[76,"1.3.03",1,3,3,"","Do you have a cyber security incident response team?",2,"","","","",5,"",5,null,"03","1.3.03","","",""]
[77,"1.3.04",1,3,4,"","Does your cyber security incident response team understand the:","N/A","","","",4,"","",4,null,"04","1.3.04","","",""]
[78,"1.3.04a",1,3,4,"a","Key concepts of cyber security incident response (eg drivers, definitions, approaches)?",2,"","","","","",6,6,null,"04","1.3.04a","","",""]
[79,"1.3.04b",1,3,4,"b","Requirements for reporting certain types of cyber security incident?",2,"","","","","",6,6,null,"04","1.3.04b","","",""]
[80,"1.3.05",1,3,5,"","Is your cyber security incident response team:","N/A","","","",4,"","",4,null,"05","1.3.05","","",""]
[81,"1.3.05a",1,3,5,"a","Supported by key stakeholders, such as senior management, the PR department, HR, Legal, IT and business unit management",2,"","","","","",6,6,null,"05","1.3.05a","","",""]
[82,"1.3.05b",1,3,5,"b","Given the authority to confiscate or disconnect equipment and monitor suspicious activity",3,"","","","","",6,6,null,"05","1.3.05b","","",""]
[83,"1.3.05c",1,3,5,"c","Able to undertake external communications and information sharing (eg what can be shared with whom, when, and over what channels)",3,"","","","","",6,6,null,"05","1.3.05c","","",""]
[84,"1.3.05d",1,3,5,"d","Clear about escalation points in the cyber security incident management process",2,"","","","","",6,6,null,"05","1.3.05d","","",""]
[85,"1.3.06",1,3,6,"","Is your cyber security incident response team empowered – without fear of blame or recrimination - to:","N/A","","","",4,"","",4,null,"06","1.3.06","","",""]
[86,"1.3.06a",1,3,6,"a","Escalate the problem to management in a timely manner?",3,"","","","","",6,6,null,"06","1.3.06a","","",""]
[87,"1.3.06b",1,3,6,"b","Explain the possible consequences of the cyber security incident – and its potential impact on the business?",3,"","","","","",6,6,null,"06","1.3.06b","","",""]
[88,"1.3.06c",1,3,6,"c","Get relevant outsiders involved?",3,"","","","","",6,6,null,"06","1.3.06c","","",""]
[89,"1.3.07",1,3,7,"","Does your cyber security incident response team have access to individuals (internal and external) who have a deep understanding about:","N/A","","","",4,"","",4,null,"07","1.3.07","","",""]
[90,"1.3.07a",1,3,7,"a","How to carry out sophisticated cyber security incident investigations quickly and effectively",4,"","","","","",6,6,null,"07","1.3.07a","","",""]
[91,"1.3.07b",1,3,7,"b","The different types of cyber security attacker (and how they operate)?",3,"","","","","",6,6,null,"07","1.3.07b","","",""]
[92,"1.3.07c",1,3,7,"c","Advanced persistent threats?",4,"","","","","",6,6,null,"07","1.3.07c","","",""]
[93,"1.3.07d",1,3,7,"d","Methods of compromising systems?",3,"","","","","",6,6,null,"07","1.3.07d","","",""]
[94,"1.3.07e",1,3,7,"e","Sophisticated analysis of malware?",5,"","","","","",6,6,null,"07","1.3.07e","","",""]
[95,"1.3.07f",1,3,7,"f","Forensics?",5,"","","","","",6,6,null,"07","1.3.07f","","",""]
[96,"1.3.08",1,3,8,"","Does your cyber security incident team have a cyber security incident response toolkit to help investigations?",4,"","","","",5,"",5,null,"08","1.3.08","","",""]
[97,"1.3.09",1,3,9,"","Does your cyber security incident response toolkit include:","N/A","","","",4,"","",4,null,"09","1.3.09","","",""]
[98,"1.3.09a",1,3,9,"a","A suitable method for recording all aspects of the incident, ideally using a template to ensure a consistent, comprehensive approach?",4,"","","","","",6,6,null,"09","1.3.09a","","",""]
[99,"1.3.09b",1,3,9,"b","Contact details of all key stakeholders, such as internal and external investigators, technical specialist, suppliers, legal resources, human resources, public relations and business management?",3,"","","","","",6,6,null,"09","1.3.09b","","",""]
[100,"1.3.09c",1,3,9,"c","Incident analysis resources: such as port lists; packet sniffers and protocol analysers; documentation for security systems (eg IDS, SIEM, malware protection); network diagrams; and a list of critical assets.",5,"","","","","",6,6,null,"09","1.3.09c","","",""]
[101,"1.3.09d",1,3,9,"d","Forensic imaging tools (eg an imaging laptop; encrypted disks for image storage; mobile phone; digital camera / recorder; portable printer; removable media with trusted versions of programs; and evidence gathering accessories)?",5,"","","","","",6,6,null,"09","1.3.09d","","",""]
[102,"1.3.09e",1,3,9,"e","Physical tools (eg screwdrivers, Allen keys, wire cutters, evidence bags, gloves and torch)?",4,"","","","","",6,6,null,"09","1.3.09e","","",""]
[103,"","","","","","Process","","","",3,"","","",3,null,"","","",1,""]
[104,"1.3.10",1,3,10,"","Do you have:","N/A","","","",4,"","",4,null,"10","1.3.10","","",""]
[105,"1.3.10a",1,3,10,"a","Policies, processes, plans or methodologies to help you respond to cyber security incidents effectively?",1,"","","","","",6,6,null,"10","1.3.10a","","",""]
[106,"1.3.10b",1,3,10,"b","A formal cyber security incident response process?",1,"","","","","",6,6,null,"10","1.3.10b","","",""]
[107,"1.3.10c",1,3,10,"c","A strategic approach for handling cyber security incidents?",3,"","","","","",6,6,null,"10","1.3.10c","","",""]
[108,"1.3.11",1,3,11,"","Does your cyber security incident response strategy include:","N/A","","","",4,"","",4,null,"11","1.3.11","","",""]
[109,"1.3.11a",1,3,11,"a","Identifying the key components of an effective cyber security incident response process?",4,"","","","","",6,6,null,"11","1.3.11a","","",""]
[110,"1.3.11b",1,3,11,"b","Aligning cyber security incident response with business continuity plans and arrangements?",5,"","","","","",6,6,null,"11","1.3.11b","","",""]
[111,"1.3.11c",1,3,11,"c","Addressing arrangements corporate-wide (including third parties, where needed)?",5,"","","","","",6,6,null,"11","1.3.11c","","",""]
[112,"1.3.11d",1,3,11,"d","Providing sufficient funding and resources to deal with cyber security incidents effectively?",5,"","","","","",6,6,null,"11","1.3.11d","","",""]
[113,"1.3.11e",1,3,11,"e","Appointing individuals in advance who have sufficient decision-making authority to take action fast in an emergency situation?",4,"","","","","",6,6,null,"11","1.3.11e","","",""]
[114,"1.3.11f",1,3,11,"f","Determining what activities should be outsourced to an external cyber security incident response specialist",4,"","","","","",6,6,null,"11","1.3.11f","","",""]
[115,"1.3.11g",1,3,11,"g","Developing criteria upon which to base selection of the right cyber security incident response providers, ensuring value for money?",4,"","","","","",6,6,null,"11","1.3.11g","","",""]
[116,"1.3.11h",1,3,11,"h","Evaluating the benefits offered by appropriately certified cyber security incident response providers?",4,"","","","","",6,6,null,"11","1.3.11h","","",""]
[117,"1.3.12",1,3,12,"","Does your cyber security incident response process take account of:","N/A","","","",4,"","",4,null,"12","1.3.12","","",""]
[118,"1.3.12a",1,3,12,"a","Definitions required to support the Triage element of the cyber security incident process (eg to define what criteria re required to classify and prioritise incidents)?",4,"","","","","",6,6,null,"12","1.3.12a","","",""]
[119,"1.3.12b",1,3,12,"b","Advice and guidance provided on government websites, such as the CESG Top ten steps to cyber security and GovCertUK incident response guidelines?",3,"","","","","",6,6,null,"12","1.3.12b","","",""]
[120,"1.3.12c",1,3,12,"c","Publicly available traditional or cyber security specific incident response guides, such as the NIST Computer Security Handling Guide (Special Publication 800-61), the Responding to targeted cyber attacks report from ISACA (collaborating with E&Y) and the CREST Cyber Security Incident Response Guide?",3,"","","","","",6,6,null,"12","1.3.12c","","",""]
[121,"1.3.13",1,3,13,"","Does your cyber security incident response process cover all stage of an investigation, which includes:","N/A","","","",4,"","",4,null,"13","1.3.13","","",""]
[122,"1.3.13a",1,3,13,"a","Identifying cyber security incidents?",2,"","","","","",6,6,null,"13","1.3.13a","","",""]
[123,"1.3.13b",1,3,13,"b","Investigating the situation (including triage)?",2,"","","","","",6,6,null,"13","1.3.13b","","",""]
[124,"1.3.13c",1,3,13,"c","Taking appropriate action (eg contain incident and eradicate cause)?",2,"","","","","",6,6,null,"13","1.3.13c","","",""]
[125,"1.3.13d",1,3,13,"d","Recovering systems, data and connectivity?",2,"","","","","",6,6,null,"13","1.3.13d","","",""]
[126,"1.3.14",1,3,14,"","Does your cyber security incident response process state:","N/A","","","",4,"","",4,null,"14","1.3.14","","",""]
[127,"1.3.14a",1,3,14,"a","Who should be responsible for each step?",2,{"$f":"IF(AND(LEN(C128)=1,LEN(D128)=0),1,\"\")","v":""},{"$f":"IF(AND(LEN(C128)=1,LEN(D128)=1,LEN(E128)=0,LEN(F128)=0),2,\"\")","v":""},{"$f":"IF(AND(LEN(C128)=0,LEN(E128)=0),3,\"\")","v":""},{"$f":"IF(AND(LEN(C128)>0,LEN(D128>0),LEN(E128)>0,LEN(F128)=0,H128=\"N/A\"),4,\"\")","v":""},{"$f":"IF(AND(LEN(C128)>0,LEN(D128>0),LEN(E128)>0,LEN(F128)=0,H128>0,H128<6),5,\"\")","v":""},{"$f":"IF(AND(LEN(C128)>0,LEN(D128>0),LEN(E128)>0,LEN(F128)>0,H128>0,H128<6),6,\"\")","v":6},{"$f":"SUM(I128:N128)","v":6},null,{"$f":"IF(LEN(E128)>0,TEXT(E128,\"00\"),\"\")","v":"14"},{"$f":"IF(O128=1,C128,IF(O128=2,C128&\".\"&D128,IF(O128=3,\"\",IF(O128=4,C128&\".\"&D128&\".\"&Q128,IF(O128=5,C128&\".\"&D128&\".\"&Q128,IF(O128=6,C128&\".\"&D128&\".\"&Q128&F128,\"\"))))))","v":"1.3.14a"},{"$f":"IF(O128=O127,IF(NOT(R128>R127),1,\"\"),\"\")","v":""},"",""]
[128,{"$f":"R129","v":"1.3.14b"},1,3,14,"b","How it should be carried out?",2,"","","","","",6,6,null,"14","1.3.14b","",{"$f":"IF(NOT(R129>R128),1,\"\")","v":""},""]
[129,"1.3.14c",1,3,14,"c","Who to contact for support?",2,"","","","","",6,6,null,"14","1.3.14c","","",""]
[130,"1.3.15",1,3,15,"","Does your cyber security incident response process include pre-agreed response actions (eg using attack play-books) for particular situations",5,"","","","",5,"",5,null,"15","1.3.15","","",{"$f":"IF(O131<4,IF(LEN(H131)=0,\"\",1),IF(O131=4,IF(H131=\"N/A\",\"\",1),IF(AND(O131>4,O131<7),IF(AND(H131>0,H131<6),\"\",1),1)))","v":""}]
[131,"1.3.16",1,3,16,"","Is your cyber security incident response process integrated with:","N/A","","","",4,"","",4,null,"16","1.3.16","","",""]
[132,"1.3.16a",1,3,16,"a","Relevant day-to-day third parties (eg suppliers, partners and customers)?",2,"","","","","",6,6,null,"16","1.3.16a","","",""]
[133,"1.3.16b",1,3,16,"b","Specialist third party security experts, such as outsourced security services (eg security device management) to Managed Security Services Providers (MSSP) or a Security Operations Centre (SOC)?",2,"","","","","",6,6,null,"16","1.3.16b","","",""]
[134,"1.3.16c",1,3,16,"c","Human Resources (HR), if prosecution is likely or the culprit is suspected to be internal?",2,"","","","","",6,6,null,"16","1.3.16c","","",""]
[135,"1.3.16d",1,3,16,"d","Legal counsel and Public Relations (PR)?",2,"","","","","",6,6,null,"16","1.3.16d","","",""]
[136,"1.3.17",1,3,17,"","Does your cyber security incident response process address important security requirements during the investigation, which includes:","N/A","","","",4,"","",4,null,"17","1.3.17","","",""]
[137,"1.3.17a",1,3,17,"a","Maintaining the integrity of your most important data in a compromised environment)?",4,"","","","","",6,6,null,"17","1.3.17a","","",""]
[138,"1.3.17b",1,3,17,"b","Preventing (or reducing) unauthorised disclosure of confidential information?",4,"","","","","",6,6,null,"17","1.3.17b","","",""]
[139,"1.3.17c",1,3,17,"c","Complying with data privacy or data protection requirements (eg reporting the loss of personal data)?",3,"","","","","",6,6,null,"17","1.3.17c","","",""]
[140,"1.3.17d",1,3,17,"d","Monitoring new (and existing) vulnerabilities during the cyber security attack?",4,"","","","","",6,6,null,"17","1.3.17d","","",""]
[141,"1.3.18",1,3,18,"","Has your cyber security incident response process been:","N/A","","","",4,"","",4,null,"18","1.3.18","","",""]
[142,"1.3.18a",1,3,18,"a","Signed off by appropriate management?",2,"","","","","",6,6,null,"18","1.3.18a","","",""]
[143,"1.3.18b",1,3,18,"b","Kept up to date?",2,"","","","","",6,6,null,"18","1.3.18b","","",""]
[144,"1.3.18c",1,3,18,"c","Reviewed on a regular basis?",2,"","","","","",6,6,null,"18","1.3.18c","","",""]
[145,"1.3.19",1,3,19,"","Does your cyber security incident response process enable you to respond to a cyber security incident:","N/A","","","",4,"","",4,null,"19","1.3.19","","",""]
[146,"1.3.19a",1,3,19,"a","Quickly (ie within critical timescales)?",4,"","","","","",6,6,null,"19","1.3.19a","","",""]
[147,"1.3.19b",1,3,19,"b","Effectively (ensuring that all services have been restored to working order)?",4,"","","","","",6,6,null,"19","1.3.19b","","",""]
[148,"1.3.19c",1,3,19,"c","In a consistent manner?",4,"","","","","",6,6,null,"19","1.3.19c","","",""]
[149,"1.3.20",1,3,20,"","Does your cyber security incident response process enable you to:","N/A","","","",4,"","",4,null,"20","1.3.20","","",""]
[150,"1.3.20a",1,3,20,"a","Cope with many different scenarios?",4,"","","","","",6,6,null,"20","1.3.20a","","",""]
[151,"1.3.20b",1,3,20,"b","Proactively implement and adapt approaches as needed?",5,"","","","","",6,6,null,"20","1.3.20b","","",""]
[152,"1.3.21",1,3,21,"","Is your cyber security incident response process tested:","N/A","","","",4,"","",4,null,"21","1.3.21","","",""]
[153,"1.3.21a",1,3,21,"a","Thoroughly using a range of different scenarios?",3,"","","","","",6,6,null,"21","1.3.21a","","",""]
[154,"1.3.21b",1,3,21,"b","On a regular basis?",2,"","","","","",6,6,null,"21","1.3.21b","","",""]
[155,"1.3.21c",1,3,21,"c","In conjunction with relevant third parties?",4,"","","","","",6,6,null,"21","1.3.21c","","",""]
[156,"1.3.22",1,3,22,"","Do you analyse the results of these tests?",4,"","","","",5,"",5,null,"22","1.3.22","","",""]
[157,"1.3.23",1,3,23,"","Do you address weaknesses identified during these tests?",4,"","","","",5,"",5,null,"23","1.3.23","","",""]
[158,"","","","","","Technology","","","",3,"","","",3,null,"","","",1,""]
[159,"1.3.23",1,3,23,"","Do you have technical arrangements to support cyber security incident response?",1,"","","","",5,"",5,null,"23","1.3.23","","",""]
[160,"1.3.24",1,3,24,"","Do your technical arrangements for supporting cyber security incident response provide you (and any relevant third parties) with sufficient understanding of:","N/A","","","",4,"","",4,null,"24","1.3.24","","",""]
[161,"1.3.24a",1,3,24,"a","Your IT infrastructure?",3,"","","","","",6,6,null,"24","1.3.24a","","",""]
[162,"1.3.24b",1,3,24,"b","The topology of your networks (eg via a suitable network diagram)?",3,"","","","","",6,6,null,"24","1.3.24b","","",""]
[163,"1.3.25",1,3,25,"","Do your technical arrangements for supporting cyber security incident response include:","N/A","","","",4,"","",4,null,"25","1.3.25","","",""]
[164,"1.3.25a",1,3,25,"a","An appropriate set of incident response tools?",3,"","","","","",6,6,null,"25","1.3.25a","","",""]
[165,"1.3.25b",1,3,25,"b","Implementing technical controls like firewalls, mail filters and intrusion detection systems (IDS) or data loss prevention (DLP) technology?",4,"","","","","",6,6,null,"25","1.3.25b","","",""]
[166,"1.3.25c",1,3,25,"c","Logging the right events and turning on the appropriate logging features?",3,"","","","","",6,6,null,"25","1.3.25c","","",""]
[167,"1.3.25d",1,3,25,"d","Maintaining sufficient historical data (eg because logs are overwritten or you do not have sufficient storage space)?",4,"","","","","",6,6,null,"25","1.3.25d","","",""]
[168,"1.3.25e",1,3,25,"e","Deploying other suitable technical controls, as required, such as patching?",3,"","","","","",6,6,null,"25","1.3.25e","","",""]
[169,"1.3.25f",1,3,25,"f","Identifying your Internet points of presence (‘touch points’)?",4,"","","","","",6,6,null,"25","1.3.25f","","",""]
[170,"1.3.26",1,3,26,"","Do your technical arrangements for support cyber security incident response provide you with enough relevant knowledge to conduct a suitable investigation?",5,"","","","",5,"",5,null,"26","1.3.26","","",""]
[171,"","","","","","Information","","","",3,"","","",3,null,"","","",1,""]
[172,"1.3.27",1,3,27,"","Do you have information readily available that will help the cyber security incident response team (including third party experts) to respond quickly and effectively?",3,"","","","",5,"",5,null,"27","1.3.27","","",""]
[173,"1.3.28",1,3,28,"","Does this information include relevant details about:","N/A","","","",4,"","",4,null,"28","1.3.28","","",""]
[174,"1.3.28a",1,3,28,"a","Business management (eg what the business does, main point(s) of contact, approach to business impact assessment)?",3,"","","","","",6,6,null,"28","1.3.28a","","",""]
[175,"1.3.28b",1,3,28,"b","IT infrastructure (eg network diagrams, system architecture and layout)?",3,"","","","","",6,6,null,"28","1.3.28b","","",""]
[176,"1.3.28c",1,3,28,"c","Data (eg what type of information is processed, where and how)?",3,"","","","","",6,6,null,"28","1.3.28c","","",""]
[177,"1.3.28d",1,3,28,"d","Event logging (eg what types of data and events are logged; on which systems; how and when; as well as how this data is collated and analysed)?",3,"","","","","",6,6,null,"28","1.3.28d","","",""]
[178,"1.3.29",1,3,29,"","In the event of a cyber security incident are you able to quickly get relevant information from:","N/A","","","",4,"","",4,null,"29","1.3.29","","",""]
[179,"1.3.29a",1,3,29,"a","Technical security specialists?",3,"","","","","",6,6,null,"29","1.3.29a","","",""]
[180,"1.3.29b",1,3,29,"b","Relevant business representatives?",3,"","","","","",6,6,null,"29","1.3.29b","","",""]
[181,"1.3.29c",1,3,29,"c","Your Crisis Management Team?",3,"","","","","",6,6,null,"29","1.3.29c","","",""]
[182,"1.3.29d",1,3,29,"d","Legal or HR specialists?",3,"","","","","",6,6,null,"29","1.3.29d","","",""]
[183,"1.3.30",1,3,30,"","In the event of a cyber security incident are you able to:","N/A","","","",4,"","",4,null,"30","1.3.30","","",""]
[184,"1.3.30a",1,3,30,"a","Gain fast access to facilities at your outsourced service providers (ie access to premises or equipment)?",5,"","","","","",6,6,null,"30","1.3.30a","","",""]
[185,"1.3.30b",1,3,30,"b","Obtain essential supporting information (eg event logs) from all your third party suppliers (eg cloud service suppliers, infrastructure outsourcers and managed service providers) in a timely and suitable manner?",5,"","","","","",6,6,null,"30","1.3.30b","","",""]
[186,"1.3.30c",1,3,30,"c","Contact relevant people in third parties who would be impacted if your organisation had to operate in a degraded capacity?",4,"","","","","",6,6,null,"30","1.3.30c","","",""]
[187,"1.4",1,4,"","","Control environment","","",2,"","","","",2,null,"","1.4",{"$f":"IF(O188=O187,IF(NOT(R188>R187),1,\"\"),\"\")","v":""},{"$f":"IF(NOT(R188>R187),1,\"\")","v":""},""]
[188,"1.4.01",1,4,1,"","Do you have a set of controls to help reduce the frequency and impact of cyber security incidents?",1,"","","","",5,"",5,null,"01","1.4.01","","",""]
[189,"1.4.02",1,4,2,"","Does your control set include basic controls to help support cyber security incident investigations, including:","N/A","","","",4,"","",4,null,"02","1.4.02","","",""]
[190,"1.4.02a",1,4,2,"a","Information classification, labelling and handling techniques?",2,{"$f":"IF(AND(LEN(C191)=1,LEN(D191)=0),1,\"\")","v":""},{"$f":"IF(AND(LEN(C191)=1,LEN(D191)=1,LEN(E191)=0,LEN(F191)=0),2,\"\")","v":""},{"$f":"IF(AND(LEN(C191)=0,LEN(E191)=0),3,\"\")","v":""},{"$f":"IF(AND(LEN(C191)>0,LEN(D191>0),LEN(E191)>0,LEN(F191)=0,H191=\"N/A\"),4,\"\")","v":""},{"$f":"IF(AND(LEN(C191)>0,LEN(D191>0),LEN(E191)>0,LEN(F191)=0,H191>0,H191<6),5,\"\")","v":""},{"$f":"IF(AND(LEN(C191)>0,LEN(D191>0),LEN(E191)>0,LEN(F191)>0,H191>0,H191<6),6,\"\")","v":6},{"$f":"SUM(I191:N191)","v":6},null,{"$f":"IF(LEN(E191)>0,TEXT(E191,\"00\"),\"\")","v":"02"},{"$f":"IF(O191=1,C191,IF(O191=2,C191&\".\"&D191,IF(O191=3,\"\",IF(O191=4,C191&\".\"&D191&\".\"&Q191,IF(O191=5,C191&\".\"&D191&\".\"&Q191,IF(O191=6,C191&\".\"&D191&\".\"&Q191&F191,\"\"))))))","v":"1.4.02a"},{"$f":"IF(O191=O190,IF(NOT(R191>R190),1,\"\"),\"\")","v":""},"",""]
[191,{"$f":"R192","v":"1.4.02b"},1,4,2,"b","Access control arrangements?",2,"","","","","",6,6,null,"02","1.4.02b","",{"$f":"IF(NOT(R192>R191),1,\"\")","v":""},""]
[192,"1.4.02c",1,4,2,"c","Patch management?",2,"","","","","",6,6,null,"02","1.4.02c","","",""]
[193,"1.4.02d",1,4,2,"d","Firewalls?",2,"","","","","",6,6,null,"02","1.4.02d","","",""]
[194,"1.4.02e",1,4,2,"e","Malware protection?",2,"","","","","",6,6,null,"02","1.4.02e","","",{"$f":"IF(O195<4,IF(LEN(H195)=0,\"\",1),IF(O195=4,IF(H195=\"N/A\",\"\",1),IF(AND(O195>4,O195<7),IF(AND(H195>0,H195<6),\"\",1),1)))","v":""}]
[195,"1.4.02f",1,4,2,"f","‘Secure’ configuration of servers and connected devices?",2,"","","","","",6,6,null,"02","1.4.02f","","",""]
[196,"1.4.02g",1,4,2,"g","Backups?",2,"","","","","",6,6,null,"02","1.4.02g","","",""]
[197,"1.4.03",1,4,3,"","Is your cyber security control set:","N/A","","","",4,"","",4,null,"03","1.4.03","","",""]
[198,"1.4.03a",1,4,3,"a","Based on a formal cyber security framework, such as the SANS top 20 cyber security controls or the CESG 10 Steps to Cyber Security or PAS 55?",3,"","","","","",6,6,null,"03","1.4.03a","","",""]
[199,"1.4.03b",1,4,3,"b","Signed-off by senior management?",2,"","","","","",6,6,null,"03","1.4.03b","","",""]
[200,"1.4.03c",1,4,3,"c","Kept-up-to date?",2,"","","","","",6,6,null,"03","1.4.03c","","",""]
[201,"1.4.03d",1,4,3,"d","Monitored for effectiveness?",3,"","","","","",6,6,null,"03","1.4.03d","","",""]
[202,"1.4.03e",1,4,3,"e","Reviewed on a regular basis?",2,"","","","","",6,6,null,"03","1.4.03e","","",""]
[203,"1.4.04",1,4,4,"","Do you provide internet access through a central corporate gateway, rather than locally?",4,"","","","",5,"",5,null,"04","1.4.04","","",""]
[204,"1.4.05",1,4,5,"","Do you deploy technical security monitoring tools?",3,"","","","",5,"",5,null,"05","1.4.05","","",""]
[205,"1.4.06",1,4,6,"","Do your technical security monitoring tools include:","N/A","","","",4,"","",4,null,"06","1.4.06","","",""]
[206,"1.4.06a",1,4,6,"a","Intrusion prevention systems (IPS)?",4,"","","","","",6,6,null,"06","1.4.06a","","",""]
[207,"1.4.06b",1,4,6,"b","Intrusion detection systems (IDS)?",4,"","","","","",6,6,null,"06","1.4.06b","","",""]
[208,"1.4.06c",1,4,6,"c","Data loss preventions (DLP) systems?",3,"","","","","",6,6,null,"06","1.4.06c","","",""]
[209,"1.4.06d",1,4,6,"d","A searchable incident event repository (SIEM)?",4,"","","","","",6,6,null,"06","1.4.06d","","",""]
[210,"1.4.06e",1,4,6,"e","Commercial APT prevention tools?",5,"","","","","",6,6,null,"06","1.4.06e","","",""]
[211,"1.4.07",1,4,7,"","Is your cyber security control set supplemented by specialised cyber security controls?",4,"","","","",5,"",5,null,"07","1.4.07","","",""]
[212,"1.4.08",1,4,8,"","Do your specialised cyber security controls include:","N/A","","","",4,"","",4,null,"08","1.4.08","","",""]
[213,"1.4.08a",1,4,8,"a","Multi factor authentication - something you know (eg a User ID and password) and something you have (eg an access, bank or smart card)?",4,"","","","","",6,6,null,"08","1.4.08a","","",""]
[214,"1.4.08b",1,4,8,"b","Digital certificates used to “sign” code from a vendor so that the code can be trusted?",4,"","","","","",6,6,null,"08","1.4.08b","","",""]
[215,"1.4.08c",1,4,8,"c","Whitelisting (defining all acceptable ports, addresses or similar – and preventing all other access) or blacklisting (preventing access from specific sites, or addresses)?",4,"","","","","",6,6,null,"08","1.4.08c","","",""]
[216,"1.4.09",1,4,9,"","Is your cyber security control set supplemented by advanced cyber security controls?",5,"","","","",5,"",5,null,"09","1.4.09","","",""]
[217,"1.4.10",1,4,10,"","Do your advanced cyber security controls include:","N/A","","","",4,"","",4,null,"10","1.4.10","","",""]
[218,"1.4.10a",1,4,10,"a","Continuous monitoring (eg via a Security Operations centre (SOC)?",5,"","","","","",6,6,null,"10","1.4.10a","","",""]
[219,"1.4.10b",1,4,10,"b","Proactive APT assessments?",5,"","","","","",6,6,null,"10","1.4.10b","","",""]
[220,"1.4.10c",1,4,10,"c","Outbound gateway consolidation?",5,"","","","","",6,6,null,"10","1.4.10c","","",""]
[221,"1.4.10d",1,4,10,"d","System virtualisation?",5,"","","","","",6,6,null,"10","1.4.10d","","",""]
[222,"1.4.10e",1,4,10,"e","Sensitive network or data segregation?",5,"","","","","",6,6,null,"10","1.4.10e","","",""]
[223,"1.4.10f",1,4,10,"f","Counterintelligence operations?",5,"","","","","",6,6,null,"10","1.4.10f","","",""]
[224,"1.4.11",1,4,11,"","Does your cyber security control set help you to:","N/A","","","",4,"","",4,null,"11","1.4.11","","",""]
[225,"1.4.11a",1,4,11,"a","Make it more difficult for attackers to be successful?",4,"","","","","",6,6,null,"11","1.4.11a","","",""]
[226,"1.4.11b",1,4,11,"b","Detect that a cyber security attack is being planned - or is already underway?",4,"","","","","",6,6,null,"11","1.4.11b","","",""]
[227,"1.5",1,5,"","","Maturity assessment","","",2,"","","","",2,null,"","1.5",{"$f":"IF(O228=O227,IF(NOT(R228>R227),1,\"\"),\"\")","v":""},{"$f":"IF(NOT(R228>R227),1,\"\")","v":""},""]
[228,"1.5.01",1,5,1,"","Have you created an organisation-specific definition of the term “cyber security incident” so that the scope of the term is clear?",3,"","","","",5,"",5,null,"01","1.5.01","","",""]
[229,"1.5.02",1,5,2,"","Does your definition of the term “cyber security incident” take account of the:","N/A","","","",4,"","",4,null,"02","1.5.02","","",""]
[230,"1.5.02a",1,5,2,"a","Different types of cyber security incident (eg hacking, malware or social engineering)?",3,"","","","","",6,6,null,"02","1.5.02a","","",""]
[231,"1.5.02b",1,5,2,"b","Sources of cyber security incidents (eg petty criminals, insiders, hacktivists, an organised crime syndicate, extremist group or state-sponsored body)?",3,"","","","","",6,6,null,"02","1.5.02b","","",""]
[232,"1.5.02c",1,5,2,"c","Basic cyber security incidents (eg minor crime, localised disruption and theft)?",3,"","","","","",6,6,null,"02","1.5.02c","","",""]
[233,"1.5.02d",1,5,2,"d","Sophisticated cyber security attacks (eg major organised crime, widespread disruption, critical damage to national infrastructure and even warfare)?",3,"","","","","",6,6,null,"02","1.5.02d","","",""]
[234,"1.5.02e",1,5,2,"e","Difference between a cyber security and a traditional IT or information security incident (if any)?",4,"","","","","",6,6,null,"02","1.5.02e","","",""]
[235,"1.5.03",1,5,3,"","Do you maintain an appropriate cyber security incident response capability?",2,"","","","",5,"",5,null,"03","1.5.03","","",""]
[236,"1.5.04",1,5,4,"","Does your cyber security incident response capability include:","N/A","","","",4,"","",4,null,"04","1.5.04","","",""]
[237,"1.5.04a",1,5,4,"a","Appointing a cyber security incident response team (internal and / or external) and determining what services they should provide?",2,"","","","","",6,6,null,"04","1.5.04a","","",""]
[238,"1.5.04b",1,5,4,"b","Raising awareness about the need for an effective cyber security response capability?",2,"","","","","",6,6,null,"04","1.5.04b","","",""]
[239,"1.5.04c",1,5,4,"c","Developing a consistent, repeatable cyber security incident response process or methodology for handling cyber security incidents (or suspected incidents) as they occur, so that the appropriate actions are taken?",3,"","","","","",6,6,null,"04","1.5.04c","","",""]
[240,"1.5.04d",1,5,4,"d","Making effective use of relevant technologies?",3,"","","","","",6,6,null,"04","1.5.04d","","",""]
[241,"1.5.04e",1,5,4,"e","Ensuring that cyber security incidents are properly followed up once they have been responded to effectively?",3,"","","","","",6,6,null,"04","1.5.04e","","",""]
[242,"1.5.05",1,5,5,"","Have you obtained senior management commitment for your cyber security incident response capability?",4,"","","","",5,"",5,null,"05","1.5.05","","",""]
[243,"1.5.06",1,5,6,"","Does senior management commitment include:","N/A","","","",4,"","",4,null,"06","1.5.06","","",""]
[244,"1.5.06a",1,5,6,"a","Providing sufficient funding and resources to deal with cyber security incidents effectively?",5,"","","","","",6,6,null,"06","1.5.06a","","",""]
[245,"1.5.06b",1,5,6,"b","Determining whether to establish a specialised cyber security incident response capability or integrate cyber security incidents into existing incident management systems?",5,"","","","","",6,6,null,"06","1.5.06b","","",""]
[246,"1.5.06c",1,5,6,"c","Finding appropriate external sources and levels of guidance to help you prepare for a cyber security incident",5,"","","","","",6,6,null,"06","1.5.06c","","",""]
[247,"1.5.07",1,5,7,"","Do you know your state of readiness to be able to respond to a cyber security incident in a fast, effective manner?",4,"","","","",5,"",5,null,"07","1.5.07","","",""]
[248,"1.5.08",1,5,8,"","Do you determine the requirements you have for your cyber security incident response capability?",3,"","","","",5,"",5,null,"08","1.5.08","","",""]
[249,"1.5.09",1,5,9,"","Do you measure the level of maturity of your cyber security incident response capability in terms of:","N/A","","","",4,"","",4,null,"09","1.5.09","","",""]
[250,"1.5.09a",1,5,9,"a","People (eg an incident response team or individual, technical experts, fast access to decision-makers, representation from key suppliers)?",4,"","","","","",6,6,null,"09","1.5.09a","","",""]
[251,"1.5.09b",1,5,9,"b","Process (eg knowing what to do, how to do it and when to do it – when detecting, containing, eradicating or recovering from a cyber security incident)?",4,"","","","","",6,6,null,"09","1.5.09b","","",""]
[252,"1.5.09c",1,5,9,"c","Technology (eg knowing their network topology, providing the right event logs)?",4,"","","","","",6,6,null,"09","1.5.09c","","",""]
[253,"1.5.09d",1,5,9,"d","Information (eg having information close to hand about business operations and priorities; critical assets; and key dependencies, such as on third parties, important locations or where relevant information resides)?",4,{"$f":"IF(AND(LEN(C254)=1,LEN(D254)=0),1,\"\")","v":""},{"$f":"IF(AND(LEN(C254)=1,LEN(D254)=1,LEN(E254)=0,LEN(F254)=0),2,\"\")","v":""},{"$f":"IF(AND(LEN(C254)=0,LEN(E254)=0),3,\"\")","v":""},{"$f":"IF(AND(LEN(C254)>0,LEN(D254>0),LEN(E254)>0,LEN(F254)=0,H254=\"N/A\"),4,\"\")","v":""},{"$f":"IF(AND(LEN(C254)>0,LEN(D254>0),LEN(E254)>0,LEN(F254)=0,H254>0,H254<6),5,\"\")","v":""},{"$f":"IF(AND(LEN(C254)>0,LEN(D254>0),LEN(E254)>0,LEN(F254)>0,H254>0,H254<6),6,\"\")","v":6},{"$f":"SUM(I254:N254)","v":6},null,{"$f":"IF(LEN(E254)>0,TEXT(E254,\"00\"),\"\")","v":"09"},{"$f":"IF(O254=1,C254,IF(O254=2,C254&\".\"&D254,IF(O254=3,\"\",IF(O254=4,C254&\".\"&D254&\".\"&Q254,IF(O254=5,C254&\".\"&D254&\".\"&Q254,IF(O254=6,C254&\".\"&D254&\".\"&Q254&F254,\"\"))))))","v":"1.5.09d"},{"$f":"IF(O254=O253,IF(NOT(R254>R253),1,\"\"),\"\")","v":""},"",""]
[254,{"$f":"R255","v":"1.5.09e"},1,5,9,"e","Preparedness, response and follow up activities?",4,"","","","","",6,6,null,"09","1.5.09e","",{"$f":"IF(NOT(R255>R254),1,\"\")","v":""},""]
[255,"1.5.09f",1,5,9,"f","Ability to adopt a systematic, structured approach to cyber security incident response?",4,"","","","","",6,6,null,"09","1.5.09f","","",""]
[256,"1.5.10",1,5,10,"","Do you compare the maturity of your cyber security incident response capability:","N/A","","","",4,"","",4,null,"10","1.5.10","","",""]
[257,"1.5.10a",1,5,10,"a","To your requirements for such a capability?",5,"","","","","",6,6,null,"10","1.5.10a","","",""]
[258,"1.5.10b",1,5,10,"b","With similar organisation to help determine if this level of maturity is appropriate for your organisation?",5,"","","","","",6,6,null,"10","1.5.10b","","",{"$f":"IF(O259<4,IF(LEN(H259)=0,\"\",1),IF(O259=4,IF(H259=\"N/A\",\"\",1),IF(AND(O259>4,O259<7),IF(AND(H259>0,H259<6),\"\",1),1)))","v":""}]
[259,"1.5.11",1,5,11,"","Does the make-up of your your cyber security incident response capability take into account what can and cannot be done with the time, resources and money available?",5,"","","","",5,"",5,null,"11","1.5.11","","",""]
[260,"1.5.12",1,5,12,"","Do you continually review the internal capabilities and capacity of your cyber security incident response team?",4,"","","","",5,"",5,null,"12","1.5.12","","",""]
[261,2,2,"","","","Respond","",1,"","","","","",1,null,"",2,"",1,""]
[262,"2.1",2,1,"","","Identification","","",2,"","","","",2,null,"","2.1","","",""]
[263,"2.1.01",2,1,1,"","Do you identify suspected cyber security incidents?",1,"","","","",5,"",5,null,"01","2.1.01","","",""]
[264,"2.1.02",2,1,2,"","Do you inform users that they should:","N/A","","","",4,"","",4,null,"02","2.1.02","","",""]
[265,"2.1.02a",2,1,2,"a","Report all suspected cyber security breaches to a central point (eg information failures; loss of services; detection of malicious code; denial of service attacks; errors from incomplete or inaccurate business data)?",1,"","","","","",6,6,null,"02","2.1.02a","","",""]
[266,"2.1.02b",2,1,2,"b","Note all important details (eg type of breach, messages on screen, and details of unusual occurrences)?",2,"","","","","",6,6,null,"02","2.1.02b","","",""]
[267,"2.1.02c",2,1,2,"c","Restrain from attempting to take remedial actions themselves?",2,"","","","","",6,6,null,"02","2.1.02c","","",""]
[268,"2.1.03",2,1,3,"","Do you identify cyber security incidents by analysing suspicious events reported by users to the IT help desk (or equivalent)?",2,"","","","",5,"",5,null,"03","2.1.03","","",""]
[269,"2.1.04",2,1,4,"","Is this analysis based on:","N/A","","","",4,"","",4,null,"04","2.1.04","","",""]
[270,"2.1.04a",2,1,4,"a","Comparing characteristics of the suspicious event to known ‘normal’ system and network behaviour?",4,"","","","","",6,6,null,"04","2.1.04a","","",""]
[271,"2.1.04b",2,1,4,"b","A good working knowledge of what indictors of compromise (IOCs) would look like?",4,"","","","","",6,6,null,"04","2.1.04b","","",""]
[272,"2.1.05",2,1,5,"","To help identify potential cyber security incidents do you monitor information from a variety of sources, including:","N/A","","","",4,"","",4,null,"05","2.1.05","","",""]
[273,"2.1.05a",2,1,5,"a","System logs (eg operating system logs, service and application logs, network device logs and network flows)",3,"","","","","",6,6,null,"05","2.1.05a","","",""]
[274,"2.1.05b",2,1,5,"b","Alerts generated by technical security software (eg IDS, IPS, DLP, SIEM, antivirus and spam software), file integrity checking software, monitoring services (often provided by a third party)?",4,"","","","","",6,6,null,"05","2.1.05b","","",""]
[275,"2.1.05c",2,1,5,"c","Data provided by monitoring services or a Security Operations Centre (often provided by third parties)?",5,"","","","","",6,6,null,"05","2.1.05c","","",""]
[276,"2.1.05d",2,1,5,"d","Publicly available information (eg information on new exploits, information exchange groups, third party organisations, governments)?",4,"","","","","",6,6,null,"05","2.1.05d","","",""]
[277,"2.1.05e",2,1,5,"e","People from within your organisation?",3,"","","","","",6,6,null,"05","2.1.05e","","",""]
[278,"2.1.05f",2,1,5,"f","A variety of third parties (eg customers, suppliers, IT providers, ISPs, partners; government bodies)?",3,"","","","","",6,6,null,"05","2.1.05f","","",""]
[279,"2.1.05g",2,1,5,"g","Anomalies detected by audits, investigations or reviews?",3,"","","","","",6,6,null,"05","2.1.05g","","",""]
[280,"2.1.06",2,1,6,"","Having identified a suspected cyber security incident, do you:","N/A","","","",4,"","",4,null,"06","2.1.06","","",""]
[281,"2.1.06a",2,1,6,"a","Investigate different types of technical information, such as IP addresses?",4,"","","","","",6,6,null,"06","2.1.06a","","",""]
[282,"2.1.06b",2,1,6,"b","Analyse all available information related to a potential cyber security incident?",3,"","","","","",6,6,null,"06","2.1.06b","","",""]
[283,"2.1.06c",2,1,6,"c","Determine what has actually happened (eg a DDOS, malware attack, system hack, session hijack or data corruption)?",3,"","","","","",6,6,null,"06","2.1.06c","","",""]
[284,"2.1.06d",2,1,6,"d","Confirm that they have actually been subject to a cyber security attack or had a cyber-related breach (the unknown element)?",3,"","","","","",6,6,null,"06","2.1.06d","","",""]
[285,"2.1.07",2,1,7,"","When monitoring information from relevant technical sources, such as specialised security software (eg SIEM or IDS) do you:","N/A","","","",4,"","",4,null,"07","2.1.07","","",""]
[286,"2.1.07a",2,1,7,"a","Monitor all relevant events?",4,"","","","","",6,6,null,"07","2.1.07a","","",""]
[287,"2.1.07b",2,1,7,"b","Carry out monitoring regularly?",4,"","","","","",6,6,null,"07","2.1.07b","","",""]
[288,"2.1.07c",2,1,7,"c","Carry out monitoring in an appropriate manner, focusing on finding anomalies?",4,"","","","","",6,6,null,"07","2.1.07c","","",""]
[289,"2.1.07d",2,1,7,"d","Respond to alerts correctly (avoiding the risk of overlooking indicative alerts or over-reacting to benign alerts)?",4,"","","","","",6,6,null,"07","2.1.07d","","",""]
[290,"2.1.07e",2,1,7,"e","Aggregate what may seem like benign alerts into what is a coherent threat message?",5,"","","","","",6,6,null,"07","2.1.07e","","",""]
[291,"2.1.08",2,1,8,"","Do you take additional steps to identify cyber security incidents by:","N/A","","","",4,"","",4,null,"08","2.1.08","","",""]
[292,"2.1.08a",2,1,8,"a","Providing situational awareness (particularly through cyber intelligence)?",5,"","","","","",6,6,null,"08","2.1.08a","","",""]
[293,"2.1.08b",2,1,8,"b","Continuously monitoring events that could result in your organisation being affected by a cyber security incident?",5,"","","","","",6,6,null,"08","2.1.08b","","",""]
[294,"2.1.08c",2,1,8,"c","Evaluating threat analytics (typically based on the threat model of the behaviour of attacks), helping to determine both symptoms and behaviour?",5,"","","","","",6,6,null,"08","2.1.08c","","",""]
[295,"2.1.08d",2,1,8,"d","Performing specialised analysis of host assets, network data and attack files (eg malware)?",5,"","","","","",6,6,null,"08","2.1.08d","","",""]
[296,"2.1.08e",2,1,8,"e","Prioritising assets to be investigated?",5,"","","","","",6,6,null,"08","2.1.08e","","",""]
[297,"2.1.08f",2,1,8,"f","Addressing unusual or novel problems (eg to do with bespoke file types or encryption)?",5,"","","","","",6,6,null,"08","2.1.08f","","",""]
[298,"2.1.09",2,1,9,"","Do you use security analytics?",4,"","","","",5,"",5,null,"09","2.1.09","","",""]
[299,"2.1.10",2,1,10,"","Does your security analytics include:","N/A","","","",4,"","",4,null,"10","2.1.10","","",""]
[300,"2.1.10a",2,1,10,"a","Testing for possible attackers or poor user behaviour (eg users opening ‘honey pot’ attachments, or similar)?",5,"","","","","",6,6,null,"10","2.1.10a","","",""]
[301,"2.1.10b",2,1,10,"b","Automated analytics platform (more than just a SIEM)?",5,"","","","","",6,6,null,"10","2.1.10b","","",""]
[302,"2.1.10c",2,1,10,"c","Evaluating threat analytics (typically based on the threat model of the behaviour of attacks), helping to determine both symptoms and behaviour?",5,"","","","","",6,6,null,"10","2.1.10c","","",""]
[303,"2.2",2,2,"","","Investigation","","",2,"","","","",2,null,"","2.2",{"$f":"IF(O304=O303,IF(NOT(R304>R303),1,\"\"),\"\")","v":""},{"$f":"IF(NOT(R304>R303),1,\"\")","v":""},""]
[304,"","","","","","Understanding","","","",3,"","","",3,null,"","","",1,""]
[305,"2.2.01",2,2,1,"","Do you take steps to investigate the cyber security incident?",1,"","","","",5,"",5,null,"01","2.2.01","","",""]
[306,"2.2.02",2,2,2,"","Does your investigation of the event include:","N/A","","","",4,"","",4,null,"02","2.2.02","","",""]
[307,"2.2.02a",2,2,2,"a","Establishing the objectives of the investigation?",2,"","","","","",6,6,null,"02","2.2.02a","","",""]
[308,"2.2.02b",2,2,2,"b","Performing detailed analysis of the cyber security incident?",2,"","","","","",6,6,null,"02","2.2.02b","","",""]
[309,"2.2.02c",2,2,2,"c","Placing priority on the speed of investigation?",3,"","","","","",6,6,null,"02","2.2.02c","","",""]
[310,"2.2.03",2,2,3,"","Does your analysis of the cyber security incident include:","N/A","","","",4,"","",4,null,"03","2.2.03","","",""]
[311,"2.2.03a",2,2,3,"a","Identifying what systems, networks and information (assets) have been compromised?",2,"","","","","",6,6,null,"03","2.2.03a","","",""]
[312,"2.2.03b",2,2,3,"b","Determining what information has been disclosed to unauthorised parties, stolen, deleted or corrupted?",3,"","","","","",6,6,null,"03","2.2.03b","","",""]
[313,"2.2.03c",2,2,3,"c","Working out how it happened (eg how did the attacker gain entry to the system)?",3,"","","","","",6,6,null,"03","2.2.03c","","",""]
[314,"2.2.03d",2,2,3,"d","Finding out who did it (ie which threat agent or agents)?",3,"","","","","",6,6,null,"03","2.2.03d","","",""]
[315,"2.2.03e",2,2,3,"e","Determining why they did it, such as financial crime (eg fraud or extortion), theft of intellectual property, personal attack (eg revenge), or disruption to critical services?",3,"","","","","",6,6,null,"03","2.2.03e","","",""]
[316,"2.2.03f",2,2,3,"f","Estimating the potential business impact of the cyber security incident?",3,{"$f":"IF(AND(LEN(C317)=1,LEN(D317)=0),1,\"\")","v":""},{"$f":"IF(AND(LEN(C317)=1,LEN(D317)=1,LEN(E317)=0,LEN(F317)=0),2,\"\")","v":""},{"$f":"IF(AND(LEN(C317)=0,LEN(E317)=0),3,\"\")","v":""},{"$f":"IF(AND(LEN(C317)>0,LEN(D317>0),LEN(E317)>0,LEN(F317)=0,H317=\"N/A\"),4,\"\")","v":""},{"$f":"IF(AND(LEN(C317)>0,LEN(D317>0),LEN(E317)>0,LEN(F317)=0,H317>0,H317<6),5,\"\")","v":""},{"$f":"IF(AND(LEN(C317)>0,LEN(D317>0),LEN(E317)>0,LEN(F317)>0,H317>0,H317<6),6,\"\")","v":6},{"$f":"SUM(I317:N317)","v":6},null,{"$f":"IF(LEN(E317)>0,TEXT(E317,\"00\"),\"\")","v":"03"},{"$f":"IF(O317=1,C317,IF(O317=2,C317&\".\"&D317,IF(O317=3,\"\",IF(O317=4,C317&\".\"&D317&\".\"&Q317,IF(O317=5,C317&\".\"&D317&\".\"&Q317,IF(O317=6,C317&\".\"&D317&\".\"&Q317&F317,\"\"))))))","v":"2.2.03f"},{"$f":"IF(O317=O316,IF(NOT(R317>R316),1,\"\"),\"\")","v":""},"",""]
[317,{"$f":"R318","v":"2.2.04"},2,2,4,"","Do your investigation determine what:","N/A","","","",4,"","",4,null,"04","2.2.04","",{"$f":"IF(NOT(R318>R317),1,\"\")","v":""},""]
[318,"2.2.04a",2,2,4,"a","Methodologies the attackers are using?",4,"","","","","",6,6,null,"04","2.2.04a","","",""]
[319,"2.2.04b",2,2,4,"b","Who their target is for the attack (eg an individual, the whole organisation, your market sector or the government)?",4,"","","","","",6,6,null,"04","2.2.04b","","",""]
[320,"2.2.05",2,2,5,"","Do you have access to cyber threat intelligence?",4,"","","","",5,"",5,null,"05","2.2.05","","",""]
[321,"2.2.06",2,2,6,"","Does your cyber threat intelligence come from a variety of reputable sources, such as government, CERTS, collaborative groups or expert third parties?",5,"","","","",5,"",5,null,"06","2.2.06","","",""]
[322,"2.2.07",2,2,7,"","Does your cyber threat intelligence help you to determine the attacker(s):","N/A","","","",4,"","",4,null,"07","2.2.07","","",{"$f":"IF(O323<4,IF(LEN(H323)=0,\"\",1),IF(O323=4,IF(H323=\"N/A\",\"\",1),IF(AND(O323>4,O323<7),IF(AND(H323>0,H323<6),\"\",1),1)))","v":""}]
[323,"2.2.07a",2,2,7,"a","Capabilities (what can they actually do)?",5,"","","","","",6,6,null,"07","2.2.07a","","",""]
[324,"2.2.07b",2,2,7,"b","Motives (why are they attacking you)?",5,"","","","","",6,6,null,"07","2.2.07b","","",""]
[325,"2.2.07c",2,2,7,"c","Likely actions (eg their tactics, techniques and procedures)?",5,"","","","","",6,6,null,"07","2.2.07c","","",""]
[326,"","","","","","Triage","","","",3,"","","",3,null,"","","",1,""]
[327,"2.2.08",2,2,8,"","Do you perform Triage on the cyber security incident in the early part of an investigation?",2,"","","","",5,"",5,null,"08","2.2.08","","",""]
[328,"2.2.09",2,2,9,"","Do the actions you carry out as part of Triage include:","N/A","","","",4,"","",4,null,"09","2.2.09","","",""]
[329,"2.2.09a",2,2,9,"a","Classifying cyber security incidents (eg critical, significant, normal or negligible impact)?",3,"","","","","",6,6,null,"09","2.2.09a","","",""]
[330,"2.2.09b",2,2,9,"b","Prioritising these incidents (eg high, medium or low)?",3,"","","","","",6,6,null,"09","2.2.09b","","",""]
[331,"2.2.09c",2,2,9,"c","Assigning incidents to appropriate personnel in terms of their legitimacy, correctness, constituency origin, severity or impact?",3,"","","","","",6,6,null,"09","2.2.09c","","",""]
[332,"","","","","","First response","","","",3,"","","",3,null,"","","",1,""]
[333,"2.2.10",2,2,10,"","Do you have one or more named individuals (or a team) who are capable of dealing with the initial stages of cyber incident response (first responders)?",2,"","","","",5,"",5,null,"10","2.2.10","","",""]
[334,"2.2.11",2,2,11,"","Are your first responders able to:","N/A","","","",4,"","",4,null,"11","2.2.11","","",""]
[335,"2.2.11a",2,2,11,"a","Classify and prioritise cyber security incidents?",2,"","","","","",6,6,null,"11","2.2.11a","","",""]
[336,"2.2.11b",2,2,11,"b","Avoid taking the wrong initial action when a cyber security attack occurs (eg taking systems off the network or cleaning up systems, which could have a detrimental affect like alerting an attacker or destroying vital evidence)?",3,"","","","","",6,6,null,"11","2.2.11b","","",""]
[337,"2.2.11c",2,2,11,"c","Identify quickly when the scope and severity is beyond local or in-house skills?",3,"","","","","",6,6,null,"11","2.2.11c","","",""]
[338,"2.2.12",2,2,12,"","Have arrangements to have been made in advance so that expert investigators:","N/A","","","",4,"","",4,null,"12","2.2.12","","",""]
[339,"2.2.12a",2,2,12,"a","Are available at short notice?",4,"","","","","",6,6,null,"12","2.2.12a","","",""]
[340,"2.2.12b",2,2,12,"b","Have enough prior information to be able to hit the ground running?",4,"","","","","",6,6,null,"12","2.2.12b","","",""]
[341,"2.2.13",2,2,13,"","Are you able to quickly contact third parties that you may wish to get involved, such as technology forensics specialists, technology analysts (for example, database experts), information analysts (for example, accountants), legal experts and on-site police support?",4,"","","","",5,"",5,null,"13","2.2.13","","",""]
[342,"2.2.14",2,2,14,"","Do you have a crisis management team (or equivalent) to support serious cyber security incidents?",4,"","","","",5,"",5,null,"14","2.2.14","","",""]
[343,"2.2.15",2,2,15,"","Are you able to manage the cyber security incident:","N/A","","","",4,"","",4,null,"15","2.2.15","","",""]
[344,"2.2.15a",2,2,15,"a","Via one central point of contact?",3,"","","","","",6,6,null,"15","2.2.15a","","",""]
[345,"2.2.15b",2,2,15,"b","From one central location?",3,"","","","","",6,6,null,"15","2.2.15b","","",""]
[346,"2.2.15c",2,2,15,"c","In a specialised incident response location, such as a ‘war room’, if required?",5,"","","","","",6,6,null,"15","2.2.15c","","",""]
[347,"","","","","","Initial analysis","","","",3,"","","",3,null,"","","",1,""]
[348,"2.2.16",2,2,16,"","Do you perform initial analysis to determine the precise nature of the incident?",3,"","","","",5,"",5,null,"16","2.2.16","","",""]
[349,"2.2.17",2,2,17,"","Are your cyber security incident investigations:","N/A","","","",4,"","",4,null,"17","2.2.17","","",""]
[350,"2.2.17a",2,2,17,"a","Evidence-driven, based on information gathered from corporate infrastructure or applications (typically event logs)?",3,"","","","","",6,6,null,"17","2.2.17a","","",""]
[351,"2.2.17b",2,2,17,"b","Intelligence driven, based on information gathered from: government agencies (eg CPNI), monitoring of internal resources, open source information or data provided internally?",5,"","","","","",6,6,null,"17","2.2.17b","","",""]
[352,"2.2.18",2,2,18,"","Do your cyber security incident investigations include:","N/A","","","",4,"","",4,null,"18","2.2.18","","",""]
[353,"2.2.18a",2,2,18,"a","Considering all relevant event logs (eg logs generated by firewalls, web servers, traditional servers / workstations, business applications, email history and archives, network data, internet usage and building access)?",2,"","","","","",6,6,null,"18","2.2.18a","","",""]
[354,"2.2.18b",2,2,18,"b","Examining important alerts or suspicious events in logs or technical security monitoring systems (eg IDS, IPS, DLP or SIEM)?",4,"","","","","",6,6,null,"18","2.2.18b","","",""]
[355,"2.2.18c",2,2,18,"c","Correlating them with network data (including data from cloud service providers)?",4,"","","","","",6,6,null,"18","2.2.18c","","",""]
[356,"2.2.18d",2,2,18,"d","Comparing these pieces of information against threat intelligence?",5,"","","","","",6,6,null,"18","2.2.18d","","",""]
[357,"2.2.19",2,2,19,"","Do you thoroughly investigate each possible trigger event including:","N/A","","","",4,"","",4,null,"19","2.2.19","","",""]
[358,"2.2.19a",2,2,19,"a","Date/time?",4,"","","","","",6,6,null,"19","2.2.19a","","",""]
[359,"2.2.19b",2,2,19,"b","Internet protocol (IP) address (internal or external)?",4,"","","","","",6,6,null,"19","2.2.19b","","",""]
[360,"2.2.19c",2,2,19,"c","Port (source or destination), domain and file (eg exe, .dll)?",4,"","","","","",6,6,null,"19","2.2.19c","","",""]
[361,"2.2.19d",2,2,19,"d","System (hardware vendor, operating system, applications, purpose, location)?",4,"","","","","",6,6,null,"19","2.2.19d","","",""]
[362,"2.2.20",2,2,20,"","Do you retain relevant logs:","N/A","","","",4,"","",4,null,"20","2.2.20","","",""]
[363,"2.2.20a",2,2,20,"a","For as long as possible?",3,"","","","","",6,6,null,"20","2.2.20a","","",""]
[364,"2.2.20b",2,2,20,"b","As part of an approved log retention policy?",3,"","","","","",6,6,null,"20","2.2.20b","","",""]
[365,"","","","","","Collaboration","","","",3,"","","",3,null,"","","",1,""]
[366,"2.2.21",2,2,21,"","Do you analyse the possible systemic nature of the attack?",5,"","","","",5,"",5,null,"21","2.2.21","","",""]
[367,"2.2.22",2,2,22,"","Does this analysis include:","N/A","","","",4,"","",4,null,"22","2.2.22","","",""]
[368,"2.2.22a",2,2,22,"a","Tying disparate events together into a coherent picture?",5,"","","","","",6,6,null,"22","2.2.22a","","",""]
[369,"2.2.22b",2,2,22,"b","Linking events to possible related events in other organisations with which you are associated (eg other Banks if you are in the Banking sector)?",5,"","","","","",6,6,null,"22","2.2.22b","","",""]
[370,"2.3",2,3,"","","Action","","",2,"","","","",2,null,"","2.3",{"$f":"IF(O371=O370,IF(NOT(R371>R370),1,\"\"),\"\")","v":""},{"$f":"IF(NOT(R371>R370),1,\"\")","v":""},""]
[371,"","","","","","Containment","","","",3,"","","",3,null,"","","",1,""]
[372,"2.3.01",2,3,1,"","Do you take steps to contain the damage being done by the cyber security incident?",1,"","","","",5,"",5,null,"01","2.3.01","","",""]
[373,"2.3.02",2,3,2,"","Does the objective of containment include:","N/A","","","",4,"","",4,null,"02","2.3.02","","",""]
[374,"2.3.02a",2,3,2,"a","Making best efforts to return to functionality as normal?",3,"","","","","",6,6,null,"02","2.3.02a","","",""]
[375,"2.3.02b",2,3,2,"b","Returning to business as usual?",2,"","","","","",6,6,null,"02","2.3.02b","","",""]
[376,"2.3.02c",2,3,2,"c","Continuing to analyse the incident?",3,"","","","","",6,6,null,"02","2.3.02c","","",""]
[377,"2.3.02d",2,3,2,"d","Planning longer term remediation?",3,"","","","","",6,6,null,"02","2.3.02d","","",""]
[378,"2.3.03",2,3,3,"","Does containment include stopping it from spreading to other:","N/A","","","",4,"","",4,null,"03","2.3.03","","",""]
[379,"2.3.03a",2,3,3,"a","Networks within your organisation?",2,{"$f":"IF(AND(LEN(C380)=1,LEN(D380)=0),1,\"\")","v":""},{"$f":"IF(AND(LEN(C380)=1,LEN(D380)=1,LEN(E380)=0,LEN(F380)=0),2,\"\")","v":""},{"$f":"IF(AND(LEN(C380)=0,LEN(E380)=0),3,\"\")","v":""},{"$f":"IF(AND(LEN(C380)>0,LEN(D380>0),LEN(E380)>0,LEN(F380)=0,H380=\"N/A\"),4,\"\")","v":""},{"$f":"IF(AND(LEN(C380)>0,LEN(D380>0),LEN(E380)>0,LEN(F380)=0,H380>0,H380<6),5,\"\")","v":""},{"$f":"IF(AND(LEN(C380)>0,LEN(D380>0),LEN(E380)>0,LEN(F380)>0,H380>0,H380<6),6,\"\")","v":6},{"$f":"SUM(I380:N380)","v":6},null,{"$f":"IF(LEN(E380)>0,TEXT(E380,\"00\"),\"\")","v":"03"},{"$f":"IF(O380=1,C380,IF(O380=2,C380&\".\"&D380,IF(O380=3,\"\",IF(O380=4,C380&\".\"&D380&\".\"&Q380,IF(O380=5,C380&\".\"&D380&\".\"&Q380,IF(O380=6,C380&\".\"&D380&\".\"&Q380&F380,\"\"))))))","v":"2.3.03a"},{"$f":"IF(O380=O379,IF(NOT(R380>R379),1,\"\"),\"\")","v":""},"",""]
[380,{"$f":"R381","v":"2.3.03b"},2,3,3,"b","Networks beyond your organisation?",2,"","","","","",6,6,null,"03","2.3.03b","",{"$f":"IF(NOT(R381>R380),1,\"\")","v":""},""]
[381,"2.3.03c",2,3,3,"c","Devices within your organisation?",2,"","","","","",6,6,null,"03","2.3.03c","","",""]
[382,"2.3.03d",2,3,3,"d","Devices beyond your organisation?",2,"","","","","",6,6,null,"03","2.3.03d","","",""]
[383,"2.3.04",2,3,4,"","Does containment include a number of concurrent actions aimed at reducing the immediate impact of the cyber security incident?",3,"","","","",5,"",5,null,"04","2.3.04","","",""]
[384,"2.3.05",2,3,5,"","Does containment include removing the attacker’s access to your systems?",3,"","","","",5,"",5,null,"05","2.3.05","","",""]
[385,"2.3.06",2,3,6,"","Do your methods of containment include:","N/A","","","",4,"","",4,null,"06","2.3.06","","",""]
[386,"2.3.06a",2,3,6,"a","Blocking (and logging) of unauthorised access?",3,"","","","","",6,6,null,"06","2.3.06a","","",{"$f":"IF(O387<4,IF(LEN(H387)=0,\"\",1),IF(O387=4,IF(H387=\"N/A\",\"\",1),IF(AND(O387>4,O387<7),IF(AND(H387>0,H387<6),\"\",1),1)))","v":""}]
[387,"2.3.06b",2,3,6,"b","Blocking malware sources (eg email addresses and websites)?",3,"","","","","",6,6,null,"06","2.3.06b","","",""]
[388,"2.3.06c",2,3,6,"c","Closing particular ports and mail servers?",3,"","","","","",6,6,null,"06","2.3.06c","","",""]
[389,"2.3.06d",2,3,6,"d","Firewall filtering?",3,"","","","","",6,6,null,"06","2.3.06d","","",""]
[390,"2.3.06e",2,3,6,"e","Relocating website home pages?",4,"","","","","",6,6,null,"06","2.3.06e","","",""]
[391,"2.3.06f",2,3,6,"f","Isolating systems?",3,"","","","","",6,6,null,"06","2.3.06f","","",""]
[392,"2.3.06g",2,3,6,"g","Taking back-ups?",3,"","","","","",6,6,null,"06","2.3.06g","","",""]
[393,"2.3.07",2,3,7,"","Do you have separate containment strategies for different types of:","N/A","","","",4,"","",4,null,"07","2.3.07","","",""]
[394,"2.3.07a",2,3,7,"a","Cyber security attack?",5,"","","","","",6,6,null,"07","2.3.07a","","",""]
[395,"2.3.07b",2,3,7,"b","Sources of attack (the attack agent)?",5,"","","","","",6,6,null,"07","2.3.07b","","",""]
[396,"2.3.08",2,3,8,"","Do your containment strategies include clearly documented criteria to facilitate decision-making?",5,"","","","",5,"",5,null,"08","2.3.08","","",""]
[397,"2.3.09",2,3,9,"","Do your containment strategies include evaluating the:","N/A","","","",4,"","",4,null,"09","2.3.09","","",""]
[398,"2.3.09a",2,3,9,"a","Potential damage to and theft of resources?",4,"","","","","",6,6,null,"09","2.3.09a","","",""]
[399,"2.3.09b",2,3,9,"b","Need for evidence preservation?",4,"","","","","",6,6,null,"09","2.3.09b","","",""]
[400,"2.3.09c",2,3,9,"c","Service availability (eg network connectivity, services provided to external parties)?",4,"","","","","",6,6,null,"09","2.3.09c","","",""]
[401,"2.3.09d",2,3,9,"d","Time and resources needed to implement the strategy?",4,"","","","","",6,6,null,"09","2.3.09d","","",""]
[402,"2.3.09e",2,3,9,"e","Effectiveness of the strategy (eg partial containment, full containment)?",5,"","","","","",6,6,null,"09","2.3.09e","","",""]
[403,"2.3.09f",2,3,9,"f","Duration of the solution (eg emergency workaround to be removed in four hours, temporary workaround to be removed in two weeks, permanent solution)?",5,"","","","","",6,6,null,"09","2.3.09f","","",""]
[404,"2.3.10",2,3,10,"","Does your approach to containing cyber security incidents include:","N/A","","","",4,"","",4,null,"10","2.3.10","","",""]
[405,"2.3.10a",2,3,10,"a","Identifying immediate actions to be performed (eg based on high risk assets, time dependant issues, business / commercial decisions)?",4,"","","","","",6,6,null,"10","2.3.10a","","",""]
[406,"2.3.10b",2,3,10,"b","Ensuring that actions can be performed safely (eg by avoiding actions that can hamper response strategies, such as ‘seize and replace’)?",4,"","","","","",6,6,null,"10","2.3.10b","","",""]
[407,"2.3.10c",2,3,10,"c","Minimising the risk that an attacker will respond/escalate?",4,"","","","","",6,6,null,"10","2.3.10c","","",""]
[408,"2.3.10d",2,3,10,"d","Determining whether findings identified during the investigation are critical?",4,"","","","","",6,6,null,"10","2.3.10d","","",""]
[409,"2.3.10e",2,3,10,"e","Reacting to critical findings during the investigation?",5,"","","","","",6,6,null,"10","2.3.10e","","",""]
[410,"2.3.10f",2,3,10,"f","Duration of the solution (eg emergency workaround to be removed in four hours, temporary workaround to be removed in two weeks, permanent solution)?",5,"","","","","",6,6,null,"10","2.3.10f","","",""]
[411,"2.3.11",2,3,11,"","Does your approach to containing cyber security incidents include analysing:","N/A","","","",4,"","",4,null,"11","2.3.11","","",""]
[412,"2.3.11a",2,3,11,"a","Events in relation to the ‘attacker kill chain’ (ie reconnaissance, weaponize, deliver, exploit, install, command & control and act on objectives)?",5,"","","","","",6,6,null,"11","2.3.11a","","",""]
[413,"2.3.11b",2,3,11,"b","Both the attacker and defender aspects of an attack?",5,"","","","","",6,6,null,"11","2.3.11b","","",""]
[414,"","","","","","Eradication","","","",3,"","","",3,null,"","","",1,""]
[415,"2.3.12",2,3,12,"","Do you take steps to eliminate the cause of the cyber security incident (eradication)?",2,"","","","",5,"",5,null,"12","2.3.12","","",""]
[416,"2.3.13",2,3,13,"","Does eradication include (where necessary):","N/A","","","",4,"","",4,null,"13","2.3.13","","",""]
[417,"2.3.13a",2,3,13,"a","Removing the attack from the network?",3,"","","","","",6,6,null,"13","2.3.13a","","",""]
[418,"2.3.13b",2,3,13,"b","Deleting malware?",3,"","","","","",6,6,null,"13","2.3.13b","","",""]
[419,"2.3.13c",2,3,13,"c","Disabling breached user accounts?",3,"","","","","",6,6,null,"13","2.3.13c","","",""]
[420,"2.3.13d",2,3,13,"d","Identifying vulnerabilities that were exploited?",3,"","","","","",6,6,null,"13","2.3.13d","","",""]
[421,"2.3.13e",2,3,13,"e","Mitigating vulnerabilities that were exploited?",4,"","","","","",6,6,null,"13","2.3.13e","","",""]
[422,"2.3.14",2,3,14,"","Does the eradication process include:","N/A","","","",4,"","",4,null,"14","2.3.14","","",""]
[423,"2.3.14a",2,3,14,"a","Identifying all affected hosts within your organisation, so that they can be remediated?",3,"","","","","",6,6,null,"14","2.3.14a","","",""]
[424,"2.3.14b",2,3,14,"b","Identifying all affected hosts beyond your organisation, so that they can be remediated?",5,"","","","","",6,6,null,"14","2.3.14b","","",""]
[425,"2.3.14c",2,3,14,"c","Carrying out malware analysis?",5,"","","","","",6,6,null,"14","2.3.14c","","",""]
[426,"2.3.14d",2,3,14,"d","Checking for any response from the attacker to your actions?",5,"","","","","",6,6,null,"14","2.3.14d","","",""]
[427,"2.3.14e",2,3,14,"e","Developing a response (preferably in advance) if the attacker uses a different method of attack?",5,"","","","","",6,6,null,"14","2.3.14e","","",""]
[428,"2.3.14f",2,3,14,"f","Allowing sufficient time to ensure that the network is secure and that there is no response from the attacker?",3,"","","","","",6,6,null,"14","2.3.14f","","",""]
[429,"2.3.15",2,3,15,"","Do you produce an eradication plan?",3,"","","","",5,"",5,null,"15","2.3.15","","",""]
[430,"2.3.16",2,3,16,"","Is the eradication plan executed with speed and precision?",4,"","","","",5,"",5,null,"16","2.3.16","","",""]
[431,"2.3.17",2,3,17,"","Does the eradication plan enable actions to be taken to prevent attackers:","N/A","","","",4,"","",4,null,"17","2.3.17","","",""]
[432,"2.3.17a",2,3,17,"a","Sensing they have been discovered once eradication is underway?",5,"","","","","",6,6,null,"17","2.3.17a","","",""]
[433,"2.3.17b",2,3,17,"b","Re-establishing a base and entrenching themselves into the network again?",5,"","","","","",6,6,null,"17","2.3.17b","","",""]
[434,"2.3.17c",2,3,17,"c","Continuing the attack during eradication?",5,"","","","","",6,6,null,"17","2.3.17c","","",""]
[435,"2.3.17d",2,3,17,"d","Avoiding identification during eradication?",5,"","","","","",6,6,null,"17","2.3.17d","","",""]
[436,"","","","","","Evidence","","","",3,"","","",3,null,"","","",1,""]
[437,"2.3.18",2,3,18,"","Do you take steps to preserve evidence when dealing with the cyber security?",2,"","","","",5,"",5,null,"18","2.3.18","","",""]
[438,"2.3.19",2,3,19,"","Do you have a formal process for handling evidence when dealing with the cyber security?",3,"","","","",5,"",5,null,"19","2.3.19","","",""]
[439,"2.3.20",2,3,20,"","Does your process for handling evidence include:","N/A","","","",4,"","",4,null,"20","2.3.20","","",""]
[440,"2.3.20a",2,3,20,"a","Allowing for admissibility of evidence (whether or not the evidence can be used in court)?",3,"","","","","",6,6,null,"20","2.3.20a","","",""]
[441,"2.3.20b",2,3,20,"b","Allowing for weight of evidence (the quality and completeness of evidence)?",3,"","","","","",6,6,null,"20","2.3.20b","","",""]
[442,"2.3.20c",2,3,20,"c","Adherence to an approved set of guidelines, such as the Association of Chief Police Officers (ACPO) Guidelines on Computer Evidence (ACPO)?",3,"","","","","",6,6,null,"20","2.3.20c","","",""]
[443,"2.3.20d",2,3,20,"d","Complying with relevant laws?",3,{"$f":"IF(AND(LEN(C444)=1,LEN(D444)=0),1,\"\")","v":""},{"$f":"IF(AND(LEN(C444)=1,LEN(D444)=1,LEN(E444)=0,LEN(F444)=0),2,\"\")","v":""},{"$f":"IF(AND(LEN(C444)=0,LEN(E444)=0),3,\"\")","v":""},{"$f":"IF(AND(LEN(C444)>0,LEN(D444>0),LEN(E444)>0,LEN(F444)=0,H444=\"N/A\"),4,\"\")","v":""},{"$f":"IF(AND(LEN(C444)>0,LEN(D444>0),LEN(E444)>0,LEN(F444)=0,H444>0,H444<6),5,\"\")","v":""},{"$f":"IF(AND(LEN(C444)>0,LEN(D444>0),LEN(E444)>0,LEN(F444)>0,H444>0,H444<6),6,\"\")","v":6},{"$f":"SUM(I444:N444)","v":6},null,{"$f":"IF(LEN(E444)>0,TEXT(E444,\"00\"),\"\")","v":"20"},{"$f":"IF(O444=1,C444,IF(O444=2,C444&\".\"&D444,IF(O444=3,\"\",IF(O444=4,C444&\".\"&D444&\".\"&Q444,IF(O444=5,C444&\".\"&D444&\".\"&Q444,IF(O444=6,C444&\".\"&D444&\".\"&Q444&F444,\"\"))))))","v":"2.3.20d"},{"$f":"IF(O444=O443,IF(NOT(R444>R443),1,\"\"),\"\")","v":""},"",""]
[444,{"$f":"R445","v":"2.3.21"},2,3,21,"","Does your process for handling evidence explicitly include complying with the:","N/A","","","",4,"","",4,null,"21","2.3.21","",{"$f":"IF(NOT(R445>R444),1,\"\")","v":""},""]
[445,"2.3.21a",2,3,21,"a","Police and Criminal evidence act 1984 (PACE)?",3,"","","","","",6,6,null,"21","2.3.21a","","",""]
[446,"2.3.21b",2,3,21,"b","Data Protection Act 1988?",3,"","","","","",6,6,null,"21","2.3.21b","","",""]
[447,"2.3.21c",2,3,21,"c","Computer Misuse Act 1990?",3,"","","","","",6,6,null,"21","2.3.21c","","",""]
[448,"2.3.21d",2,3,21,"d","Regulation of Investigatory Powers 2000 (RIPA)?",3,"","","","","",6,6,null,"21","2.3.21d","","",""]
[449,"2.3.22",2,3,22,"","When handling evidence do you maintain a chain of evidence for:","N/A","","","",4,"","",4,null,"22","2.3.22","","",""]
[450,"2.3.22a",2,3,22,"a","Paper-based information?",3,"","","","","",6,6,null,"22","2.3.22a","","",{"$f":"IF(O451<4,IF(LEN(H451)=0,\"\",1),IF(O451=4,IF(H451=\"N/A\",\"\",1),IF(AND(O451>4,O451<7),IF(AND(H451>0,H451<6),\"\",1),1)))","v":""}]
[451,"2.3.22b",2,3,22,"b","Electronic information?",3,"","","","","",6,6,null,"22","2.3.22b","","",""]
[452,"2.3.23",2,3,23,"","Do you keep a detailed written log of every action taken during the investigation?",3,"","","","",5,"",5,null,"23","2.3.23","","",""]
[453,"2.3.24",2,3,24,"","Does this action log include:","N/A","","","",4,"","",4,null,"24","2.3.24","","",""]
[454,"2.3.24a",2,3,24,"a","Identifying information (eg the location, serial number, model number, hostname, media access control (MAC) addresses, and IP addresses of a computer)?",4,"","","","","",6,6,null,"24","2.3.24a","","",""]
[455,"2.3.24b",2,3,24,"b","Showing who did what, where, when, how and to what?",4,"","","","","",6,6,null,"24","2.3.24b","","",""]
[456,"2.3.24c",2,3,24,"c","Identifying where, when and how certain actions were taken by the perpetrators, such as command and control; exfiltration?",4,"","","","","",6,6,null,"24","2.3.24c","","",""]
[457,"2.3.24d",2,3,24,"d","Name, title, and phone number of each individual who collected or handled the evidence during the investigation?",4,"","","","","",6,6,null,"24","2.3.24d","","",""]
[458,"2.3.24e",2,3,24,"e","Time and date (including time zone) of each occurrence of evidence handling?",4,"","","","","",6,6,null,"24","2.3.24e","","",""]
[459,"2.3.24f",2,3,24,"f","Locations where the evidence was stored?",4,"","","","","",6,6,null,"24","2.3.24f","","",""]
[460,"2.3.25",2,3,25,"","Does the content of the action log enable:","N/A","","","",4,"","",4,null,"25","2.3.25","","",""]
[461,"2.3.25a",2,3,25,"a","Clear and precise evidence to be referred to at a later date?",5,"","","","","",6,6,null,"25","2.3.25a","","",""]
[462,"2.3.25b",2,3,25,"b","The sequence of events and actions taken to be repeated by opposition experts, if required?",5,"","","","","",6,6,null,"25","2.3.25b","","",""]
[463,"2.3.26",2,3,26,"","When gathering data for a potential prosecution, do you ensure that:","N/A","","","",4,"","",4,null,"26","2.3.26","","",""]
[464,"2.3.26a",2,3,26,"a","Any systems under investigation are not turned off until an expert decision on the risk of doing so has been made?",5,"","","","","",6,6,null,"26","2.3.26a","","",""]
[465,"2.3.26b",2,3,26,"b","Analysis is not performed on a live system under investigation before a forensically safe image has been taken?",5,"","","","","",6,6,null,"26","2.3.26b","","",""]
[466,"2.3.27",2,3,27,"","When supporting forensic work, do you ensure that:","N/A","","","",4,"","",4,null,"27","2.3.27","","",""]
[467,"2.3.27a",2,3,27,"a","Forensic work is only being performed on copies of the evidential material (eg using imaging technology)?",5,"","","","","",6,6,null,"27","2.3.27a","","",""]
[468,"2.3.27b",2,3,27,"b","The integrity of all evidential material is protected?",5,"","","","","",6,6,null,"27","2.3.27b","","",""]
[469,"2.4",2,4,"","","Recovery","","",2,"","","","",2,null,"","2.4",{"$f":"IF(O470=O469,IF(NOT(R470>R469),1,\"\"),\"\")","v":""},{"$f":"IF(NOT(R470>R469),1,\"\")","v":""},""]
[470,"","","","","","Objectives","","","",3,"","","",3,null,"","","",1,""]
[471,"2.4.01",2,4,1,"","Do you take steps to recover from a cyber security incident quickly and effectively?",1,"","","","",5,"",5,null,"01","2.4.01","","",""]
[472,"2.4.02",2,4,2,"","Do your objectives for recovering from a cyber security incident cover immediate business requirements, including:","N/A","","","",4,"","",4,null,"02","2.4.02","","",""]
[473,"2.4.02a",2,4,2,"a","Restoring systems to normal operation as soon as possible?",2,"","","","","",6,6,null,"02","2.4.02a","","",""]
[474,"2.4.02b",2,4,2,"b","Confirming that the systems are functioning normally?",2,"","","","","",6,6,null,"02","2.4.02b","","",""]
[475,"2.4.02c",2,4,2,"c","Restricting the amount of financial loss?",3,"","","","","",6,6,null,"02","2.4.02c","","",""]
[476,"2.4.02d",2,4,2,"d","Protecting the reputation of your organisation?",3,"","","","","",6,6,null,"02","2.4.02d","","",""]
[477,"2.4.02e",2,4,2,"e","Protecting confidential information?",3,"","","","","",6,6,null,"02","2.4.02e","","",""]
[478,"2.4.02f",2,4,2,"f","Complying with legal and regulatory requirements (eg PCI / DSS, NERC, ISO 27001, HIPAA or FISMA)?",3,"","","","","",6,6,null,"02","2.4.02f","","",""]
[479,"2.4.02g",2,4,2,"g","Limiting liabilities if things go wrong - or if there is a court case (ie take ‘reasonable’ precautions)?",3,"","","","","",6,6,null,"02","2.4.02g","","",""]
[480,"2.4.02h",2,4,2,"h","Providing assurance to third parties that everything is under control?",3,"","","","","",6,6,null,"02","2.4.02h","","",""]
[481,"2.4.03",2,4,3,"","Do your objectives for recovering from a cyber security incident cover wider implications for reducing the likelihood of future attacks, including:","N/A","","","",4,"","",4,null,"03","2.4.03","","",""]
[482,"2.4.03a",2,4,3,"a","Remediating vulnerabilities to prevent similar incidents occurring?",2,"","","","","",6,6,null,"03","2.4.03a","","",""]
[483,"2.4.03b",2,4,3,"b","Addressing similar weaknesses in your cyber security controls enterprise-wide and beyond?",2,"","","","","",6,6,null,"03","2.4.03b","","",""]
[484,"2.4.03c",2,4,3,"c","Reducing the frequency and impact of future security incidents?",3,"","","","","",6,6,null,"03","2.4.03c","","",""]
[485,"2.4.03d",2,4,3,"d","Proactively responding to the attack (eg by closing channels or 'attacking the attacker')?",5,"","","","","",6,6,null,"03","2.4.03d","","",""]
[486,"2.4.03e",2,4,3,"e","Closing down any criminal operation?",5,"","","","","",6,6,null,"03","2.4.03e","","",""]
[487,"2.4.03f",2,4,3,"f","Punishing offenders (eg prosecuting criminals, exposing national saboteurs and disciplining insiders?",4,"","","","","",6,6,null,"03","2.4.03f","","",""]
[488,"","","","","","Recovery Plan","","","",3,"","","",3,null,"","","",1,""]
[489,"2.4.04",2,4,4,"","Do you have a formal recovery plan for recovering from a cyber security incident?",2,"","","","",5,"",5,null,"04","2.4.04","","",""]
[490,"2.4.05",2,4,5,"","Does your recovery plan enable you to recover from a cyber security incident:","N/A","","","",4,"","",4,null,"05","2.4.05","","",""]
[491,"2.4.05a",2,4,5,"a","Quickly (ie within critical timescales)?",3,"","","","","",6,6,null,"05","2.4.05a","","",""]
[492,"2.4.05b",2,4,5,"b","Effectively (ensuring that all services have been restored to working order)?",3,"","","","","",6,6,null,"05","2.4.05b","","",""]
[493,"2.4.05c",2,4,5,"c","In a consistent manner?",3,"","","","","",6,6,null,"05","2.4.05c","","",""]
[494,"2.4.06",2,4,6,"","Does your recovery plan cover basic recovery techniques including:","N/A","","","",4,"","",4,null,"06","2.4.06","","",""]
[495,"2.4.06a",2,4,6,"a","Rebuilding infected systems (often from known ‘clean’ sources)",2,"","","","","",6,6,null,"06","2.4.06a","","",""]
[496,"2.4.06b",2,4,6,"b","Reconnecting networks",2,"","","","","",6,6,null,"06","2.4.06b","","",""]
[497,"2.4.06c",2,4,6,"c","Restoring, recreating or correcting information?",2,"","","","","",6,6,null,"06","2.4.06c","","",""]
[498,"2.4.06d",2,4,6,"d","Documenting changes made to the infrastructure?",2,"","","","","",6,6,null,"06","2.4.06d","","",""]
[499,"2.4.06e",2,4,6,"e","Dealing with parts of your systems or networks that cannot be recovered?",2,"","","","","",6,6,null,"06","2.4.06e","","",""]
[500,"2.4.07",2,4,7,"","Does your recovery plan cover additional recovery techniques including:","N/A","","","",4,"","",4,null,"07","2.4.07","","",""]
[501,"2.4.07a",2,4,7,"a","Replacing compromised files with clean versions?",3,"","","","","",6,6,null,"07","2.4.07a","","",""]
[502,"2.4.07b",2,4,7,"b","Removing temporary constraints imposed during the containment period?",3,"","","","","",6,6,null,"07","2.4.07b","","",""]
[503,"2.4.07c",2,4,7,"c","Resetting passwords on compromised accounts?",3,"","","","","",6,6,null,"07","2.4.07c","","",""]
[504,"2.4.07d",2,4,7,"d","Installing patches, changing passwords and tightening network perimeter security, such as firewall rulesets?",4,"","","","","",6,6,null,"07","2.4.07d","","",""]
[505,"2.4.07e",2,4,7,"e","Testing systems thoroughly – including security controls?",4,"","","","","",6,6,null,"07","2.4.07e","","",""]
[506,"2.4.07f",2,4,7,"f","Confirming the integrity of business systems and controls?",3,{"$f":"IF(AND(LEN(C507)=1,LEN(D507)=0),1,\"\")","v":""},{"$f":"IF(AND(LEN(C507)=1,LEN(D507)=1,LEN(E507)=0,LEN(F507)=0),2,\"\")","v":""},{"$f":"IF(AND(LEN(C507)=0,LEN(E507)=0),3,\"\")","v":""},{"$f":"IF(AND(LEN(C507)>0,LEN(D507>0),LEN(E507)>0,LEN(F507)=0,H507=\"N/A\"),4,\"\")","v":""},{"$f":"IF(AND(LEN(C507)>0,LEN(D507>0),LEN(E507)>0,LEN(F507)=0,H507>0,H507<6),5,\"\")","v":""},{"$f":"IF(AND(LEN(C507)>0,LEN(D507>0),LEN(E507)>0,LEN(F507)>0,H507>0,H507<6),6,\"\")","v":6},{"$f":"SUM(I507:N507)","v":6},null,{"$f":"IF(LEN(E507)>0,TEXT(E507,\"00\"),\"\")","v":"07"},{"$f":"IF(O507=1,C507,IF(O507=2,C507&\".\"&D507,IF(O507=3,\"\",IF(O507=4,C507&\".\"&D507&\".\"&Q507,IF(O507=5,C507&\".\"&D507&\".\"&Q507,IF(O507=6,C507&\".\"&D507&\".\"&Q507&F507,\"\"))))))","v":"2.4.07f"},{"$f":"IF(O507=O506,IF(NOT(R507>R506),1,\"\"),\"\")","v":""},"",""]
[507,{"$f":"R508","v":"2.4.07g"},2,4,7,"g","Announcing the resumption of business services to all relevant stakeholders?",3,"","","","","",6,6,null,"07","2.4.07g","",{"$f":"IF(NOT(R508>R507),1,\"\")","v":""},""]
[508,"2.4.08",2,4,8,"","Is your recovery plan:","N/A","","","",4,"","",4,null,"08","2.4.08","","",""]
[509,"2.4.08a",2,4,8,"a","Linked to the nature of the attack",5,"","","","","",6,6,null,"08","2.4.08a","","",""]
[510,"2.4.08b",2,4,8,"b","Based on a risk-based approach to recovery?",5,"","","","","",6,6,null,"08","2.4.08b","","",""]
[511,"2.4.08c",2,4,8,"c","Designed to prevent exacerbating current risks caused by the incident or introducing new risks?",5,"","","","","",6,6,null,"08","2.4.08c","","",""]
[512,"","","","","","Validation","","","",3,"","","",3,null,"","","",1,""]
[513,"2.4.09",2,4,9,"","Do you validate that systems are operating normally again by:","N/A","","","",4,"","",4,null,"09","2.4.09","","",""]
[514,"2.4.09a",2,4,9,"a","Carrying out an independent penetration test of the affected systems?",4,"","","","","",6,6,null,"09","2.4.09a","","",{"$f":"IF(O515<4,IF(LEN(H515)=0,\"\",1),IF(O515=4,IF(H515=\"N/A\",\"\",1),IF(AND(O515>4,O515<7),IF(AND(H515>0,H515<6),\"\",1),1)))","v":""}]
[515,"2.4.09b",2,4,9,"b","Undertaking a security controls assessment?",4,"","","","","",6,6,null,"09","2.4.09b","","",""]
[516,"2.4.10",2,4,10,"","To help detect further attacks (or attempted attacks) do you:","N/A","","","",4,"","",4,null,"10","2.4.10","","",""]
[517,"2.4.10a",2,4,10,"a","Retain cyber security threat intelligence (including network situational awareness)?",5,"","","","","",6,6,null,"10","2.4.10a","","",""]
[518,"2.4.10b",2,4,10,"b","Monitor the network over an extended time?",5,"","","","","",6,6,null,"10","2.4.10b","","",""]
[519,"2.4.11",2,4,11,"","Once systems have been recovered and controls have been tested do you:","N/A","","","",4,"","",4,null,"11","2.4.11","","",""]
[520,"2.4.11a",2,4,11,"a","Provided stakeholders with a brief summary of what took place?",3,"","","","","",6,6,null,"11","2.4.11a","","",""]
[521,"2.4.11b",2,4,11,"b","Brief stakeholders within a day or so of the event?",3,"","","","","",6,6,null,"11","2.4.11b","","",""]
[522,3,3,"","","","Follow up","",1,"","","","","",1,null,"",3,"",1,""]
[523,"3.1",3,1,"","","Incident investigation","","",2,"","","","",2,null,"","3.1","","",""]
[524,"3.1.01",3,1,1,"","Do you investigate cyber security incidents more thoroughly after they have been resolved?",1,"","","","",5,"",5,null,"01","3.1.01","","",""]
[525,"3.1.02",3,1,2,"","Is your investigation carried out in a structured, systematic manner?",2,"","","","",5,"",5,null,"02","3.1.02","","",""]
[526,"3.1.03",3,1,3,"","Do you perform problem cause analysis for cyber security incidents?",3,"","","","",5,"",5,null,"03","3.1.03","","",""]
[527,"3.1.04",3,1,4,"","Does your problem cause analysis include using appropriate investigative techniques, such as:",4,"","","","",5,"",5,null,"04","3.1.04","","",""]
[528,"3.1.05",3,1,5,"","Do you carry out root cause identification for cyber security incidents?",3,"","","","",5,"",5,null,"05","3.1.05","","",""]
[529,"3.1.06",3,1,6,"","Does your root cause identification include using appropriate investigative techniques, such as:",4,"","","","",5,"",5,null,"06","3.1.06","","",""]
[530,"3.1.07",3,1,7,"","Does your root cause identification help to identify previously unknown sources of cyber security incidents?",5,"","","","",5,"",5,null,"07","3.1.07","","",""]
[531,"3.1.08",3,1,8,"","Do you quantify the business impact of cyber security incidents (eg in terms of financial, reputational, management or compliance impact)?",4,"","","","",5,"",5,null,"08","3.1.08","","",""]
[532,"3.1.09",3,1,9,"","Do you carry out sufficient investigation to identify the perpetrators(s) of the cyber security incident, which may involve specialist support, such as from forensic investigators?",5,"","","","",5,"",5,null,"09","3.1.09","","",""]
[533,"3.1.10",3,1,10,"","Does your investigation cover events in relation to the ‘attacker kill chain’ (ie reconnaissance, weaponize, deliver, exploit, install, command & control and act on objectives)?",5,"","","","",5,"",5,null,"10","3.1.10","","",""]
[534,"3.1.11",3,1,11,"","Does your investigation link to wider problem management activities, such as those used in service management (eg ITIL approach)?",5,"","","","",5,"",5,null,"11","3.1.11","","",""]
[535,"3.2",3,2,"","","Reporting","","",2,"","","","",2,null,"","3.2",{"$f":"IF(O536=O535,IF(NOT(R536>R535),1,\"\"),\"\")","v":""},{"$f":"IF(NOT(R536>R535),1,\"\")","v":""},""]
[536,"3.2.01",3,2,1,"","Are cyber security incidents reported to relevant internal stakeholders (eg information security, corporate IT departments and business units)?",1,"","","","",5,"",5,null,"01","3.2.01","","",""]
[537,"3.2.02",3,2,2,"","Are you aware of:","N/A","","","",4,"","",4,null,"02","3.2.02","","",""]
[538,"3.2.02a",3,2,2,"a","Your regulatory and legal reporting requirements (eg mandatory reporting to particular authorities)?",2,"","","","","",6,6,null,"02","3.2.02a","","",""]
[539,"3.2.02b",3,2,2,"b","What types of cyber security incident need to be reported?",2,"","","","","",6,6,null,"02","3.2.02b","","",""]
[540,"3.2.02c",3,2,2,"c","To which external body each type of cyber security incidents need to be reported?",2,"","","","","",6,6,null,"02","3.2.02c","","",""]
[541,"3.2.02d",3,2,2,"d","The format in which cyber security incidents need to be reported?",2,"","","","","",6,6,null,"02","3.2.02d","","",""]
[542,"3.2.02e",3,2,2,"e","The objectives of reporting cyber security incidents?",2,"","","","","",6,6,null,"02","3.2.02e","","",""]
[543,"3.2.03",3,2,3,"","Do you report targeted cyber security incidents, to required authorities, such as GovCertUK (the Government’s Computer Emergency Response Team)?",3,"","","","",5,"",5,null,"03","3.2.03","","",""]
[544,"3.2.04",3,2,4,"","Do you notify required authorities, such as GovCertUK (the Government’s Computer Emergency Response Team) of any other (non-targeted) cyber security incidents?",3,"","","","",5,"",5,null,"04","3.2.04","","",""]
[545,"3.2.05",3,2,5,"","When reporting cyber security incidents, do you provide:","N/A","","","",4,"","",4,null,"05","3.2.05","","",""]
[546,"3.2.05a",3,2,5,"a","A full description of the nature of the incident, its history, and what actions were taken to recover?",4,"","","","","",6,6,null,"05","3.2.05a","","",""]
[547,"3.2.05b",3,2,5,"b","A realistic estimate of the financial cost of the incident, as well as other impacts on the business, such as in terms of damage to reputation, loss of management control or impaired growth?",4,"","","","","",6,6,null,"05","3.2.05b","","",""]
[548,"3.2.05c",3,2,5,"c","Recommendations regarding enhanced or additional controls required to prevent, detect, remediate or recover from cyber security incidents more effectively?",4,"","","","","",6,6,null,"05","3.2.05c","","",""]
[549,"3.2.06",3,2,6,"","Do you voluntarily report cyber security incidents to important stakeholders, such as law enforcement agencies, specialised bodies (eg NIST, ENISA or CREST), regulatory bodies with particular market sectors (eg the FSA or Bank of England in Finance) or collaborative groups?",5,"","","","",5,"",5,null,"06","3.2.06","","",""]
[550,"3.2.07",3,2,7,"","Do you provide recommendations to external bodies regarding enhanced or additional controls required to prevent, detect, remediate or recover from cyber security incidents more effectively?",5,"","","","",5,"",5,null,"07","3.2.07","","",""]
[551,"3.3",3,3,"","","Post incident review","","",2,"","","","",2,null,"","3.3",{"$f":"IF(O552=O551,IF(NOT(R552>R551),1,\"\"),\"\")","v":""},{"$f":"IF(NOT(R552>R551),1,\"\")","v":""},""]
[552,"3.3.01",3,3,1,"","Do you carry out post incident reviews for particular cyber security incidents?",1,"","","","",5,"",5,null,"01","3.3.01","","",""]
[553,"3.3.02",3,3,2,"","Is your post incident review process formalised (eg documented and approved)?",2,"","","","",5,"",5,null,"02","3.3.02","","",""]
[554,"3.3.03",3,3,3,"","Do your post incident reviews include analysing the incident management process to determine:","N/A","","","",4,"","",4,null,"03","3.3.03","","",""]
[555,"3.3.03a",3,3,3,"a","How quickly actions were taken to identify, respond to and recover from the incident?",3,"","","","","",6,6,null,"03","3.3.03a","","",""]
[556,"3.3.03b",3,3,3,"b","How long attackers were in systems before detection?",5,"","","","","",6,6,null,"03","3.3.03b","","",""]
[557,"3.3.03c",3,3,3,"c","What actions attackers took and planned to take",5,"","","","","",6,6,null,"03","3.3.03c","","",""]
[558,"3.3.03d",3,3,3,"d","The level of protection maintained over critical systems and confidential information during the incident?",4,"","","","","",6,6,null,"03","3.3.03d","","",""]
[559,"3.3.03e",3,3,3,"e","How well staff and management performed in dealing with the incident?",3,"","","","","",6,6,null,"03","3.3.03e","","",""]
[560,"3.3.03f",3,3,3,"f","If all key discussions and decisions conducted during the eradication event were well documented?",3,"","","","","",6,6,null,"03","3.3.03f","","",""]
[561,"3.3.03g",3,3,3,"g","The effectiveness of procedures?",3,"","","","","",6,6,null,"03","3.3.03g","","",""]
[562,"3.3.03h",3,3,3,"h","If any steps or actions taken might have inhibited the recovery?",3,"","","","","",6,6,null,"03","3.3.03h","","",""]
[563,"3.3.03i",3,3,3,"i","If any unforeseen events could have been prevented?",3,"","","","","",6,6,null,"03","3.3.03i","","",""]
[564,"3.3.04",3,3,4,"","Do your post incident reviews include informing possible future actions by evaluating:","N/A","","","",4,"","",4,null,"04","3.3.04","","",""]
[565,"3.3.04a",3,3,4,"a","What the staff and management can do differently the next time a similar cyber security incident occurs?",3,"","","","","",6,6,null,"04","3.3.04a","","",""]
[566,"3.3.04b",3,3,4,"b","How information sharing with other organisations can be improved?",3,"","","","","",6,6,null,"04","3.3.04b","","",""]
[567,"3.3.04c",3,3,4,"c","What corrective actions can prevent similar incidents in the future?",3,"","","","","",6,6,null,"04","3.3.04c","","",""]
[568,"3.3.04d",3,3,4,"d","Any precursors or indicators that should be watched for in the future to detect similar incidents?",4,{"$f":"IF(AND(LEN(C569)=1,LEN(D569)=0),1,\"\")","v":""},{"$f":"IF(AND(LEN(C569)=1,LEN(D569)=1,LEN(E569)=0,LEN(F569)=0),2,\"\")","v":""},{"$f":"IF(AND(LEN(C569)=0,LEN(E569)=0),3,\"\")","v":""},{"$f":"IF(AND(LEN(C569)>0,LEN(D569>0),LEN(E569)>0,LEN(F569)=0,H569=\"N/A\"),4,\"\")","v":""},{"$f":"IF(AND(LEN(C569)>0,LEN(D569>0),LEN(E569)>0,LEN(F569)=0,H569>0,H569<6),5,\"\")","v":""},{"$f":"IF(AND(LEN(C569)>0,LEN(D569>0),LEN(E569)>0,LEN(F569)>0,H569>0,H569<6),6,\"\")","v":6},{"$f":"SUM(I569:N569)","v":6},null,{"$f":"IF(LEN(E569)>0,TEXT(E569,\"00\"),\"\")","v":"04"},{"$f":"IF(O569=1,C569,IF(O569=2,C569&\".\"&D569,IF(O569=3,\"\",IF(O569=4,C569&\".\"&D569&\".\"&Q569,IF(O569=5,C569&\".\"&D569&\".\"&Q569,IF(O569=6,C569&\".\"&D569&\".\"&Q569&F569,\"\"))))))","v":"3.3.04d"},{"$f":"IF(O569=O568,IF(NOT(R569>R568),1,\"\"),\"\")","v":""},"",""]
[569,{"$f":"R570","v":"3.3.04e"},3,3,4,"e","How results can be fed back into your risk assessment methodology?",4,"","","","","",6,6,null,"04","3.3.04e","",{"$f":"IF(NOT(R570>R569),1,\"\")","v":""},""]
[570,"3.3.05",3,3,5,"","Is a report produced from your post incident review?",3,"","","","",5,"",5,null,"05","3.3.05","","",""]
[571,"3.3.06",3,3,6,"","Are the results of your post implementation review report presented to all relevant stakeholders?",4,"","","","",5,"",5,null,"06","3.3.06","","",""]
[572,"3.3.07",3,3,7,"","Is your post incident review process evaluated on a regular basis to identify any improvements that can be made to it)?",4,"","","","",5,"",5,null,"07","3.3.07","","",""]
[573,"3.4",3,4,"","","Lessons learned","","",2,"","","","",2,null,"","3.4",{"$f":"IF(O574=O573,IF(NOT(R574>R573),1,\"\"),\"\")","v":""},{"$f":"IF(NOT(R574>R573),1,\"\")","v":""},""]
[574,"3.4.01",3,4,1,"","Do you identify lessons learned from cyber security incidents?",1,"","","","",5,"",5,null,"01","3.4.01","","",""]
[575,"3.4.02",3,4,2,"","Are lessons learned:","N/A","","","",4,"","",4,null,"02","3.4.02","","",""]
[576,"3.4.02a",3,4,2,"a","Formally documented?",2,"","","","","",6,6,null,"02","3.4.02a","","",""]
[577,"3.4.02b",3,4,2,"b","Communicated to relevant stakeholders?",2,"","","","","",6,6,null,"02","3.4.02b","","",""]
[578,"3.4.02c",3,4,2,"c","Built upon in the form of tangible actions?",3,{"$f":"IF(AND(LEN(C579)=1,LEN(D579)=0),1,\"\")","v":""},{"$f":"IF(AND(LEN(C579)=1,LEN(D579)=1,LEN(E579)=0,LEN(F579)=0),2,\"\")","v":""},{"$f":"IF(AND(LEN(C579)=0,LEN(E579)=0),3,\"\")","v":""},{"$f":"IF(AND(LEN(C579)>0,LEN(D579>0),LEN(E579)>0,LEN(F579)=0,H579=\"N/A\"),4,\"\")","v":""},{"$f":"IF(AND(LEN(C579)>0,LEN(D579>0),LEN(E579)>0,LEN(F579)=0,H579>0,H579<6),5,\"\")","v":""},{"$f":"IF(AND(LEN(C579)>0,LEN(D579>0),LEN(E579)>0,LEN(F579)>0,H579>0,H579<6),6,\"\")","v":6},{"$f":"SUM(I579:N579)","v":6},null,{"$f":"IF(LEN(E579)>0,TEXT(E579,\"00\"),\"\")","v":"02"},{"$f":"IF(O579=1,C579,IF(O579=2,C579&\".\"&D579,IF(O579=3,\"\",IF(O579=4,C579&\".\"&D579&\".\"&Q579,IF(O579=5,C579&\".\"&D579&\".\"&Q579,IF(O579=6,C579&\".\"&D579&\".\"&Q579&F579,\"\"))))))","v":"3.4.02c"},{"$f":"IF(O579=O578,IF(NOT(R579>R578),1,\"\"),\"\")","v":""},{"$f":"IF(NOT(R579>R578),1,\"\")","v":""},{"$f":"IF(O579<4,IF(LEN(H579)=0,\"\",1),IF(O579=4,IF(H579=\"N/A\",\"\",1),IF(AND(O579>4,O579<7),IF(AND(H579>0,H579<6),\"\",1),1)))","v":""}]
[579,"3.4.02d",3,4,2,"d","Used to share both key issues and good practice across all areas of the business, not just within IT and cyber security teams?",4,"","","","","",6,6,null,"02","3.4.02d","","",""]
[580,"3.4.03",3,4,3,"","Is communication to stakeholders about lessons learned:","N/A","","","",4,"","",4,null,"03","3.4.03","","",""]
[581,"3.4.03a",3,4,3,"a","Clear and concise?",2,"","","","","",6,6,null,"03","3.4.03a","","",""]
[582,"3.4.03b",3,4,3,"b","Focused on problem resolution and control improvement?",2,"","","","","",6,6,null,"03","3.4.03b","","",""]
[583,"3.4.04",3,4,4,"","Is communication to stakeholders about lessons learned used to:","N/A","","","",4,"","",4,null,"04","3.4.04","","",""]
[584,"3.4.04a",3,4,4,"a","Help identify any gaps that remain and proposed efforts to mitigate them?",2,"","","","","",6,6,null,"04","3.4.04a","","",""]
[585,"3.4.04b",3,4,4,"b","Inform strategic security goals?",2,"","","","","",6,6,null,"04","3.4.04b","","",""]
[586,"3.4.05",3,4,5,"","Are formal actions plans developed to help build on lessons learned?",3,"","","","",5,"",5,null,"05","3.4.05","","",""]
[587,"3.4.06",3,4,6,"","Do actions plans:","N/A","","","",4,"","",4,null,"06","3.4.06","","",""]
[588,"3.4.06a",3,4,6,"a","Consider whether technical capability gaps contributed to the attacker’s success or whether people or process gaps were the main culprit?",3,"","","","","",6,6,null,"06","3.4.06a","","",""]
[589,"3.4.06b",3,4,6,"b","Leverage lessons learned from the incident to become more resilient in the face of future cyber security attacks?",3,"","","","","",6,6,null,"06","3.4.06b","","",""]
[590,"3.4.07",3,4,7,"","Do actions plans include projects or initiatives, technical and nontechnical that will help:","N/A","","","",4,"","",4,null,"07","3.4.07","","",""]
[591,"3.4.07a",3,4,7,"a","Reduce an attacker’s chance of success?",3,"","","","","",6,6,null,"07","3.4.07a","","",""]
[592,"3.4.07b",3,4,7,"b","Respond to an attacker’s activities more rapidly and effectively?",3,"","","","","",6,6,null,"07","3.4.07b","","",""]
[593,"3.4.08",3,4,8,"","Is each action:","N/A","","","",4,"","",4,null,"08","3.4.08","","",""]
[594,"3.4.08a",3,4,8,"a","Assigned to a named individual?",4,"","","","","",6,6,null,"08","3.4.08a","","",""]
[595,"3.4.08b",3,4,8,"b","Given a suitable priority?",3,"","","","","",6,6,null,"08","3.4.08b","","",""]
[596,"3.4.08c",3,4,8,"c","Allocated a completion date?",3,"","","","","",6,6,null,"08","3.4.08c","","",""]
[597,"3.4.08d",3,4,8,"d","Monitored to ensure that it is being completed in a timely and effective manner?",4,"","","","","",6,6,null,"08","3.4.08d","","",""]
[598,"3.5",3,5,"","","Updating","","",2,"","","","",2,null,"","3.5","","",""]
[599,"3.5.01",3,5,1,"","Following a cyber security incident, do you carry out any updates (eg to your cyber security incident response approaches, controls and related documents)?",1,"","","","",5,"",5,null,"01","3.5.01","","",""]
[600,"3.5.02",3,5,2,"","Following a cyber security incident, do you update your:","N/A","","","",4,"","",4,null,"02","3.5.02","","",""]
[601,"3.5.02a",3,5,2,"a","Cyber security incident management methodologies or processes?",2,"","","","","",6,6,null,"02","3.5.02a","","",""]
[602,"3.5.02b",3,5,2,"b","Cyber security incident response plan?",2,"","","","","",6,6,null,"02","3.5.02b","","",""]
[603,"3.5.02c",3,5,2,"c","Management controls (eg training and awareness)",2,"","","","","",6,6,null,"02","3.5.02c","","",""]
[604,"3.5.02d",3,5,2,"d","Technical controls (eg patching, configuring system logs, and use of intrusion prevention / detection tools)",3,"","","","","",6,6,null,"02","3.5.02d","","",""]
[605,"3.5.02e",3,5,2,"e","Roles and responsibilities for handling incidents?",3,"","","","","",6,6,null,"02","3.5.02e","","",""]
[606,"3.5.03",3,5,3,"","When updating controls, do you consider the attack vectors causing most concern, which often include:",5,"","","","",5,"",5,null,"03","3.5.03","","",""]
[607,"3.5.04",3,5,4,"","When updating controls, do you:",5,"","","","",5,"",5,null,"04","3.5.04","","",""]
[608,"3.5.04a",3,5,4,"a","Consider their effectiveness in relation to events in the ‘attacker kill chain’ (ie reconnaissance, weaponize, deliver, exploit, install, command & control and act on objectives)?",5,"","","","","",6,6,null,"04","3.5.04a","","",""]
[609,"3.5.04b",3,5,4,"b","Review implications for tactical and short term security projects?",5,"","","","","",6,6,null,"04","3.5.04b","","",""]
[610,"3.5.05",3,5,5,"","Following a cyber security incident, do you feed the results of incident analysis back into your:","N/A","","","",4,"","",4,null,"05","3.5.05","","",""]
[611,"3.5.05a",3,5,5,"a","Risk assessment methodologies?",4,"","","","","",6,6,null,"05","3.5.05a","","",""]
[612,"3.5.05b",3,5,5,"b","Cyber security threat analysis?",4,"","","","","",6,6,null,"05","3.5.05b","","",""]
[613,"3.5.05c",3,5,5,"c","Business continuity or crisis management arrangements?",3,"","","","","",6,6,null,"05","3.5.05c","","",""]
[614,"3.5.05d",3,5,5,"d","Contractual arrangements with third party suppliers?",5,"","","","","",6,6,null,"05","3.5.05d","","",""]
[615,"3.5.05e",3,5,5,"e","Business intelligence initiatives?",5,"","","","","",6,6,null,"05","3.5.05e","","",""]
[616,"3.5.06",3,5,6,"","Are updates carried out:","N/A","","","",4,"","",4,null,"06","3.5.06","","",""]
[617,"3.5.06a",3,5,6,"a","Using a structured, systematic process?",3,"","","","","",6,6,null,"06","3.5.06a","","",""]
[618,"3.5.06b",3,5,6,"b","In accordance with formally approved documentation?",3,"","","","","",6,6,null,"06","3.5.06b","","",""]
[619,"3.5.07",3,5,7,"","Following a cyber security incident, do you review your state of readiness for handling a cyber security incident?",5,"","","","",5,"",5,null,"07","3.5.07","","",""]
[620,"3.6",3,6,"","","Trend analysis","","",2,"","","","",2,null,"","3.6","","",""]
[621,"3.6.01",3,6,1,"","Do you maintain a central register of all cyber security incidents?",3,"","","","",5,"",5,null,"01","3.6.01","","",""]
[622,"3.6.02",3,6,2,"","Does this register link with the risk registers used to record cyber risks?",4,"","","","",5,"",5,null,"02","3.6.02","","",""]
[623,"3.6.03",3,6,3,"","Do you analyse relevant cyber security incident data regularly (trend analysis) to help:","N/A","","","",4,"","",4,null,"03","3.6.03","","",""]
[624,"3.6.03a",3,6,3,"a","Evaluate patterns and trends of cyber security incidents?",4,"","","","","",6,6,null,"03","3.6.03a","","",""]
[625,"3.6.03b",3,6,3,"b","Identify common factors that have influenced cyber security incidents?",4,"","","","","",6,6,null,"03","3.6.03b","","",""]
[626,"3.6.03c",3,6,3,"c","Determine the effectiveness of controls (eg which controls are better at preventing, detecting and delaying cyber security incidents or minimising their business impact)?",3,"","","","","",6,6,null,"03","3.6.03c","","",""]
[627,"3.6.03d",3,6,3,"d","Address attribution (eg their ability to bundle data together to produce meaningful conclusions)",3,"","","","","",6,6,null,"03","3.6.03d","","",""]
[628,"3.6.03e",3,6,3,"e","Understand the costs and impacts associated with cyber security incidents?",3,"","","","","",6,6,null,"03","3.6.03e","","",""]
[629,"3.6.04",3,6,4,"","Does your analysis of cyber security incident data include:","N/A","","","",4,"","",4,null,"04","3.6.04","","",""]
[630,{"$f":"R631","v":"3.6.04a"},3,6,4,"a","Searching your archived data, as required?",4,"","","","","",6,6,null,"04","3.6.04a","","",""]
[631,"3.6.04b",3,6,4,"b","Protecting your archived data, as it is often sensitive?",4,"","","","","",6,6,null,"04","3.6.04b","","",""]
[632,"3.6.05",3,6,5,"","Does your trend analysis:",5,"","","","",5,"",5,null,"05","3.6.05","","",""]
[633,"3.6.05a",3,6,5,"a","Cover all types of technology, rather than just particular types or suppliers (ie it is technology agnostic)?",3,"","","","","",6,6,null,"05","3.6.05a","","",""]
[634,"3.6.05b",3,6,5,"b","Evaluate the mean time of cyber security incident investigations (ie how long each investigation took to identify, respond to and recover from incidents)",5,"","","","","",6,6,null,"05","3.6.05b","","",""]
[635,"3.6.06",3,6,6,"","Does your trend analysis include:",5,"","","","",5,"",5,null,"06","3.6.06","","",""]
[636,"3.6.06a",3,6,6,"a","Looking for flaws across the entire organisation or over time, rather than just concentrating on what can be perceived as a single event?",4,"","","","","",6,6,null,"06","3.6.06a","","",""]
[637,"3.6.06b",3,6,6,"b","Sharing information about your cyber security incidents with the wider community (eg in your markets sector, membership bodies, government and law enforcement)?",4,"","","","","",6,6,null,"06","3.6.06b","","",""]
[638,"3.6.07",3,6,7,"","Do your objectives for sharing information include:","N/A","","","",4,"","",4,null,"07","3.6.07","","",""]
[639,"3.6.07a",3,6,7,"a","Gaining advice on reducing vulnerabilities in your organisation?",4,"","","","","",6,6,null,"07","3.6.07a","","",""]
[640,"3.6.07b",3,6,7,"b","Learning how to configure systems to reduce the potential attack surface?",4,{"$f":"IF(AND(LEN(C641)=1,LEN(D641)=0),1,\"\")","v":""},{"$f":"IF(AND(LEN(C641)=1,LEN(D641)=1,LEN(E641)=0,LEN(F641)=0),2,\"\")","v":""},{"$f":"IF(AND(LEN(C641)=0,LEN(E641)=0),3,\"\")","v":""},{"$f":"IF(AND(LEN(C641)>0,LEN(D641>0),LEN(E641)>0,LEN(F641)=0,H641=\"N/A\"),4,\"\")","v":""},{"$f":"IF(AND(LEN(C641)>0,LEN(D641>0),LEN(E641)>0,LEN(F641)=0,H641>0,H641<6),5,\"\")","v":""},{"$f":"IF(AND(LEN(C641)>0,LEN(D641>0),LEN(E641)>0,LEN(F641)>0,H641>0,H641<6),6,\"\")","v":6},{"$f":"SUM(I641:N641)","v":6},null,{"$f":"IF(LEN(E641)>0,TEXT(E641,\"00\"),\"\")","v":"07"},{"$f":"IF(O641=1,C641,IF(O641=2,C641&\".\"&D641,IF(O641=3,\"\",IF(O641=4,C641&\".\"&D641&\".\"&Q641,IF(O641=5,C641&\".\"&D641&\".\"&Q641,IF(O641=6,C641&\".\"&D641&\".\"&Q641&F641,\"\"))))))","v":"3.6.07b"},"","",""]
[641,"3.6.07c",3,6,7,"c","Getting hold of tools and services to help you fix problems?",3,"","","","","",6,6,null,"07","3.6.07c","","",""]
[642,"3.6.08",3,6,8,"","Do these activities include:","N/A","","","",4,"","",4,null,"08","3.6.08",{"$f":"IF(O643=O642,IF(NOT(R643>R642),1,\"\"),\"\")","v":""},{"$f":"IF(NOT(R643>R642),1,\"\")","v":""},{"$f":"IF(O643<4,IF(LEN(H643)=0,\"\",1),IF(O643=4,IF(H643=\"N/A\",\"\",1),IF(AND(O643>4,O643<7),IF(AND(H643>0,H643<6),\"\",1),1)))","v":""}]
[643,"3.6.08a",3,6,8,"a","Taking part in external events, such as by attending conferences, enrolling in training programmes and subscribing to specialised services?",4,"","","","","",6,6,null,"08","3.6.08a","","",""]
[644,"3.6.08b",3,6,8,"b","Collaborating with relevant third parties, such as participating in information exchanges, contributing to scenario-based rehearsals and introducing two-way cyber security alert mechanisms?",5,"","","","","",6,6,null,"08","3.6.08b","","",""]
[645,"3.6.08c",3,6,8,"c","Making use of the UK Government’s certified Cyber Incident Response (CIR) services?",5,"","","","","",6,6,null,"08","3.6.08c","","",""]

{"sheet":"Assessment - Phase 1","index":7,"n_rows":266,"n_cols":28,"rows_kept":266,"cut":false,"hidden":false,"merged":[[1,5,4,5]]}
[]
[null,null,null,null,null,"Maturity model for Phase 1 - Prepare"]
[]
[]
[]
[]
[null,null,null,null,null,null,"Response","Weighting","Weighted score","Evidence supplied","Comments"]
[2,{"$f":"VLOOKUP(A8,contentref,2,FALSE)","v":"1.1"},{"$f":"VLOOKUP(A8,contentref,15,FALSE)","v":2},null,{"$f":"IF(C8=1,\"Phase \"&B8,IF(C8=2,\"Step \"&VLOOKUP(A8,contentref,4,FALSE),B8))","v":"Step 1"},{"$f":"VLOOKUP(A8,contentref,7,FALSE)","v":"Criticality assessment"},null,{"$f":"IF(ISERROR(VLOOKUP(E8,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E8,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E8,Weightings!T:Y,6,FALSE)))","v":""},{"$f":"IF(ISERROR(VLOOKUP(AA8,detail_maturity_score,3,FALSE)*VLOOKUP(H8,weighting_scores,2,FALSE)),\"\",VLOOKUP(AA8,detail_maturity_score,3,FALSE)*VLOOKUP(H8,weighting_scores,2,FALSE))","v":""}]
[3,"1.1.01",5,null,"1.1.01","Have you defined your critical information assets?",null,{"$f":"IF(ISERROR(VLOOKUP(E9,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E9,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E9,Weightings!T:Y,6,FALSE)))","v":"x 1"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA9,detail_maturity_score,3,FALSE)","v":""}]
[4,"1.1.02",4,null,"1.1.02","Does your defined set of critical information assets include:",null,{"$f":"IF(ISERROR(VLOOKUP(E10,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E10,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E10,Weightings!T:Y,6,FALSE)))","v":""},""]
[5,"1.1.02a",6,null,"1.1.02a","Important business applications?",null,{"$f":"IF(ISERROR(VLOOKUP(E11,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E11,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E11,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA11,detail_maturity_score,3,FALSE)","v":""}]
[6,"1.1.02b",6,null,"1.1.02b","Key systems and networks (infrastructure)?",null,{"$f":"IF(ISERROR(VLOOKUP(E12,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E12,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E12,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA12,detail_maturity_score,3,FALSE)","v":""}]
[7,"1.1.02c",6,null,"1.1.02c","Confidential data?",null,{"$f":"IF(ISERROR(VLOOKUP(E13,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E13,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E13,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA13,detail_maturity_score,3,FALSE)","v":""}]
[8,"1.1.03",4,null,"1.1.03","Is the criticality of these assets:",null,{"$f":"IF(ISERROR(VLOOKUP(E14,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E14,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E14,Weightings!T:Y,6,FALSE)))","v":""},""]
[9,"1.1.03a",6,null,"1.1.03a","Defined in a structured, systematic manner?",null,{"$f":"IF(ISERROR(VLOOKUP(E15,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E15,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E15,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA15,detail_maturity_score,3,FALSE)","v":""}]
[10,"1.1.03b",6,null,"1.1.03b","Based on an analysis of their strategic or monetary value?",null,{"$f":"IF(ISERROR(VLOOKUP(E16,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E16,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E16,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA16,detail_maturity_score,3,FALSE)","v":""}]
[11,"1.1.04",4,null,"1.1.04","Have you identified:",null,{"$f":"IF(ISERROR(VLOOKUP(E17,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E17,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E17,Weightings!T:Y,6,FALSE)))","v":""},""]
[12,"1.1.04a",6,null,"1.1.04a","Where your critical systems are physically located in your organisation and in third party organisations?",null,{"$f":"IF(ISERROR(VLOOKUP(E18,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E18,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E18,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA18,detail_maturity_score,3,FALSE)","v":""}]
[13,"1.1.04b",6,null,"1.1.04b","On which systems your confidential information is stored or processed (eg on servers, devices and in the cloud)?",null,{"$f":"IF(ISERROR(VLOOKUP(E19,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E19,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E19,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA19,detail_maturity_score,3,FALSE)","v":""}]
[14,"1.1.05",5,null,"1.1.05","Have you assigned responsibility for protecting your critical assets to capable, named individuals?",null,{"$f":"IF(ISERROR(VLOOKUP(E20,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E20,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E20,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA20,detail_maturity_score,3,FALSE)","v":""}]
[15,"1.1.06",5,null,"1.1.06","Do you conduct business impact assessments of your critical assets (either individually or in aggregate) to determine the likely (or actual) level of business impact caused if your organisation was hit by a cyber security incident?",null,{"$f":"IF(ISERROR(VLOOKUP(E21,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E21,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E21,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA21,detail_maturity_score,3,FALSE)","v":""}]
[16,"1.1.07",4,null,"1.1.07","Do your business impact assessments determine the level of business impact if:",null,{"$f":"IF(ISERROR(VLOOKUP(E22,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E22,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E22,Weightings!T:Y,6,FALSE)))","v":""},""]
[17,"1.1.07a",6,null,"1.1.07a","Sensitive or other confidential information was disclosed to unauthorised parties?",null,{"$f":"IF(ISERROR(VLOOKUP(E23,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E23,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E23,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA23,detail_maturity_score,3,FALSE)","v":""}]
[18,"1.1.07b",6,null,"1.1.07b","Important information was compromised (eg key data is inaccurate or wrongly processed)?",null,{"$f":"IF(ISERROR(VLOOKUP(E24,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E24,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E24,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA24,detail_maturity_score,3,FALSE)","v":""}]
[19,"1.1.07c",6,null,"1.1.07c","Critical systems or infrastructure were no longer available?",null,{"$f":"IF(ISERROR(VLOOKUP(E25,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E25,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E25,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA25,detail_maturity_score,3,FALSE)","v":""}]
[20,"1.1.08",4,null,"1.1.08","Do your business impact assessments cover all relevant types of business consequences that could affect your organisation, including:",null,{"$f":"IF(ISERROR(VLOOKUP(E26,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E26,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E26,Weightings!T:Y,6,FALSE)))","v":""},""]
[21,"1.1.08a",6,null,"1.1.08a","Potential or actual financial loss?",null,{"$f":"IF(ISERROR(VLOOKUP(E27,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E27,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E27,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA27,detail_maturity_score,3,FALSE)","v":""}]
[22,"1.1.08b",6,null,"1.1.08b","Compliance implications (eg fines, business restrictions or other penalties)?",null,{"$f":"IF(ISERROR(VLOOKUP(E28,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E28,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E28,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA28,detail_maturity_score,3,FALSE)","v":""}]
[23,"1.1.08c",6,null,"1.1.08c","Damage to reputation?",null,{"$f":"IF(ISERROR(VLOOKUP(E29,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E29,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E29,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA29,detail_maturity_score,3,FALSE)","v":""}]
[24,"1.1.08d",6,null,"1.1.08d","Loss of management control?",null,{"$f":"IF(ISERROR(VLOOKUP(E30,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E30,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E30,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA30,detail_maturity_score,3,FALSE)","v":""}]
[25,"1.1.08e",6,null,"1.1.08e","Impaired growth?",null,{"$f":"IF(ISERROR(VLOOKUP(E31,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E31,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E31,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA31,detail_maturity_score,3,FALSE)","v":""}]
[26,"1.2",2,null,"Step 2","Threat analysis",null,{"$f":"IF(ISERROR(VLOOKUP(E32,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E32,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E32,Weightings!T:Y,6,FALSE)))","v":""},""]
[27,"1.2.01",5,null,"1.2.01","Do you analyse cyber security threats and associated vulnerabilities?",null,{"$f":"IF(ISERROR(VLOOKUP(E33,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E33,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E33,Weightings!T:Y,6,FALSE)))","v":"x 1"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA33,detail_maturity_score,3,FALSE)","v":""}]
[28,"1.2.02",4,null,"1.2.02","Is your cyber security threat analysis:",null,{"$f":"IF(ISERROR(VLOOKUP(E34,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E34,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E34,Weightings!T:Y,6,FALSE)))","v":""},""]
[29,"1.2.02a",6,null,"1.2.02a","Carried out in a structured, systematic manner?",null,{"$f":"IF(ISERROR(VLOOKUP(E35,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E35,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E35,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA35,detail_maturity_score,3,FALSE)","v":""}]
[30,"1.2.02b",6,null,"1.2.02b","Conducted on a regular basis?",null,{"$f":"IF(ISERROR(VLOOKUP(E36,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E36,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E36,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA36,detail_maturity_score,3,FALSE)","v":""}]
[31,"1.2.02c",6,null,"1.2.02c","Linked to a knowledge base of known attack types and attack agents?",null,{"$f":"IF(ISERROR(VLOOKUP(E37,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E37,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E37,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA37,detail_maturity_score,3,FALSE)","v":""}]
[32,"1.2.03",5,null,"1.2.03","Does your cyber security threat analysis give you a good understanding of the level of threat to your organisation from different types of cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E38,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E38,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E38,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA38,detail_maturity_score,3,FALSE)","v":""}]
[33,"1.2.04",4,null,"1.2.04","Does your threat analysis focus on:",null,{"$f":"IF(ISERROR(VLOOKUP(E39,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E39,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E39,Weightings!T:Y,6,FALSE)))","v":""},""]
[34,"1.2.04a",6,null,"1.2.04a","The cyber security landscape relevant to your organisation?",null,{"$f":"IF(ISERROR(VLOOKUP(E40,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E40,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E40,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA40,detail_maturity_score,3,FALSE)","v":""}]
[35,"1.2.04b",6,null,"1.2.04b","Relevant sources of threats (eg organised crime syndicates, state-sponsored organisations, extremist groups, hacktivists, insiders – or a combination of these)?",null,{"$f":"IF(ISERROR(VLOOKUP(E41,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E41,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E41,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[36,"1.2.04c",6,null,"1.2.04c","Which cyber security threats are most likely to affect your critical information assets?",null,{"$f":"IF(ISERROR(VLOOKUP(E42,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E42,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E42,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[37,"1.2.04d",6,null,"1.2.04d","Vulnerabilities to each particular cyber security threat (eg control weaknesses or special circumstances)?",null,{"$f":"IF(ISERROR(VLOOKUP(E43,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E43,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E43,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[38,"1.2.04e",6,null,"1.2.04e","Possible threat vectors for attacks to exploit (eg Internet downloads, unauthorised USB sticks, misconfigured systems, inappropriate access, or collusion)?",null,{"$f":"IF(ISERROR(VLOOKUP(E44,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E44,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E44,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[39,"1.2.04f",6,null,"1.2.04f","The technical infrastructure that supports your critical assets?",null,{"$f":"IF(ISERROR(VLOOKUP(E45,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E45,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E45,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[40,"1.2.05",4,null,"1.2.05","Does your cyber security threat analysis address all stages of a cyber security attack, including:",null,{"$f":"IF(ISERROR(VLOOKUP(E46,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E46,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E46,Weightings!T:Y,6,FALSE)))","v":""},""]
[41,"1.2.05a",6,null,"1.2.05a","Reconnaissance (gaining information about a target individual or organisation for use in a future cyber-attack)?",null,{"$f":"IF(ISERROR(VLOOKUP(E47,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E47,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E47,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA47,detail_maturity_score,3,FALSE)","v":""}]
[42,"1.2.05b",6,null,"1.2.05b","Disruption (eg to a business, system or service)?",null,{"$f":"IF(ISERROR(VLOOKUP(E48,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E48,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E48,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA48,detail_maturity_score,3,FALSE)","v":""}]
[43,"1.2.05c",6,null,"1.2.05c","Extraction (eg obtaining money, sensitive information or user credentials from the target)?",null,{"$f":"IF(ISERROR(VLOOKUP(E49,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E49,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E49,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA49,detail_maturity_score,3,FALSE)","v":""}]
[44,"1.2.05d",6,null,"1.2.05d","Manipulation (eg adding, changing or deleting key information)?",null,{"$f":"IF(ISERROR(VLOOKUP(E50,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E50,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E50,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA50,detail_maturity_score,3,FALSE)","v":""}]
[45,"1.2.06",4,null,"1.2.06","Does your cyber security threat analysis cover:",null,{"$f":"IF(ISERROR(VLOOKUP(E51,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E51,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E51,Weightings!T:Y,6,FALSE)))","v":""},""]
[46,"1.2.06a",6,null,"1.2.06a","The ‘attacker kill chain’ (ie reconnaissance, weaponize, deliver, exploit, install, command & control and act on objectives)?",null,{"$f":"IF(ISERROR(VLOOKUP(E52,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E52,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E52,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA52,detail_maturity_score,3,FALSE)","v":""}]
[47,"1.2.06b",6,null,"1.2.06b","Both the attacker and defender aspects of an attack?",null,{"$f":"IF(ISERROR(VLOOKUP(E53,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E53,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E53,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA53,detail_maturity_score,3,FALSE)","v":""}]
[48,"1.2.07",4,null,"1.2.07","Do you put your cyber security threat analysis into context, based on a solid understanding of:",null,{"$f":"IF(ISERROR(VLOOKUP(E54,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E54,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E54,Weightings!T:Y,6,FALSE)))","v":""},""]
[49,"1.2.07a",6,null,"1.2.07a","The nature of your business, business strategy, business processes and risk appetite?",null,{"$f":"IF(ISERROR(VLOOKUP(E55,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E55,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E55,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA55,detail_maturity_score,3,FALSE)","v":""}]
[50,"1.2.07b",6,null,"1.2.07b","Key dependencies your organisation has; for example on people, technology, suppliers, partners and the environment in which you operate?",null,{"$f":"IF(ISERROR(VLOOKUP(E56,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E56,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E56,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA56,detail_maturity_score,3,FALSE)","v":""}]
[51,"1.2.07c",6,null,"1.2.07c","The assets which are most likely to be targeted, such as infrastructure, money, intellectual property or people – and the computer systems that support them?",null,{"$f":"IF(ISERROR(VLOOKUP(E57,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E57,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E57,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA57,detail_maturity_score,3,FALSE)","v":""}]
[52,"1.2.08",5,null,"1.2.08","Does your threat analysis include information from cyber security threat intelligence sources?",null,{"$f":"IF(ISERROR(VLOOKUP(E58,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E58,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E58,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA58,detail_maturity_score,3,FALSE)","v":""}]
[53,"1.2.09",4,null,"1.2.09","Do your cyber security threat intelligence sources include information:",null,{"$f":"IF(ISERROR(VLOOKUP(E59,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E59,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E59,Weightings!T:Y,6,FALSE)))","v":""},""]
[54,"1.2.09a",6,null,"1.2.09a","You have specially compiled in your own organisation?",null,{"$f":"IF(ISERROR(VLOOKUP(E60,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E60,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E60,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA60,detail_maturity_score,3,FALSE)","v":""}]
[55,"1.2.09b",6,null,"1.2.09b","Obtained from the government, collaborative groups, competitors or CERTs and vendors)?",null,{"$f":"IF(ISERROR(VLOOKUP(E61,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E61,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E61,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA61,detail_maturity_score,3,FALSE)","v":""}]
[56,"1.2.09c",6,null,"1.2.09c","Purchased from reputable vendors?",null,{"$f":"IF(ISERROR(VLOOKUP(E62,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E62,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E62,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA62,detail_maturity_score,3,FALSE)","v":""}]
[57,"1.2.10",5,null,"1.2.10","Does your threat analysis include actionable cyber security threat intelligence, enabling positive changes to be made immediately?",null,{"$f":"IF(ISERROR(VLOOKUP(E63,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E63,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E63,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA63,detail_maturity_score,3,FALSE)","v":""}]
[58,"1.2.11",5,null,"1.2.11","Do you perform realistic simulations of possible cyber security incidents (eg by carrying out scenario testing)?",null,{"$f":"IF(ISERROR(VLOOKUP(E64,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E64,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E64,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA64,detail_maturity_score,3,FALSE)","v":""}]
[59,"1.2.12",4,null,"1.2.12","Do you make scenario testing more effective by ensuring it includes:",null,{"$f":"IF(ISERROR(VLOOKUP(E65,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E65,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E65,Weightings!T:Y,6,FALSE)))","v":""},""]
[60,"1.2.12a",6,null,"1.2.12a","Simulating a real attack as closely as possible?",null,{"$f":"IF(ISERROR(VLOOKUP(E66,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E66,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E66,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA66,detail_maturity_score,3,FALSE)","v":""}]
[61,"1.2.12b",6,null,"1.2.12b","Evaluating situational awareness and applicability to your organisation?",null,{"$f":"IF(ISERROR(VLOOKUP(E67,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E67,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E67,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA67,detail_maturity_score,3,FALSE)","v":""}]
[62,"1.2.12c",6,null,"1.2.12c","Initiating a fictional (but realistic) attack internally and assessing how well you can respond to it?",null,{"$f":"IF(ISERROR(VLOOKUP(E68,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E68,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E68,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA68,detail_maturity_score,3,FALSE)","v":""}]
[63,"1.2.13",4,null,"1.2.13","Do you carry out cyber security scenarios:",null,{"$f":"IF(ISERROR(VLOOKUP(E69,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E69,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E69,Weightings!T:Y,6,FALSE)))","v":""},""]
[64,"1.2.13a",6,null,"1.2.13a","That result in different outcomes such as unavailability, data theft and data/systems corruption?",null,{"$f":"IF(ISERROR(VLOOKUP(E70,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E70,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E70,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA70,detail_maturity_score,3,FALSE)","v":""}]
[65,"1.2.13b",6,null,"1.2.13b","Where your systems and/or data have suffered integrity loss?",null,{"$f":"IF(ISERROR(VLOOKUP(E71,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E71,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E71,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA71,detail_maturity_score,3,FALSE)","v":""}]
[66,{"$f":"VLOOKUP(A72,contentref,2,FALSE)","v":"1.2.14"},{"$f":"VLOOKUP(A72,contentref,15,FALSE)","v":5},null,{"$f":"IF(C72=1,\"Phase \"&B72,IF(C72=2,\"Step \"&VLOOKUP(A72,contentref,4,FALSE),B72))","v":"1.2.14"},{"$f":"VLOOKUP(A72,contentref,7,FALSE)","v":"Do you carry out periodic scenario-based training, helping to ensure that relevant individuals understand their role and prepare them to handle cyber security incidents?"},null,{"$f":"IF(ISERROR(VLOOKUP(E72,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E72,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E72,Weightings!T:Y,6,FALSE)))","v":"x 4"},{"$f":"IF(ISERROR(VLOOKUP(AA72,detail_maturity_score,3,FALSE)*VLOOKUP(H72,weighting_scores,2,FALSE)),\"\",VLOOKUP(AA72,detail_maturity_score,3,FALSE)*VLOOKUP(H72,weighting_scores,2,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA72,detail_maturity_score,3,FALSE)","v":""}]
[67,"1.2.15",5,null,"1.2.15","Does this scenario-based training work through a series of attack scenarios fine-tuned to the threats and vulnerabilities your organisation face?",null,{"$f":"IF(ISERROR(VLOOKUP(E73,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E73,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E73,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA73,detail_maturity_score,3,FALSE)","v":""}]
[68,"1.2.16",5,null,"1.2.16","Do you evaluate newly emerging methods of conducting more advanced cyber security threat analysis to help improve the effectiveness of your cyber security threat analysis?",null,{"$f":"IF(ISERROR(VLOOKUP(E74,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E74,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E74,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA74,detail_maturity_score,3,FALSE)","v":""}]
[69,"1.3",2,null,"Step 3","People, Process, Technology and Information",null,{"$f":"IF(ISERROR(VLOOKUP(E75,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E75,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E75,Weightings!T:Y,6,FALSE)))","v":""},""]
[70,"",3,null,"","People",null,{"$f":"IF(ISERROR(VLOOKUP(E76,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E76,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E76,Weightings!T:Y,6,FALSE)))","v":""},""]
[71,"1.3.01",5,null,"1.3.01","Do you have a point of contact for handling cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E77,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E77,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E77,Weightings!T:Y,6,FALSE)))","v":"x 1"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA77,detail_maturity_score,3,FALSE)","v":""}]
[72,"1.3.02",4,null,"1.3.02","Have all employees been:",null,{"$f":"IF(ISERROR(VLOOKUP(E78,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E78,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E78,Weightings!T:Y,6,FALSE)))","v":""},""]
[73,"1.3.02a",6,null,"1.3.02a","Made aware of the risk from cyber security attacks",null,{"$f":"IF(ISERROR(VLOOKUP(E79,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E79,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E79,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA79,detail_maturity_score,3,FALSE)","v":""}]
[74,"1.3.02b",6,null,"1.3.02b","Briefed on how to report actual and suspected cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E80,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E80,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E80,Weightings!T:Y,6,FALSE)))","v":"x 1"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA80,detail_maturity_score,3,FALSE)","v":""}]
[75,"1.3.02c",6,null,"1.3.02c","Shown how to help reduce the likelihood and frequency of these attacks?",null,{"$f":"IF(ISERROR(VLOOKUP(E81,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E81,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E81,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA81,detail_maturity_score,3,FALSE)","v":""}]
[76,"1.3.03",5,null,"1.3.03","Do you have a cyber security incident response team?",null,{"$f":"IF(ISERROR(VLOOKUP(E82,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E82,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E82,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA82,detail_maturity_score,3,FALSE)","v":""}]
[77,"1.3.04",4,null,"1.3.04","Does your cyber security incident response team understand the:",null,{"$f":"IF(ISERROR(VLOOKUP(E83,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E83,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E83,Weightings!T:Y,6,FALSE)))","v":""},""]
[78,"1.3.04a",6,null,"1.3.04a","Key concepts of cyber security incident response (eg drivers, definitions, approaches)?",null,{"$f":"IF(ISERROR(VLOOKUP(E84,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E84,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E84,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA84,detail_maturity_score,3,FALSE)","v":""}]
[79,"1.3.04b",6,null,"1.3.04b","Requirements for reporting certain types of cyber security incident?",null,{"$f":"IF(ISERROR(VLOOKUP(E85,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E85,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E85,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA85,detail_maturity_score,3,FALSE)","v":""}]
[80,"1.3.05",4,null,"1.3.05","Is your cyber security incident response team:",null,{"$f":"IF(ISERROR(VLOOKUP(E86,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E86,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E86,Weightings!T:Y,6,FALSE)))","v":""},""]
[81,"1.3.05a",6,null,"1.3.05a","Supported by key stakeholders, such as senior management, the PR department, HR, Legal, IT and business unit management",null,{"$f":"IF(ISERROR(VLOOKUP(E87,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E87,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E87,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA87,detail_maturity_score,3,FALSE)","v":""}]
[82,"1.3.05b",6,null,"1.3.05b","Given the authority to confiscate or disconnect equipment and monitor suspicious activity",null,{"$f":"IF(ISERROR(VLOOKUP(E88,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E88,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E88,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA88,detail_maturity_score,3,FALSE)","v":""}]
[83,"1.3.05c",6,null,"1.3.05c","Able to undertake external communications and information sharing (eg what can be shared with whom, when, and over what channels)",null,{"$f":"IF(ISERROR(VLOOKUP(E89,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E89,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E89,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA89,detail_maturity_score,3,FALSE)","v":""}]
[84,"1.3.05d",6,null,"1.3.05d","Clear about escalation points in the cyber security incident management process",null,{"$f":"IF(ISERROR(VLOOKUP(E90,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E90,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E90,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA90,detail_maturity_score,3,FALSE)","v":""}]
[85,"1.3.06",4,null,"1.3.06","Is your cyber security incident response team empowered – without fear of blame or recrimination - to:",null,{"$f":"IF(ISERROR(VLOOKUP(E91,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E91,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E91,Weightings!T:Y,6,FALSE)))","v":""},""]
[86,"1.3.06a",6,null,"1.3.06a","Escalate the problem to management in a timely manner?",null,{"$f":"IF(ISERROR(VLOOKUP(E92,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E92,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E92,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA92,detail_maturity_score,3,FALSE)","v":""}]
[87,"1.3.06b",6,null,"1.3.06b","Explain the possible consequences of the cyber security incident – and its potential impact on the business?",null,{"$f":"IF(ISERROR(VLOOKUP(E93,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E93,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E93,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA93,detail_maturity_score,3,FALSE)","v":""}]
[88,"1.3.06c",6,null,"1.3.06c","Get relevant outsiders involved?",null,{"$f":"IF(ISERROR(VLOOKUP(E94,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E94,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E94,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA94,detail_maturity_score,3,FALSE)","v":""}]
[89,"1.3.07",4,null,"1.3.07","Does your cyber security incident response team have access to individuals (internal and external) who have a deep understanding about:",null,{"$f":"IF(ISERROR(VLOOKUP(E95,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E95,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E95,Weightings!T:Y,6,FALSE)))","v":""},""]
[90,"1.3.07a",6,null,"1.3.07a","How to carry out sophisticated cyber security incident investigations quickly and effectively",null,{"$f":"IF(ISERROR(VLOOKUP(E96,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E96,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E96,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA96,detail_maturity_score,3,FALSE)","v":""}]
[91,"1.3.07b",6,null,"1.3.07b","The different types of cyber security attacker (and how they operate)?",null,{"$f":"IF(ISERROR(VLOOKUP(E97,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E97,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E97,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[92,"1.3.07c",6,null,"1.3.07c","Advanced persistent threats?",null,{"$f":"IF(ISERROR(VLOOKUP(E98,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E98,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E98,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[93,"1.3.07d",6,null,"1.3.07d","Methods of compromising systems?",null,{"$f":"IF(ISERROR(VLOOKUP(E99,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E99,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E99,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[94,"1.3.07e",6,null,"1.3.07e","Sophisticated analysis of malware?",null,{"$f":"IF(ISERROR(VLOOKUP(E100,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E100,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E100,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[95,"1.3.07f",6,null,"1.3.07f","Forensics?",null,{"$f":"IF(ISERROR(VLOOKUP(E101,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E101,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E101,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[96,"1.3.08",5,null,"1.3.08","Does your cyber security incident team have a cyber security incident response toolkit to help investigations?",null,{"$f":"IF(ISERROR(VLOOKUP(E102,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E102,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E102,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[97,"1.3.09",4,null,"1.3.09","Does your cyber security incident response toolkit include:",null,{"$f":"IF(ISERROR(VLOOKUP(E103,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E103,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E103,Weightings!T:Y,6,FALSE)))","v":""},""]
[98,"1.3.09a",6,null,"1.3.09a","A suitable method for recording all aspects of the incident, ideally using a template to ensure a consistent, comprehensive approach?",null,{"$f":"IF(ISERROR(VLOOKUP(E104,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E104,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E104,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA104,detail_maturity_score,3,FALSE)","v":""}]
[99,"1.3.09b",6,null,"1.3.09b","Contact details of all key stakeholders, such as internal and external investigators, technical specialist, suppliers, legal resources, human resources, public relations and business management?",null,{"$f":"IF(ISERROR(VLOOKUP(E105,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E105,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E105,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA105,detail_maturity_score,3,FALSE)","v":""}]
[100,"1.3.09c",6,null,"1.3.09c","Incident analysis resources: such as port lists; packet sniffers and protocol analysers; documentation for security systems (eg IDS, SIEM, malware protection); network diagrams; and a list of critical assets.",null,{"$f":"IF(ISERROR(VLOOKUP(E106,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E106,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E106,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA106,detail_maturity_score,3,FALSE)","v":""}]
[101,"1.3.09d",6,null,"1.3.09d","Forensic imaging tools (eg an imaging laptop; encrypted disks for image storage; mobile phone; digital camera / recorder; portable printer; removable media with trusted versions of programs; and evidence gathering accessories)?",null,{"$f":"IF(ISERROR(VLOOKUP(E107,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E107,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E107,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA107,detail_maturity_score,3,FALSE)","v":""}]
[102,"1.3.09e",6,null,"1.3.09e","Physical tools (eg screwdrivers, Allen keys, wire cutters, evidence bags, gloves and torch)?",null,{"$f":"IF(ISERROR(VLOOKUP(E108,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E108,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E108,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA108,detail_maturity_score,3,FALSE)","v":""}]
[103,"",3,null,"","Process",null,{"$f":"IF(ISERROR(VLOOKUP(E109,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E109,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E109,Weightings!T:Y,6,FALSE)))","v":""},""]
[104,"1.3.10",4,null,"1.3.10","Do you have:",null,{"$f":"IF(ISERROR(VLOOKUP(E110,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E110,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E110,Weightings!T:Y,6,FALSE)))","v":""},""]
[105,"1.3.10a",6,null,"1.3.10a","Policies, processes, plans or methodologies to help you respond to cyber security incidents effectively?",null,{"$f":"IF(ISERROR(VLOOKUP(E111,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E111,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E111,Weightings!T:Y,6,FALSE)))","v":"x 1"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA111,detail_maturity_score,3,FALSE)","v":""}]
[106,"1.3.10b",6,null,"1.3.10b","A formal cyber security incident response process?",null,{"$f":"IF(ISERROR(VLOOKUP(E112,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E112,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E112,Weightings!T:Y,6,FALSE)))","v":"x 1"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA112,detail_maturity_score,3,FALSE)","v":""}]
[107,"1.3.10c",6,null,"1.3.10c","A strategic approach for handling cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E113,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E113,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E113,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA113,detail_maturity_score,3,FALSE)","v":""}]
[108,"1.3.11",4,null,"1.3.11","Does your cyber security incident response strategy include:",null,{"$f":"IF(ISERROR(VLOOKUP(E114,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E114,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E114,Weightings!T:Y,6,FALSE)))","v":""},""]
[109,"1.3.11a",6,null,"1.3.11a","Identifying the key components of an effective cyber security incident response process?",null,{"$f":"IF(ISERROR(VLOOKUP(E115,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E115,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E115,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA115,detail_maturity_score,3,FALSE)","v":""}]
[110,"1.3.11b",6,null,"1.3.11b","Aligning cyber security incident response with business continuity plans and arrangements?",null,{"$f":"IF(ISERROR(VLOOKUP(E116,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E116,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E116,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[111,"1.3.11c",6,null,"1.3.11c","Addressing arrangements corporate-wide (including third parties, where needed)?",null,{"$f":"IF(ISERROR(VLOOKUP(E117,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E117,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E117,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[112,"1.3.11d",6,null,"1.3.11d","Providing sufficient funding and resources to deal with cyber security incidents effectively?",null,{"$f":"IF(ISERROR(VLOOKUP(E118,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E118,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E118,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[113,"1.3.11e",6,null,"1.3.11e","Appointing individuals in advance who have sufficient decision-making authority to take action fast in an emergency situation?",null,{"$f":"IF(ISERROR(VLOOKUP(E119,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E119,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E119,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[114,"1.3.11f",6,null,"1.3.11f","Determining what activities should be outsourced to an external cyber security incident response specialist",null,{"$f":"IF(ISERROR(VLOOKUP(E120,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E120,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E120,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[115,"1.3.11g",6,null,"1.3.11g","Developing criteria upon which to base selection of the right cyber security incident response providers, ensuring value for money?",null,{"$f":"IF(ISERROR(VLOOKUP(E121,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E121,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E121,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[116,"1.3.11h",6,null,"1.3.11h","Evaluating the benefits offered by appropriately certified cyber security incident response providers?",null,{"$f":"IF(ISERROR(VLOOKUP(E122,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E122,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E122,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[117,"1.3.12",4,null,"1.3.12","Does your cyber security incident response process take account of:",null,{"$f":"IF(ISERROR(VLOOKUP(E123,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E123,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E123,Weightings!T:Y,6,FALSE)))","v":""},""]
[118,"1.3.12a",6,null,"1.3.12a","Definitions required to support the Triage element of the cyber security incident process (eg to define what criteria re required to classify and prioritise incidents)?",null,{"$f":"IF(ISERROR(VLOOKUP(E124,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E124,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E124,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA124,detail_maturity_score,3,FALSE)","v":""}]
[119,"1.3.12b",6,null,"1.3.12b","Advice and guidance provided on government websites, such as the CESG Top ten steps to cyber security and GovCertUK incident response guidelines?",null,{"$f":"IF(ISERROR(VLOOKUP(E125,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E125,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E125,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA125,detail_maturity_score,3,FALSE)","v":""}]
[120,"1.3.12c",6,null,"1.3.12c","Publicly available traditional or cyber security specific incident response guides, such as the NIST Computer Security Handling Guide (Special Publication 800-61), the Responding to targeted cyber attacks report from ISACA (collaborating with E&Y) and the CREST Cyber Security Incident Response Guide?",null,{"$f":"IF(ISERROR(VLOOKUP(E126,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E126,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E126,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA126,detail_maturity_score,3,FALSE)","v":""}]
[121,"1.3.13",4,null,"1.3.13","Does your cyber security incident response process cover all stage of an investigation, which includes:",null,{"$f":"IF(ISERROR(VLOOKUP(E127,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E127,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E127,Weightings!T:Y,6,FALSE)))","v":""},""]
[122,"1.3.13a",6,null,"1.3.13a","Identifying cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E128,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E128,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E128,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA128,detail_maturity_score,3,FALSE)","v":""}]
[123,"1.3.13b",6,null,"1.3.13b","Investigating the situation (including triage)?",null,{"$f":"IF(ISERROR(VLOOKUP(E129,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E129,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E129,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA129,detail_maturity_score,3,FALSE)","v":""}]
[124,"1.3.13c",6,null,"1.3.13c","Taking appropriate action (eg contain incident and eradicate cause)?",null,{"$f":"IF(ISERROR(VLOOKUP(E130,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E130,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E130,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA130,detail_maturity_score,3,FALSE)","v":""}]
[125,"1.3.13d",6,null,"1.3.13d","Recovering systems, data and connectivity?",null,{"$f":"IF(ISERROR(VLOOKUP(E131,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E131,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E131,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA131,detail_maturity_score,3,FALSE)","v":""}]
[126,"1.3.14",4,null,"1.3.14","Does your cyber security incident response process state:",null,{"$f":"IF(ISERROR(VLOOKUP(E132,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E132,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E132,Weightings!T:Y,6,FALSE)))","v":""},""]
[127,"1.3.14a",6,null,"1.3.14a","Who should be responsible for each step?",null,{"$f":"IF(ISERROR(VLOOKUP(E133,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E133,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E133,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA133,detail_maturity_score,3,FALSE)","v":""}]
[128,"1.3.14b",6,null,"1.3.14b","How it should be carried out?",null,{"$f":"IF(ISERROR(VLOOKUP(E134,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E134,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E134,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA134,detail_maturity_score,3,FALSE)","v":""}]
[129,"1.3.14c",6,null,"1.3.14c","Who to contact for support?",null,{"$f":"IF(ISERROR(VLOOKUP(E135,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E135,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E135,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA135,detail_maturity_score,3,FALSE)","v":""}]
[130,{"$f":"VLOOKUP(A136,contentref,2,FALSE)","v":"1.3.15"},{"$f":"VLOOKUP(A136,contentref,15,FALSE)","v":5},null,{"$f":"IF(C136=1,\"Phase \"&B136,IF(C136=2,\"Step \"&VLOOKUP(A136,contentref,4,FALSE),B136))","v":"1.3.15"},{"$f":"VLOOKUP(A136,contentref,7,FALSE)","v":"Does your cyber security incident response process include pre-agreed response actions (eg using attack play-books) for particular situations"},null,{"$f":"IF(ISERROR(VLOOKUP(E136,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E136,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E136,Weightings!T:Y,6,FALSE)))","v":"x 5"},{"$f":"IF(ISERROR(VLOOKUP(AA136,detail_maturity_score,3,FALSE)*VLOOKUP(H136,weighting_scores,2,FALSE)),\"\",VLOOKUP(AA136,detail_maturity_score,3,FALSE)*VLOOKUP(H136,weighting_scores,2,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA136,detail_maturity_score,3,FALSE)","v":""}]
[131,"1.3.16",4,null,"1.3.16","Is your cyber security incident response process integrated with:",null,{"$f":"IF(ISERROR(VLOOKUP(E137,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E137,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E137,Weightings!T:Y,6,FALSE)))","v":""},""]
[132,"1.3.16a",6,null,"1.3.16a","Relevant day-to-day third parties (eg suppliers, partners and customers)?",null,{"$f":"IF(ISERROR(VLOOKUP(E138,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E138,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E138,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA138,detail_maturity_score,3,FALSE)","v":""}]
[133,"1.3.16b",6,null,"1.3.16b","Specialist third party security experts, such as outsourced security services (eg security device management) to Managed Security Services Providers (MSSP) or a Security Operations Centre (SOC)?",null,{"$f":"IF(ISERROR(VLOOKUP(E139,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E139,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E139,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA139,detail_maturity_score,3,FALSE)","v":""}]
[134,"1.3.16c",6,null,"1.3.16c","Human Resources (HR), if prosecution is likely or the culprit is suspected to be internal?",null,{"$f":"IF(ISERROR(VLOOKUP(E140,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E140,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E140,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA140,detail_maturity_score,3,FALSE)","v":""}]
[135,"1.3.16d",6,null,"1.3.16d","Legal counsel and Public Relations (PR)?",null,{"$f":"IF(ISERROR(VLOOKUP(E141,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E141,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E141,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA141,detail_maturity_score,3,FALSE)","v":""}]
[136,"1.3.17",4,null,"1.3.17","Does your cyber security incident response process address important security requirements during the investigation, which includes:",null,{"$f":"IF(ISERROR(VLOOKUP(E142,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E142,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E142,Weightings!T:Y,6,FALSE)))","v":""},""]
[137,"1.3.17a",6,null,"1.3.17a","Maintaining the integrity of your most important data in a compromised environment)?",null,{"$f":"IF(ISERROR(VLOOKUP(E143,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E143,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E143,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA143,detail_maturity_score,3,FALSE)","v":""}]
[138,"1.3.17b",6,null,"1.3.17b","Preventing (or reducing) unauthorised disclosure of confidential information?",null,{"$f":"IF(ISERROR(VLOOKUP(E144,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E144,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E144,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA144,detail_maturity_score,3,FALSE)","v":""}]
[139,"1.3.17c",6,null,"1.3.17c","Complying with data privacy or data protection requirements (eg reporting the loss of personal data)?",null,{"$f":"IF(ISERROR(VLOOKUP(E145,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E145,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E145,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA145,detail_maturity_score,3,FALSE)","v":""}]
[140,"1.3.17d",6,null,"1.3.17d","Monitoring new (and existing) vulnerabilities during the cyber security attack?",null,{"$f":"IF(ISERROR(VLOOKUP(E146,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E146,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E146,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA146,detail_maturity_score,3,FALSE)","v":""}]
[141,"1.3.18",4,null,"1.3.18","Has your cyber security incident response process been:",null,{"$f":"IF(ISERROR(VLOOKUP(E147,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E147,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E147,Weightings!T:Y,6,FALSE)))","v":""},""]
[142,"1.3.18a",6,null,"1.3.18a","Signed off by appropriate management?",null,{"$f":"IF(ISERROR(VLOOKUP(E148,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E148,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E148,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA148,detail_maturity_score,3,FALSE)","v":""}]
[143,"1.3.18b",6,null,"1.3.18b","Kept up to date?",null,{"$f":"IF(ISERROR(VLOOKUP(E149,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E149,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E149,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA149,detail_maturity_score,3,FALSE)","v":""}]
[144,"1.3.18c",6,null,"1.3.18c","Reviewed on a regular basis?",null,{"$f":"IF(ISERROR(VLOOKUP(E150,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E150,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E150,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA150,detail_maturity_score,3,FALSE)","v":""}]
[145,"1.3.19",4,null,"1.3.19","Does your cyber security incident response process enable you to respond to a cyber security incident:",null,{"$f":"IF(ISERROR(VLOOKUP(E151,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E151,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E151,Weightings!T:Y,6,FALSE)))","v":""},""]
[146,"1.3.19a",6,null,"1.3.19a","Quickly (ie within critical timescales)?",null,{"$f":"IF(ISERROR(VLOOKUP(E152,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E152,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E152,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA152,detail_maturity_score,3,FALSE)","v":""}]
[147,"1.3.19b",6,null,"1.3.19b","Effectively (ensuring that all services have been restored to working order)?",null,{"$f":"IF(ISERROR(VLOOKUP(E153,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E153,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E153,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA153,detail_maturity_score,3,FALSE)","v":""}]
[148,"1.3.19c",6,null,"1.3.19c","In a consistent manner?",null,{"$f":"IF(ISERROR(VLOOKUP(E154,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E154,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E154,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA154,detail_maturity_score,3,FALSE)","v":""}]
[149,"1.3.20",4,null,"1.3.20","Does your cyber security incident response process enable you to:",null,{"$f":"IF(ISERROR(VLOOKUP(E155,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E155,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E155,Weightings!T:Y,6,FALSE)))","v":""},""]
[150,"1.3.20a",6,null,"1.3.20a","Cope with many different scenarios?",null,{"$f":"IF(ISERROR(VLOOKUP(E156,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E156,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E156,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA156,detail_maturity_score,3,FALSE)","v":""}]
[151,"1.3.20b",6,null,"1.3.20b","Proactively implement and adapt approaches as needed?",null,{"$f":"IF(ISERROR(VLOOKUP(E157,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E157,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E157,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA157,detail_maturity_score,3,FALSE)","v":""}]
[152,"1.3.21",4,null,"1.3.21","Is your cyber security incident response process tested:",null,{"$f":"IF(ISERROR(VLOOKUP(E158,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E158,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E158,Weightings!T:Y,6,FALSE)))","v":""},""]
[153,"1.3.21a",6,null,"1.3.21a","Thoroughly using a range of different scenarios?",null,{"$f":"IF(ISERROR(VLOOKUP(E159,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E159,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E159,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA159,detail_maturity_score,3,FALSE)","v":""}]
[154,"1.3.21b",6,null,"1.3.21b","On a regular basis?",null,{"$f":"IF(ISERROR(VLOOKUP(E160,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E160,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E160,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA160,detail_maturity_score,3,FALSE)","v":""}]
[155,"1.3.21c",6,null,"1.3.21c","In conjunction with relevant third parties?",null,{"$f":"IF(ISERROR(VLOOKUP(E161,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E161,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E161,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA161,detail_maturity_score,3,FALSE)","v":""}]
[156,"1.3.22",5,null,"1.3.22","Do you analyse the results of these tests?",null,{"$f":"IF(ISERROR(VLOOKUP(E162,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E162,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E162,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA162,detail_maturity_score,3,FALSE)","v":""}]
[157,"1.3.23",5,null,"1.3.23","Do you address weaknesses identified during these tests?",null,{"$f":"IF(ISERROR(VLOOKUP(E163,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E163,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E163,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA163,detail_maturity_score,3,FALSE)","v":""}]
[158,"",3,null,"","Technology",null,{"$f":"IF(ISERROR(VLOOKUP(E164,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E164,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E164,Weightings!T:Y,6,FALSE)))","v":""},""]
[159,"1.3.23",5,null,"1.3.23","Do you have technical arrangements to support cyber security incident response?",null,{"$f":"IF(ISERROR(VLOOKUP(E165,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E165,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E165,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA165,detail_maturity_score,3,FALSE)","v":""}]
[160,"1.3.24",4,null,"1.3.24","Do your technical arrangements for supporting cyber security incident response provide you (and any relevant third parties) with sufficient understanding of:",null,{"$f":"IF(ISERROR(VLOOKUP(E166,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E166,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E166,Weightings!T:Y,6,FALSE)))","v":""},""]
[161,"1.3.24a",6,null,"1.3.24a","Your IT infrastructure?",null,{"$f":"IF(ISERROR(VLOOKUP(E167,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E167,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E167,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA167,detail_maturity_score,3,FALSE)","v":""}]
[162,"1.3.24b",6,null,"1.3.24b","The topology of your networks (eg via a suitable network diagram)?",null,{"$f":"IF(ISERROR(VLOOKUP(E168,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E168,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E168,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA168,detail_maturity_score,3,FALSE)","v":""}]
[163,"1.3.25",4,null,"1.3.25","Do your technical arrangements for supporting cyber security incident response include:",null,{"$f":"IF(ISERROR(VLOOKUP(E169,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E169,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E169,Weightings!T:Y,6,FALSE)))","v":""},""]
[164,"1.3.25a",6,null,"1.3.25a","An appropriate set of incident response tools?",null,{"$f":"IF(ISERROR(VLOOKUP(E170,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E170,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E170,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA170,detail_maturity_score,3,FALSE)","v":""}]
[165,"1.3.25b",6,null,"1.3.25b","Implementing technical controls like firewalls, mail filters and intrusion detection systems (IDS) or data loss prevention (DLP) technology?",null,{"$f":"IF(ISERROR(VLOOKUP(E171,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E171,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E171,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[166,"1.3.25c",6,null,"1.3.25c","Logging the right events and turning on the appropriate logging features?",null,{"$f":"IF(ISERROR(VLOOKUP(E172,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E172,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E172,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[167,"1.3.25d",6,null,"1.3.25d","Maintaining sufficient historical data (eg because logs are overwritten or you do not have sufficient storage space)?",null,{"$f":"IF(ISERROR(VLOOKUP(E173,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E173,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E173,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[168,"1.3.25e",6,null,"1.3.25e","Deploying other suitable technical controls, as required, such as patching?",null,{"$f":"IF(ISERROR(VLOOKUP(E174,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E174,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E174,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[169,"1.3.25f",6,null,"1.3.25f","Identifying your Internet points of presence (‘touch points’)?",null,{"$f":"IF(ISERROR(VLOOKUP(E175,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E175,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E175,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[170,"1.3.26",5,null,"1.3.26","Do your technical arrangements for support cyber security incident response provide you with enough relevant knowledge to conduct a suitable investigation?",null,{"$f":"IF(ISERROR(VLOOKUP(E176,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E176,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E176,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[171,"",3,null,"","Information",null,{"$f":"IF(ISERROR(VLOOKUP(E177,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E177,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E177,Weightings!T:Y,6,FALSE)))","v":""},""]
[172,"1.3.27",5,null,"1.3.27","Do you have information readily available that will help the cyber security incident response team (including third party experts) to respond quickly and effectively?",null,{"$f":"IF(ISERROR(VLOOKUP(E178,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E178,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E178,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA178,detail_maturity_score,3,FALSE)","v":""}]
[173,"1.3.28",4,null,"1.3.28","Does this information include relevant details about:",null,{"$f":"IF(ISERROR(VLOOKUP(E179,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E179,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E179,Weightings!T:Y,6,FALSE)))","v":""},""]
[174,"1.3.28a",6,null,"1.3.28a","Business management (eg what the business does, main point(s) of contact, approach to business impact assessment)?",null,{"$f":"IF(ISERROR(VLOOKUP(E180,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E180,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E180,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA180,detail_maturity_score,3,FALSE)","v":""}]
[175,"1.3.28b",6,null,"1.3.28b","IT infrastructure (eg network diagrams, system architecture and layout)?",null,{"$f":"IF(ISERROR(VLOOKUP(E181,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E181,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E181,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA181,detail_maturity_score,3,FALSE)","v":""}]
[176,"1.3.28c",6,null,"1.3.28c","Data (eg what type of information is processed, where and how)?",null,{"$f":"IF(ISERROR(VLOOKUP(E182,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E182,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E182,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA182,detail_maturity_score,3,FALSE)","v":""}]
[177,"1.3.28d",6,null,"1.3.28d","Event logging (eg what types of data and events are logged; on which systems; how and when; as well as how this data is collated and analysed)?",null,{"$f":"IF(ISERROR(VLOOKUP(E183,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E183,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E183,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA183,detail_maturity_score,3,FALSE)","v":""}]
[178,"1.3.29",4,null,"1.3.29","In the event of a cyber security incident are you able to quickly get relevant information from:",null,{"$f":"IF(ISERROR(VLOOKUP(E184,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E184,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E184,Weightings!T:Y,6,FALSE)))","v":""},""]
[179,"1.3.29a",6,null,"1.3.29a","Technical security specialists?",null,{"$f":"IF(ISERROR(VLOOKUP(E185,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E185,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E185,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA185,detail_maturity_score,3,FALSE)","v":""}]
[180,"1.3.29b",6,null,"1.3.29b","Relevant business representatives?",null,{"$f":"IF(ISERROR(VLOOKUP(E186,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E186,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E186,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA186,detail_maturity_score,3,FALSE)","v":""}]
[181,"1.3.29c",6,null,"1.3.29c","Your Crisis Management Team?",null,{"$f":"IF(ISERROR(VLOOKUP(E187,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E187,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E187,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA187,detail_maturity_score,3,FALSE)","v":""}]
[182,"1.3.29d",6,null,"1.3.29d","Legal or HR specialists?",null,{"$f":"IF(ISERROR(VLOOKUP(E188,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E188,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E188,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA188,detail_maturity_score,3,FALSE)","v":""}]
[183,"1.3.30",4,null,"1.3.30","In the event of a cyber security incident are you able to:",null,{"$f":"IF(ISERROR(VLOOKUP(E189,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E189,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E189,Weightings!T:Y,6,FALSE)))","v":""},""]
[184,"1.3.30a",6,null,"1.3.30a","Gain fast access to facilities at your outsourced service providers (ie access to premises or equipment)?",null,{"$f":"IF(ISERROR(VLOOKUP(E190,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E190,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E190,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA190,detail_maturity_score,3,FALSE)","v":""}]
[185,"1.3.30b",6,null,"1.3.30b","Obtain essential supporting information (eg event logs) from all your third party suppliers (eg cloud service suppliers, infrastructure outsourcers and managed service providers) in a timely and suitable manner?",null,{"$f":"IF(ISERROR(VLOOKUP(E191,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E191,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E191,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA191,detail_maturity_score,3,FALSE)","v":""}]
[186,"1.3.30c",6,null,"1.3.30c","Contact relevant people in third parties who would be impacted if your organisation had to operate in a degraded capacity?",null,{"$f":"IF(ISERROR(VLOOKUP(E192,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E192,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E192,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA192,detail_maturity_score,3,FALSE)","v":""}]
[187,"1.4",2,null,"Step 4","Control environment",null,{"$f":"IF(ISERROR(VLOOKUP(E193,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E193,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E193,Weightings!T:Y,6,FALSE)))","v":""},""]
[188,"1.4.01",5,null,"1.4.01","Do you have a set of controls to help reduce the frequency and impact of cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E194,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E194,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E194,Weightings!T:Y,6,FALSE)))","v":"x 1"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA194,detail_maturity_score,3,FALSE)","v":""}]
[189,"1.4.02",4,null,"1.4.02","Does your control set include basic controls to help support cyber security incident investigations, including:",null,{"$f":"IF(ISERROR(VLOOKUP(E195,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E195,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E195,Weightings!T:Y,6,FALSE)))","v":""},""]
[190,"1.4.02a",6,null,"1.4.02a","Information classification, labelling and handling techniques?",null,{"$f":"IF(ISERROR(VLOOKUP(E196,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E196,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E196,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA196,detail_maturity_score,3,FALSE)","v":""}]
[191,"1.4.02b",6,null,"1.4.02b","Access control arrangements?",null,{"$f":"IF(ISERROR(VLOOKUP(E197,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E197,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E197,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[192,"1.4.02c",6,null,"1.4.02c","Patch management?",null,{"$f":"IF(ISERROR(VLOOKUP(E198,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E198,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E198,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[193,"1.4.02d",6,null,"1.4.02d","Firewalls?",null,{"$f":"IF(ISERROR(VLOOKUP(E199,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E199,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E199,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[194,{"$f":"VLOOKUP(A200,contentref,2,FALSE)","v":"1.4.02e"},{"$f":"VLOOKUP(A200,contentref,15,FALSE)","v":6},null,{"$f":"IF(C200=1,\"Phase \"&B200,IF(C200=2,\"Step \"&VLOOKUP(A200,contentref,4,FALSE),B200))","v":"1.4.02e"},{"$f":"VLOOKUP(A200,contentref,7,FALSE)","v":"Malware protection?"},null,{"$f":"IF(ISERROR(VLOOKUP(E200,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E200,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E200,Weightings!T:Y,6,FALSE)))","v":"x 2"},{"$f":"IF(ISERROR(VLOOKUP(AA200,detail_maturity_score,3,FALSE)*VLOOKUP(H200,weighting_scores,2,FALSE)),\"\",VLOOKUP(AA200,detail_maturity_score,3,FALSE)*VLOOKUP(H200,weighting_scores,2,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[195,"1.4.02f",6,null,"1.4.02f","‘Secure’ configuration of servers and connected devices?",null,{"$f":"IF(ISERROR(VLOOKUP(E201,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E201,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E201,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[196,"1.4.02g",6,null,"1.4.02g","Backups?",null,{"$f":"IF(ISERROR(VLOOKUP(E202,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E202,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E202,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[197,"1.4.03",4,null,"1.4.03","Is your cyber security control set:",null,{"$f":"IF(ISERROR(VLOOKUP(E203,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E203,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E203,Weightings!T:Y,6,FALSE)))","v":""},""]
[198,"1.4.03a",6,null,"1.4.03a","Based on a formal cyber security framework, such as the SANS top 20 cyber security controls or the CESG 10 Steps to Cyber Security or PAS 55?",null,{"$f":"IF(ISERROR(VLOOKUP(E204,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E204,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E204,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA204,detail_maturity_score,3,FALSE)","v":""}]
[199,"1.4.03b",6,null,"1.4.03b","Signed-off by senior management?",null,{"$f":"IF(ISERROR(VLOOKUP(E205,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E205,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E205,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[200,"1.4.03c",6,null,"1.4.03c","Kept-up-to date?",null,{"$f":"IF(ISERROR(VLOOKUP(E206,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E206,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E206,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[201,"1.4.03d",6,null,"1.4.03d","Monitored for effectiveness?",null,{"$f":"IF(ISERROR(VLOOKUP(E207,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E207,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E207,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[202,"1.4.03e",6,null,"1.4.03e","Reviewed on a regular basis?",null,{"$f":"IF(ISERROR(VLOOKUP(E208,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E208,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E208,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[203,"1.4.04",5,null,"1.4.04","Do you provide internet access through a central corporate gateway, rather than locally?",null,{"$f":"IF(ISERROR(VLOOKUP(E209,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E209,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E209,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[204,"1.4.05",5,null,"1.4.05","Do you deploy technical security monitoring tools?",null,{"$f":"IF(ISERROR(VLOOKUP(E210,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E210,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E210,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[205,"1.4.06",4,null,"1.4.06","Do your technical security monitoring tools include:",null,{"$f":"IF(ISERROR(VLOOKUP(E211,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E211,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E211,Weightings!T:Y,6,FALSE)))","v":""},""]
[206,"1.4.06a",6,null,"1.4.06a","Intrusion prevention systems (IPS)?",null,{"$f":"IF(ISERROR(VLOOKUP(E212,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E212,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E212,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA212,detail_maturity_score,3,FALSE)","v":""}]
[207,"1.4.06b",6,null,"1.4.06b","Intrusion detection systems (IDS)?",null,{"$f":"IF(ISERROR(VLOOKUP(E213,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E213,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E213,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[208,"1.4.06c",6,null,"1.4.06c","Data loss preventions (DLP) systems?",null,{"$f":"IF(ISERROR(VLOOKUP(E214,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E214,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E214,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[209,"1.4.06d",6,null,"1.4.06d","A searchable incident event repository (SIEM)?",null,{"$f":"IF(ISERROR(VLOOKUP(E215,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E215,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E215,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[210,"1.4.06e",6,null,"1.4.06e","Commercial APT prevention tools?",null,{"$f":"IF(ISERROR(VLOOKUP(E216,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E216,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E216,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[211,"1.4.07",5,null,"1.4.07","Is your cyber security control set supplemented by specialised cyber security controls?",null,{"$f":"IF(ISERROR(VLOOKUP(E217,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E217,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E217,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[212,"1.4.08",4,null,"1.4.08","Do your specialised cyber security controls include:",null,{"$f":"IF(ISERROR(VLOOKUP(E218,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E218,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E218,Weightings!T:Y,6,FALSE)))","v":""},""]
[213,"1.4.08a",6,null,"1.4.08a","Multi factor authentication - something you know (eg a User ID and password) and something you have (eg an access, bank or smart card)?",null,{"$f":"IF(ISERROR(VLOOKUP(E219,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E219,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E219,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA219,detail_maturity_score,3,FALSE)","v":""}]
[214,"1.4.08b",6,null,"1.4.08b","Digital certificates used to “sign” code from a vendor so that the code can be trusted?",null,{"$f":"IF(ISERROR(VLOOKUP(E220,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E220,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E220,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA220,detail_maturity_score,3,FALSE)","v":""}]
[215,"1.4.08c",6,null,"1.4.08c","Whitelisting (defining all acceptable ports, addresses or similar – and preventing all other access) or blacklisting (preventing access from specific sites, or addresses)?",null,{"$f":"IF(ISERROR(VLOOKUP(E221,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E221,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E221,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA221,detail_maturity_score,3,FALSE)","v":""}]
[216,"1.4.09",5,null,"1.4.09","Is your cyber security control set supplemented by advanced cyber security controls?",null,{"$f":"IF(ISERROR(VLOOKUP(E222,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E222,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E222,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA222,detail_maturity_score,3,FALSE)","v":""}]
[217,"1.4.10",4,null,"1.4.10","Do your advanced cyber security controls include:",null,{"$f":"IF(ISERROR(VLOOKUP(E223,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E223,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E223,Weightings!T:Y,6,FALSE)))","v":""},""]
[218,"1.4.10a",6,null,"1.4.10a","Continuous monitoring (eg via a Security Operations centre (SOC)?",null,{"$f":"IF(ISERROR(VLOOKUP(E224,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E224,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E224,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA224,detail_maturity_score,3,FALSE)","v":""}]
[219,"1.4.10b",6,null,"1.4.10b","Proactive APT assessments?",null,{"$f":"IF(ISERROR(VLOOKUP(E225,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E225,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E225,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[220,"1.4.10c",6,null,"1.4.10c","Outbound gateway consolidation?",null,{"$f":"IF(ISERROR(VLOOKUP(E226,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E226,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E226,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[221,"1.4.10d",6,null,"1.4.10d","System virtualisation?",null,{"$f":"IF(ISERROR(VLOOKUP(E227,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E227,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E227,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[222,"1.4.10e",6,null,"1.4.10e","Sensitive network or data segregation?",null,{"$f":"IF(ISERROR(VLOOKUP(E228,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E228,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E228,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[223,"1.4.10f",6,null,"1.4.10f","Counterintelligence operations?",null,{"$f":"IF(ISERROR(VLOOKUP(E229,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E229,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E229,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[224,"1.4.11",4,null,"1.4.11","Does your cyber security control set help you to:",null,{"$f":"IF(ISERROR(VLOOKUP(E230,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E230,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E230,Weightings!T:Y,6,FALSE)))","v":""},""]
[225,"1.4.11a",6,null,"1.4.11a","Make it more difficult for attackers to be successful?",null,{"$f":"IF(ISERROR(VLOOKUP(E231,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E231,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E231,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA231,detail_maturity_score,3,FALSE)","v":""}]
[226,"1.4.11b",6,null,"1.4.11b","Detect that a cyber security attack is being planned - or is already underway?",null,{"$f":"IF(ISERROR(VLOOKUP(E232,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E232,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E232,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA232,detail_maturity_score,3,FALSE)","v":""}]
[227,"1.5",2,null,"Step 5","Maturity assessment",null,{"$f":"IF(ISERROR(VLOOKUP(E233,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E233,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E233,Weightings!T:Y,6,FALSE)))","v":""},""]
[228,"1.5.01",5,null,"1.5.01","Have you created an organisation-specific definition of the term “cyber security incident” so that the scope of the term is clear?",null,{"$f":"IF(ISERROR(VLOOKUP(E234,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E234,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E234,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA234,detail_maturity_score,3,FALSE)","v":""}]
[229,"1.5.02",4,null,"1.5.02","Does your definition of the term “cyber security incident” take account of the:",null,{"$f":"IF(ISERROR(VLOOKUP(E235,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E235,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E235,Weightings!T:Y,6,FALSE)))","v":""},""]
[230,"1.5.02a",6,null,"1.5.02a","Different types of cyber security incident (eg hacking, malware or social engineering)?",null,{"$f":"IF(ISERROR(VLOOKUP(E236,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E236,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E236,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA236,detail_maturity_score,3,FALSE)","v":""}]
[231,"1.5.02b",6,null,"1.5.02b","Sources of cyber security incidents (eg petty criminals, insiders, hacktivists, an organised crime syndicate, extremist group or state-sponsored body)?",null,{"$f":"IF(ISERROR(VLOOKUP(E237,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E237,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E237,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[232,"1.5.02c",6,null,"1.5.02c","Basic cyber security incidents (eg minor crime, localised disruption and theft)?",null,{"$f":"IF(ISERROR(VLOOKUP(E238,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E238,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E238,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[233,"1.5.02d",6,null,"1.5.02d","Sophisticated cyber security attacks (eg major organised crime, widespread disruption, critical damage to national infrastructure and even warfare)?",null,{"$f":"IF(ISERROR(VLOOKUP(E239,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E239,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E239,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[234,"1.5.02e",6,null,"1.5.02e","Difference between a cyber security and a traditional IT or information security incident (if any)?",null,{"$f":"IF(ISERROR(VLOOKUP(E240,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E240,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E240,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[235,"1.5.03",5,null,"1.5.03","Do you maintain an appropriate cyber security incident response capability?",null,{"$f":"IF(ISERROR(VLOOKUP(E241,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E241,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E241,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[236,"1.5.04",4,null,"1.5.04","Does your cyber security incident response capability include:",null,{"$f":"IF(ISERROR(VLOOKUP(E242,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E242,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E242,Weightings!T:Y,6,FALSE)))","v":""},""]
[237,"1.5.04a",6,null,"1.5.04a","Appointing a cyber security incident response team (internal and / or external) and determining what services they should provide?",null,{"$f":"IF(ISERROR(VLOOKUP(E243,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E243,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E243,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA243,detail_maturity_score,3,FALSE)","v":""}]
[238,"1.5.04b",6,null,"1.5.04b","Raising awareness about the need for an effective cyber security response capability?",null,{"$f":"IF(ISERROR(VLOOKUP(E244,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E244,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E244,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[239,"1.5.04c",6,null,"1.5.04c","Developing a consistent, repeatable cyber security incident response process or methodology for handling cyber security incidents (or suspected incidents) as they occur, so that the appropriate actions are taken?",null,{"$f":"IF(ISERROR(VLOOKUP(E245,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E245,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E245,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[240,"1.5.04d",6,null,"1.5.04d","Making effective use of relevant technologies?",null,{"$f":"IF(ISERROR(VLOOKUP(E246,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E246,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E246,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[241,"1.5.04e",6,null,"1.5.04e","Ensuring that cyber security incidents are properly followed up once they have been responded to effectively?",null,{"$f":"IF(ISERROR(VLOOKUP(E247,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E247,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E247,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[242,"1.5.05",5,null,"1.5.05","Have you obtained senior management commitment for your cyber security incident response capability?",null,{"$f":"IF(ISERROR(VLOOKUP(E248,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E248,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E248,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[243,"1.5.06",4,null,"1.5.06","Does senior management commitment include:",null,{"$f":"IF(ISERROR(VLOOKUP(E249,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E249,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E249,Weightings!T:Y,6,FALSE)))","v":""},""]
[244,"1.5.06a",6,null,"1.5.06a","Providing sufficient funding and resources to deal with cyber security incidents effectively?",null,{"$f":"IF(ISERROR(VLOOKUP(E250,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E250,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E250,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA250,detail_maturity_score,3,FALSE)","v":""}]
[245,"1.5.06b",6,null,"1.5.06b","Determining whether to establish a specialised cyber security incident response capability or integrate cyber security incidents into existing incident management systems?",null,{"$f":"IF(ISERROR(VLOOKUP(E251,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E251,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E251,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA251,detail_maturity_score,3,FALSE)","v":""}]
[246,"1.5.06c",6,null,"1.5.06c","Finding appropriate external sources and levels of guidance to help you prepare for a cyber security incident",null,{"$f":"IF(ISERROR(VLOOKUP(E252,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E252,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E252,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA252,detail_maturity_score,3,FALSE)","v":""}]
[247,"1.5.07",5,null,"1.5.07","Do you know your state of readiness to be able to respond to a cyber security incident in a fast, effective manner?",null,{"$f":"IF(ISERROR(VLOOKUP(E253,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E253,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E253,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA253,detail_maturity_score,3,FALSE)","v":""}]
[248,"1.5.08",5,null,"1.5.08","Do you determine the requirements you have for your cyber security incident response capability?",null,{"$f":"IF(ISERROR(VLOOKUP(E254,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E254,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E254,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA254,detail_maturity_score,3,FALSE)","v":""}]
[249,"1.5.09",4,null,"1.5.09","Do you measure the level of maturity of your cyber security incident response capability in terms of:",null,{"$f":"IF(ISERROR(VLOOKUP(E255,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E255,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E255,Weightings!T:Y,6,FALSE)))","v":""},""]
[250,"1.5.09a",6,null,"1.5.09a","People (eg an incident response team or individual, technical experts, fast access to decision-makers, representation from key suppliers)?",null,{"$f":"IF(ISERROR(VLOOKUP(E256,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E256,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E256,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA256,detail_maturity_score,3,FALSE)","v":""}]
[251,"1.5.09b",6,null,"1.5.09b","Process (eg knowing what to do, how to do it and when to do it – when detecting, containing, eradicating or recovering from a cyber security incident)?",null,{"$f":"IF(ISERROR(VLOOKUP(E257,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E257,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E257,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[252,"1.5.09c",6,null,"1.5.09c","Technology (eg knowing their network topology, providing the right event logs)?",null,{"$f":"IF(ISERROR(VLOOKUP(E258,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E258,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E258,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[253,"1.5.09d",6,null,"1.5.09d","Information (eg having information close to hand about business operations and priorities; critical assets; and key dependencies, such as on third parties, important locations or where relevant information resides)?",null,{"$f":"IF(ISERROR(VLOOKUP(E259,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E259,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E259,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[254,"1.5.09e",6,null,"1.5.09e","Preparedness, response and follow up activities?",null,{"$f":"IF(ISERROR(VLOOKUP(E260,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E260,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E260,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[255,"1.5.09f",6,null,"1.5.09f","Ability to adopt a systematic, structured approach to cyber security incident response?",null,{"$f":"IF(ISERROR(VLOOKUP(E261,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E261,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E261,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[256,"1.5.10",4,null,"1.5.10","Do you compare the maturity of your cyber security incident response capability:",null,{"$f":"IF(ISERROR(VLOOKUP(E262,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E262,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E262,Weightings!T:Y,6,FALSE)))","v":""},""]
[257,"1.5.10a",6,null,"1.5.10a","To your requirements for such a capability?",null,{"$f":"IF(ISERROR(VLOOKUP(E263,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E263,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E263,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA263,detail_maturity_score,3,FALSE)","v":""}]
[258,{"$f":"VLOOKUP(A264,contentref,2,FALSE)","v":"1.5.10b"},6,null,"1.5.10b","With similar organisation to help determine if this level of maturity is appropriate for your organisation?",null,{"$f":"IF(ISERROR(VLOOKUP(E264,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E264,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E264,Weightings!T:Y,6,FALSE)))","v":"x 5"},{"$f":"IF(ISERROR(VLOOKUP(AA264,detail_maturity_score,3,FALSE)*VLOOKUP(H264,weighting_scores,2,FALSE)),\"\",VLOOKUP(AA264,detail_maturity_score,3,FALSE)*VLOOKUP(H264,weighting_scores,2,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA264,detail_maturity_score,3,FALSE)","v":""}]
[259,"1.5.11",5,null,"1.5.11","Does the make-up of your your cyber security incident response capability take into account what can and cannot be done with the time, resources and money available?",null,{"$f":"IF(ISERROR(VLOOKUP(E265,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E265,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E265,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA265,detail_maturity_score,3,FALSE)","v":""}]
[260,"1.5.12",5,null,"1.5.12","Do you continually review the internal capabilities and capacity of your cyber security incident response team?",null,{"$f":"IF(ISERROR(VLOOKUP(E266,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E266,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E266,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA266,detail_maturity_score,3,FALSE)","v":""}]

{"sheet":"Assessment - Phase 2","index":8,"n_rows":267,"n_cols":28,"rows_kept":267,"cut":false,"hidden":false,"merged":[[1,5,4,5]]}
[]
[null,null,null,null,null,"Maturity model for Phase 2 - Respond"]
[]
[]
[]
[]
[null,null,null,null,null,null,"Response","Weighting","Weighted score","Evidence supplied","Comments"]
[262,{"$f":"VLOOKUP(A8,contentref,2,FALSE)","v":"2.1"},{"$f":"VLOOKUP(A8,contentref,15,FALSE)","v":2},null,{"$f":"IF(C8=1,\"Phase \"&B8,IF(C8=2,\"Step \"&VLOOKUP(A8,contentref,4,FALSE),B8))","v":"Step 1"},{"$f":"VLOOKUP(A8,contentref,7,FALSE)","v":"Identification"},null,{"$f":"IF(ISERROR(VLOOKUP(E8,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E8,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E8,Weightings!T:Y,6,FALSE)))","v":""},{"$f":"IF(ISERROR(VLOOKUP(AA8,detail_maturity_score,3,FALSE)*VLOOKUP(H8,weighting_scores,2,FALSE)),\"\",VLOOKUP(AA8,detail_maturity_score,3,FALSE)*VLOOKUP(H8,weighting_scores,2,FALSE))","v":""}]
[263,"2.1.01",5,null,"2.1.01","Do you identify suspected cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E9,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E9,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E9,Weightings!T:Y,6,FALSE)))","v":"x 1"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA9,detail_maturity_score,3,FALSE)","v":""}]
[264,"2.1.02",4,null,"2.1.02","Do you inform users that they should:",null,{"$f":"IF(ISERROR(VLOOKUP(E10,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E10,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E10,Weightings!T:Y,6,FALSE)))","v":""},""]
[265,"2.1.02a",6,null,"2.1.02a","Report all suspected cyber security breaches to a central point (eg information failures; loss of services; detection of malicious code; denial of service attacks; errors from incomplete or inaccurate business data)?",null,{"$f":"IF(ISERROR(VLOOKUP(E11,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E11,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E11,Weightings!T:Y,6,FALSE)))","v":"x 1"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA11,detail_maturity_score,3,FALSE)","v":""}]
[266,"2.1.02b",6,null,"2.1.02b","Note all important details (eg type of breach, messages on screen, and details of unusual occurrences)?",null,{"$f":"IF(ISERROR(VLOOKUP(E12,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E12,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E12,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA12,detail_maturity_score,3,FALSE)","v":""}]
[267,"2.1.02c",6,null,"2.1.02c","Restrain from attempting to take remedial actions themselves?",null,{"$f":"IF(ISERROR(VLOOKUP(E13,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E13,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E13,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA13,detail_maturity_score,3,FALSE)","v":""}]
[268,"2.1.03",5,null,"2.1.03","Do you identify cyber security incidents by analysing suspicious events reported by users to the IT help desk (or equivalent)?",null,{"$f":"IF(ISERROR(VLOOKUP(E14,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E14,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E14,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA14,detail_maturity_score,3,FALSE)","v":""}]
[269,"2.1.04",4,null,"2.1.04","Is this analysis based on:",null,{"$f":"IF(ISERROR(VLOOKUP(E15,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E15,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E15,Weightings!T:Y,6,FALSE)))","v":""},""]
[270,"2.1.04a",6,null,"2.1.04a","Comparing characteristics of the suspicious event to known ‘normal’ system and network behaviour?",null,{"$f":"IF(ISERROR(VLOOKUP(E16,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E16,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E16,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA16,detail_maturity_score,3,FALSE)","v":""}]
[271,"2.1.04b",6,null,"2.1.04b","A good working knowledge of what indictors of compromise (IOCs) would look like?",null,{"$f":"IF(ISERROR(VLOOKUP(E17,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E17,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E17,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA17,detail_maturity_score,3,FALSE)","v":""}]
[272,"2.1.05",4,null,"2.1.05","To help identify potential cyber security incidents do you monitor information from a variety of sources, including:",null,{"$f":"IF(ISERROR(VLOOKUP(E18,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E18,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E18,Weightings!T:Y,6,FALSE)))","v":""},""]
[273,"2.1.05a",6,null,"2.1.05a","System logs (eg operating system logs, service and application logs, network device logs and network flows)",null,{"$f":"IF(ISERROR(VLOOKUP(E19,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E19,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E19,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA19,detail_maturity_score,3,FALSE)","v":""}]
[274,"2.1.05b",6,null,"2.1.05b","Alerts generated by technical security software (eg IDS, IPS, DLP, SIEM, antivirus and spam software), file integrity checking software, monitoring services (often provided by a third party)?",null,{"$f":"IF(ISERROR(VLOOKUP(E20,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E20,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E20,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[275,"2.1.05c",6,null,"2.1.05c","Data provided by monitoring services or a Security Operations Centre (often provided by third parties)?",null,{"$f":"IF(ISERROR(VLOOKUP(E21,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E21,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E21,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[276,"2.1.05d",6,null,"2.1.05d","Publicly available information (eg information on new exploits, information exchange groups, third party organisations, governments)?",null,{"$f":"IF(ISERROR(VLOOKUP(E22,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E22,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E22,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[277,"2.1.05e",6,null,"2.1.05e","People from within your organisation?",null,{"$f":"IF(ISERROR(VLOOKUP(E23,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E23,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E23,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[278,"2.1.05f",6,null,"2.1.05f","A variety of third parties (eg customers, suppliers, IT providers, ISPs, partners; government bodies)?",null,{"$f":"IF(ISERROR(VLOOKUP(E24,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E24,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E24,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[279,"2.1.05g",6,null,"2.1.05g","Anomalies detected by audits, investigations or reviews?",null,{"$f":"IF(ISERROR(VLOOKUP(E25,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E25,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E25,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[280,"2.1.06",4,null,"2.1.06","Having identified a suspected cyber security incident, do you:",null,{"$f":"IF(ISERROR(VLOOKUP(E26,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E26,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E26,Weightings!T:Y,6,FALSE)))","v":""},""]
[281,"2.1.06a",6,null,"2.1.06a","Investigate different types of technical information, such as IP addresses?",null,{"$f":"IF(ISERROR(VLOOKUP(E27,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E27,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E27,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA27,detail_maturity_score,3,FALSE)","v":""}]
[282,"2.1.06b",6,null,"2.1.06b","Analyse all available information related to a potential cyber security incident?",null,{"$f":"IF(ISERROR(VLOOKUP(E28,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E28,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E28,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA28,detail_maturity_score,3,FALSE)","v":""}]
[283,"2.1.06c",6,null,"2.1.06c","Determine what has actually happened (eg a DDOS, malware attack, system hack, session hijack or data corruption)?",null,{"$f":"IF(ISERROR(VLOOKUP(E29,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E29,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E29,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA29,detail_maturity_score,3,FALSE)","v":""}]
[284,"2.1.06d",6,null,"2.1.06d","Confirm that they have actually been subject to a cyber security attack or had a cyber-related breach (the unknown element)?",null,{"$f":"IF(ISERROR(VLOOKUP(E30,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E30,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E30,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA30,detail_maturity_score,3,FALSE)","v":""}]
[285,"2.1.07",4,null,"2.1.07","When monitoring information from relevant technical sources, such as specialised security software (eg SIEM or IDS) do you:",null,{"$f":"IF(ISERROR(VLOOKUP(E31,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E31,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E31,Weightings!T:Y,6,FALSE)))","v":""},""]
[286,"2.1.07a",6,null,"2.1.07a","Monitor all relevant events?",null,{"$f":"IF(ISERROR(VLOOKUP(E32,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E32,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E32,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA32,detail_maturity_score,3,FALSE)","v":""}]
[287,"2.1.07b",6,null,"2.1.07b","Carry out monitoring regularly?",null,{"$f":"IF(ISERROR(VLOOKUP(E33,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E33,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E33,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA33,detail_maturity_score,3,FALSE)","v":""}]
[288,"2.1.07c",6,null,"2.1.07c","Carry out monitoring in an appropriate manner, focusing on finding anomalies?",null,{"$f":"IF(ISERROR(VLOOKUP(E34,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E34,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E34,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA34,detail_maturity_score,3,FALSE)","v":""}]
[289,"2.1.07d",6,null,"2.1.07d","Respond to alerts correctly (avoiding the risk of overlooking indicative alerts or over-reacting to benign alerts)?",null,{"$f":"IF(ISERROR(VLOOKUP(E35,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E35,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E35,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA35,detail_maturity_score,3,FALSE)","v":""}]
[290,"2.1.07e",6,null,"2.1.07e","Aggregate what may seem like benign alerts into what is a coherent threat message?",null,{"$f":"IF(ISERROR(VLOOKUP(E36,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E36,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E36,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA36,detail_maturity_score,3,FALSE)","v":""}]
[291,"2.1.08",4,null,"2.1.08","Do you take additional steps to identify cyber security incidents by:",null,{"$f":"IF(ISERROR(VLOOKUP(E37,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E37,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E37,Weightings!T:Y,6,FALSE)))","v":""},""]
[292,"2.1.08a",6,null,"2.1.08a","Providing situational awareness (particularly through cyber intelligence)?",null,{"$f":"IF(ISERROR(VLOOKUP(E38,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E38,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E38,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA38,detail_maturity_score,3,FALSE)","v":""}]
[293,"2.1.08b",6,null,"2.1.08b","Continuously monitoring events that could result in your organisation being affected by a cyber security incident?",null,{"$f":"IF(ISERROR(VLOOKUP(E39,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E39,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E39,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[294,"2.1.08c",6,null,"2.1.08c","Evaluating threat analytics (typically based on the threat model of the behaviour of attacks), helping to determine both symptoms and behaviour?",null,{"$f":"IF(ISERROR(VLOOKUP(E40,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E40,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E40,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[295,"2.1.08d",6,null,"2.1.08d","Performing specialised analysis of host assets, network data and attack files (eg malware)?",null,{"$f":"IF(ISERROR(VLOOKUP(E41,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E41,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E41,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[296,"2.1.08e",6,null,"2.1.08e","Prioritising assets to be investigated?",null,{"$f":"IF(ISERROR(VLOOKUP(E42,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E42,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E42,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[297,"2.1.08f",6,null,"2.1.08f","Addressing unusual or novel problems (eg to do with bespoke file types or encryption)?",null,{"$f":"IF(ISERROR(VLOOKUP(E43,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E43,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E43,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[298,"2.1.09",5,null,"2.1.09","Do you use security analytics?",null,{"$f":"IF(ISERROR(VLOOKUP(E44,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E44,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E44,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[299,"2.1.10",4,null,"2.1.10","Does your security analytics include:",null,{"$f":"IF(ISERROR(VLOOKUP(E45,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E45,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E45,Weightings!T:Y,6,FALSE)))","v":""},""]
[300,"2.1.10a",6,null,"2.1.10a","Testing for possible attackers or poor user behaviour (eg users opening ‘honey pot’ attachments, or similar)?",null,{"$f":"IF(ISERROR(VLOOKUP(E46,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E46,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E46,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA46,detail_maturity_score,3,FALSE)","v":""}]
[301,"2.1.10b",6,null,"2.1.10b","Automated analytics platform (more than just a SIEM)?",null,{"$f":"IF(ISERROR(VLOOKUP(E47,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E47,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E47,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA47,detail_maturity_score,3,FALSE)","v":""}]
[302,"2.1.10c",6,null,"2.1.10c","Evaluating threat analytics (typically based on the threat model of the behaviour of attacks), helping to determine both symptoms and behaviour?",null,{"$f":"IF(ISERROR(VLOOKUP(E48,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E48,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E48,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA48,detail_maturity_score,3,FALSE)","v":""}]
[303,"2.2",2,null,"Step 2","Investigation",null,{"$f":"IF(ISERROR(VLOOKUP(E49,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E49,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E49,Weightings!T:Y,6,FALSE)))","v":""},""]
[304,"",3,null,"","Understanding",null,{"$f":"IF(ISERROR(VLOOKUP(E50,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E50,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E50,Weightings!T:Y,6,FALSE)))","v":""},""]
[305,"2.2.01",5,null,"2.2.01","Do you take steps to investigate the cyber security incident?",null,{"$f":"IF(ISERROR(VLOOKUP(E51,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E51,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E51,Weightings!T:Y,6,FALSE)))","v":"x 1"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA51,detail_maturity_score,3,FALSE)","v":""}]
[306,"2.2.02",4,null,"2.2.02","Does your investigation of the event include:",null,{"$f":"IF(ISERROR(VLOOKUP(E52,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E52,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E52,Weightings!T:Y,6,FALSE)))","v":""},""]
[307,"2.2.02a",6,null,"2.2.02a","Establishing the objectives of the investigation?",null,{"$f":"IF(ISERROR(VLOOKUP(E53,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E53,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E53,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA53,detail_maturity_score,3,FALSE)","v":""}]
[308,"2.2.02b",6,null,"2.2.02b","Performing detailed analysis of the cyber security incident?",null,{"$f":"IF(ISERROR(VLOOKUP(E54,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E54,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E54,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA54,detail_maturity_score,3,FALSE)","v":""}]
[309,"2.2.02c",6,null,"2.2.02c","Placing priority on the speed of investigation?",null,{"$f":"IF(ISERROR(VLOOKUP(E55,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E55,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E55,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA55,detail_maturity_score,3,FALSE)","v":""}]
[310,"2.2.03",4,null,"2.2.03","Does your analysis of the cyber security incident include:",null,{"$f":"IF(ISERROR(VLOOKUP(E56,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E56,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E56,Weightings!T:Y,6,FALSE)))","v":""},""]
[311,"2.2.03a",6,null,"2.2.03a","Identifying what systems, networks and information (assets) have been compromised?",null,{"$f":"IF(ISERROR(VLOOKUP(E57,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E57,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E57,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA57,detail_maturity_score,3,FALSE)","v":""}]
[312,"2.2.03b",6,null,"2.2.03b","Determining what information has been disclosed to unauthorised parties, stolen, deleted or corrupted?",null,{"$f":"IF(ISERROR(VLOOKUP(E58,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E58,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E58,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[313,"2.2.03c",6,null,"2.2.03c","Working out how it happened (eg how did the attacker gain entry to the system)?",null,{"$f":"IF(ISERROR(VLOOKUP(E59,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E59,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E59,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[314,"2.2.03d",6,null,"2.2.03d","Finding out who did it (ie which threat agent or agents)?",null,{"$f":"IF(ISERROR(VLOOKUP(E60,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E60,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E60,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[315,"2.2.03e",6,null,"2.2.03e","Determining why they did it, such as financial crime (eg fraud or extortion), theft of intellectual property, personal attack (eg revenge), or disruption to critical services?",null,{"$f":"IF(ISERROR(VLOOKUP(E61,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E61,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E61,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[316,"2.2.03f",6,null,"2.2.03f","Estimating the potential business impact of the cyber security incident?",null,{"$f":"IF(ISERROR(VLOOKUP(E62,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E62,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E62,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[317,"2.2.04",4,null,"2.2.04","Do your investigation determine what:",null,{"$f":"IF(ISERROR(VLOOKUP(E63,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E63,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E63,Weightings!T:Y,6,FALSE)))","v":""},""]
[318,"2.2.04a",6,null,"2.2.04a","Methodologies the attackers are using?",null,{"$f":"IF(ISERROR(VLOOKUP(E64,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E64,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E64,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA64,detail_maturity_score,3,FALSE)","v":""}]
[319,"2.2.04b",6,null,"2.2.04b","Who their target is for the attack (eg an individual, the whole organisation, your market sector or the government)?",null,{"$f":"IF(ISERROR(VLOOKUP(E65,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E65,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E65,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA65,detail_maturity_score,3,FALSE)","v":""}]
[320,"2.2.05",5,null,"2.2.05","Do you have access to cyber threat intelligence?",null,{"$f":"IF(ISERROR(VLOOKUP(E66,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E66,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E66,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA66,detail_maturity_score,3,FALSE)","v":""}]
[321,"2.2.06",5,null,"2.2.06","Does your cyber threat intelligence come from a variety of reputable sources, such as government, CERTS, collaborative groups or expert third parties?",null,{"$f":"IF(ISERROR(VLOOKUP(E67,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E67,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E67,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA67,detail_maturity_score,3,FALSE)","v":""}]
[322,"2.2.07",4,null,"2.2.07","Does your cyber threat intelligence help you to determine the attacker(s):",null,{"$f":"IF(ISERROR(VLOOKUP(E68,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E68,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E68,Weightings!T:Y,6,FALSE)))","v":""},""]
[323,"2.2.07a",6,null,"2.2.07a","Capabilities (what can they actually do)?",null,{"$f":"IF(ISERROR(VLOOKUP(E69,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E69,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E69,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA69,detail_maturity_score,3,FALSE)","v":""}]
[324,"2.2.07b",6,null,"2.2.07b","Motives (why are they attacking you)?",null,{"$f":"IF(ISERROR(VLOOKUP(E70,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E70,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E70,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA70,detail_maturity_score,3,FALSE)","v":""}]
[325,"2.2.07c",6,null,"2.2.07c","Likely actions (eg their tactics, techniques and procedures)?",null,{"$f":"IF(ISERROR(VLOOKUP(E71,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E71,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E71,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA71,detail_maturity_score,3,FALSE)","v":""}]
[326,{"$f":"VLOOKUP(A72,contentref,2,FALSE)","v":""},{"$f":"VLOOKUP(A72,contentref,15,FALSE)","v":3},null,{"$f":"IF(C72=1,\"Phase \"&B72,IF(C72=2,\"Step \"&VLOOKUP(A72,contentref,4,FALSE),B72))","v":""},{"$f":"VLOOKUP(A72,contentref,7,FALSE)","v":"Triage"},null,{"$f":"IF(ISERROR(VLOOKUP(E72,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E72,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E72,Weightings!T:Y,6,FALSE)))","v":""},{"$f":"IF(ISERROR(VLOOKUP(AA72,detail_maturity_score,3,FALSE)*VLOOKUP(H72,weighting_scores,2,FALSE)),\"\",VLOOKUP(AA72,detail_maturity_score,3,FALSE)*VLOOKUP(H72,weighting_scores,2,FALSE))","v":""}]
[327,"2.2.08",5,null,"2.2.08","Do you perform Triage on the cyber security incident in the early part of an investigation?",null,{"$f":"IF(ISERROR(VLOOKUP(E73,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E73,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E73,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA73,detail_maturity_score,3,FALSE)","v":""}]
[328,"2.2.09",4,null,"2.2.09","Do the actions you carry out as part of Triage include:",null,{"$f":"IF(ISERROR(VLOOKUP(E74,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E74,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E74,Weightings!T:Y,6,FALSE)))","v":""},""]
[329,"2.2.09a",6,null,"2.2.09a","Classifying cyber security incidents (eg critical, significant, normal or negligible impact)?",null,{"$f":"IF(ISERROR(VLOOKUP(E75,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E75,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E75,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA75,detail_maturity_score,3,FALSE)","v":""}]
[330,"2.2.09b",6,null,"2.2.09b","Prioritising these incidents (eg high, medium or low)?",null,{"$f":"IF(ISERROR(VLOOKUP(E76,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E76,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E76,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA76,detail_maturity_score,3,FALSE)","v":""}]
[331,"2.2.09c",6,null,"2.2.09c","Assigning incidents to appropriate personnel in terms of their legitimacy, correctness, constituency origin, severity or impact?",null,{"$f":"IF(ISERROR(VLOOKUP(E77,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E77,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E77,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA77,detail_maturity_score,3,FALSE)","v":""}]
[332,"",3,null,"","First response",null,{"$f":"IF(ISERROR(VLOOKUP(E78,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E78,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E78,Weightings!T:Y,6,FALSE)))","v":""},""]
[333,"2.2.10",5,null,"2.2.10","Do you have one or more named individuals (or a team) who are capable of dealing with the initial stages of cyber incident response (first responders)?",null,{"$f":"IF(ISERROR(VLOOKUP(E79,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E79,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E79,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA79,detail_maturity_score,3,FALSE)","v":""}]
[334,"2.2.11",4,null,"2.2.11","Are your first responders able to:",null,{"$f":"IF(ISERROR(VLOOKUP(E80,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E80,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E80,Weightings!T:Y,6,FALSE)))","v":""},""]
[335,"2.2.11a",6,null,"2.2.11a","Classify and prioritise cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E81,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E81,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E81,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA81,detail_maturity_score,3,FALSE)","v":""}]
[336,"2.2.11b",6,null,"2.2.11b","Avoid taking the wrong initial action when a cyber security attack occurs (eg taking systems off the network or cleaning up systems, which could have a detrimental affect like alerting an attacker or destroying vital evidence)?",null,{"$f":"IF(ISERROR(VLOOKUP(E82,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E82,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E82,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA82,detail_maturity_score,3,FALSE)","v":""}]
[337,"2.2.11c",6,null,"2.2.11c","Identify quickly when the scope and severity is beyond local or in-house skills?",null,{"$f":"IF(ISERROR(VLOOKUP(E83,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E83,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E83,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA83,detail_maturity_score,3,FALSE)","v":""}]
[338,"2.2.12",4,null,"2.2.12","Have arrangements to have been made in advance so that expert investigators:",null,{"$f":"IF(ISERROR(VLOOKUP(E84,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E84,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E84,Weightings!T:Y,6,FALSE)))","v":""},""]
[339,"2.2.12a",6,null,"2.2.12a","Are available at short notice?",null,{"$f":"IF(ISERROR(VLOOKUP(E85,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E85,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E85,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA85,detail_maturity_score,3,FALSE)","v":""}]
[340,"2.2.12b",6,null,"2.2.12b","Have enough prior information to be able to hit the ground running?",null,{"$f":"IF(ISERROR(VLOOKUP(E86,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E86,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E86,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA86,detail_maturity_score,3,FALSE)","v":""}]
[341,"2.2.13",5,null,"2.2.13","Are you able to quickly contact third parties that you may wish to get involved, such as technology forensics specialists, technology analysts (for example, database experts), information analysts (for example, accountants), legal experts and on-site police support?",null,{"$f":"IF(ISERROR(VLOOKUP(E87,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E87,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E87,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA87,detail_maturity_score,3,FALSE)","v":""}]
[342,"2.2.14",5,null,"2.2.14","Do you have a crisis management team (or equivalent) to support serious cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E88,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E88,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E88,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA88,detail_maturity_score,3,FALSE)","v":""}]
[343,"2.2.15",4,null,"2.2.15","Are you able to manage the cyber security incident:",null,{"$f":"IF(ISERROR(VLOOKUP(E89,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E89,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E89,Weightings!T:Y,6,FALSE)))","v":""},""]
[344,"2.2.15a",6,null,"2.2.15a","Via one central point of contact?",null,{"$f":"IF(ISERROR(VLOOKUP(E90,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E90,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E90,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA90,detail_maturity_score,3,FALSE)","v":""}]
[345,"2.2.15b",6,null,"2.2.15b","From one central location?",null,{"$f":"IF(ISERROR(VLOOKUP(E91,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E91,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E91,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA91,detail_maturity_score,3,FALSE)","v":""}]
[346,"2.2.15c",6,null,"2.2.15c","In a specialised incident response location, such as a ‘war room’, if required?",null,{"$f":"IF(ISERROR(VLOOKUP(E92,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E92,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E92,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA92,detail_maturity_score,3,FALSE)","v":""}]
[347,"",3,null,"","Initial analysis",null,{"$f":"IF(ISERROR(VLOOKUP(E93,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E93,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E93,Weightings!T:Y,6,FALSE)))","v":""},""]
[348,"2.2.16",5,null,"2.2.16","Do you perform initial analysis to determine the precise nature of the incident?",null,{"$f":"IF(ISERROR(VLOOKUP(E94,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E94,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E94,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA94,detail_maturity_score,3,FALSE)","v":""}]
[349,"2.2.17",4,null,"2.2.17","Are your cyber security incident investigations:",null,{"$f":"IF(ISERROR(VLOOKUP(E95,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E95,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E95,Weightings!T:Y,6,FALSE)))","v":""},""]
[350,"2.2.17a",6,null,"2.2.17a","Evidence-driven, based on information gathered from corporate infrastructure or applications (typically event logs)?",null,{"$f":"IF(ISERROR(VLOOKUP(E96,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E96,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E96,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA96,detail_maturity_score,3,FALSE)","v":""}]
[351,"2.2.17b",6,null,"2.2.17b","Intelligence driven, based on information gathered from: government agencies (eg CPNI), monitoring of internal resources, open source information or data provided internally?",null,{"$f":"IF(ISERROR(VLOOKUP(E97,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E97,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E97,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA97,detail_maturity_score,3,FALSE)","v":""}]
[352,"2.2.18",4,null,"2.2.18","Do your cyber security incident investigations include:",null,{"$f":"IF(ISERROR(VLOOKUP(E98,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E98,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E98,Weightings!T:Y,6,FALSE)))","v":""},""]
[353,"2.2.18a",6,null,"2.2.18a","Considering all relevant event logs (eg logs generated by firewalls, web servers, traditional servers / workstations, business applications, email history and archives, network data, internet usage and building access)?",null,{"$f":"IF(ISERROR(VLOOKUP(E99,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E99,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E99,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA99,detail_maturity_score,3,FALSE)","v":""}]
[354,"2.2.18b",6,null,"2.2.18b","Examining important alerts or suspicious events in logs or technical security monitoring systems (eg IDS, IPS, DLP or SIEM)?",null,{"$f":"IF(ISERROR(VLOOKUP(E100,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E100,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E100,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA100,detail_maturity_score,3,FALSE)","v":""}]
[355,"2.2.18c",6,null,"2.2.18c","Correlating them with network data (including data from cloud service providers)?",null,{"$f":"IF(ISERROR(VLOOKUP(E101,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E101,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E101,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA101,detail_maturity_score,3,FALSE)","v":""}]
[356,"2.2.18d",6,null,"2.2.18d","Comparing these pieces of information against threat intelligence?",null,{"$f":"IF(ISERROR(VLOOKUP(E102,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E102,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E102,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA102,detail_maturity_score,3,FALSE)","v":""}]
[357,"2.2.19",4,null,"2.2.19","Do you thoroughly investigate each possible trigger event including:",null,{"$f":"IF(ISERROR(VLOOKUP(E103,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E103,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E103,Weightings!T:Y,6,FALSE)))","v":""},""]
[358,"2.2.19a",6,null,"2.2.19a","Date/time?",null,{"$f":"IF(ISERROR(VLOOKUP(E104,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E104,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E104,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA104,detail_maturity_score,3,FALSE)","v":""}]
[359,"2.2.19b",6,null,"2.2.19b","Internet protocol (IP) address (internal or external)?",null,{"$f":"IF(ISERROR(VLOOKUP(E105,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E105,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E105,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA105,detail_maturity_score,3,FALSE)","v":""}]
[360,"2.2.19c",6,null,"2.2.19c","Port (source or destination), domain and file (eg exe, .dll)?",null,{"$f":"IF(ISERROR(VLOOKUP(E106,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E106,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E106,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA106,detail_maturity_score,3,FALSE)","v":""}]
[361,"2.2.19d",6,null,"2.2.19d","System (hardware vendor, operating system, applications, purpose, location)?",null,{"$f":"IF(ISERROR(VLOOKUP(E107,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E107,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E107,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA107,detail_maturity_score,3,FALSE)","v":""}]
[362,"2.2.20",4,null,"2.2.20","Do you retain relevant logs:",null,{"$f":"IF(ISERROR(VLOOKUP(E108,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E108,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E108,Weightings!T:Y,6,FALSE)))","v":""},""]
[363,"2.2.20a",6,null,"2.2.20a","For as long as possible?",null,{"$f":"IF(ISERROR(VLOOKUP(E109,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E109,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E109,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA109,detail_maturity_score,3,FALSE)","v":""}]
[364,"2.2.20b",6,null,"2.2.20b","As part of an approved log retention policy?",null,{"$f":"IF(ISERROR(VLOOKUP(E110,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E110,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E110,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA110,detail_maturity_score,3,FALSE)","v":""}]
[365,"",3,null,"","Collaboration",null,{"$f":"IF(ISERROR(VLOOKUP(E111,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E111,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E111,Weightings!T:Y,6,FALSE)))","v":""},""]
[366,"2.2.21",5,null,"2.2.21","Do you analyse the possible systemic nature of the attack?",null,{"$f":"IF(ISERROR(VLOOKUP(E112,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E112,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E112,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA112,detail_maturity_score,3,FALSE)","v":""}]
[367,"2.2.22",4,null,"2.2.22","Does this analysis include:",null,{"$f":"IF(ISERROR(VLOOKUP(E113,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E113,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E113,Weightings!T:Y,6,FALSE)))","v":""},""]
[368,"2.2.22a",6,null,"2.2.22a","Tying disparate events together into a coherent picture?",null,{"$f":"IF(ISERROR(VLOOKUP(E114,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E114,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E114,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA114,detail_maturity_score,3,FALSE)","v":""}]
[369,"2.2.22b",6,null,"2.2.22b","Linking events to possible related events in other organisations with which you are associated (eg other Banks if you are in the Banking sector)?",null,{"$f":"IF(ISERROR(VLOOKUP(E115,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E115,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E115,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA115,detail_maturity_score,3,FALSE)","v":""}]
[370,"2.3",2,null,"Step 3","Action",null,{"$f":"IF(ISERROR(VLOOKUP(E116,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E116,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E116,Weightings!T:Y,6,FALSE)))","v":""},""]
[371,"",3,null,"","Containment",null,{"$f":"IF(ISERROR(VLOOKUP(E117,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E117,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E117,Weightings!T:Y,6,FALSE)))","v":""},""]
[372,"2.3.01",5,null,"2.3.01","Do you take steps to contain the damage being done by the cyber security incident?",null,{"$f":"IF(ISERROR(VLOOKUP(E118,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E118,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E118,Weightings!T:Y,6,FALSE)))","v":"x 1"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA118,detail_maturity_score,3,FALSE)","v":""}]
[373,"2.3.02",4,null,"2.3.02","Does the objective of containment include:",null,{"$f":"IF(ISERROR(VLOOKUP(E119,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E119,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E119,Weightings!T:Y,6,FALSE)))","v":""},""]
[374,"2.3.02a",6,null,"2.3.02a","Making best efforts to return to functionality as normal?",null,{"$f":"IF(ISERROR(VLOOKUP(E120,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E120,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E120,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA120,detail_maturity_score,3,FALSE)","v":""}]
[375,"2.3.02b",6,null,"2.3.02b","Returning to business as usual?",null,{"$f":"IF(ISERROR(VLOOKUP(E121,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E121,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E121,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA121,detail_maturity_score,3,FALSE)","v":""}]
[376,"2.3.02c",6,null,"2.3.02c","Continuing to analyse the incident?",null,{"$f":"IF(ISERROR(VLOOKUP(E122,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E122,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E122,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA122,detail_maturity_score,3,FALSE)","v":""}]
[377,"2.3.02d",6,null,"2.3.02d","Planning longer term remediation?",null,{"$f":"IF(ISERROR(VLOOKUP(E123,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E123,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E123,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA123,detail_maturity_score,3,FALSE)","v":""}]
[378,"2.3.03",4,null,"2.3.03","Does containment include stopping it from spreading to other:",null,{"$f":"IF(ISERROR(VLOOKUP(E124,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E124,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E124,Weightings!T:Y,6,FALSE)))","v":""},""]
[379,"2.3.03a",6,null,"2.3.03a","Networks within your organisation?",null,{"$f":"IF(ISERROR(VLOOKUP(E125,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E125,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E125,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA125,detail_maturity_score,3,FALSE)","v":""}]
[380,"2.3.03b",6,null,"2.3.03b","Networks beyond your organisation?",null,{"$f":"IF(ISERROR(VLOOKUP(E126,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E126,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E126,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[381,"2.3.03c",6,null,"2.3.03c","Devices within your organisation?",null,{"$f":"IF(ISERROR(VLOOKUP(E127,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E127,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E127,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[382,"2.3.03d",6,null,"2.3.03d","Devices beyond your organisation?",null,{"$f":"IF(ISERROR(VLOOKUP(E128,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E128,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E128,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[383,"2.3.04",5,null,"2.3.04","Does containment include a number of concurrent actions aimed at reducing the immediate impact of the cyber security incident?",null,{"$f":"IF(ISERROR(VLOOKUP(E129,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E129,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E129,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[384,"2.3.05",5,null,"2.3.05","Does containment include removing the attacker’s access to your systems?",null,{"$f":"IF(ISERROR(VLOOKUP(E130,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E130,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E130,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[385,"2.3.06",4,null,"2.3.06","Do your methods of containment include:",null,{"$f":"IF(ISERROR(VLOOKUP(E131,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E131,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E131,Weightings!T:Y,6,FALSE)))","v":""},""]
[386,"2.3.06a",6,null,"2.3.06a","Blocking (and logging) of unauthorised access?",null,{"$f":"IF(ISERROR(VLOOKUP(E132,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E132,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E132,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA132,detail_maturity_score,3,FALSE)","v":""}]
[387,"2.3.06b",6,null,"2.3.06b","Blocking malware sources (eg email addresses and websites)?",null,{"$f":"IF(ISERROR(VLOOKUP(E133,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E133,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E133,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[388,"2.3.06c",6,null,"2.3.06c","Closing particular ports and mail servers?",null,{"$f":"IF(ISERROR(VLOOKUP(E134,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E134,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E134,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[389,"2.3.06d",6,null,"2.3.06d","Firewall filtering?",null,{"$f":"IF(ISERROR(VLOOKUP(E135,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E135,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E135,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[390,{"$f":"VLOOKUP(A136,contentref,2,FALSE)","v":"2.3.06e"},{"$f":"VLOOKUP(A136,contentref,15,FALSE)","v":6},null,{"$f":"IF(C136=1,\"Phase \"&B136,IF(C136=2,\"Step \"&VLOOKUP(A136,contentref,4,FALSE),B136))","v":"2.3.06e"},{"$f":"VLOOKUP(A136,contentref,7,FALSE)","v":"Relocating website home pages?"},null,{"$f":"IF(ISERROR(VLOOKUP(E136,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E136,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E136,Weightings!T:Y,6,FALSE)))","v":"x 4"},{"$f":"IF(ISERROR(VLOOKUP(AA136,detail_maturity_score,3,FALSE)*VLOOKUP(H136,weighting_scores,2,FALSE)),\"\",VLOOKUP(AA136,detail_maturity_score,3,FALSE)*VLOOKUP(H136,weighting_scores,2,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[391,"2.3.06f",6,null,"2.3.06f","Isolating systems?",null,{"$f":"IF(ISERROR(VLOOKUP(E137,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E137,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E137,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[392,"2.3.06g",6,null,"2.3.06g","Taking back-ups?",null,{"$f":"IF(ISERROR(VLOOKUP(E138,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E138,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E138,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[393,"2.3.07",4,null,"2.3.07","Do you have separate containment strategies for different types of:",null,{"$f":"IF(ISERROR(VLOOKUP(E139,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E139,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E139,Weightings!T:Y,6,FALSE)))","v":""},""]
[394,"2.3.07a",6,null,"2.3.07a","Cyber security attack?",null,{"$f":"IF(ISERROR(VLOOKUP(E140,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E140,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E140,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA140,detail_maturity_score,3,FALSE)","v":""}]
[395,"2.3.07b",6,null,"2.3.07b","Sources of attack (the attack agent)?",null,{"$f":"IF(ISERROR(VLOOKUP(E141,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E141,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E141,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA141,detail_maturity_score,3,FALSE)","v":""}]
[396,"2.3.08",5,null,"2.3.08","Do your containment strategies include clearly documented criteria to facilitate decision-making?",null,{"$f":"IF(ISERROR(VLOOKUP(E142,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E142,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E142,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA142,detail_maturity_score,3,FALSE)","v":""}]
[397,"2.3.09",4,null,"2.3.09","Do your containment strategies include evaluating the:",null,{"$f":"IF(ISERROR(VLOOKUP(E143,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E143,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E143,Weightings!T:Y,6,FALSE)))","v":""},""]
[398,"2.3.09a",6,null,"2.3.09a","Potential damage to and theft of resources?",null,{"$f":"IF(ISERROR(VLOOKUP(E144,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E144,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E144,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA144,detail_maturity_score,3,FALSE)","v":""}]
[399,"2.3.09b",6,null,"2.3.09b","Need for evidence preservation?",null,{"$f":"IF(ISERROR(VLOOKUP(E145,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E145,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E145,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[400,"2.3.09c",6,null,"2.3.09c","Service availability (eg network connectivity, services provided to external parties)?",null,{"$f":"IF(ISERROR(VLOOKUP(E146,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E146,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E146,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[401,"2.3.09d",6,null,"2.3.09d","Time and resources needed to implement the strategy?",null,{"$f":"IF(ISERROR(VLOOKUP(E147,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E147,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E147,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[402,"2.3.09e",6,null,"2.3.09e","Effectiveness of the strategy (eg partial containment, full containment)?",null,{"$f":"IF(ISERROR(VLOOKUP(E148,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E148,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E148,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[403,"2.3.09f",6,null,"2.3.09f","Duration of the solution (eg emergency workaround to be removed in four hours, temporary workaround to be removed in two weeks, permanent solution)?",null,{"$f":"IF(ISERROR(VLOOKUP(E149,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E149,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E149,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[404,"2.3.10",4,null,"2.3.10","Does your approach to containing cyber security incidents include:",null,{"$f":"IF(ISERROR(VLOOKUP(E150,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E150,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E150,Weightings!T:Y,6,FALSE)))","v":""},""]
[405,"2.3.10a",6,null,"2.3.10a","Identifying immediate actions to be performed (eg based on high risk assets, time dependant issues, business / commercial decisions)?",null,{"$f":"IF(ISERROR(VLOOKUP(E151,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E151,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E151,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA151,detail_maturity_score,3,FALSE)","v":""}]
[406,"2.3.10b",6,null,"2.3.10b","Ensuring that actions can be performed safely (eg by avoiding actions that can hamper response strategies, such as ‘seize and replace’)?",null,{"$f":"IF(ISERROR(VLOOKUP(E152,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E152,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E152,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[407,"2.3.10c",6,null,"2.3.10c","Minimising the risk that an attacker will respond/escalate?",null,{"$f":"IF(ISERROR(VLOOKUP(E153,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E153,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E153,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[408,"2.3.10d",6,null,"2.3.10d","Determining whether findings identified during the investigation are critical?",null,{"$f":"IF(ISERROR(VLOOKUP(E154,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E154,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E154,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[409,"2.3.10e",6,null,"2.3.10e","Reacting to critical findings during the investigation?",null,{"$f":"IF(ISERROR(VLOOKUP(E155,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E155,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E155,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[410,"2.3.10f",6,null,"2.3.10f","Duration of the solution (eg emergency workaround to be removed in four hours, temporary workaround to be removed in two weeks, permanent solution)?",null,{"$f":"IF(ISERROR(VLOOKUP(E156,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E156,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E156,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[411,"2.3.11",4,null,"2.3.11","Does your approach to containing cyber security incidents include analysing:",null,{"$f":"IF(ISERROR(VLOOKUP(E157,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E157,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E157,Weightings!T:Y,6,FALSE)))","v":""},""]
[412,"2.3.11a",6,null,"2.3.11a","Events in relation to the ‘attacker kill chain’ (ie reconnaissance, weaponize, deliver, exploit, install, command & control and act on objectives)?",null,{"$f":"IF(ISERROR(VLOOKUP(E158,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E158,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E158,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA158,detail_maturity_score,3,FALSE)","v":""}]
[413,"2.3.11b",6,null,"2.3.11b","Both the attacker and defender aspects of an attack?",null,{"$f":"IF(ISERROR(VLOOKUP(E159,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E159,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E159,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA159,detail_maturity_score,3,FALSE)","v":""}]
[414,"",3,null,"","Eradication",null,{"$f":"IF(ISERROR(VLOOKUP(E160,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E160,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E160,Weightings!T:Y,6,FALSE)))","v":""},""]
[415,"2.3.12",5,null,"2.3.12","Do you take steps to eliminate the cause of the cyber security incident (eradication)?",null,{"$f":"IF(ISERROR(VLOOKUP(E161,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E161,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E161,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA161,detail_maturity_score,3,FALSE)","v":""}]
[416,"2.3.13",4,null,"2.3.13","Does eradication include (where necessary):",null,{"$f":"IF(ISERROR(VLOOKUP(E162,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E162,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E162,Weightings!T:Y,6,FALSE)))","v":""},""]
[417,"2.3.13a",6,null,"2.3.13a","Removing the attack from the network?",null,{"$f":"IF(ISERROR(VLOOKUP(E163,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E163,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E163,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA163,detail_maturity_score,3,FALSE)","v":""}]
[418,"2.3.13b",6,null,"2.3.13b","Deleting malware?",null,{"$f":"IF(ISERROR(VLOOKUP(E164,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E164,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E164,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA164,detail_maturity_score,3,FALSE)","v":""}]
[419,"2.3.13c",6,null,"2.3.13c","Disabling breached user accounts?",null,{"$f":"IF(ISERROR(VLOOKUP(E165,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E165,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E165,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA165,detail_maturity_score,3,FALSE)","v":""}]
[420,"2.3.13d",6,null,"2.3.13d","Identifying vulnerabilities that were exploited?",null,{"$f":"IF(ISERROR(VLOOKUP(E166,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E166,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E166,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA166,detail_maturity_score,3,FALSE)","v":""}]
[421,"2.3.13e",6,null,"2.3.13e","Mitigating vulnerabilities that were exploited?",null,{"$f":"IF(ISERROR(VLOOKUP(E167,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E167,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E167,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA167,detail_maturity_score,3,FALSE)","v":""}]
[422,"2.3.14",4,null,"2.3.14","Does the eradication process include:",null,{"$f":"IF(ISERROR(VLOOKUP(E168,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E168,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E168,Weightings!T:Y,6,FALSE)))","v":""},""]
[423,"2.3.14a",6,null,"2.3.14a","Identifying all affected hosts within your organisation, so that they can be remediated?",null,{"$f":"IF(ISERROR(VLOOKUP(E169,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E169,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E169,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA169,detail_maturity_score,3,FALSE)","v":""}]
[424,"2.3.14b",6,null,"2.3.14b","Identifying all affected hosts beyond your organisation, so that they can be remediated?",null,{"$f":"IF(ISERROR(VLOOKUP(E170,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E170,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E170,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[425,"2.3.14c",6,null,"2.3.14c","Carrying out malware analysis?",null,{"$f":"IF(ISERROR(VLOOKUP(E171,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E171,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E171,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[426,"2.3.14d",6,null,"2.3.14d","Checking for any response from the attacker to your actions?",null,{"$f":"IF(ISERROR(VLOOKUP(E172,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E172,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E172,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[427,"2.3.14e",6,null,"2.3.14e","Developing a response (preferably in advance) if the attacker uses a different method of attack?",null,{"$f":"IF(ISERROR(VLOOKUP(E173,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E173,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E173,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[428,"2.3.14f",6,null,"2.3.14f","Allowing sufficient time to ensure that the network is secure and that there is no response from the attacker?",null,{"$f":"IF(ISERROR(VLOOKUP(E174,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E174,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E174,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[429,"2.3.15",5,null,"2.3.15","Do you produce an eradication plan?",null,{"$f":"IF(ISERROR(VLOOKUP(E175,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E175,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E175,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[430,"2.3.16",5,null,"2.3.16","Is the eradication plan executed with speed and precision?",null,{"$f":"IF(ISERROR(VLOOKUP(E176,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E176,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E176,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[431,"2.3.17",4,null,"2.3.17","Does the eradication plan enable actions to be taken to prevent attackers:",null,{"$f":"IF(ISERROR(VLOOKUP(E177,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E177,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E177,Weightings!T:Y,6,FALSE)))","v":""},""]
[432,"2.3.17a",6,null,"2.3.17a","Sensing they have been discovered once eradication is underway?",null,{"$f":"IF(ISERROR(VLOOKUP(E178,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E178,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E178,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA178,detail_maturity_score,3,FALSE)","v":""}]
[433,"2.3.17b",6,null,"2.3.17b","Re-establishing a base and entrenching themselves into the network again?",null,{"$f":"IF(ISERROR(VLOOKUP(E179,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E179,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E179,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA179,detail_maturity_score,3,FALSE)","v":""}]
[434,"2.3.17c",6,null,"2.3.17c","Continuing the attack during eradication?",null,{"$f":"IF(ISERROR(VLOOKUP(E180,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E180,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E180,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA180,detail_maturity_score,3,FALSE)","v":""}]
[435,"2.3.17d",6,null,"2.3.17d","Avoiding identification during eradication?",null,{"$f":"IF(ISERROR(VLOOKUP(E181,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E181,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E181,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA181,detail_maturity_score,3,FALSE)","v":""}]
[436,"",3,null,"","Evidence",null,{"$f":"IF(ISERROR(VLOOKUP(E182,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E182,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E182,Weightings!T:Y,6,FALSE)))","v":""},""]
[437,"2.3.18",5,null,"2.3.18","Do you take steps to preserve evidence when dealing with the cyber security?",null,{"$f":"IF(ISERROR(VLOOKUP(E183,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E183,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E183,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA183,detail_maturity_score,3,FALSE)","v":""}]
[438,"2.3.19",5,null,"2.3.19","Do you have a formal process for handling evidence when dealing with the cyber security?",null,{"$f":"IF(ISERROR(VLOOKUP(E184,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E184,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E184,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA184,detail_maturity_score,3,FALSE)","v":""}]
[439,"2.3.20",4,null,"2.3.20","Does your process for handling evidence include:",null,{"$f":"IF(ISERROR(VLOOKUP(E185,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E185,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E185,Weightings!T:Y,6,FALSE)))","v":""},""]
[440,"2.3.20a",6,null,"2.3.20a","Allowing for admissibility of evidence (whether or not the evidence can be used in court)?",null,{"$f":"IF(ISERROR(VLOOKUP(E186,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E186,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E186,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA186,detail_maturity_score,3,FALSE)","v":""}]
[441,"2.3.20b",6,null,"2.3.20b","Allowing for weight of evidence (the quality and completeness of evidence)?",null,{"$f":"IF(ISERROR(VLOOKUP(E187,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E187,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E187,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA187,detail_maturity_score,3,FALSE)","v":""}]
[442,"2.3.20c",6,null,"2.3.20c","Adherence to an approved set of guidelines, such as the Association of Chief Police Officers (ACPO) Guidelines on Computer Evidence (ACPO)?",null,{"$f":"IF(ISERROR(VLOOKUP(E188,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E188,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E188,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA188,detail_maturity_score,3,FALSE)","v":""}]
[443,"2.3.20d",6,null,"2.3.20d","Complying with relevant laws?",null,{"$f":"IF(ISERROR(VLOOKUP(E189,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E189,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E189,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA189,detail_maturity_score,3,FALSE)","v":""}]
[444,"2.3.21",4,null,"2.3.21","Does your process for handling evidence explicitly include complying with the:",null,{"$f":"IF(ISERROR(VLOOKUP(E190,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E190,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E190,Weightings!T:Y,6,FALSE)))","v":""},""]
[445,"2.3.21a",6,null,"2.3.21a","Police and Criminal evidence act 1984 (PACE)?",null,{"$f":"IF(ISERROR(VLOOKUP(E191,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E191,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E191,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA191,detail_maturity_score,3,FALSE)","v":""}]
[446,"2.3.21b",6,null,"2.3.21b","Data Protection Act 1988?",null,{"$f":"IF(ISERROR(VLOOKUP(E192,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E192,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E192,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA192,detail_maturity_score,3,FALSE)","v":""}]
[447,"2.3.21c",6,null,"2.3.21c","Computer Misuse Act 1990?",null,{"$f":"IF(ISERROR(VLOOKUP(E193,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E193,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E193,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA193,detail_maturity_score,3,FALSE)","v":""}]
[448,"2.3.21d",6,null,"2.3.21d","Regulation of Investigatory Powers 2000 (RIPA)?",null,{"$f":"IF(ISERROR(VLOOKUP(E194,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E194,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E194,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA194,detail_maturity_score,3,FALSE)","v":""}]
[449,"2.3.22",4,null,"2.3.22","When handling evidence do you maintain a chain of evidence for:",null,{"$f":"IF(ISERROR(VLOOKUP(E195,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E195,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E195,Weightings!T:Y,6,FALSE)))","v":""},""]
[450,"2.3.22a",6,null,"2.3.22a","Paper-based information?",null,{"$f":"IF(ISERROR(VLOOKUP(E196,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E196,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E196,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA196,detail_maturity_score,3,FALSE)","v":""}]
[451,"2.3.22b",6,null,"2.3.22b","Electronic information?",null,{"$f":"IF(ISERROR(VLOOKUP(E197,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E197,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E197,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA197,detail_maturity_score,3,FALSE)","v":""}]
[452,"2.3.23",5,null,"2.3.23","Do you keep a detailed written log of every action taken during the investigation?",null,{"$f":"IF(ISERROR(VLOOKUP(E198,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E198,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E198,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA198,detail_maturity_score,3,FALSE)","v":""}]
[453,"2.3.24",4,null,"2.3.24","Does this action log include:",null,{"$f":"IF(ISERROR(VLOOKUP(E199,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E199,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E199,Weightings!T:Y,6,FALSE)))","v":""},""]
[454,{"$f":"VLOOKUP(A200,contentref,2,FALSE)","v":"2.3.24a"},{"$f":"VLOOKUP(A200,contentref,15,FALSE)","v":6},null,{"$f":"IF(C200=1,\"Phase \"&B200,IF(C200=2,\"Step \"&VLOOKUP(A200,contentref,4,FALSE),B200))","v":"2.3.24a"},{"$f":"VLOOKUP(A200,contentref,7,FALSE)","v":"Identifying information (eg the location, serial number, model number, hostname, media access control (MAC) addresses, and IP addresses of a computer)?"},null,{"$f":"IF(ISERROR(VLOOKUP(E200,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E200,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E200,Weightings!T:Y,6,FALSE)))","v":"x 4"},{"$f":"IF(ISERROR(VLOOKUP(AA200,detail_maturity_score,3,FALSE)*VLOOKUP(H200,weighting_scores,2,FALSE)),\"\",VLOOKUP(AA200,detail_maturity_score,3,FALSE)*VLOOKUP(H200,weighting_scores,2,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA200,detail_maturity_score,3,FALSE)","v":""}]
[455,"2.3.24b",6,null,"2.3.24b","Showing who did what, where, when, how and to what?",null,{"$f":"IF(ISERROR(VLOOKUP(E201,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E201,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E201,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[456,"2.3.24c",6,null,"2.3.24c","Identifying where, when and how certain actions were taken by the perpetrators, such as command and control; exfiltration?",null,{"$f":"IF(ISERROR(VLOOKUP(E202,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E202,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E202,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[457,"2.3.24d",6,null,"2.3.24d","Name, title, and phone number of each individual who collected or handled the evidence during the investigation?",null,{"$f":"IF(ISERROR(VLOOKUP(E203,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E203,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E203,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[458,"2.3.24e",6,null,"2.3.24e","Time and date (including time zone) of each occurrence of evidence handling?",null,{"$f":"IF(ISERROR(VLOOKUP(E204,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E204,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E204,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[459,"2.3.24f",6,null,"2.3.24f","Locations where the evidence was stored?",null,{"$f":"IF(ISERROR(VLOOKUP(E205,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E205,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E205,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[460,"2.3.25",4,null,"2.3.25","Does the content of the action log enable:",null,{"$f":"IF(ISERROR(VLOOKUP(E206,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E206,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E206,Weightings!T:Y,6,FALSE)))","v":""},""]
[461,"2.3.25a",6,null,"2.3.25a","Clear and precise evidence to be referred to at a later date?",null,{"$f":"IF(ISERROR(VLOOKUP(E207,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E207,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E207,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA207,detail_maturity_score,3,FALSE)","v":""}]
[462,"2.3.25b",6,null,"2.3.25b","The sequence of events and actions taken to be repeated by opposition experts, if required?",null,{"$f":"IF(ISERROR(VLOOKUP(E208,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E208,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E208,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA208,detail_maturity_score,3,FALSE)","v":""}]
[463,"2.3.26",4,null,"2.3.26","When gathering data for a potential prosecution, do you ensure that:",null,{"$f":"IF(ISERROR(VLOOKUP(E209,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E209,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E209,Weightings!T:Y,6,FALSE)))","v":""},""]
[464,"2.3.26a",6,null,"2.3.26a","Any systems under investigation are not turned off until an expert decision on the risk of doing so has been made?",null,{"$f":"IF(ISERROR(VLOOKUP(E210,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E210,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E210,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA210,detail_maturity_score,3,FALSE)","v":""}]
[465,"2.3.26b",6,null,"2.3.26b","Analysis is not performed on a live system under investigation before a forensically safe image has been taken?",null,{"$f":"IF(ISERROR(VLOOKUP(E211,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E211,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E211,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA211,detail_maturity_score,3,FALSE)","v":""}]
[466,"2.3.27",4,null,"2.3.27","When supporting forensic work, do you ensure that:",null,{"$f":"IF(ISERROR(VLOOKUP(E212,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E212,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E212,Weightings!T:Y,6,FALSE)))","v":""},""]
[467,"2.3.27a",6,null,"2.3.27a","Forensic work is only being performed on copies of the evidential material (eg using imaging technology)?",null,{"$f":"IF(ISERROR(VLOOKUP(E213,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E213,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E213,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA213,detail_maturity_score,3,FALSE)","v":""}]
[468,"2.3.27b",6,null,"2.3.27b","The integrity of all evidential material is protected?",null,{"$f":"IF(ISERROR(VLOOKUP(E214,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E214,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E214,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA214,detail_maturity_score,3,FALSE)","v":""}]
[469,"2.4",2,null,"Step 4","Recovery",null,{"$f":"IF(ISERROR(VLOOKUP(E215,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E215,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E215,Weightings!T:Y,6,FALSE)))","v":""},""]
[470,"",3,null,"","Objectives",null,{"$f":"IF(ISERROR(VLOOKUP(E216,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E216,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E216,Weightings!T:Y,6,FALSE)))","v":""},""]
[471,"2.4.01",5,null,"2.4.01","Do you take steps to recover from a cyber security incident quickly and effectively?",null,{"$f":"IF(ISERROR(VLOOKUP(E217,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E217,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E217,Weightings!T:Y,6,FALSE)))","v":"x 1"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA217,detail_maturity_score,3,FALSE)","v":""}]
[472,"2.4.02",4,null,"2.4.02","Do your objectives for recovering from a cyber security incident cover immediate business requirements, including:",null,{"$f":"IF(ISERROR(VLOOKUP(E218,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E218,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E218,Weightings!T:Y,6,FALSE)))","v":""},""]
[473,"2.4.02a",6,null,"2.4.02a","Restoring systems to normal operation as soon as possible?",null,{"$f":"IF(ISERROR(VLOOKUP(E219,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E219,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E219,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA219,detail_maturity_score,3,FALSE)","v":""}]
[474,"2.4.02b",6,null,"2.4.02b","Confirming that the systems are functioning normally?",null,{"$f":"IF(ISERROR(VLOOKUP(E220,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E220,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E220,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[475,"2.4.02c",6,null,"2.4.02c","Restricting the amount of financial loss?",null,{"$f":"IF(ISERROR(VLOOKUP(E221,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E221,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E221,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[476,"2.4.02d",6,null,"2.4.02d","Protecting the reputation of your organisation?",null,{"$f":"IF(ISERROR(VLOOKUP(E222,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E222,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E222,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[477,"2.4.02e",6,null,"2.4.02e","Protecting confidential information?",null,{"$f":"IF(ISERROR(VLOOKUP(E223,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E223,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E223,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[478,"2.4.02f",6,null,"2.4.02f","Complying with legal and regulatory requirements (eg PCI / DSS, NERC, ISO 27001, HIPAA or FISMA)?",null,{"$f":"IF(ISERROR(VLOOKUP(E224,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E224,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E224,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[479,"2.4.02g",6,null,"2.4.02g","Limiting liabilities if things go wrong - or if there is a court case (ie take ‘reasonable’ precautions)?",null,{"$f":"IF(ISERROR(VLOOKUP(E225,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E225,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E225,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[480,"2.4.02h",6,null,"2.4.02h","Providing assurance to third parties that everything is under control?",null,{"$f":"IF(ISERROR(VLOOKUP(E226,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E226,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E226,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[481,"2.4.03",4,null,"2.4.03","Do your objectives for recovering from a cyber security incident cover wider implications for reducing the likelihood of future attacks, including:",null,{"$f":"IF(ISERROR(VLOOKUP(E227,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E227,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E227,Weightings!T:Y,6,FALSE)))","v":""},""]
[482,"2.4.03a",6,null,"2.4.03a","Remediating vulnerabilities to prevent similar incidents occurring?",null,{"$f":"IF(ISERROR(VLOOKUP(E228,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E228,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E228,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA228,detail_maturity_score,3,FALSE)","v":""}]
[483,"2.4.03b",6,null,"2.4.03b","Addressing similar weaknesses in your cyber security controls enterprise-wide and beyond?",null,{"$f":"IF(ISERROR(VLOOKUP(E229,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E229,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E229,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[484,"2.4.03c",6,null,"2.4.03c","Reducing the frequency and impact of future security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E230,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E230,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E230,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[485,"2.4.03d",6,null,"2.4.03d","Proactively responding to the attack (eg by closing channels or 'attacking the attacker')?",null,{"$f":"IF(ISERROR(VLOOKUP(E231,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E231,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E231,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[486,"2.4.03e",6,null,"2.4.03e","Closing down any criminal operation?",null,{"$f":"IF(ISERROR(VLOOKUP(E232,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E232,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E232,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[487,"2.4.03f",6,null,"2.4.03f","Punishing offenders (eg prosecuting criminals, exposing national saboteurs and disciplining insiders?",null,{"$f":"IF(ISERROR(VLOOKUP(E233,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E233,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E233,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[488,"",3,null,"","Recovery Plan",null,{"$f":"IF(ISERROR(VLOOKUP(E234,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E234,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E234,Weightings!T:Y,6,FALSE)))","v":""},""]
[489,"2.4.04",5,null,"2.4.04","Do you have a formal recovery plan for recovering from a cyber security incident?",null,{"$f":"IF(ISERROR(VLOOKUP(E235,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E235,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E235,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA235,detail_maturity_score,3,FALSE)","v":""}]
[490,"2.4.05",4,null,"2.4.05","Does your recovery plan enable you to recover from a cyber security incident:",null,{"$f":"IF(ISERROR(VLOOKUP(E236,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E236,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E236,Weightings!T:Y,6,FALSE)))","v":""},""]
[491,"2.4.05a",6,null,"2.4.05a","Quickly (ie within critical timescales)?",null,{"$f":"IF(ISERROR(VLOOKUP(E237,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E237,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E237,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA237,detail_maturity_score,3,FALSE)","v":""}]
[492,"2.4.05b",6,null,"2.4.05b","Effectively (ensuring that all services have been restored to working order)?",null,{"$f":"IF(ISERROR(VLOOKUP(E238,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E238,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E238,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA238,detail_maturity_score,3,FALSE)","v":""}]
[493,"2.4.05c",6,null,"2.4.05c","In a consistent manner?",null,{"$f":"IF(ISERROR(VLOOKUP(E239,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E239,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E239,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA239,detail_maturity_score,3,FALSE)","v":""}]
[494,"2.4.06",4,null,"2.4.06","Does your recovery plan cover basic recovery techniques including:",null,{"$f":"IF(ISERROR(VLOOKUP(E240,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E240,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E240,Weightings!T:Y,6,FALSE)))","v":""},""]
[495,"2.4.06a",6,null,"2.4.06a","Rebuilding infected systems (often from known ‘clean’ sources)",null,{"$f":"IF(ISERROR(VLOOKUP(E241,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E241,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E241,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA241,detail_maturity_score,3,FALSE)","v":""}]
[496,"2.4.06b",6,null,"2.4.06b","Reconnecting networks",null,{"$f":"IF(ISERROR(VLOOKUP(E242,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E242,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E242,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA242,detail_maturity_score,3,FALSE)","v":""}]
[497,"2.4.06c",6,null,"2.4.06c","Restoring, recreating or correcting information?",null,{"$f":"IF(ISERROR(VLOOKUP(E243,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E243,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E243,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA243,detail_maturity_score,3,FALSE)","v":""}]
[498,"2.4.06d",6,null,"2.4.06d","Documenting changes made to the infrastructure?",null,{"$f":"IF(ISERROR(VLOOKUP(E244,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E244,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E244,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA244,detail_maturity_score,3,FALSE)","v":""}]
[499,"2.4.06e",6,null,"2.4.06e","Dealing with parts of your systems or networks that cannot be recovered?",null,{"$f":"IF(ISERROR(VLOOKUP(E245,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E245,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E245,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA245,detail_maturity_score,3,FALSE)","v":""}]
[500,"2.4.07",4,null,"2.4.07","Does your recovery plan cover additional recovery techniques including:",null,{"$f":"IF(ISERROR(VLOOKUP(E246,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E246,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E246,Weightings!T:Y,6,FALSE)))","v":""},""]
[501,"2.4.07a",6,null,"2.4.07a","Replacing compromised files with clean versions?",null,{"$f":"IF(ISERROR(VLOOKUP(E247,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E247,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E247,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA247,detail_maturity_score,3,FALSE)","v":""}]
[502,"2.4.07b",6,null,"2.4.07b","Removing temporary constraints imposed during the containment period?",null,{"$f":"IF(ISERROR(VLOOKUP(E248,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E248,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E248,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[503,"2.4.07c",6,null,"2.4.07c","Resetting passwords on compromised accounts?",null,{"$f":"IF(ISERROR(VLOOKUP(E249,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E249,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E249,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[504,"2.4.07d",6,null,"2.4.07d","Installing patches, changing passwords and tightening network perimeter security, such as firewall rulesets?",null,{"$f":"IF(ISERROR(VLOOKUP(E250,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E250,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E250,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[505,"2.4.07e",6,null,"2.4.07e","Testing systems thoroughly – including security controls?",null,{"$f":"IF(ISERROR(VLOOKUP(E251,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E251,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E251,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[506,"2.4.07f",6,null,"2.4.07f","Confirming the integrity of business systems and controls?",null,{"$f":"IF(ISERROR(VLOOKUP(E252,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E252,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E252,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[507,"2.4.07g",6,null,"2.4.07g","Announcing the resumption of business services to all relevant stakeholders?",null,{"$f":"IF(ISERROR(VLOOKUP(E253,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E253,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E253,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[508,"2.4.08",4,null,"2.4.08","Is your recovery plan:",null,{"$f":"IF(ISERROR(VLOOKUP(E254,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E254,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E254,Weightings!T:Y,6,FALSE)))","v":""},""]
[509,"2.4.08a",6,null,"2.4.08a","Linked to the nature of the attack",null,{"$f":"IF(ISERROR(VLOOKUP(E255,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E255,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E255,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA255,detail_maturity_score,3,FALSE)","v":""}]
[510,"2.4.08b",6,null,"2.4.08b","Based on a risk-based approach to recovery?",null,{"$f":"IF(ISERROR(VLOOKUP(E256,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E256,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E256,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA256,detail_maturity_score,3,FALSE)","v":""}]
[511,"2.4.08c",6,null,"2.4.08c","Designed to prevent exacerbating current risks caused by the incident or introducing new risks?",null,{"$f":"IF(ISERROR(VLOOKUP(E257,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E257,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E257,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA257,detail_maturity_score,3,FALSE)","v":""}]
[512,"",3,null,"","Validation",null,{"$f":"IF(ISERROR(VLOOKUP(E258,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E258,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E258,Weightings!T:Y,6,FALSE)))","v":""},""]
[513,"2.4.09",4,null,"2.4.09","Do you validate that systems are operating normally again by:",null,{"$f":"IF(ISERROR(VLOOKUP(E259,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E259,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E259,Weightings!T:Y,6,FALSE)))","v":""},""]
[514,"2.4.09a",6,null,"2.4.09a","Carrying out an independent penetration test of the affected systems?",null,{"$f":"IF(ISERROR(VLOOKUP(E260,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E260,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E260,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA260,detail_maturity_score,3,FALSE)","v":""}]
[515,"2.4.09b",6,null,"2.4.09b","Undertaking a security controls assessment?",null,{"$f":"IF(ISERROR(VLOOKUP(E261,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E261,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E261,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA261,detail_maturity_score,3,FALSE)","v":""}]
[516,"2.4.10",4,null,"2.4.10","To help detect further attacks (or attempted attacks) do you:",null,{"$f":"IF(ISERROR(VLOOKUP(E262,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E262,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E262,Weightings!T:Y,6,FALSE)))","v":""},""]
[517,"2.4.10a",6,null,"2.4.10a","Retain cyber security threat intelligence (including network situational awareness)?",null,{"$f":"IF(ISERROR(VLOOKUP(E263,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E263,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E263,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA263,detail_maturity_score,3,FALSE)","v":""}]
[518,{"$f":"VLOOKUP(A264,contentref,2,FALSE)","v":"2.4.10b"},6,null,"2.4.10b","Monitor the network over an extended time?",null,{"$f":"IF(ISERROR(VLOOKUP(E264,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E264,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E264,Weightings!T:Y,6,FALSE)))","v":"x 5"},{"$f":"IF(ISERROR(VLOOKUP(AA264,detail_maturity_score,3,FALSE)*VLOOKUP(H264,weighting_scores,2,FALSE)),\"\",VLOOKUP(AA264,detail_maturity_score,3,FALSE)*VLOOKUP(H264,weighting_scores,2,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA264,detail_maturity_score,3,FALSE)","v":""}]
[519,"2.4.11",4,null,"2.4.11","Once systems have been recovered and controls have been tested do you:",null,{"$f":"IF(ISERROR(VLOOKUP(E265,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E265,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E265,Weightings!T:Y,6,FALSE)))","v":""},""]
[520,"2.4.11a",6,null,"2.4.11a","Provided stakeholders with a brief summary of what took place?",null,{"$f":"IF(ISERROR(VLOOKUP(E266,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E266,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E266,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA266,detail_maturity_score,3,FALSE)","v":""}]
[521,"2.4.11b",6,null,"2.4.11b","Brief stakeholders within a day or so of the event?",null,{"$f":"IF(ISERROR(VLOOKUP(E267,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E267,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E267,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA267,detail_maturity_score,3,FALSE)","v":""}]

{"sheet":"Assessment - Phase 3","index":9,"n_rows":130,"n_cols":28,"rows_kept":130,"cut":false,"hidden":false,"merged":[[1,5,4,5]]}
[]
[null,null,null,null,null,"Maturity model for Phase 3 - Follow Up"]
[]
[]
[]
[]
[null,null,null,null,null,null,"Response","Weighting","Weighted score","Evidence supplied","Comments"]
[523,{"$f":"VLOOKUP(A8,contentref,2,FALSE)","v":"3.1"},{"$f":"VLOOKUP(A8,contentref,15,FALSE)","v":2},null,{"$f":"IF(C8=1,\"Phase \"&B8,IF(C8=2,\"Step \"&VLOOKUP(A8,contentref,4,FALSE),B8))","v":"Step 1"},{"$f":"VLOOKUP(A8,contentref,7,FALSE)","v":"Incident investigation"},null,{"$f":"IF(ISERROR(VLOOKUP(E8,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E8,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E8,Weightings!T:Y,6,FALSE)))","v":""},{"$f":"IF(ISERROR(VLOOKUP(AA8,detail_maturity_score,3,FALSE)*VLOOKUP(H8,weighting_scores,2,FALSE)),\"\",VLOOKUP(AA8,detail_maturity_score,3,FALSE)*VLOOKUP(H8,weighting_scores,2,FALSE))","v":""}]
[524,"3.1.01",5,null,"3.1.01","Do you investigate cyber security incidents more thoroughly after they have been resolved?",null,{"$f":"IF(ISERROR(VLOOKUP(E9,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E9,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E9,Weightings!T:Y,6,FALSE)))","v":"x 1"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA9,detail_maturity_score,3,FALSE)","v":""}]
[525,"3.1.02",5,null,"3.1.02","Is your investigation carried out in a structured, systematic manner?",null,{"$f":"IF(ISERROR(VLOOKUP(E10,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E10,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E10,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[526,"3.1.03",5,null,"3.1.03","Do you perform problem cause analysis for cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E11,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E11,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E11,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[527,"3.1.04",5,null,"3.1.04","Does your problem cause analysis include using appropriate investigative techniques, such as:",null,{"$f":"IF(ISERROR(VLOOKUP(E12,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E12,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E12,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[528,"3.1.05",5,null,"3.1.05","Do you carry out root cause identification for cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E13,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E13,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E13,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[529,"3.1.06",5,null,"3.1.06","Does your root cause identification include using appropriate investigative techniques, such as:",null,{"$f":"IF(ISERROR(VLOOKUP(E14,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E14,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E14,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[530,"3.1.07",5,null,"3.1.07","Does your root cause identification help to identify previously unknown sources of cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E15,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E15,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E15,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[531,"3.1.08",5,null,"3.1.08","Do you quantify the business impact of cyber security incidents (eg in terms of financial, reputational, management or compliance impact)?",null,{"$f":"IF(ISERROR(VLOOKUP(E16,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E16,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E16,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[532,"3.1.09",5,null,"3.1.09","Do you carry out sufficient investigation to identify the perpetrators(s) of the cyber security incident, which may involve specialist support, such as from forensic investigators?",null,{"$f":"IF(ISERROR(VLOOKUP(E17,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E17,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E17,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[533,"3.1.10",5,null,"3.1.10","Does your investigation cover events in relation to the ‘attacker kill chain’ (ie reconnaissance, weaponize, deliver, exploit, install, command & control and act on objectives)?",null,{"$f":"IF(ISERROR(VLOOKUP(E18,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E18,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E18,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[534,"3.1.11",5,null,"3.1.11","Does your investigation link to wider problem management activities, such as those used in service management (eg ITIL approach)?",null,{"$f":"IF(ISERROR(VLOOKUP(E19,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E19,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E19,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[535,"3.2",2,null,"Step 2","Reporting",null,{"$f":"IF(ISERROR(VLOOKUP(E20,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E20,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E20,Weightings!T:Y,6,FALSE)))","v":""},""]
[536,"3.2.01",5,null,"3.2.01","Are cyber security incidents reported to relevant internal stakeholders (eg information security, corporate IT departments and business units)?",null,{"$f":"IF(ISERROR(VLOOKUP(E21,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E21,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E21,Weightings!T:Y,6,FALSE)))","v":"x 1"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA21,detail_maturity_score,3,FALSE)","v":""}]
[537,"3.2.02",4,null,"3.2.02","Are you aware of:",null,{"$f":"IF(ISERROR(VLOOKUP(E22,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E22,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E22,Weightings!T:Y,6,FALSE)))","v":""},""]
[538,"3.2.02a",6,null,"3.2.02a","Your regulatory and legal reporting requirements (eg mandatory reporting to particular authorities)?",null,{"$f":"IF(ISERROR(VLOOKUP(E23,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E23,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E23,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA23,detail_maturity_score,3,FALSE)","v":""}]
[539,"3.2.02b",6,null,"3.2.02b","What types of cyber security incident need to be reported?",null,{"$f":"IF(ISERROR(VLOOKUP(E24,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E24,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E24,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[540,"3.2.02c",6,null,"3.2.02c","To which external body each type of cyber security incidents need to be reported?",null,{"$f":"IF(ISERROR(VLOOKUP(E25,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E25,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E25,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[541,"3.2.02d",6,null,"3.2.02d","The format in which cyber security incidents need to be reported?",null,{"$f":"IF(ISERROR(VLOOKUP(E26,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E26,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E26,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[542,"3.2.02e",6,null,"3.2.02e","The objectives of reporting cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E27,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E27,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E27,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[543,"3.2.03",5,null,"3.2.03","Do you report targeted cyber security incidents, to required authorities, such as GovCertUK (the Government’s Computer Emergency Response Team)?",null,{"$f":"IF(ISERROR(VLOOKUP(E28,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E28,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E28,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[544,"3.2.04",5,null,"3.2.04","Do you notify required authorities, such as GovCertUK (the Government’s Computer Emergency Response Team) of any other (non-targeted) cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E29,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E29,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E29,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[545,"3.2.05",4,null,"3.2.05","When reporting cyber security incidents, do you provide:",null,{"$f":"IF(ISERROR(VLOOKUP(E30,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E30,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E30,Weightings!T:Y,6,FALSE)))","v":""},""]
[546,"3.2.05a",6,null,"3.2.05a","A full description of the nature of the incident, its history, and what actions were taken to recover?",null,{"$f":"IF(ISERROR(VLOOKUP(E31,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E31,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E31,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA31,detail_maturity_score,3,FALSE)","v":""}]
[547,"3.2.05b",6,null,"3.2.05b","A realistic estimate of the financial cost of the incident, as well as other impacts on the business, such as in terms of damage to reputation, loss of management control or impaired growth?",null,{"$f":"IF(ISERROR(VLOOKUP(E32,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E32,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E32,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA32,detail_maturity_score,3,FALSE)","v":""}]
[548,"3.2.05c",6,null,"3.2.05c","Recommendations regarding enhanced or additional controls required to prevent, detect, remediate or recover from cyber security incidents more effectively?",null,{"$f":"IF(ISERROR(VLOOKUP(E33,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E33,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E33,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA33,detail_maturity_score,3,FALSE)","v":""}]
[549,"3.2.06",5,null,"3.2.06","Do you voluntarily report cyber security incidents to important stakeholders, such as law enforcement agencies, specialised bodies (eg NIST, ENISA or CREST), regulatory bodies with particular market sectors (eg the FSA or Bank of England in Finance) or collaborative groups?",null,{"$f":"IF(ISERROR(VLOOKUP(E34,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E34,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E34,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA34,detail_maturity_score,3,FALSE)","v":""}]
[550,"3.2.07",5,null,"3.2.07","Do you provide recommendations to external bodies regarding enhanced or additional controls required to prevent, detect, remediate or recover from cyber security incidents more effectively?",null,{"$f":"IF(ISERROR(VLOOKUP(E35,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E35,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E35,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA35,detail_maturity_score,3,FALSE)","v":""}]
[551,"3.3",2,null,"Step 3","Post incident review",null,{"$f":"IF(ISERROR(VLOOKUP(E36,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E36,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E36,Weightings!T:Y,6,FALSE)))","v":""},""]
[552,"3.3.01",5,null,"3.3.01","Do you carry out post incident reviews for particular cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E37,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E37,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E37,Weightings!T:Y,6,FALSE)))","v":"x 1"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA37,detail_maturity_score,3,FALSE)","v":""}]
[553,"3.3.02",5,null,"3.3.02","Is your post incident review process formalised (eg documented and approved)?",null,{"$f":"IF(ISERROR(VLOOKUP(E38,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E38,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E38,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA38,detail_maturity_score,3,FALSE)","v":""}]
[554,"3.3.03",4,null,"3.3.03","Do your post incident reviews include analysing the incident management process to determine:",null,{"$f":"IF(ISERROR(VLOOKUP(E39,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E39,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E39,Weightings!T:Y,6,FALSE)))","v":""},""]
[555,{"$f":"VLOOKUP(A40,contentref,2,FALSE)","v":"3.3.03a"},{"$f":"VLOOKUP(A40,contentref,15,FALSE)","v":6},null,{"$f":"IF(C40=1,\"Phase \"&B40,IF(C40=2,\"Step \"&VLOOKUP(A40,contentref,4,FALSE),B40))","v":"3.3.03a"},{"$f":"VLOOKUP(A40,contentref,7,FALSE)","v":"How quickly actions were taken to identify, respond to and recover from the incident?"},null,{"$f":"IF(ISERROR(VLOOKUP(E40,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E40,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E40,Weightings!T:Y,6,FALSE)))","v":"x 3"},{"$f":"IF(ISERROR(VLOOKUP(AA40,detail_maturity_score,3,FALSE)*VLOOKUP(H40,weighting_scores,2,FALSE)),\"\",VLOOKUP(AA40,detail_maturity_score,3,FALSE)*VLOOKUP(H40,weighting_scores,2,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA40,detail_maturity_score,3,FALSE)","v":""}]
[556,"3.3.03b",6,null,"3.3.03b","How long attackers were in systems before detection?",null,{"$f":"IF(ISERROR(VLOOKUP(E41,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E41,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E41,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[557,"3.3.03c",6,null,"3.3.03c","What actions attackers took and planned to take",null,{"$f":"IF(ISERROR(VLOOKUP(E42,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E42,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E42,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[558,"3.3.03d",6,null,"3.3.03d","The level of protection maintained over critical systems and confidential information during the incident?",null,{"$f":"IF(ISERROR(VLOOKUP(E43,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E43,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E43,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[559,"3.3.03e",6,null,"3.3.03e","How well staff and management performed in dealing with the incident?",null,{"$f":"IF(ISERROR(VLOOKUP(E44,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E44,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E44,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[560,"3.3.03f",6,null,"3.3.03f","If all key discussions and decisions conducted during the eradication event were well documented?",null,{"$f":"IF(ISERROR(VLOOKUP(E45,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E45,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E45,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[561,"3.3.03g",6,null,"3.3.03g","The effectiveness of procedures?",null,{"$f":"IF(ISERROR(VLOOKUP(E46,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E46,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E46,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[562,"3.3.03h",6,null,"3.3.03h","If any steps or actions taken might have inhibited the recovery?",null,{"$f":"IF(ISERROR(VLOOKUP(E47,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E47,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E47,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[563,"3.3.03i",6,null,"3.3.03i","If any unforeseen events could have been prevented?",null,{"$f":"IF(ISERROR(VLOOKUP(E48,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E48,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E48,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[564,"3.3.04",4,null,"3.3.04","Do your post incident reviews include informing possible future actions by evaluating:",null,{"$f":"IF(ISERROR(VLOOKUP(E49,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E49,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E49,Weightings!T:Y,6,FALSE)))","v":""},""]
[565,"3.3.04a",6,null,"3.3.04a","What the staff and management can do differently the next time a similar cyber security incident occurs?",null,{"$f":"IF(ISERROR(VLOOKUP(E50,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E50,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E50,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA50,detail_maturity_score,3,FALSE)","v":""}]
[566,"3.3.04b",6,null,"3.3.04b","How information sharing with other organisations can be improved?",null,{"$f":"IF(ISERROR(VLOOKUP(E51,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E51,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E51,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[567,"3.3.04c",6,null,"3.3.04c","What corrective actions can prevent similar incidents in the future?",null,{"$f":"IF(ISERROR(VLOOKUP(E52,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E52,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E52,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[568,"3.3.04d",6,null,"3.3.04d","Any precursors or indicators that should be watched for in the future to detect similar incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E53,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E53,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E53,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[569,"3.3.04e",6,null,"3.3.04e","How results can be fed back into your risk assessment methodology?",null,{"$f":"IF(ISERROR(VLOOKUP(E54,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E54,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E54,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[570,"3.3.05",5,null,"3.3.05","Is a report produced from your post incident review?",null,{"$f":"IF(ISERROR(VLOOKUP(E55,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E55,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E55,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[571,"3.3.06",5,null,"3.3.06","Are the results of your post implementation review report presented to all relevant stakeholders?",null,{"$f":"IF(ISERROR(VLOOKUP(E56,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E56,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E56,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[572,"3.3.07",5,null,"3.3.07","Is your post incident review process evaluated on a regular basis to identify any improvements that can be made to it)?",null,{"$f":"IF(ISERROR(VLOOKUP(E57,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E57,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E57,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[573,"3.4",2,null,"Step 4","Lessons learned",null,{"$f":"IF(ISERROR(VLOOKUP(E58,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E58,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E58,Weightings!T:Y,6,FALSE)))","v":""},""]
[574,"3.4.01",5,null,"3.4.01","Do you identify lessons learned from cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E59,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E59,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E59,Weightings!T:Y,6,FALSE)))","v":"x 1"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA59,detail_maturity_score,3,FALSE)","v":""}]
[575,"3.4.02",4,null,"3.4.02","Are lessons learned:",null,{"$f":"IF(ISERROR(VLOOKUP(E60,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E60,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E60,Weightings!T:Y,6,FALSE)))","v":""},""]
[576,"3.4.02a",6,null,"3.4.02a","Formally documented?",null,{"$f":"IF(ISERROR(VLOOKUP(E61,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E61,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E61,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA61,detail_maturity_score,3,FALSE)","v":""}]
[577,"3.4.02b",6,null,"3.4.02b","Communicated to relevant stakeholders?",null,{"$f":"IF(ISERROR(VLOOKUP(E62,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E62,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E62,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA62,detail_maturity_score,3,FALSE)","v":""}]
[578,"3.4.02c",6,null,"3.4.02c","Built upon in the form of tangible actions?",null,{"$f":"IF(ISERROR(VLOOKUP(E63,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E63,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E63,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA63,detail_maturity_score,3,FALSE)","v":""}]
[579,"3.4.02d",6,null,"3.4.02d","Used to share both key issues and good practice across all areas of the business, not just within IT and cyber security teams?",null,{"$f":"IF(ISERROR(VLOOKUP(E64,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E64,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E64,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA64,detail_maturity_score,3,FALSE)","v":""}]
[580,"3.4.03",4,null,"3.4.03","Is communication to stakeholders about lessons learned:",null,{"$f":"IF(ISERROR(VLOOKUP(E65,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E65,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E65,Weightings!T:Y,6,FALSE)))","v":""},""]
[581,"3.4.03a",6,null,"3.4.03a","Clear and concise?",null,{"$f":"IF(ISERROR(VLOOKUP(E66,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E66,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E66,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA66,detail_maturity_score,3,FALSE)","v":""}]
[582,"3.4.03b",6,null,"3.4.03b","Focused on problem resolution and control improvement?",null,{"$f":"IF(ISERROR(VLOOKUP(E67,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E67,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E67,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA67,detail_maturity_score,3,FALSE)","v":""}]
[583,"3.4.04",4,null,"3.4.04","Is communication to stakeholders about lessons learned used to:",null,{"$f":"IF(ISERROR(VLOOKUP(E68,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E68,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E68,Weightings!T:Y,6,FALSE)))","v":""},""]
[584,"3.4.04a",6,null,"3.4.04a","Help identify any gaps that remain and proposed efforts to mitigate them?",null,{"$f":"IF(ISERROR(VLOOKUP(E69,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E69,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E69,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA69,detail_maturity_score,3,FALSE)","v":""}]
[585,"3.4.04b",6,null,"3.4.04b","Inform strategic security goals?",null,{"$f":"IF(ISERROR(VLOOKUP(E70,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E70,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E70,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA70,detail_maturity_score,3,FALSE)","v":""}]
[586,"3.4.05",5,null,"3.4.05","Are formal actions plans developed to help build on lessons learned?",null,{"$f":"IF(ISERROR(VLOOKUP(E71,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E71,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E71,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA71,detail_maturity_score,3,FALSE)","v":""}]
[587,{"$f":"VLOOKUP(A72,contentref,2,FALSE)","v":"3.4.06"},{"$f":"VLOOKUP(A72,contentref,15,FALSE)","v":4},null,{"$f":"IF(C72=1,\"Phase \"&B72,IF(C72=2,\"Step \"&VLOOKUP(A72,contentref,4,FALSE),B72))","v":"3.4.06"},{"$f":"VLOOKUP(A72,contentref,7,FALSE)","v":"Do actions plans:"},null,{"$f":"IF(ISERROR(VLOOKUP(E72,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E72,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E72,Weightings!T:Y,6,FALSE)))","v":""},{"$f":"IF(ISERROR(VLOOKUP(AA72,detail_maturity_score,3,FALSE)*VLOOKUP(H72,weighting_scores,2,FALSE)),\"\",VLOOKUP(AA72,detail_maturity_score,3,FALSE)*VLOOKUP(H72,weighting_scores,2,FALSE))","v":""}]
[588,"3.4.06a",6,null,"3.4.06a","Consider whether technical capability gaps contributed to the attacker’s success or whether people or process gaps were the main culprit?",null,{"$f":"IF(ISERROR(VLOOKUP(E73,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E73,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E73,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA73,detail_maturity_score,3,FALSE)","v":""}]
[589,"3.4.06b",6,null,"3.4.06b","Leverage lessons learned from the incident to become more resilient in the face of future cyber security attacks?",null,{"$f":"IF(ISERROR(VLOOKUP(E74,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E74,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E74,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA74,detail_maturity_score,3,FALSE)","v":""}]
[590,"3.4.07",4,null,"3.4.07","Do actions plans include projects or initiatives, technical and nontechnical that will help:",null,{"$f":"IF(ISERROR(VLOOKUP(E75,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E75,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E75,Weightings!T:Y,6,FALSE)))","v":""},""]
[591,"3.4.07a",6,null,"3.4.07a","Reduce an attacker’s chance of success?",null,{"$f":"IF(ISERROR(VLOOKUP(E76,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E76,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E76,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA76,detail_maturity_score,3,FALSE)","v":""}]
[592,"3.4.07b",6,null,"3.4.07b","Respond to an attacker’s activities more rapidly and effectively?",null,{"$f":"IF(ISERROR(VLOOKUP(E77,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E77,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E77,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA77,detail_maturity_score,3,FALSE)","v":""}]
[593,"3.4.08",4,null,"3.4.08","Is each action:",null,{"$f":"IF(ISERROR(VLOOKUP(E78,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E78,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E78,Weightings!T:Y,6,FALSE)))","v":""},""]
[594,"3.4.08a",6,null,"3.4.08a","Assigned to a named individual?",null,{"$f":"IF(ISERROR(VLOOKUP(E79,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E79,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E79,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA79,detail_maturity_score,3,FALSE)","v":""}]
[595,"3.4.08b",6,null,"3.4.08b","Given a suitable priority?",null,{"$f":"IF(ISERROR(VLOOKUP(E80,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E80,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E80,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA80,detail_maturity_score,3,FALSE)","v":""}]
[596,"3.4.08c",6,null,"3.4.08c","Allocated a completion date?",null,{"$f":"IF(ISERROR(VLOOKUP(E81,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E81,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E81,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA81,detail_maturity_score,3,FALSE)","v":""}]
[597,"3.4.08d",6,null,"3.4.08d","Monitored to ensure that it is being completed in a timely and effective manner?",null,{"$f":"IF(ISERROR(VLOOKUP(E82,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E82,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E82,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA82,detail_maturity_score,3,FALSE)","v":""}]
[598,"3.5",2,null,"Step 5","Updating",null,{"$f":"IF(ISERROR(VLOOKUP(E83,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E83,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E83,Weightings!T:Y,6,FALSE)))","v":""},""]
[599,"3.5.01",5,null,"3.5.01","Following a cyber security incident, do you carry out any updates (eg to your cyber security incident response approaches, controls and related documents)?",null,{"$f":"IF(ISERROR(VLOOKUP(E84,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E84,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E84,Weightings!T:Y,6,FALSE)))","v":"x 1"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA84,detail_maturity_score,3,FALSE)","v":""}]
[600,"3.5.02",4,null,"3.5.02","Following a cyber security incident, do you update your:",null,{"$f":"IF(ISERROR(VLOOKUP(E85,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E85,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E85,Weightings!T:Y,6,FALSE)))","v":""},""]
[601,"3.5.02a",6,null,"3.5.02a","Cyber security incident management methodologies or processes?",null,{"$f":"IF(ISERROR(VLOOKUP(E86,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E86,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E86,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA86,detail_maturity_score,3,FALSE)","v":""}]
[602,"3.5.02b",6,null,"3.5.02b","Cyber security incident response plan?",null,{"$f":"IF(ISERROR(VLOOKUP(E87,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E87,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E87,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[603,"3.5.02c",6,null,"3.5.02c","Management controls (eg training and awareness)",null,{"$f":"IF(ISERROR(VLOOKUP(E88,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E88,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E88,Weightings!T:Y,6,FALSE)))","v":"x 2"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[604,"3.5.02d",6,null,"3.5.02d","Technical controls (eg patching, configuring system logs, and use of intrusion prevention / detection tools)",null,{"$f":"IF(ISERROR(VLOOKUP(E89,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E89,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E89,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[605,"3.5.02e",6,null,"3.5.02e","Roles and responsibilities for handling incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E90,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E90,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E90,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[606,"3.5.03",5,null,"3.5.03","When updating controls, do you consider the attack vectors causing most concern, which often include:",null,{"$f":"IF(ISERROR(VLOOKUP(E91,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E91,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E91,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[607,"3.5.04",5,null,"3.5.04","When updating controls, do you:",null,{"$f":"IF(ISERROR(VLOOKUP(E92,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E92,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E92,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[608,"3.5.04a",6,null,"3.5.04a","Consider their effectiveness in relation to events in the ‘attacker kill chain’ (ie reconnaissance, weaponize, deliver, exploit, install, command & control and act on objectives)?",null,{"$f":"IF(ISERROR(VLOOKUP(E93,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E93,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E93,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[609,"3.5.04b",6,null,"3.5.04b","Review implications for tactical and short term security projects?",null,{"$f":"IF(ISERROR(VLOOKUP(E94,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E94,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E94,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[610,"3.5.05",4,null,"3.5.05","Following a cyber security incident, do you feed the results of incident analysis back into your:",null,{"$f":"IF(ISERROR(VLOOKUP(E95,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E95,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E95,Weightings!T:Y,6,FALSE)))","v":""},""]
[611,"3.5.05a",6,null,"3.5.05a","Risk assessment methodologies?",null,{"$f":"IF(ISERROR(VLOOKUP(E96,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E96,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E96,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA96,detail_maturity_score,3,FALSE)","v":""}]
[612,"3.5.05b",6,null,"3.5.05b","Cyber security threat analysis?",null,{"$f":"IF(ISERROR(VLOOKUP(E97,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E97,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E97,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA97,detail_maturity_score,3,FALSE)","v":""}]
[613,"3.5.05c",6,null,"3.5.05c","Business continuity or crisis management arrangements?",null,{"$f":"IF(ISERROR(VLOOKUP(E98,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E98,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E98,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA98,detail_maturity_score,3,FALSE)","v":""}]
[614,"3.5.05d",6,null,"3.5.05d","Contractual arrangements with third party suppliers?",null,{"$f":"IF(ISERROR(VLOOKUP(E99,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E99,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E99,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA99,detail_maturity_score,3,FALSE)","v":""}]
[615,"3.5.05e",6,null,"3.5.05e","Business intelligence initiatives?",null,{"$f":"IF(ISERROR(VLOOKUP(E100,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E100,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E100,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA100,detail_maturity_score,3,FALSE)","v":""}]
[616,"3.5.06",4,null,"3.5.06","Are updates carried out:",null,{"$f":"IF(ISERROR(VLOOKUP(E101,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E101,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E101,Weightings!T:Y,6,FALSE)))","v":""},""]
[617,"3.5.06a",6,null,"3.5.06a","Using a structured, systematic process?",null,{"$f":"IF(ISERROR(VLOOKUP(E102,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E102,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E102,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA102,detail_maturity_score,3,FALSE)","v":""}]
[618,"3.5.06b",6,null,"3.5.06b","In accordance with formally approved documentation?",null,{"$f":"IF(ISERROR(VLOOKUP(E103,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E103,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E103,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA103,detail_maturity_score,3,FALSE)","v":""}]
[619,{"$f":"VLOOKUP(A104,contentref,2,FALSE)","v":"3.5.07"},{"$f":"VLOOKUP(A104,contentref,15,FALSE)","v":5},null,{"$f":"IF(C104=1,\"Phase \"&B104,IF(C104=2,\"Step \"&VLOOKUP(A104,contentref,4,FALSE),B104))","v":"3.5.07"},{"$f":"VLOOKUP(A104,contentref,7,FALSE)","v":"Following a cyber security incident, do you review your state of readiness for handling a cyber security incident?"},null,{"$f":"IF(ISERROR(VLOOKUP(E104,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E104,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E104,Weightings!T:Y,6,FALSE)))","v":"x 5"},{"$f":"IF(ISERROR(VLOOKUP(AA104,detail_maturity_score,3,FALSE)*VLOOKUP(H104,weighting_scores,2,FALSE)),\"\",VLOOKUP(AA104,detail_maturity_score,3,FALSE)*VLOOKUP(H104,weighting_scores,2,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA104,detail_maturity_score,3,FALSE)","v":""}]
[620,"3.6",2,null,"Step 6","Trend analysis",null,{"$f":"IF(ISERROR(VLOOKUP(E105,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E105,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E105,Weightings!T:Y,6,FALSE)))","v":""},""]
[621,"3.6.01",5,null,"3.6.01","Do you maintain a central register of all cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E106,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E106,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E106,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA106,detail_maturity_score,3,FALSE)","v":""}]
[622,"3.6.02",5,null,"3.6.02","Does this register link with the risk registers used to record cyber risks?",null,{"$f":"IF(ISERROR(VLOOKUP(E107,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E107,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E107,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA107,detail_maturity_score,3,FALSE)","v":""}]
[623,"3.6.03",4,null,"3.6.03","Do you analyse relevant cyber security incident data regularly (trend analysis) to help:",null,{"$f":"IF(ISERROR(VLOOKUP(E108,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E108,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E108,Weightings!T:Y,6,FALSE)))","v":""},""]
[624,"3.6.03a",6,null,"3.6.03a","Evaluate patterns and trends of cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E109,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E109,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E109,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA109,detail_maturity_score,3,FALSE)","v":""}]
[625,"3.6.03b",6,null,"3.6.03b","Identify common factors that have influenced cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E110,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E110,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E110,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA110,detail_maturity_score,3,FALSE)","v":""}]
[626,"3.6.03c",6,null,"3.6.03c","Determine the effectiveness of controls (eg which controls are better at preventing, detecting and delaying cyber security incidents or minimising their business impact)?",null,{"$f":"IF(ISERROR(VLOOKUP(E111,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E111,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E111,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA111,detail_maturity_score,3,FALSE)","v":""}]
[627,"3.6.03d",6,null,"3.6.03d","Address attribution (eg their ability to bundle data together to produce meaningful conclusions)",null,{"$f":"IF(ISERROR(VLOOKUP(E112,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E112,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E112,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA112,detail_maturity_score,3,FALSE)","v":""}]
[628,"3.6.03e",6,null,"3.6.03e","Understand the costs and impacts associated with cyber security incidents?",null,{"$f":"IF(ISERROR(VLOOKUP(E113,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E113,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E113,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA113,detail_maturity_score,3,FALSE)","v":""}]
[629,"3.6.04",4,null,"3.6.04","Does your analysis of cyber security incident data include:",null,{"$f":"IF(ISERROR(VLOOKUP(E114,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E114,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E114,Weightings!T:Y,6,FALSE)))","v":""},""]
[630,"3.6.04a",6,null,"3.6.04a","Searching your archived data, as required?",null,{"$f":"IF(ISERROR(VLOOKUP(E115,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E115,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E115,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(AA115,detail_maturity_score,3,FALSE)","v":""}]
[631,"3.6.04b",6,null,"3.6.04b","Protecting your archived data, as it is often sensitive?",null,{"$f":"IF(ISERROR(VLOOKUP(E116,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E116,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E116,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[632,"3.6.05",5,null,"3.6.05","Does your trend analysis:",null,{"$f":"IF(ISERROR(VLOOKUP(E117,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E117,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E117,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[633,"3.6.05a",6,null,"3.6.05a","Cover all types of technology, rather than just particular types or suppliers (ie it is technology agnostic)?",null,{"$f":"IF(ISERROR(VLOOKUP(E118,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E118,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E118,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[634,"3.6.05b",6,null,"3.6.05b","Evaluate the mean time of cyber security incident investigations (ie how long each investigation took to identify, respond to and recover from incidents)",null,{"$f":"IF(ISERROR(VLOOKUP(E119,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E119,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E119,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[635,"3.6.06",5,null,"3.6.06","Does your trend analysis include:",null,{"$f":"IF(ISERROR(VLOOKUP(E120,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E120,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E120,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[636,"3.6.06a",6,null,"3.6.06a","Looking for flaws across the entire organisation or over time, rather than just concentrating on what can be perceived as a single event?",null,{"$f":"IF(ISERROR(VLOOKUP(E121,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E121,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E121,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[637,"3.6.06b",6,null,"3.6.06b","Sharing information about your cyber security incidents with the wider community (eg in your markets sector, membership bodies, government and law enforcement)?",null,{"$f":"IF(ISERROR(VLOOKUP(E122,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E122,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E122,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[638,"3.6.07",4,null,"3.6.07","Do your objectives for sharing information include:",null,{"$f":"IF(ISERROR(VLOOKUP(E123,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E123,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E123,Weightings!T:Y,6,FALSE)))","v":""},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[639,"3.6.07a",6,null,"3.6.07a","Gaining advice on reducing vulnerabilities in your organisation?",null,{"$f":"IF(ISERROR(VLOOKUP(E124,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E124,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E124,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[640,"3.6.07b",6,null,"3.6.07b","Learning how to configure systems to reduce the potential attack surface?",null,{"$f":"IF(ISERROR(VLOOKUP(E125,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E125,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E125,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[641,"3.6.07c",6,null,"3.6.07c","Getting hold of tools and services to help you fix problems?",null,{"$f":"IF(ISERROR(VLOOKUP(E126,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E126,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E126,Weightings!T:Y,6,FALSE)))","v":"x 3"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[642,"3.6.08",4,null,"3.6.08","Do these activities include:",null,{"$f":"IF(ISERROR(VLOOKUP(E127,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E127,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E127,Weightings!T:Y,6,FALSE)))","v":""},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[643,"3.6.08a",6,null,"3.6.08a","Taking part in external events, such as by attending conferences, enrolling in training programmes and subscribing to specialised services?",null,{"$f":"IF(ISERROR(VLOOKUP(E128,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E128,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E128,Weightings!T:Y,6,FALSE)))","v":"x 4"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[644,"3.6.08b",6,null,"3.6.08b","Collaborating with relevant third parties, such as participating in information exchanges, contributing to scenario-based rehearsals and introducing two-way cyber security alert mechanisms?",null,{"$f":"IF(ISERROR(VLOOKUP(E129,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E129,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E129,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]
[645,"3.6.08c",6,null,"3.6.08c","Making use of the UK Government’s certified Cyber Incident Response (CIR) services?",null,{"$f":"IF(ISERROR(VLOOKUP(E130,Weightings!T:Y,6,FALSE)),\"\",IF(VLOOKUP(E130,Weightings!T:Y,6,FALSE)=0,\"\",VLOOKUP(E130,Weightings!T:Y,6,FALSE)))","v":"x 5"},"",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,""]

{"sheet":"Aggregated Results","index":10,"n_rows":21,"n_cols":35,"rows_kept":21,"cut":false,"hidden":false,"merged":[[1,4,1,5],[1,6,1,7],[0,3,0,18]]}
[null,null,null,{"$f":"\"Aggregated maturity level results\"&IF(LEN(scope_area_of_assessment)=0,\"\",\" for \"&scope_area_of_assessment)","v":"Aggregated maturity level results"}]
[null,null,"Cyber Security Incident Response","Cyber Security Incident Response","Maturity level (1 to 5)",null,"Target maturity (1 to 5)",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"rating","target",1,2,3,1,2,3]
[null,"CSIR",{"$f":"VLOOKUP(B3,'MMAT ref'!A:E,2,FALSE)","v":{"$error":"#N/A"}},{"$f":"B3&\" - \"&C3","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(B3,'MMAT ref'!A:E,4,FALSE)","v":{"$error":"#N/A"}},{"$f":"IF(ISERROR(E3),\"\",E3)","v":""},{"$f":"H3","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(B3,'MMAT ref'!A:F,6,FALSE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'MMAT ref'!AE1","v":1},{"$f":"VLOOKUP(B4,'MMAT ref'!AE:AG,3,FALSE)","v":"Prepare"},{"$f":"VLOOKUP(B4,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C4","v":"Phase 1 - Prepare"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q1","v":"1.1"},{"$f":"Z4&\" - \"&VLOOKUP(Z4,textref,3,FALSE)","v":"1.1 - Criticality assessment"},{"$f":"VLOOKUP(Z4,'MMAT ref'!Q:R,2,FALSE)","v":1},{"$f":"VLOOKUP(Z4,B:H,7,FALSE)","v":2},{"$f":"IF(VALUE(LEFT($AA4,1))=AD$2,$AB4,\"\")","v":1},null,null,{"$f":"IF(VALUE(LEFT($AA4,1))=AG$2,$AC4,\"\")","v":2}]
[null,{"$f":"'MMAT ref'!AE2","v":"1.1"},{"$f":"VLOOKUP(B5,'MMAT ref'!AE:AG,3,FALSE)","v":"Criticality assessment"},{"$f":"VLOOKUP(B5,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C5","v":"Step 1 - Criticality assessment"},{"$f":"VLOOKUP(B5,Z4:AB8,3,FALSE)","v":1},{"$f":"IF(ISERROR(E5),\"\",E5)","v":1},{"$f":"H5","v":2},{"$f":"Targets!F5","v":2},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q2","v":"1.2"},"1.2 - Threat analysis",{"$f":"VLOOKUP(Z5,'MMAT ref'!Q:R,2,FALSE)","v":1},2,{"$f":"IF(VALUE(LEFT($AA5,1))=AD$2,$AB5,\"\")","v":1},null,null,{"$f":"IF(VALUE(LEFT($AA5,1))=AG$2,$AC5,\"\")","v":2}]
[null,{"$f":"'MMAT ref'!AE3","v":"1.2"},{"$f":"VLOOKUP(B6,'MMAT ref'!AE:AG,3,FALSE)","v":"Threat analysis"},{"$f":"VLOOKUP(B6,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C6","v":"Step 2 - Threat analysis"},{"$f":"VLOOKUP(B6,Z5:AB9,3,FALSE)","v":1},{"$f":"IF(ISERROR(E6),\"\",E6)","v":1},{"$f":"H6","v":2},{"$f":"Targets!F6","v":2},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q3","v":"1.3"},"1.3 - People, Process, Technology and Information",{"$f":"VLOOKUP(Z6,'MMAT ref'!Q:R,2,FALSE)","v":1},2,1,null,null,2]
[null,{"$f":"'MMAT ref'!AE4","v":"1.3"},{"$f":"VLOOKUP(B7,'MMAT ref'!AE:AG,3,FALSE)","v":"People, Process, Technology and Information"},{"$f":"VLOOKUP(B7,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C7","v":"Step 3 - People, Process, Technology and Information"},1,{"$f":"IF(ISERROR(E7),\"\",E7)","v":1},{"$f":"H7","v":2},{"$f":"Targets!F7","v":2},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q4","v":"1.4"},"1.4 - Control environment",{"$f":"VLOOKUP(Z7,'MMAT ref'!Q:R,2,FALSE)","v":1},2,1,null,null,2]
[null,{"$f":"'MMAT ref'!AE5","v":"1.4"},{"$f":"VLOOKUP(B8,'MMAT ref'!AE:AG,3,FALSE)","v":"Control environment"},{"$f":"VLOOKUP(B8,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C8","v":"Step 4 - Control environment"},1,1,2,{"$f":"Targets!F8","v":2},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q5","v":"1.5"},"1.5 - Maturity assessment",{"$f":"VLOOKUP(Z8,'MMAT ref'!Q:R,2,FALSE)","v":1},2,1,null,null,2]
[null,{"$f":"'MMAT ref'!AE6","v":"1.5"},{"$f":"VLOOKUP(B9,'MMAT ref'!AE:AG,3,FALSE)","v":"Maturity assessment"},{"$f":"VLOOKUP(B9,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C9","v":"Step 5 - Maturity assessment"},1,1,2,{"$f":"Targets!F9","v":2},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q6","v":"2.1"},"2.1 - Identification",{"$f":"VLOOKUP(Z9,'MMAT ref'!Q:R,2,FALSE)","v":1},2,null,{"$f":"IF(VALUE(LEFT($AA9,1))=AE$2,$AB9,\"\")","v":1},null,null,2]
[null,{"$f":"'MMAT ref'!AE7","v":2},{"$f":"VLOOKUP(B10,'MMAT ref'!AE:AG,3,FALSE)","v":"Respond"},{"$f":"VLOOKUP(B10,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C10","v":"Phase 2 - Respond"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q7","v":"2.2"},"2.2 - Investigation",{"$f":"VLOOKUP(Z10,'MMAT ref'!Q:R,2,FALSE)","v":1},2,null,1,null,null,2]
[null,{"$f":"'MMAT ref'!AE8","v":"2.1"},{"$f":"VLOOKUP(B11,'MMAT ref'!AE:AG,3,FALSE)","v":"Identification"},{"$f":"VLOOKUP(B11,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C11","v":"Step 1 - Identification"},{"$f":"VLOOKUP(B11,'MMAT ref'!Q:R,2,FALSE)","v":1},1,2,{"$f":"Targets!F11","v":2},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q8","v":"2.3"},"2.3 - Action",{"$f":"VLOOKUP(Z11,'MMAT ref'!Q:R,2,FALSE)","v":1},2,null,1,null,null,2]
[null,{"$f":"'MMAT ref'!AE9","v":"2.2"},{"$f":"VLOOKUP(B12,'MMAT ref'!AE:AG,3,FALSE)","v":"Investigation"},{"$f":"VLOOKUP(B12,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C12","v":"Step 2 - Investigation"},{"$f":"VLOOKUP(B12,'MMAT ref'!Q:R,2,FALSE)","v":1},1,2,{"$f":"Targets!F12","v":2},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q9","v":"2.4"},"2.4 - Recovery",{"$f":"VLOOKUP(Z12,'MMAT ref'!Q:R,2,FALSE)","v":1},2,null,1,null,null,2]
[null,{"$f":"'MMAT ref'!AE10","v":"2.3"},{"$f":"VLOOKUP(B13,'MMAT ref'!AE:AG,3,FALSE)","v":"Action"},{"$f":"VLOOKUP(B13,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C13","v":"Step 3 - Action"},{"$f":"VLOOKUP(B13,'MMAT ref'!Q:R,2,FALSE)","v":1},1,2,{"$f":"Targets!F13","v":2},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q10","v":"3.1"},"3.1 - Incident investigation",{"$f":"VLOOKUP(Z13,'MMAT ref'!Q:R,2,FALSE)","v":1},2,null,null,1,null,null,2]
[null,{"$f":"'MMAT ref'!AE11","v":"2.4"},{"$f":"VLOOKUP(B14,'MMAT ref'!AE:AG,3,FALSE)","v":"Recovery"},{"$f":"VLOOKUP(B14,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C14","v":"Step 4 - Recovery"},{"$f":"VLOOKUP(B14,'MMAT ref'!Q:R,2,FALSE)","v":1},1,2,{"$f":"Targets!F14","v":2},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q11","v":"3.2"},"3.2 - Reporting",{"$f":"VLOOKUP(Z14,'MMAT ref'!Q:R,2,FALSE)","v":1},2,null,null,1,null,null,2]
[null,{"$f":"'MMAT ref'!AE12","v":3},{"$f":"VLOOKUP(B15,'MMAT ref'!AE:AG,3,FALSE)","v":"Follow up"},{"$f":"VLOOKUP(B15,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C15","v":"Phase 3 - Follow up"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q12","v":"3.3"},"3.3 - Post incident review",{"$f":"VLOOKUP(Z15,'MMAT ref'!Q:R,2,FALSE)","v":1},2,null,null,1,null,null,2]
[null,{"$f":"'MMAT ref'!AE13","v":"3.1"},{"$f":"VLOOKUP(B16,'MMAT ref'!AE:AG,3,FALSE)","v":"Incident investigation"},{"$f":"VLOOKUP(B16,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C16","v":"Step 1 - Incident investigation"},{"$f":"VLOOKUP(B16,'MMAT ref'!Q:R,2,FALSE)","v":1},1,2,{"$f":"Targets!F16","v":2},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q13","v":"3.4"},"3.4 - Lessons learned",{"$f":"VLOOKUP(Z16,'MMAT ref'!Q:R,2,FALSE)","v":1},2,null,null,1,null,null,2]
[null,{"$f":"'MMAT ref'!AE14","v":"3.2"},{"$f":"VLOOKUP(B17,'MMAT ref'!AE:AG,3,FALSE)","v":"Reporting"},{"$f":"VLOOKUP(B17,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C17","v":"Step 2 - Reporting"},{"$f":"VLOOKUP(B17,'MMAT ref'!Q:R,2,FALSE)","v":1},1,2,{"$f":"Targets!F17","v":2},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q14","v":"3.5"},"3.5 - Updating",{"$f":"VLOOKUP(Z17,'MMAT ref'!Q:R,2,FALSE)","v":1},2,null,null,1,null,null,2]
[null,{"$f":"'MMAT ref'!AE15","v":"3.3"},{"$f":"VLOOKUP(B18,'MMAT ref'!AE:AG,3,FALSE)","v":"Post incident review"},{"$f":"VLOOKUP(B18,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C18","v":"Step 3 - Post incident review"},{"$f":"VLOOKUP(B18,'MMAT ref'!Q:R,2,FALSE)","v":1},1,2,{"$f":"Targets!F18","v":2},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q15","v":"3.6"},"3.6 - Trend analysis",{"$f":"VLOOKUP(Z18,'MMAT ref'!Q:R,2,FALSE)","v":1},2,null,null,1,null,null,2]
[null,{"$f":"'MMAT ref'!AE16","v":"3.4"},{"$f":"VLOOKUP(B19,'MMAT ref'!AE:AG,3,FALSE)","v":"Lessons learned"},{"$f":"VLOOKUP(B19,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C19","v":"Step 4 - Lessons learned"},{"$f":"VLOOKUP(B19,'MMAT ref'!Q:R,2,FALSE)","v":1},1,2,{"$f":"Targets!F19","v":2}]
[null,{"$f":"'MMAT ref'!AE17","v":"3.5"},{"$f":"VLOOKUP(B20,'MMAT ref'!AE:AG,3,FALSE)","v":"Updating"},{"$f":"VLOOKUP(B20,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C20","v":"Step 5 - Updating"},{"$f":"VLOOKUP(B20,'MMAT ref'!Q:R,2,FALSE)","v":1},1,2,{"$f":"Targets!F20","v":2}]
[null,{"$f":"'MMAT ref'!AE18","v":"3.6"},{"$f":"VLOOKUP(B21,'MMAT ref'!AE:AG,3,FALSE)","v":"Trend analysis"},{"$f":"VLOOKUP(B21,'MMAT ref'!AE:AG,2,FALSE)& \" - \"&C21","v":"Step 6 - Trend analysis"},{"$f":"VLOOKUP(B21,'MMAT ref'!Q:R,2,FALSE)","v":1},1,2,{"$f":"Targets!F21","v":2}]

{"sheet":"Results - Phase 1","index":11,"n_rows":266,"n_cols":24,"rows_kept":266,"cut":false,"hidden":false,"merged":[[1,5,2,8],[3,5,4,8]]}
[]
[null,null,null,null,null,{"$f":"\"Results\"&IF(LEN(scope_area_of_assessment)=0,\"\",\" for \"&scope_area_of_assessment)","v":"Results"}]
[]
[null,null,null,null,null,"Maturity model for Phase 1 - Prepare"]
[]
[]
["Order","FullQ","Type",null,null,null,"Response (0-3)","Weighted score (0-15)","Evidence supplied"]
[2,{"$f":"VLOOKUP(A8,contentref,2,FALSE)","v":"1.1"},{"$f":"VLOOKUP(A8,contentref,15,FALSE)","v":2},null,{"$f":"IF(C8=1,\"Phase \"&B8,IF(C8=2,\"Step \"&VLOOKUP(A8,contentref,4,FALSE),B8))","v":"Step 1"},{"$f":"VLOOKUP(A8,contentref,7,FALSE)","v":"Criticality assessment"},{"$f":"\"Maturity level:  \"&O8","v":"Maturity level:  Level 1"},null,null,null,null,{"$f":"TEXT(B8,\"0.0\")","v":"1.1"},{"$f":"SUMIF(U:U,L8,H:H)/(SUMIF(U:U,L8,X:X))","v":0},{"$f":"HLOOKUP(M8*100,level_ref,2,TRUE)","v":"Level 1"},{"$f":"IF(ISERROR(N8),\"\",N8)","v":"Level 1"},{"$f":"HLOOKUP(M8*100,level_ref,3,TRUE)","v":1},{"$f":"IF(ISERROR(P8),\"\",P8)","v":1},null,null,null,{"$f":"IF(AND(C8>4,VLOOKUP(B8,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B8,3),\"\")","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(B8,Weightings!T:X,5,FALSE)","v":{"$error":"#N/A"}},{"$f":"IF(VLOOKUP(B8,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$f":"W8*V8*3","v":{"$error":"#N/A"}}]
[3,"1.1.01",5,null,"1.1.01","Have you defined your critical information assets?",{"$f":"VLOOKUP(E9,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E9,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E9,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E9,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C9>4,VLOOKUP(B9,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B9,3),\"\")","v":"1.1"},{"$f":"VLOOKUP(B9,Weightings!T:X,5,FALSE)","v":1},{"$f":"IF(VLOOKUP(B9,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$f":"W9*V9*3","v":3}]
[4,"1.1.02",4,null,"1.1.02","Does your defined set of critical information assets include:",null,null,{"$f":"IF(VLOOKUP(E10,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E10,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C10>4,VLOOKUP(B10,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B10,3),\"\")","v":""},{"$f":"VLOOKUP(B10,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B10,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[5,"1.1.02a",6,null,"1.1.02a","Important business applications?",{"$f":"VLOOKUP(E11,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E11,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E11,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E11,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C11>4,VLOOKUP(B11,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B11,3),\"\")","v":"1.1"},{"$f":"VLOOKUP(B11,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B11,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[6,"1.1.02b",6,null,"1.1.02b","Key systems and networks (infrastructure)?",{"$f":"VLOOKUP(E12,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E12,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E12,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E12,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C12>4,VLOOKUP(B12,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B12,3),\"\")","v":"1.1"},{"$f":"VLOOKUP(B12,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B12,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[7,"1.1.02c",6,null,"1.1.02c","Confidential data?",{"$f":"VLOOKUP(E13,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E13,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E13,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E13,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C13>4,VLOOKUP(B13,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B13,3),\"\")","v":"1.1"},{"$f":"VLOOKUP(B13,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B13,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[8,"1.1.03",4,null,"1.1.03","Is the criticality of these assets:",null,null,{"$f":"IF(VLOOKUP(E14,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E14,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C14>4,VLOOKUP(B14,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B14,3),\"\")","v":""},{"$f":"VLOOKUP(B14,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B14,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[9,"1.1.03a",6,null,"1.1.03a","Defined in a structured, systematic manner?",{"$f":"VLOOKUP(E15,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E15,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E15,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E15,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C15>4,VLOOKUP(B15,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B15,3),\"\")","v":"1.1"},{"$f":"VLOOKUP(B15,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B15,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[10,"1.1.03b",6,null,"1.1.03b","Based on an analysis of their strategic or monetary value?",{"$f":"VLOOKUP(E16,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E16,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E16,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E16,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C16>4,VLOOKUP(B16,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B16,3),\"\")","v":"1.1"},{"$f":"VLOOKUP(B16,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B16,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[11,"1.1.04",4,null,"1.1.04","Have you identified:",null,null,{"$f":"IF(VLOOKUP(E17,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E17,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C17>4,VLOOKUP(B17,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B17,3),\"\")","v":""},{"$f":"VLOOKUP(B17,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B17,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[12,"1.1.04a",6,null,"1.1.04a","Where your critical systems are physically located in your organisation and in third party organisations?",{"$f":"VLOOKUP(E18,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E18,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E18,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E18,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C18>4,VLOOKUP(B18,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B18,3),\"\")","v":"1.1"},{"$f":"VLOOKUP(B18,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B18,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[13,"1.1.04b",6,null,"1.1.04b","On which systems your confidential information is stored or processed (eg on servers, devices and in the cloud)?",{"$f":"VLOOKUP(E19,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E19,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E19,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E19,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C19>4,VLOOKUP(B19,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B19,3),\"\")","v":"1.1"},{"$f":"VLOOKUP(B19,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B19,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[14,"1.1.05",5,null,"1.1.05","Have you assigned responsibility for protecting your critical assets to capable, named individuals?",{"$f":"VLOOKUP(E20,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E20,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E20,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E20,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C20>4,VLOOKUP(B20,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B20,3),\"\")","v":"1.1"},{"$f":"VLOOKUP(B20,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B20,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[15,"1.1.06",5,null,"1.1.06","Do you conduct business impact assessments of your critical assets (either individually or in aggregate) to determine the likely (or actual) level of business impact caused if your organisation was hit by a cyber security incident?",{"$f":"VLOOKUP(E21,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E21,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E21,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E21,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C21>4,VLOOKUP(B21,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B21,3),\"\")","v":"1.1"},{"$f":"VLOOKUP(B21,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B21,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[16,"1.1.07",4,null,"1.1.07","Do your business impact assessments determine the level of business impact if:",null,null,{"$f":"IF(VLOOKUP(E22,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E22,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C22>4,VLOOKUP(B22,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B22,3),\"\")","v":""},{"$f":"VLOOKUP(B22,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B22,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[17,"1.1.07a",6,null,"1.1.07a","Sensitive or other confidential information was disclosed to unauthorised parties?",{"$f":"VLOOKUP(E23,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E23,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E23,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E23,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C23>4,VLOOKUP(B23,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B23,3),\"\")","v":"1.1"},{"$f":"VLOOKUP(B23,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B23,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[18,"1.1.07b",6,null,"1.1.07b","Important information was compromised (eg key data is inaccurate or wrongly processed)?",{"$f":"VLOOKUP(E24,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E24,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E24,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E24,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C24>4,VLOOKUP(B24,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B24,3),\"\")","v":"1.1"},{"$f":"VLOOKUP(B24,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B24,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[19,"1.1.07c",6,null,"1.1.07c","Critical systems or infrastructure were no longer available?",{"$f":"VLOOKUP(E25,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E25,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E25,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E25,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C25>4,VLOOKUP(B25,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B25,3),\"\")","v":"1.1"},{"$f":"VLOOKUP(B25,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B25,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[20,"1.1.08",4,null,"1.1.08","Do your business impact assessments cover all relevant types of business consequences that could affect your organisation, including:",null,null,{"$f":"IF(VLOOKUP(E26,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E26,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C26>4,VLOOKUP(B26,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B26,3),\"\")","v":""},{"$f":"VLOOKUP(B26,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B26,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[21,"1.1.08a",6,null,"1.1.08a","Potential or actual financial loss?",{"$f":"VLOOKUP(E27,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E27,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E27,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E27,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C27>4,VLOOKUP(B27,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B27,3),\"\")","v":"1.1"},{"$f":"VLOOKUP(B27,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B27,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[22,"1.1.08b",6,null,"1.1.08b","Compliance implications (eg fines, business restrictions or other penalties)?",{"$f":"VLOOKUP(E28,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E28,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E28,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E28,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C28>4,VLOOKUP(B28,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B28,3),\"\")","v":"1.1"},{"$f":"VLOOKUP(B28,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B28,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[23,"1.1.08c",6,null,"1.1.08c","Damage to reputation?",{"$f":"VLOOKUP(E29,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E29,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E29,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E29,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C29>4,VLOOKUP(B29,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B29,3),\"\")","v":"1.1"},{"$f":"VLOOKUP(B29,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B29,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[24,"1.1.08d",6,null,"1.1.08d","Loss of management control?",{"$f":"VLOOKUP(E30,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E30,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E30,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E30,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C30>4,VLOOKUP(B30,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B30,3),\"\")","v":"1.1"},{"$f":"VLOOKUP(B30,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B30,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[25,"1.1.08e",6,null,"1.1.08e","Impaired growth?",{"$f":"VLOOKUP(E31,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E31,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E31,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E31,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C31>4,VLOOKUP(B31,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B31,3),\"\")","v":"1.1"},{"$f":"VLOOKUP(B31,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B31,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[26,"1.2",2,null,"Step 2","Threat analysis",{"$f":"\"Maturity level:  \"&O32","v":"Maturity level:  Level 1"},null,null,null,null,{"$f":"TEXT(B32,\"0.0\")","v":"1.2"},{"$f":"SUMIF(U:U,L32,H:H)/(SUMIF(U:U,L32,X:X))","v":0},{"$f":"HLOOKUP(M32*100,level_ref,2,TRUE)","v":"Level 1"},{"$f":"IF(ISERROR(N32),\"\",N32)","v":"Level 1"},{"$f":"HLOOKUP(M32*100,level_ref,3,TRUE)","v":1},{"$f":"IF(ISERROR(P32),\"\",P32)","v":1},null,null,null,{"$f":"IF(AND(C32>4,VLOOKUP(B32,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B32,3),\"\")","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(B32,Weightings!T:X,5,FALSE)","v":{"$error":"#N/A"}},{"$f":"IF(VLOOKUP(B32,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#N/A"}]
[27,"1.2.01",5,null,"1.2.01","Do you analyse cyber security threats and associated vulnerabilities?",{"$f":"VLOOKUP(E33,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E33,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E33,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E33,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C33>4,VLOOKUP(B33,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B33,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B33,Weightings!T:X,5,FALSE)","v":1},{"$f":"IF(VLOOKUP(B33,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},3]
[28,"1.2.02",4,null,"1.2.02","Is your cyber security threat analysis:",null,null,{"$f":"IF(VLOOKUP(E34,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E34,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C34>4,VLOOKUP(B34,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B34,3),\"\")","v":""},{"$f":"VLOOKUP(B34,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B34,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[29,"1.2.02a",6,null,"1.2.02a","Carried out in a structured, systematic manner?",{"$f":"VLOOKUP(E35,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E35,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E35,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E35,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C35>4,VLOOKUP(B35,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B35,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B35,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B35,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[30,"1.2.02b",6,null,"1.2.02b","Conducted on a regular basis?",{"$f":"VLOOKUP(E36,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E36,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E36,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E36,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C36>4,VLOOKUP(B36,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B36,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B36,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B36,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[31,"1.2.02c",6,null,"1.2.02c","Linked to a knowledge base of known attack types and attack agents?",{"$f":"VLOOKUP(E37,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E37,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E37,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E37,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C37>4,VLOOKUP(B37,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B37,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B37,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B37,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[32,"1.2.03",5,null,"1.2.03","Does your cyber security threat analysis give you a good understanding of the level of threat to your organisation from different types of cyber security incidents?",{"$f":"VLOOKUP(E38,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E38,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E38,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E38,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C38>4,VLOOKUP(B38,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B38,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B38,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B38,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[33,"1.2.04",4,null,"1.2.04","Does your threat analysis focus on:",null,null,{"$f":"IF(VLOOKUP(E39,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E39,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C39>4,VLOOKUP(B39,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B39,3),\"\")","v":""},{"$f":"VLOOKUP(B39,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B39,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[34,"1.2.04a",6,null,"1.2.04a","The cyber security landscape relevant to your organisation?",{"$f":"VLOOKUP(E40,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E40,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E40,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E40,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C40>4,VLOOKUP(B40,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B40,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B40,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B40,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[35,"1.2.04b",6,null,"1.2.04b","Relevant sources of threats (eg organised crime syndicates, state-sponsored organisations, extremist groups, hacktivists, insiders – or a combination of these)?",{"$f":"VLOOKUP(E41,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E41,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E41,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E41,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C41>4,VLOOKUP(B41,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B41,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B41,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B41,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[36,"1.2.04c",6,null,"1.2.04c","Which cyber security threats are most likely to affect your critical information assets?",{"$f":"VLOOKUP(E42,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E42,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E42,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E42,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C42>4,VLOOKUP(B42,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B42,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B42,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B42,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[37,"1.2.04d",6,null,"1.2.04d","Vulnerabilities to each particular cyber security threat (eg control weaknesses or special circumstances)?",{"$f":"VLOOKUP(E43,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E43,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E43,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E43,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C43>4,VLOOKUP(B43,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B43,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B43,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B43,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[38,"1.2.04e",6,null,"1.2.04e","Possible threat vectors for attacks to exploit (eg Internet downloads, unauthorised USB sticks, misconfigured systems, inappropriate access, or collusion)?",{"$f":"VLOOKUP(E44,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E44,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E44,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E44,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C44>4,VLOOKUP(B44,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B44,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B44,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B44,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[39,"1.2.04f",6,null,"1.2.04f","The technical infrastructure that supports your critical assets?",{"$f":"VLOOKUP(E45,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E45,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E45,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E45,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C45>4,VLOOKUP(B45,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B45,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B45,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B45,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[40,"1.2.05",4,null,"1.2.05","Does your cyber security threat analysis address all stages of a cyber security attack, including:",null,null,{"$f":"IF(VLOOKUP(E46,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E46,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C46>4,VLOOKUP(B46,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B46,3),\"\")","v":""},{"$f":"VLOOKUP(B46,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B46,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[41,"1.2.05a",6,null,"1.2.05a","Reconnaissance (gaining information about a target individual or organisation for use in a future cyber-attack)?",{"$f":"VLOOKUP(E47,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E47,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E47,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E47,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C47>4,VLOOKUP(B47,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B47,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B47,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B47,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[42,"1.2.05b",6,null,"1.2.05b","Disruption (eg to a business, system or service)?",{"$f":"VLOOKUP(E48,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E48,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E48,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E48,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C48>4,VLOOKUP(B48,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B48,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B48,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B48,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[43,"1.2.05c",6,null,"1.2.05c","Extraction (eg obtaining money, sensitive information or user credentials from the target)?",{"$f":"VLOOKUP(E49,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E49,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E49,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E49,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C49>4,VLOOKUP(B49,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B49,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B49,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B49,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[44,"1.2.05d",6,null,"1.2.05d","Manipulation (eg adding, changing or deleting key information)?",{"$f":"VLOOKUP(E50,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E50,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E50,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E50,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C50>4,VLOOKUP(B50,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B50,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B50,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B50,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[45,"1.2.06",4,null,"1.2.06","Does your cyber security threat analysis cover:",null,null,{"$f":"IF(VLOOKUP(E51,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E51,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C51>4,VLOOKUP(B51,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B51,3),\"\")","v":""},{"$f":"VLOOKUP(B51,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B51,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[46,"1.2.06a",6,null,"1.2.06a","The ‘attacker kill chain’ (ie reconnaissance, weaponize, deliver, exploit, install, command & control and act on objectives)?",{"$f":"VLOOKUP(E52,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E52,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E52,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E52,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C52>4,VLOOKUP(B52,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B52,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B52,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B52,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[47,"1.2.06b",6,null,"1.2.06b","Both the attacker and defender aspects of an attack?",{"$f":"VLOOKUP(E53,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E53,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E53,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E53,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C53>4,VLOOKUP(B53,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B53,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B53,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B53,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[48,"1.2.07",4,null,"1.2.07","Do you put your cyber security threat analysis into context, based on a solid understanding of:",null,null,{"$f":"IF(VLOOKUP(E54,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E54,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C54>4,VLOOKUP(B54,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B54,3),\"\")","v":""},{"$f":"VLOOKUP(B54,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B54,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[49,"1.2.07a",6,null,"1.2.07a","The nature of your business, business strategy, business processes and risk appetite?",{"$f":"VLOOKUP(E55,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E55,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E55,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E55,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C55>4,VLOOKUP(B55,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B55,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B55,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B55,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[50,"1.2.07b",6,null,"1.2.07b","Key dependencies your organisation has; for example on people, technology, suppliers, partners and the environment in which you operate?",{"$f":"VLOOKUP(E56,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E56,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E56,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E56,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C56>4,VLOOKUP(B56,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B56,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B56,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B56,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[51,"1.2.07c",6,null,"1.2.07c","The assets which are most likely to be targeted, such as infrastructure, money, intellectual property or people – and the computer systems that support them?",{"$f":"VLOOKUP(E57,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E57,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E57,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E57,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C57>4,VLOOKUP(B57,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B57,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B57,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B57,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[52,"1.2.08",5,null,"1.2.08","Does your threat analysis include information from cyber security threat intelligence sources?",{"$f":"VLOOKUP(E58,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E58,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E58,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E58,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C58>4,VLOOKUP(B58,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B58,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B58,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B58,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[53,"1.2.09",4,null,"1.2.09","Do your cyber security threat intelligence sources include information:",null,null,{"$f":"IF(VLOOKUP(E59,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E59,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C59>4,VLOOKUP(B59,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B59,3),\"\")","v":""},{"$f":"VLOOKUP(B59,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B59,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[54,"1.2.09a",6,null,"1.2.09a","You have specially compiled in your own organisation?",{"$f":"VLOOKUP(E60,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E60,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E60,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E60,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C60>4,VLOOKUP(B60,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B60,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B60,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B60,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[55,"1.2.09b",6,null,"1.2.09b","Obtained from the government, collaborative groups, competitors or CERTs and vendors)?",{"$f":"VLOOKUP(E61,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E61,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E61,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E61,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C61>4,VLOOKUP(B61,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B61,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B61,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B61,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[56,"1.2.09c",6,null,"1.2.09c","Purchased from reputable vendors?",{"$f":"VLOOKUP(E62,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E62,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E62,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E62,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C62>4,VLOOKUP(B62,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B62,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B62,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B62,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[57,"1.2.10",5,null,"1.2.10","Does your threat analysis include actionable cyber security threat intelligence, enabling positive changes to be made immediately?",{"$f":"VLOOKUP(E63,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E63,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E63,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E63,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C63>4,VLOOKUP(B63,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B63,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B63,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B63,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[58,"1.2.11",5,null,"1.2.11","Do you perform realistic simulations of possible cyber security incidents (eg by carrying out scenario testing)?",{"$f":"VLOOKUP(E64,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E64,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E64,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E64,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C64>4,VLOOKUP(B64,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B64,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B64,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B64,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[59,"1.2.12",4,null,"1.2.12","Do you make scenario testing more effective by ensuring it includes:",null,null,{"$f":"IF(VLOOKUP(E65,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E65,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C65>4,VLOOKUP(B65,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B65,3),\"\")","v":""},{"$f":"VLOOKUP(B65,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B65,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[60,"1.2.12a",6,null,"1.2.12a","Simulating a real attack as closely as possible?",{"$f":"VLOOKUP(E66,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E66,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E66,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E66,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C66>4,VLOOKUP(B66,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B66,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B66,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B66,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[61,"1.2.12b",6,null,"1.2.12b","Evaluating situational awareness and applicability to your organisation?",{"$f":"VLOOKUP(E67,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E67,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E67,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E67,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C67>4,VLOOKUP(B67,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B67,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B67,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B67,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[62,"1.2.12c",6,null,"1.2.12c","Initiating a fictional (but realistic) attack internally and assessing how well you can respond to it?",{"$f":"VLOOKUP(E68,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E68,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E68,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E68,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C68>4,VLOOKUP(B68,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B68,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B68,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B68,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[63,"1.2.13",4,null,"1.2.13","Do you carry out cyber security scenarios:",null,null,{"$f":"IF(VLOOKUP(E69,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E69,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C69>4,VLOOKUP(B69,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B69,3),\"\")","v":""},{"$f":"VLOOKUP(B69,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B69,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[64,"1.2.13a",6,null,"1.2.13a","That result in different outcomes such as unavailability, data theft and data/systems corruption?",{"$f":"VLOOKUP(E70,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E70,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E70,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E70,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C70>4,VLOOKUP(B70,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B70,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B70,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B70,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[65,"1.2.13b",6,null,"1.2.13b","Where your systems and/or data have suffered integrity loss?",{"$f":"VLOOKUP(E71,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E71,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E71,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E71,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C71>4,VLOOKUP(B71,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B71,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B71,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B71,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[66,{"$f":"VLOOKUP(A72,contentref,2,FALSE)","v":"1.2.14"},{"$f":"VLOOKUP(A72,contentref,15,FALSE)","v":5},null,{"$f":"IF(C72=1,\"Phase \"&B72,IF(C72=2,\"Step \"&VLOOKUP(A72,contentref,4,FALSE),B72))","v":"1.2.14"},{"$f":"VLOOKUP(A72,contentref,7,FALSE)","v":"Do you carry out periodic scenario-based training, helping to ensure that relevant individuals understand their role and prepare them to handle cyber security incidents?"},{"$f":"VLOOKUP(E72,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E72,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E72,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E72,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C72>4,VLOOKUP(B72,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B72,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B72,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B72,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[67,"1.2.15",5,null,"1.2.15","Does this scenario-based training work through a series of attack scenarios fine-tuned to the threats and vulnerabilities your organisation face?",{"$f":"VLOOKUP(E73,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E73,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E73,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E73,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C73>4,VLOOKUP(B73,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B73,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B73,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B73,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$f":"W73*V73*3","v":15}]
[68,"1.2.16",5,null,"1.2.16","Do you evaluate newly emerging methods of conducting more advanced cyber security threat analysis to help improve the effectiveness of your cyber security threat analysis?",{"$f":"VLOOKUP(E74,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E74,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E74,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E74,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C74>4,VLOOKUP(B74,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B74,3),\"\")","v":"1.2"},{"$f":"VLOOKUP(B74,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B74,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[69,"1.3",2,null,"Step 3","People, Process, Technology and Information",{"$f":"\"Maturity level:  \"&O75","v":"Maturity level:  Level 1"},null,null,null,null,{"$f":"TEXT(B75,\"0.0\")","v":"1.3"},{"$f":"SUMIF(U:U,L75,H:H)/(SUMIF(U:U,L75,X:X))","v":0},{"$f":"HLOOKUP(M75*100,level_ref,2,TRUE)","v":"Level 1"},{"$f":"IF(ISERROR(N75),\"\",N75)","v":"Level 1"},{"$f":"HLOOKUP(M75*100,level_ref,3,TRUE)","v":1},{"$f":"IF(ISERROR(P75),\"\",P75)","v":1},null,null,null,{"$f":"IF(AND(C75>4,VLOOKUP(B75,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B75,3),\"\")","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(B75,Weightings!T:X,5,FALSE)","v":{"$error":"#N/A"}},{"$f":"IF(VLOOKUP(B75,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#N/A"}]
[70,"",3,null,"","People",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C76>4,VLOOKUP(B76,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B76,3),\"\")","v":""},{"$f":"VLOOKUP(B76,Weightings!T:X,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(B76,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[71,"1.3.01",5,null,"1.3.01","Do you have a point of contact for handling cyber security incidents?",{"$f":"VLOOKUP(E77,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E77,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E77,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E77,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C77>4,VLOOKUP(B77,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B77,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B77,Weightings!T:X,5,FALSE)","v":1},{"$f":"IF(VLOOKUP(B77,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},3]
[72,"1.3.02",4,null,"1.3.02","Have all employees been:",null,null,{"$f":"IF(VLOOKUP(E78,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E78,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C78>4,VLOOKUP(B78,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B78,3),\"\")","v":""},{"$f":"VLOOKUP(B78,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B78,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[73,"1.3.02a",6,null,"1.3.02a","Made aware of the risk from cyber security attacks",{"$f":"VLOOKUP(E79,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E79,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E79,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E79,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C79>4,VLOOKUP(B79,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B79,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B79,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B79,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[74,"1.3.02b",6,null,"1.3.02b","Briefed on how to report actual and suspected cyber security incidents?",{"$f":"VLOOKUP(E80,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E80,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E80,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E80,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C80>4,VLOOKUP(B80,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B80,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B80,Weightings!T:X,5,FALSE)","v":1},{"$f":"IF(VLOOKUP(B80,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},3]
[75,"1.3.02c",6,null,"1.3.02c","Shown how to help reduce the likelihood and frequency of these attacks?",{"$f":"VLOOKUP(E81,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E81,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E81,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E81,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C81>4,VLOOKUP(B81,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B81,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B81,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B81,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[76,"1.3.03",5,null,"1.3.03","Do you have a cyber security incident response team?",{"$f":"VLOOKUP(E82,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E82,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E82,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E82,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C82>4,VLOOKUP(B82,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B82,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B82,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B82,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[77,"1.3.04",4,null,"1.3.04","Does your cyber security incident response team understand the:",null,null,{"$f":"IF(VLOOKUP(E83,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E83,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C83>4,VLOOKUP(B83,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B83,3),\"\")","v":""},{"$f":"VLOOKUP(B83,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B83,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[78,"1.3.04a",6,null,"1.3.04a","Key concepts of cyber security incident response (eg drivers, definitions, approaches)?",{"$f":"VLOOKUP(E84,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E84,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E84,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E84,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C84>4,VLOOKUP(B84,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B84,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B84,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B84,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[79,"1.3.04b",6,null,"1.3.04b","Requirements for reporting certain types of cyber security incident?",{"$f":"VLOOKUP(E85,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E85,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E85,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E85,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C85>4,VLOOKUP(B85,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B85,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B85,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B85,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[80,"1.3.05",4,null,"1.3.05","Is your cyber security incident response team:",null,null,{"$f":"IF(VLOOKUP(E86,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E86,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C86>4,VLOOKUP(B86,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B86,3),\"\")","v":""},{"$f":"VLOOKUP(B86,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B86,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[81,"1.3.05a",6,null,"1.3.05a","Supported by key stakeholders, such as senior management, the PR department, HR, Legal, IT and business unit management",{"$f":"VLOOKUP(E87,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E87,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E87,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E87,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C87>4,VLOOKUP(B87,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B87,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B87,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B87,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[82,"1.3.05b",6,null,"1.3.05b","Given the authority to confiscate or disconnect equipment and monitor suspicious activity",{"$f":"VLOOKUP(E88,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E88,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E88,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E88,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C88>4,VLOOKUP(B88,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B88,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B88,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B88,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[83,"1.3.05c",6,null,"1.3.05c","Able to undertake external communications and information sharing (eg what can be shared with whom, when, and over what channels)",{"$f":"VLOOKUP(E89,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E89,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E89,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E89,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C89>4,VLOOKUP(B89,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B89,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B89,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B89,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[84,"1.3.05d",6,null,"1.3.05d","Clear about escalation points in the cyber security incident management process",{"$f":"VLOOKUP(E90,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E90,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E90,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E90,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C90>4,VLOOKUP(B90,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B90,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B90,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B90,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[85,"1.3.06",4,null,"1.3.06","Is your cyber security incident response team empowered – without fear of blame or recrimination - to:",null,null,{"$f":"IF(VLOOKUP(E91,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E91,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C91>4,VLOOKUP(B91,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B91,3),\"\")","v":""},{"$f":"VLOOKUP(B91,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B91,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[86,"1.3.06a",6,null,"1.3.06a","Escalate the problem to management in a timely manner?",{"$f":"VLOOKUP(E92,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E92,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E92,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E92,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C92>4,VLOOKUP(B92,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B92,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B92,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B92,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[87,"1.3.06b",6,null,"1.3.06b","Explain the possible consequences of the cyber security incident – and its potential impact on the business?",{"$f":"VLOOKUP(E93,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E93,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E93,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E93,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C93>4,VLOOKUP(B93,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B93,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B93,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B93,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[88,"1.3.06c",6,null,"1.3.06c","Get relevant outsiders involved?",{"$f":"VLOOKUP(E94,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E94,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E94,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E94,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C94>4,VLOOKUP(B94,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B94,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B94,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B94,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[89,"1.3.07",4,null,"1.3.07","Does your cyber security incident response team have access to individuals (internal and external) who have a deep understanding about:",null,null,{"$f":"IF(VLOOKUP(E95,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E95,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C95>4,VLOOKUP(B95,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B95,3),\"\")","v":""},{"$f":"VLOOKUP(B95,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B95,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[90,"1.3.07a",6,null,"1.3.07a","How to carry out sophisticated cyber security incident investigations quickly and effectively",{"$f":"VLOOKUP(E96,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E96,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E96,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E96,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C96>4,VLOOKUP(B96,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B96,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B96,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B96,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[91,"1.3.07b",6,null,"1.3.07b","The different types of cyber security attacker (and how they operate)?",{"$f":"VLOOKUP(E97,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E97,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E97,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E97,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C97>4,VLOOKUP(B97,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B97,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B97,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B97,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[92,"1.3.07c",6,null,"1.3.07c","Advanced persistent threats?",{"$f":"VLOOKUP(E98,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E98,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E98,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E98,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C98>4,VLOOKUP(B98,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B98,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B98,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B98,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[93,"1.3.07d",6,null,"1.3.07d","Methods of compromising systems?",{"$f":"VLOOKUP(E99,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E99,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E99,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E99,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C99>4,VLOOKUP(B99,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B99,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B99,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B99,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[94,"1.3.07e",6,null,"1.3.07e","Sophisticated analysis of malware?",{"$f":"VLOOKUP(E100,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E100,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E100,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E100,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C100>4,VLOOKUP(B100,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B100,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B100,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B100,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[95,"1.3.07f",6,null,"1.3.07f","Forensics?",{"$f":"VLOOKUP(E101,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E101,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E101,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E101,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C101>4,VLOOKUP(B101,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B101,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B101,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B101,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[96,"1.3.08",5,null,"1.3.08","Does your cyber security incident team have a cyber security incident response toolkit to help investigations?",{"$f":"VLOOKUP(E102,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E102,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E102,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E102,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C102>4,VLOOKUP(B102,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B102,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B102,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B102,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[97,"1.3.09",4,null,"1.3.09","Does your cyber security incident response toolkit include:",null,null,{"$f":"IF(VLOOKUP(E103,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E103,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C103>4,VLOOKUP(B103,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B103,3),\"\")","v":""},{"$f":"VLOOKUP(B103,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B103,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[98,"1.3.09a",6,null,"1.3.09a","A suitable method for recording all aspects of the incident, ideally using a template to ensure a consistent, comprehensive approach?",{"$f":"VLOOKUP(E104,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E104,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E104,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E104,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C104>4,VLOOKUP(B104,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B104,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B104,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B104,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[99,"1.3.09b",6,null,"1.3.09b","Contact details of all key stakeholders, such as internal and external investigators, technical specialist, suppliers, legal resources, human resources, public relations and business management?",{"$f":"VLOOKUP(E105,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E105,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E105,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E105,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C105>4,VLOOKUP(B105,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B105,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B105,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B105,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[100,"1.3.09c",6,null,"1.3.09c","Incident analysis resources: such as port lists; packet sniffers and protocol analysers; documentation for security systems (eg IDS, SIEM, malware protection); network diagrams; and a list of critical assets.",{"$f":"VLOOKUP(E106,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E106,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E106,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E106,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C106>4,VLOOKUP(B106,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B106,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B106,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B106,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[101,"1.3.09d",6,null,"1.3.09d","Forensic imaging tools (eg an imaging laptop; encrypted disks for image storage; mobile phone; digital camera / recorder; portable printer; removable media with trusted versions of programs; and evidence gathering accessories)?",{"$f":"VLOOKUP(E107,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E107,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E107,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E107,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C107>4,VLOOKUP(B107,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B107,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B107,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B107,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[102,"1.3.09e",6,null,"1.3.09e","Physical tools (eg screwdrivers, Allen keys, wire cutters, evidence bags, gloves and torch)?",{"$f":"VLOOKUP(E108,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E108,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E108,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E108,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C108>4,VLOOKUP(B108,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B108,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B108,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B108,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[103,"",3,null,"","Process",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C109>4,VLOOKUP(B109,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B109,3),\"\")","v":""},{"$f":"VLOOKUP(B109,Weightings!T:X,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(B109,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[104,"1.3.10",4,null,"1.3.10","Do you have:",null,null,{"$f":"IF(VLOOKUP(E110,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E110,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C110>4,VLOOKUP(B110,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B110,3),\"\")","v":""},{"$f":"VLOOKUP(B110,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B110,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[105,"1.3.10a",6,null,"1.3.10a","Policies, processes, plans or methodologies to help you respond to cyber security incidents effectively?",{"$f":"VLOOKUP(E111,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E111,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E111,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E111,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C111>4,VLOOKUP(B111,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B111,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B111,Weightings!T:X,5,FALSE)","v":1},{"$f":"IF(VLOOKUP(B111,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},3]
[106,"1.3.10b",6,null,"1.3.10b","A formal cyber security incident response process?",{"$f":"VLOOKUP(E112,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E112,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E112,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E112,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C112>4,VLOOKUP(B112,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B112,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B112,Weightings!T:X,5,FALSE)","v":1},{"$f":"IF(VLOOKUP(B112,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},3]
[107,"1.3.10c",6,null,"1.3.10c","A strategic approach for handling cyber security incidents?",{"$f":"VLOOKUP(E113,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E113,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E113,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E113,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C113>4,VLOOKUP(B113,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B113,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B113,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B113,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[108,"1.3.11",4,null,"1.3.11","Does your cyber security incident response strategy include:",null,null,{"$f":"IF(VLOOKUP(E114,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E114,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C114>4,VLOOKUP(B114,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B114,3),\"\")","v":""},{"$f":"VLOOKUP(B114,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B114,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[109,"1.3.11a",6,null,"1.3.11a","Identifying the key components of an effective cyber security incident response process?",{"$f":"VLOOKUP(E115,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E115,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E115,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E115,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C115>4,VLOOKUP(B115,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B115,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B115,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B115,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[110,"1.3.11b",6,null,"1.3.11b","Aligning cyber security incident response with business continuity plans and arrangements?",{"$f":"VLOOKUP(E116,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E116,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E116,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E116,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C116>4,VLOOKUP(B116,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B116,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B116,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B116,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[111,"1.3.11c",6,null,"1.3.11c","Addressing arrangements corporate-wide (including third parties, where needed)?",{"$f":"VLOOKUP(E117,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E117,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E117,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E117,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C117>4,VLOOKUP(B117,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B117,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B117,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B117,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[112,"1.3.11d",6,null,"1.3.11d","Providing sufficient funding and resources to deal with cyber security incidents effectively?",{"$f":"VLOOKUP(E118,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E118,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E118,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E118,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C118>4,VLOOKUP(B118,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B118,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B118,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B118,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[113,"1.3.11e",6,null,"1.3.11e","Appointing individuals in advance who have sufficient decision-making authority to take action fast in an emergency situation?",{"$f":"VLOOKUP(E119,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E119,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E119,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E119,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C119>4,VLOOKUP(B119,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B119,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B119,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B119,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[114,"1.3.11f",6,null,"1.3.11f","Determining what activities should be outsourced to an external cyber security incident response specialist",{"$f":"VLOOKUP(E120,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E120,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E120,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E120,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C120>4,VLOOKUP(B120,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B120,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B120,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B120,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[115,"1.3.11g",6,null,"1.3.11g","Developing criteria upon which to base selection of the right cyber security incident response providers, ensuring value for money?",{"$f":"VLOOKUP(E121,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E121,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E121,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E121,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C121>4,VLOOKUP(B121,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B121,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B121,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B121,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[116,"1.3.11h",6,null,"1.3.11h","Evaluating the benefits offered by appropriately certified cyber security incident response providers?",{"$f":"VLOOKUP(E122,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E122,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E122,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E122,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C122>4,VLOOKUP(B122,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B122,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B122,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B122,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[117,"1.3.12",4,null,"1.3.12","Does your cyber security incident response process take account of:",null,null,{"$f":"IF(VLOOKUP(E123,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E123,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C123>4,VLOOKUP(B123,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B123,3),\"\")","v":""},{"$f":"VLOOKUP(B123,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B123,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[118,"1.3.12a",6,null,"1.3.12a","Definitions required to support the Triage element of the cyber security incident process (eg to define what criteria re required to classify and prioritise incidents)?",{"$f":"VLOOKUP(E124,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E124,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E124,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E124,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C124>4,VLOOKUP(B124,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B124,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B124,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B124,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[119,"1.3.12b",6,null,"1.3.12b","Advice and guidance provided on government websites, such as the CESG Top ten steps to cyber security and GovCertUK incident response guidelines?",{"$f":"VLOOKUP(E125,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E125,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E125,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E125,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C125>4,VLOOKUP(B125,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B125,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B125,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B125,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[120,"1.3.12c",6,null,"1.3.12c","Publicly available traditional or cyber security specific incident response guides, such as the NIST Computer Security Handling Guide (Special Publication 800-61), the Responding to targeted cyber attacks report from ISACA (collaborating with E&Y) and the CREST Cyber Security Incident Response Guide?",{"$f":"VLOOKUP(E126,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E126,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E126,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E126,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C126>4,VLOOKUP(B126,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B126,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B126,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B126,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[121,"1.3.13",4,null,"1.3.13","Does your cyber security incident response process cover all stage of an investigation, which includes:",null,null,{"$f":"IF(VLOOKUP(E127,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E127,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C127>4,VLOOKUP(B127,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B127,3),\"\")","v":""},{"$f":"VLOOKUP(B127,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B127,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[122,"1.3.13a",6,null,"1.3.13a","Identifying cyber security incidents?",{"$f":"VLOOKUP(E128,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E128,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E128,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E128,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C128>4,VLOOKUP(B128,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B128,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B128,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B128,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[123,"1.3.13b",6,null,"1.3.13b","Investigating the situation (including triage)?",{"$f":"VLOOKUP(E129,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E129,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E129,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E129,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C129>4,VLOOKUP(B129,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B129,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B129,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B129,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[124,"1.3.13c",6,null,"1.3.13c","Taking appropriate action (eg contain incident and eradicate cause)?",{"$f":"VLOOKUP(E130,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E130,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E130,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E130,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C130>4,VLOOKUP(B130,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B130,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B130,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B130,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[125,"1.3.13d",6,null,"1.3.13d","Recovering systems, data and connectivity?",{"$f":"VLOOKUP(E131,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E131,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E131,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E131,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C131>4,VLOOKUP(B131,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B131,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B131,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B131,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[126,"1.3.14",4,null,"1.3.14","Does your cyber security incident response process state:",null,null,{"$f":"IF(VLOOKUP(E132,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E132,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C132>4,VLOOKUP(B132,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B132,3),\"\")","v":""},{"$f":"VLOOKUP(B132,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B132,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[127,"1.3.14a",6,null,"1.3.14a","Who should be responsible for each step?",{"$f":"VLOOKUP(E133,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E133,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E133,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E133,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C133>4,VLOOKUP(B133,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B133,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B133,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B133,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[128,"1.3.14b",6,null,"1.3.14b","How it should be carried out?",{"$f":"VLOOKUP(E134,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E134,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E134,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E134,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C134>4,VLOOKUP(B134,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B134,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B134,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B134,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[129,"1.3.14c",6,null,"1.3.14c","Who to contact for support?",{"$f":"VLOOKUP(E135,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E135,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E135,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E135,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C135>4,VLOOKUP(B135,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B135,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B135,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B135,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[130,{"$f":"VLOOKUP(A136,contentref,2,FALSE)","v":"1.3.15"},{"$f":"VLOOKUP(A136,contentref,15,FALSE)","v":5},null,{"$f":"IF(C136=1,\"Phase \"&B136,IF(C136=2,\"Step \"&VLOOKUP(A136,contentref,4,FALSE),B136))","v":"1.3.15"},{"$f":"VLOOKUP(A136,contentref,7,FALSE)","v":"Does your cyber security incident response process include pre-agreed response actions (eg using attack play-books) for particular situations"},{"$f":"VLOOKUP(E136,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E136,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E136,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E136,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C136>4,VLOOKUP(B136,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B136,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B136,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B136,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[131,"1.3.16",4,null,"1.3.16","Is your cyber security incident response process integrated with:",null,null,{"$f":"IF(VLOOKUP(E137,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E137,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C137>4,VLOOKUP(B137,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B137,3),\"\")","v":""},{"$f":"VLOOKUP(B137,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B137,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$f":"W137*V137*3","v":{"$error":"#VALUE!"}}]
[132,"1.3.16a",6,null,"1.3.16a","Relevant day-to-day third parties (eg suppliers, partners and customers)?",{"$f":"VLOOKUP(E138,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E138,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E138,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E138,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C138>4,VLOOKUP(B138,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B138,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B138,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B138,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[133,"1.3.16b",6,null,"1.3.16b","Specialist third party security experts, such as outsourced security services (eg security device management) to Managed Security Services Providers (MSSP) or a Security Operations Centre (SOC)?",{"$f":"VLOOKUP(E139,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E139,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E139,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E139,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C139>4,VLOOKUP(B139,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B139,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B139,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B139,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[134,"1.3.16c",6,null,"1.3.16c","Human Resources (HR), if prosecution is likely or the culprit is suspected to be internal?",{"$f":"VLOOKUP(E140,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E140,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E140,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E140,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C140>4,VLOOKUP(B140,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B140,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B140,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B140,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[135,"1.3.16d",6,null,"1.3.16d","Legal counsel and Public Relations (PR)?",{"$f":"VLOOKUP(E141,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E141,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E141,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E141,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C141>4,VLOOKUP(B141,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B141,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B141,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B141,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[136,"1.3.17",4,null,"1.3.17","Does your cyber security incident response process address important security requirements during the investigation, which includes:",null,null,{"$f":"IF(VLOOKUP(E142,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E142,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C142>4,VLOOKUP(B142,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B142,3),\"\")","v":""},{"$f":"VLOOKUP(B142,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B142,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[137,"1.3.17a",6,null,"1.3.17a","Maintaining the integrity of your most important data in a compromised environment)?",{"$f":"VLOOKUP(E143,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E143,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E143,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E143,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C143>4,VLOOKUP(B143,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B143,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B143,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B143,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[138,"1.3.17b",6,null,"1.3.17b","Preventing (or reducing) unauthorised disclosure of confidential information?",{"$f":"VLOOKUP(E144,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E144,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E144,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E144,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C144>4,VLOOKUP(B144,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B144,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B144,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B144,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[139,"1.3.17c",6,null,"1.3.17c","Complying with data privacy or data protection requirements (eg reporting the loss of personal data)?",{"$f":"VLOOKUP(E145,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E145,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E145,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E145,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C145>4,VLOOKUP(B145,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B145,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B145,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B145,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[140,"1.3.17d",6,null,"1.3.17d","Monitoring new (and existing) vulnerabilities during the cyber security attack?",{"$f":"VLOOKUP(E146,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E146,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E146,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E146,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C146>4,VLOOKUP(B146,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B146,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B146,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B146,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[141,"1.3.18",4,null,"1.3.18","Has your cyber security incident response process been:",null,null,{"$f":"IF(VLOOKUP(E147,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E147,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C147>4,VLOOKUP(B147,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B147,3),\"\")","v":""},{"$f":"VLOOKUP(B147,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B147,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[142,"1.3.18a",6,null,"1.3.18a","Signed off by appropriate management?",{"$f":"VLOOKUP(E148,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E148,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E148,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E148,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C148>4,VLOOKUP(B148,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B148,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B148,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B148,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[143,"1.3.18b",6,null,"1.3.18b","Kept up to date?",{"$f":"VLOOKUP(E149,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E149,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E149,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E149,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C149>4,VLOOKUP(B149,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B149,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B149,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B149,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[144,"1.3.18c",6,null,"1.3.18c","Reviewed on a regular basis?",{"$f":"VLOOKUP(E150,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E150,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E150,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E150,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C150>4,VLOOKUP(B150,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B150,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B150,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B150,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[145,"1.3.19",4,null,"1.3.19","Does your cyber security incident response process enable you to respond to a cyber security incident:",null,null,{"$f":"IF(VLOOKUP(E151,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E151,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C151>4,VLOOKUP(B151,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B151,3),\"\")","v":""},{"$f":"VLOOKUP(B151,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B151,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[146,"1.3.19a",6,null,"1.3.19a","Quickly (ie within critical timescales)?",{"$f":"VLOOKUP(E152,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E152,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E152,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E152,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C152>4,VLOOKUP(B152,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B152,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B152,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B152,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[147,"1.3.19b",6,null,"1.3.19b","Effectively (ensuring that all services have been restored to working order)?",{"$f":"VLOOKUP(E153,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E153,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E153,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E153,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C153>4,VLOOKUP(B153,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B153,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B153,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B153,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[148,"1.3.19c",6,null,"1.3.19c","In a consistent manner?",{"$f":"VLOOKUP(E154,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E154,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E154,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E154,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C154>4,VLOOKUP(B154,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B154,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B154,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B154,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[149,"1.3.20",4,null,"1.3.20","Does your cyber security incident response process enable you to:",null,null,{"$f":"IF(VLOOKUP(E155,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E155,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C155>4,VLOOKUP(B155,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B155,3),\"\")","v":""},{"$f":"VLOOKUP(B155,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B155,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[150,"1.3.20a",6,null,"1.3.20a","Cope with many different scenarios?",{"$f":"VLOOKUP(E156,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E156,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E156,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E156,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C156>4,VLOOKUP(B156,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B156,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B156,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B156,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[151,"1.3.20b",6,null,"1.3.20b","Proactively implement and adapt approaches as needed?",{"$f":"VLOOKUP(E157,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E157,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E157,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E157,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C157>4,VLOOKUP(B157,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B157,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B157,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B157,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[152,"1.3.21",4,null,"1.3.21","Is your cyber security incident response process tested:",null,null,{"$f":"IF(VLOOKUP(E158,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E158,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C158>4,VLOOKUP(B158,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B158,3),\"\")","v":""},{"$f":"VLOOKUP(B158,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B158,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[153,"1.3.21a",6,null,"1.3.21a","Thoroughly using a range of different scenarios?",{"$f":"VLOOKUP(E159,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E159,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E159,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E159,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C159>4,VLOOKUP(B159,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B159,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B159,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B159,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[154,"1.3.21b",6,null,"1.3.21b","On a regular basis?",{"$f":"VLOOKUP(E160,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E160,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E160,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E160,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C160>4,VLOOKUP(B160,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B160,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B160,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B160,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[155,"1.3.21c",6,null,"1.3.21c","In conjunction with relevant third parties?",{"$f":"VLOOKUP(E161,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E161,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E161,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E161,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C161>4,VLOOKUP(B161,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B161,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B161,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B161,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[156,"1.3.22",5,null,"1.3.22","Do you analyse the results of these tests?",{"$f":"VLOOKUP(E162,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E162,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E162,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E162,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C162>4,VLOOKUP(B162,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B162,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B162,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B162,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[157,"1.3.23",5,null,"1.3.23","Do you address weaknesses identified during these tests?",{"$f":"VLOOKUP(E163,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E163,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E163,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E163,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C163>4,VLOOKUP(B163,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B163,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B163,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B163,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[158,"",3,null,"","Technology",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C164>4,VLOOKUP(B164,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B164,3),\"\")","v":""},{"$f":"VLOOKUP(B164,Weightings!T:X,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(B164,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[159,"1.3.23",5,null,"1.3.23","Do you have technical arrangements to support cyber security incident response?",{"$f":"VLOOKUP(E165,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E165,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E165,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E165,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C165>4,VLOOKUP(B165,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B165,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B165,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B165,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[160,"1.3.24",4,null,"1.3.24","Do your technical arrangements for supporting cyber security incident response provide you (and any relevant third parties) with sufficient understanding of:",null,null,{"$f":"IF(VLOOKUP(E166,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E166,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C166>4,VLOOKUP(B166,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B166,3),\"\")","v":""},{"$f":"VLOOKUP(B166,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B166,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[161,"1.3.24a",6,null,"1.3.24a","Your IT infrastructure?",{"$f":"VLOOKUP(E167,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E167,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E167,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E167,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C167>4,VLOOKUP(B167,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B167,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B167,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B167,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[162,"1.3.24b",6,null,"1.3.24b","The topology of your networks (eg via a suitable network diagram)?",{"$f":"VLOOKUP(E168,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E168,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E168,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E168,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C168>4,VLOOKUP(B168,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B168,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B168,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B168,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[163,"1.3.25",4,null,"1.3.25","Do your technical arrangements for supporting cyber security incident response include:",null,null,{"$f":"IF(VLOOKUP(E169,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E169,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C169>4,VLOOKUP(B169,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B169,3),\"\")","v":""},{"$f":"VLOOKUP(B169,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B169,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[164,"1.3.25a",6,null,"1.3.25a","An appropriate set of incident response tools?",{"$f":"VLOOKUP(E170,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E170,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E170,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E170,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C170>4,VLOOKUP(B170,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B170,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B170,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B170,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[165,"1.3.25b",6,null,"1.3.25b","Implementing technical controls like firewalls, mail filters and intrusion detection systems (IDS) or data loss prevention (DLP) technology?",{"$f":"VLOOKUP(E171,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E171,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E171,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E171,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C171>4,VLOOKUP(B171,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B171,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B171,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B171,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[166,"1.3.25c",6,null,"1.3.25c","Logging the right events and turning on the appropriate logging features?",{"$f":"VLOOKUP(E172,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E172,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E172,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E172,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C172>4,VLOOKUP(B172,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B172,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B172,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B172,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[167,"1.3.25d",6,null,"1.3.25d","Maintaining sufficient historical data (eg because logs are overwritten or you do not have sufficient storage space)?",{"$f":"VLOOKUP(E173,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E173,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E173,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E173,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C173>4,VLOOKUP(B173,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B173,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B173,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B173,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[168,"1.3.25e",6,null,"1.3.25e","Deploying other suitable technical controls, as required, such as patching?",{"$f":"VLOOKUP(E174,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E174,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E174,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E174,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C174>4,VLOOKUP(B174,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B174,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B174,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B174,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[169,"1.3.25f",6,null,"1.3.25f","Identifying your Internet points of presence (‘touch points’)?",{"$f":"VLOOKUP(E175,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E175,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E175,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E175,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C175>4,VLOOKUP(B175,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B175,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B175,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B175,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[170,"1.3.26",5,null,"1.3.26","Do your technical arrangements for support cyber security incident response provide you with enough relevant knowledge to conduct a suitable investigation?",{"$f":"VLOOKUP(E176,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E176,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E176,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E176,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C176>4,VLOOKUP(B176,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B176,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B176,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B176,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[171,"",3,null,"","Information",null,null,null,null,null,{"$f":"TEXT(B177,\"0.0\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(AND(C177>4,VLOOKUP(B177,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B177,3),\"\")","v":""},{"$f":"VLOOKUP(B177,Weightings!T:X,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(B177,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[172,"1.3.27",5,null,"1.3.27","Do you have information readily available that will help the cyber security incident response team (including third party experts) to respond quickly and effectively?",{"$f":"VLOOKUP(E178,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E178,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E178,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E178,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C178>4,VLOOKUP(B178,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B178,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B178,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B178,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[173,"1.3.28",4,null,"1.3.28","Does this information include relevant details about:",null,null,{"$f":"IF(VLOOKUP(E179,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E179,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C179>4,VLOOKUP(B179,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B179,3),\"\")","v":""},{"$f":"VLOOKUP(B179,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B179,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[174,"1.3.28a",6,null,"1.3.28a","Business management (eg what the business does, main point(s) of contact, approach to business impact assessment)?",{"$f":"VLOOKUP(E180,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E180,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E180,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E180,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C180>4,VLOOKUP(B180,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B180,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B180,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B180,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[175,"1.3.28b",6,null,"1.3.28b","IT infrastructure (eg network diagrams, system architecture and layout)?",{"$f":"VLOOKUP(E181,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E181,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E181,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E181,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C181>4,VLOOKUP(B181,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B181,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B181,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B181,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[176,"1.3.28c",6,null,"1.3.28c","Data (eg what type of information is processed, where and how)?",{"$f":"VLOOKUP(E182,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E182,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E182,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E182,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C182>4,VLOOKUP(B182,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B182,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B182,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B182,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[177,"1.3.28d",6,null,"1.3.28d","Event logging (eg what types of data and events are logged; on which systems; how and when; as well as how this data is collated and analysed)?",{"$f":"VLOOKUP(E183,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E183,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E183,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E183,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C183>4,VLOOKUP(B183,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B183,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B183,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B183,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[178,"1.3.29",4,null,"1.3.29","In the event of a cyber security incident are you able to quickly get relevant information from:",null,null,{"$f":"IF(VLOOKUP(E184,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E184,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C184>4,VLOOKUP(B184,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B184,3),\"\")","v":""},{"$f":"VLOOKUP(B184,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B184,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[179,"1.3.29a",6,null,"1.3.29a","Technical security specialists?",{"$f":"VLOOKUP(E185,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E185,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E185,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E185,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C185>4,VLOOKUP(B185,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B185,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B185,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B185,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[180,"1.3.29b",6,null,"1.3.29b","Relevant business representatives?",{"$f":"VLOOKUP(E186,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E186,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E186,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E186,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C186>4,VLOOKUP(B186,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B186,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B186,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B186,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[181,"1.3.29c",6,null,"1.3.29c","Your Crisis Management Team?",{"$f":"VLOOKUP(E187,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E187,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E187,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E187,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C187>4,VLOOKUP(B187,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B187,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B187,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B187,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[182,"1.3.29d",6,null,"1.3.29d","Legal or HR specialists?",{"$f":"VLOOKUP(E188,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E188,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E188,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E188,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C188>4,VLOOKUP(B188,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B188,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B188,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B188,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[183,"1.3.30",4,null,"1.3.30","In the event of a cyber security incident are you able to:",null,null,{"$f":"IF(VLOOKUP(E189,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E189,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C189>4,VLOOKUP(B189,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B189,3),\"\")","v":""},{"$f":"VLOOKUP(B189,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B189,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[184,"1.3.30a",6,null,"1.3.30a","Gain fast access to facilities at your outsourced service providers (ie access to premises or equipment)?",{"$f":"VLOOKUP(E190,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E190,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E190,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E190,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C190>4,VLOOKUP(B190,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B190,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B190,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B190,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[185,"1.3.30b",6,null,"1.3.30b","Obtain essential supporting information (eg event logs) from all your third party suppliers (eg cloud service suppliers, infrastructure outsourcers and managed service providers) in a timely and suitable manner?",{"$f":"VLOOKUP(E191,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E191,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E191,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E191,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C191>4,VLOOKUP(B191,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B191,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B191,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B191,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[186,"1.3.30c",6,null,"1.3.30c","Contact relevant people in third parties who would be impacted if your organisation had to operate in a degraded capacity?",{"$f":"VLOOKUP(E192,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E192,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E192,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E192,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C192>4,VLOOKUP(B192,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B192,3),\"\")","v":"1.3"},{"$f":"VLOOKUP(B192,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B192,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[187,"1.4",2,null,"Step 4","Control environment",{"$f":"\"Maturity level:  \"&O193","v":"Maturity level:  Level 1"},null,null,null,null,{"$f":"TEXT(B193,\"0.0\")","v":"1.4"},{"$f":"SUMIF(U:U,L193,H:H)/(SUMIF(U:U,L193,X:X))","v":0},{"$f":"HLOOKUP(M193*100,level_ref,2,TRUE)","v":"Level 1"},{"$f":"IF(ISERROR(N193),\"\",N193)","v":"Level 1"},{"$f":"HLOOKUP(M193*100,level_ref,3,TRUE)","v":1},{"$f":"IF(ISERROR(P193),\"\",P193)","v":1},null,null,null,{"$f":"IF(AND(C193>4,VLOOKUP(B193,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B193,3),\"\")","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(B193,Weightings!T:X,5,FALSE)","v":{"$error":"#N/A"}},{"$f":"IF(VLOOKUP(B193,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#N/A"}]
[188,"1.4.01",5,null,"1.4.01","Do you have a set of controls to help reduce the frequency and impact of cyber security incidents?",{"$f":"VLOOKUP(E194,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E194,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E194,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E194,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C194>4,VLOOKUP(B194,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B194,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B194,Weightings!T:X,5,FALSE)","v":1},{"$f":"IF(VLOOKUP(B194,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},3]
[189,"1.4.02",4,null,"1.4.02","Does your control set include basic controls to help support cyber security incident investigations, including:",null,null,{"$f":"IF(VLOOKUP(E195,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E195,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C195>4,VLOOKUP(B195,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B195,3),\"\")","v":""},{"$f":"VLOOKUP(B195,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B195,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[190,"1.4.02a",6,null,"1.4.02a","Information classification, labelling and handling techniques?",{"$f":"VLOOKUP(E196,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E196,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E196,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E196,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C196>4,VLOOKUP(B196,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B196,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B196,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B196,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[191,"1.4.02b",6,null,"1.4.02b","Access control arrangements?",{"$f":"VLOOKUP(E197,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E197,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E197,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E197,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C197>4,VLOOKUP(B197,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B197,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B197,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B197,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[192,"1.4.02c",6,null,"1.4.02c","Patch management?",{"$f":"VLOOKUP(E198,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E198,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E198,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E198,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C198>4,VLOOKUP(B198,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B198,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B198,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B198,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[193,"1.4.02d",6,null,"1.4.02d","Firewalls?",{"$f":"VLOOKUP(E199,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E199,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E199,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E199,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C199>4,VLOOKUP(B199,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B199,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B199,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B199,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[194,{"$f":"VLOOKUP(A200,contentref,2,FALSE)","v":"1.4.02e"},{"$f":"VLOOKUP(A200,contentref,15,FALSE)","v":6},null,{"$f":"IF(C200=1,\"Phase \"&B200,IF(C200=2,\"Step \"&VLOOKUP(A200,contentref,4,FALSE),B200))","v":"1.4.02e"},{"$f":"VLOOKUP(A200,contentref,7,FALSE)","v":"Malware protection?"},{"$f":"VLOOKUP(E200,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E200,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E200,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E200,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C200>4,VLOOKUP(B200,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B200,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B200,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B200,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[195,"1.4.02f",6,null,"1.4.02f","‘Secure’ configuration of servers and connected devices?",{"$f":"VLOOKUP(E201,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E201,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E201,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E201,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C201>4,VLOOKUP(B201,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B201,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B201,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B201,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$f":"W201*V201*3","v":6}]
[196,"1.4.02g",6,null,"1.4.02g","Backups?",{"$f":"VLOOKUP(E202,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E202,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E202,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E202,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C202>4,VLOOKUP(B202,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B202,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B202,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B202,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[197,"1.4.03",4,null,"1.4.03","Is your cyber security control set:",null,null,{"$f":"IF(VLOOKUP(E203,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E203,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C203>4,VLOOKUP(B203,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B203,3),\"\")","v":""},{"$f":"VLOOKUP(B203,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B203,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[198,"1.4.03a",6,null,"1.4.03a","Based on a formal cyber security framework, such as the SANS top 20 cyber security controls or the CESG 10 Steps to Cyber Security or PAS 55?",{"$f":"VLOOKUP(E204,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E204,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E204,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E204,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C204>4,VLOOKUP(B204,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B204,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B204,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B204,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[199,"1.4.03b",6,null,"1.4.03b","Signed-off by senior management?",{"$f":"VLOOKUP(E205,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E205,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E205,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E205,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C205>4,VLOOKUP(B205,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B205,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B205,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B205,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[200,"1.4.03c",6,null,"1.4.03c","Kept-up-to date?",{"$f":"VLOOKUP(E206,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E206,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E206,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E206,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C206>4,VLOOKUP(B206,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B206,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B206,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B206,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[201,"1.4.03d",6,null,"1.4.03d","Monitored for effectiveness?",{"$f":"VLOOKUP(E207,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E207,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E207,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E207,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C207>4,VLOOKUP(B207,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B207,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B207,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B207,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[202,"1.4.03e",6,null,"1.4.03e","Reviewed on a regular basis?",{"$f":"VLOOKUP(E208,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E208,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E208,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E208,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C208>4,VLOOKUP(B208,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B208,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B208,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B208,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[203,"1.4.04",5,null,"1.4.04","Do you provide internet access through a central corporate gateway, rather than locally?",{"$f":"VLOOKUP(E209,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E209,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E209,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E209,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C209>4,VLOOKUP(B209,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B209,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B209,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B209,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[204,"1.4.05",5,null,"1.4.05","Do you deploy technical security monitoring tools?",{"$f":"VLOOKUP(E210,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E210,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E210,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E210,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C210>4,VLOOKUP(B210,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B210,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B210,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B210,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[205,"1.4.06",4,null,"1.4.06","Do your technical security monitoring tools include:",null,null,{"$f":"IF(VLOOKUP(E211,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E211,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C211>4,VLOOKUP(B211,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B211,3),\"\")","v":""},{"$f":"VLOOKUP(B211,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B211,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[206,"1.4.06a",6,null,"1.4.06a","Intrusion prevention systems (IPS)?",{"$f":"VLOOKUP(E212,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E212,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E212,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E212,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C212>4,VLOOKUP(B212,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B212,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B212,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B212,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[207,"1.4.06b",6,null,"1.4.06b","Intrusion detection systems (IDS)?",{"$f":"VLOOKUP(E213,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E213,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E213,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E213,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C213>4,VLOOKUP(B213,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B213,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B213,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B213,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[208,"1.4.06c",6,null,"1.4.06c","Data loss preventions (DLP) systems?",{"$f":"VLOOKUP(E214,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E214,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E214,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E214,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C214>4,VLOOKUP(B214,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B214,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B214,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B214,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[209,"1.4.06d",6,null,"1.4.06d","A searchable incident event repository (SIEM)?",{"$f":"VLOOKUP(E215,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E215,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E215,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E215,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C215>4,VLOOKUP(B215,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B215,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B215,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B215,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[210,"1.4.06e",6,null,"1.4.06e","Commercial APT prevention tools?",{"$f":"VLOOKUP(E216,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E216,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E216,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E216,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C216>4,VLOOKUP(B216,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B216,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B216,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B216,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[211,"1.4.07",5,null,"1.4.07","Is your cyber security control set supplemented by specialised cyber security controls?",{"$f":"VLOOKUP(E217,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E217,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E217,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E217,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C217>4,VLOOKUP(B217,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B217,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B217,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B217,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[212,"1.4.08",4,null,"1.4.08","Do your specialised cyber security controls include:",null,null,{"$f":"IF(VLOOKUP(E218,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E218,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C218>4,VLOOKUP(B218,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B218,3),\"\")","v":""},{"$f":"VLOOKUP(B218,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B218,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[213,"1.4.08a",6,null,"1.4.08a","Multi factor authentication - something you know (eg a User ID and password) and something you have (eg an access, bank or smart card)?",{"$f":"VLOOKUP(E219,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E219,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E219,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E219,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C219>4,VLOOKUP(B219,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B219,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B219,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B219,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[214,"1.4.08b",6,null,"1.4.08b","Digital certificates used to “sign” code from a vendor so that the code can be trusted?",{"$f":"VLOOKUP(E220,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E220,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E220,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E220,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C220>4,VLOOKUP(B220,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B220,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B220,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B220,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[215,"1.4.08c",6,null,"1.4.08c","Whitelisting (defining all acceptable ports, addresses or similar – and preventing all other access) or blacklisting (preventing access from specific sites, or addresses)?",{"$f":"VLOOKUP(E221,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E221,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E221,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E221,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C221>4,VLOOKUP(B221,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B221,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B221,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B221,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[216,"1.4.09",5,null,"1.4.09","Is your cyber security control set supplemented by advanced cyber security controls?",{"$f":"VLOOKUP(E222,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E222,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E222,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E222,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C222>4,VLOOKUP(B222,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B222,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B222,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B222,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[217,"1.4.10",4,null,"1.4.10","Do your advanced cyber security controls include:",null,null,{"$f":"IF(VLOOKUP(E223,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E223,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C223>4,VLOOKUP(B223,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B223,3),\"\")","v":""},{"$f":"VLOOKUP(B223,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B223,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[218,"1.4.10a",6,null,"1.4.10a","Continuous monitoring (eg via a Security Operations centre (SOC)?",{"$f":"VLOOKUP(E224,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E224,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E224,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E224,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C224>4,VLOOKUP(B224,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B224,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B224,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B224,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[219,"1.4.10b",6,null,"1.4.10b","Proactive APT assessments?",{"$f":"VLOOKUP(E225,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E225,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E225,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E225,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C225>4,VLOOKUP(B225,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B225,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B225,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B225,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[220,"1.4.10c",6,null,"1.4.10c","Outbound gateway consolidation?",{"$f":"VLOOKUP(E226,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E226,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E226,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E226,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C226>4,VLOOKUP(B226,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B226,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B226,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B226,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[221,"1.4.10d",6,null,"1.4.10d","System virtualisation?",{"$f":"VLOOKUP(E227,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E227,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E227,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E227,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C227>4,VLOOKUP(B227,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B227,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B227,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B227,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[222,"1.4.10e",6,null,"1.4.10e","Sensitive network or data segregation?",{"$f":"VLOOKUP(E228,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E228,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E228,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E228,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C228>4,VLOOKUP(B228,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B228,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B228,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B228,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[223,"1.4.10f",6,null,"1.4.10f","Counterintelligence operations?",{"$f":"VLOOKUP(E229,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E229,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E229,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E229,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C229>4,VLOOKUP(B229,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B229,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B229,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B229,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[224,"1.4.11",4,null,"1.4.11","Does your cyber security control set help you to:",null,null,{"$f":"IF(VLOOKUP(E230,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E230,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C230>4,VLOOKUP(B230,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B230,3),\"\")","v":""},{"$f":"VLOOKUP(B230,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B230,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[225,"1.4.11a",6,null,"1.4.11a","Make it more difficult for attackers to be successful?",{"$f":"VLOOKUP(E231,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E231,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E231,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E231,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C231>4,VLOOKUP(B231,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B231,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B231,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B231,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[226,"1.4.11b",6,null,"1.4.11b","Detect that a cyber security attack is being planned - or is already underway?",{"$f":"VLOOKUP(E232,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E232,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E232,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E232,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C232>4,VLOOKUP(B232,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B232,3),\"\")","v":"1.4"},{"$f":"VLOOKUP(B232,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B232,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[227,"1.5",2,null,"Step 5","Maturity assessment",{"$f":"\"Maturity level:  \"&O233","v":"Maturity level:  Level 1"},null,null,null,null,{"$f":"TEXT(B233,\"0.0\")","v":"1.5"},{"$f":"SUMIF(U:U,L233,H:H)/(SUMIF(U:U,L233,X:X))","v":0},{"$f":"HLOOKUP(M233*100,level_ref,2,TRUE)","v":"Level 1"},{"$f":"IF(ISERROR(N233),\"\",N233)","v":"Level 1"},{"$f":"HLOOKUP(M233*100,level_ref,3,TRUE)","v":1},{"$f":"IF(ISERROR(P233),\"\",P233)","v":1},null,null,null,{"$f":"IF(AND(C233>4,VLOOKUP(B233,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B233,3),\"\")","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(B233,Weightings!T:X,5,FALSE)","v":{"$error":"#N/A"}},{"$f":"IF(VLOOKUP(B233,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#N/A"}]
[228,"1.5.01",5,null,"1.5.01","Have you created an organisation-specific definition of the term “cyber security incident” so that the scope of the term is clear?",{"$f":"VLOOKUP(E234,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E234,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E234,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E234,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C234>4,VLOOKUP(B234,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B234,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B234,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B234,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[229,"1.5.02",4,null,"1.5.02","Does your definition of the term “cyber security incident” take account of the:",null,null,{"$f":"IF(VLOOKUP(E235,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E235,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C235>4,VLOOKUP(B235,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B235,3),\"\")","v":""},{"$f":"VLOOKUP(B235,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B235,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[230,"1.5.02a",6,null,"1.5.02a","Different types of cyber security incident (eg hacking, malware or social engineering)?",{"$f":"VLOOKUP(E236,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E236,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E236,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E236,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C236>4,VLOOKUP(B236,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B236,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B236,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B236,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[231,"1.5.02b",6,null,"1.5.02b","Sources of cyber security incidents (eg petty criminals, insiders, hacktivists, an organised crime syndicate, extremist group or state-sponsored body)?",{"$f":"VLOOKUP(E237,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E237,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E237,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E237,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C237>4,VLOOKUP(B237,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B237,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B237,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B237,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[232,"1.5.02c",6,null,"1.5.02c","Basic cyber security incidents (eg minor crime, localised disruption and theft)?",{"$f":"VLOOKUP(E238,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E238,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E238,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E238,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C238>4,VLOOKUP(B238,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B238,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B238,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B238,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[233,"1.5.02d",6,null,"1.5.02d","Sophisticated cyber security attacks (eg major organised crime, widespread disruption, critical damage to national infrastructure and even warfare)?",{"$f":"VLOOKUP(E239,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E239,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E239,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E239,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C239>4,VLOOKUP(B239,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B239,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B239,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B239,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[234,"1.5.02e",6,null,"1.5.02e","Difference between a cyber security and a traditional IT or information security incident (if any)?",{"$f":"VLOOKUP(E240,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E240,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E240,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E240,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C240>4,VLOOKUP(B240,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B240,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B240,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B240,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[235,"1.5.03",5,null,"1.5.03","Do you maintain an appropriate cyber security incident response capability?",{"$f":"VLOOKUP(E241,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E241,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E241,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E241,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C241>4,VLOOKUP(B241,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B241,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B241,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B241,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[236,"1.5.04",4,null,"1.5.04","Does your cyber security incident response capability include:",null,null,{"$f":"IF(VLOOKUP(E242,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E242,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C242>4,VLOOKUP(B242,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B242,3),\"\")","v":""},{"$f":"VLOOKUP(B242,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B242,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[237,"1.5.04a",6,null,"1.5.04a","Appointing a cyber security incident response team (internal and / or external) and determining what services they should provide?",{"$f":"VLOOKUP(E243,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E243,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E243,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E243,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C243>4,VLOOKUP(B243,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B243,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B243,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B243,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[238,"1.5.04b",6,null,"1.5.04b","Raising awareness about the need for an effective cyber security response capability?",{"$f":"VLOOKUP(E244,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E244,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E244,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E244,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C244>4,VLOOKUP(B244,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B244,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B244,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B244,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[239,"1.5.04c",6,null,"1.5.04c","Developing a consistent, repeatable cyber security incident response process or methodology for handling cyber security incidents (or suspected incidents) as they occur, so that the appropriate actions are taken?",{"$f":"VLOOKUP(E245,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E245,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E245,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E245,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C245>4,VLOOKUP(B245,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B245,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B245,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B245,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[240,"1.5.04d",6,null,"1.5.04d","Making effective use of relevant technologies?",{"$f":"VLOOKUP(E246,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E246,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E246,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E246,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C246>4,VLOOKUP(B246,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B246,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B246,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B246,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[241,"1.5.04e",6,null,"1.5.04e","Ensuring that cyber security incidents are properly followed up once they have been responded to effectively?",{"$f":"VLOOKUP(E247,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E247,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E247,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E247,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C247>4,VLOOKUP(B247,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B247,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B247,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B247,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[242,"1.5.05",5,null,"1.5.05","Have you obtained senior management commitment for your cyber security incident response capability?",{"$f":"VLOOKUP(E248,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E248,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E248,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E248,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C248>4,VLOOKUP(B248,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B248,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B248,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B248,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[243,"1.5.06",4,null,"1.5.06","Does senior management commitment include:",null,null,{"$f":"IF(VLOOKUP(E249,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E249,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C249>4,VLOOKUP(B249,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B249,3),\"\")","v":""},{"$f":"VLOOKUP(B249,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B249,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[244,"1.5.06a",6,null,"1.5.06a","Providing sufficient funding and resources to deal with cyber security incidents effectively?",{"$f":"VLOOKUP(E250,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E250,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E250,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E250,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C250>4,VLOOKUP(B250,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B250,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B250,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B250,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[245,"1.5.06b",6,null,"1.5.06b","Determining whether to establish a specialised cyber security incident response capability or integrate cyber security incidents into existing incident management systems?",{"$f":"VLOOKUP(E251,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E251,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E251,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E251,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C251>4,VLOOKUP(B251,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B251,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B251,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B251,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[246,"1.5.06c",6,null,"1.5.06c","Finding appropriate external sources and levels of guidance to help you prepare for a cyber security incident",{"$f":"VLOOKUP(E252,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E252,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E252,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E252,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C252>4,VLOOKUP(B252,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B252,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B252,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B252,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[247,"1.5.07",5,null,"1.5.07","Do you know your state of readiness to be able to respond to a cyber security incident in a fast, effective manner?",{"$f":"VLOOKUP(E253,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E253,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E253,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E253,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C253>4,VLOOKUP(B253,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B253,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B253,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B253,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[248,"1.5.08",5,null,"1.5.08","Do you determine the requirements you have for your cyber security incident response capability?",{"$f":"VLOOKUP(E254,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E254,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E254,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E254,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C254>4,VLOOKUP(B254,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B254,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B254,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B254,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[249,"1.5.09",4,null,"1.5.09","Do you measure the level of maturity of your cyber security incident response capability in terms of:",null,null,{"$f":"IF(VLOOKUP(E255,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E255,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C255>4,VLOOKUP(B255,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B255,3),\"\")","v":""},{"$f":"VLOOKUP(B255,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B255,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[250,"1.5.09a",6,null,"1.5.09a","People (eg an incident response team or individual, technical experts, fast access to decision-makers, representation from key suppliers)?",{"$f":"VLOOKUP(E256,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E256,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E256,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E256,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C256>4,VLOOKUP(B256,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B256,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B256,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B256,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[251,"1.5.09b",6,null,"1.5.09b","Process (eg knowing what to do, how to do it and when to do it – when detecting, containing, eradicating or recovering from a cyber security incident)?",{"$f":"VLOOKUP(E257,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E257,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E257,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E257,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C257>4,VLOOKUP(B257,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B257,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B257,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B257,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[252,"1.5.09c",6,null,"1.5.09c","Technology (eg knowing their network topology, providing the right event logs)?",{"$f":"VLOOKUP(E258,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E258,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E258,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E258,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C258>4,VLOOKUP(B258,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B258,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B258,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B258,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[253,"1.5.09d",6,null,"1.5.09d","Information (eg having information close to hand about business operations and priorities; critical assets; and key dependencies, such as on third parties, important locations or where relevant information resides)?",{"$f":"VLOOKUP(E259,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E259,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E259,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E259,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C259>4,VLOOKUP(B259,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B259,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B259,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B259,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[254,"1.5.09e",6,null,"1.5.09e","Preparedness, response and follow up activities?",{"$f":"VLOOKUP(E260,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E260,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E260,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E260,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C260>4,VLOOKUP(B260,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B260,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B260,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B260,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[255,"1.5.09f",6,null,"1.5.09f","Ability to adopt a systematic, structured approach to cyber security incident response?",{"$f":"VLOOKUP(E261,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E261,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E261,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E261,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C261>4,VLOOKUP(B261,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B261,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B261,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B261,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[256,"1.5.10",4,null,"1.5.10","Do you compare the maturity of your cyber security incident response capability:",null,null,{"$f":"IF(VLOOKUP(E262,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E262,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C262>4,VLOOKUP(B262,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B262,3),\"\")","v":""},{"$f":"VLOOKUP(B262,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B262,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[257,"1.5.10a",6,null,"1.5.10a","To your requirements for such a capability?",{"$f":"VLOOKUP(E263,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E263,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E263,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E263,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C263>4,VLOOKUP(B263,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B263,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B263,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B263,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[258,{"$f":"VLOOKUP(A264,contentref,2,FALSE)","v":"1.5.10b"},6,null,"1.5.10b","With similar organisation to help determine if this level of maturity is appropriate for your organisation?",{"$f":"VLOOKUP(E264,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E264,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E264,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E264,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C264>4,VLOOKUP(B264,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B264,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B264,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B264,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[259,"1.5.11",5,null,"1.5.11","Does the make-up of your your cyber security incident response capability take into account what can and cannot be done with the time, resources and money available?",{"$f":"VLOOKUP(E265,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E265,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E265,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E265,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C265>4,VLOOKUP(B265,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B265,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B265,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B265,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},{"$f":"W265*V265*3","v":15}]
[260,"1.5.12",5,null,"1.5.12","Do you continually review the internal capabilities and capacity of your cyber security incident response team?",{"$f":"VLOOKUP(E266,'Assessment - Phase 1'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E266,'Assessment - Phase 1'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E266,'Assessment - Phase 1'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E266,'Assessment - Phase 1'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C266>4,VLOOKUP(B266,'Assessment - Phase 1'!E:AA,23,FALSE)<>7),LEFT(B266,3),\"\")","v":"1.5"},{"$f":"VLOOKUP(B266,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B266,'Assessment - Phase 1'!B:AA,26,FALSE)=7,0,1)","v":1},12]

{"sheet":"Results - Phase 2","index":12,"n_rows":267,"n_cols":24,"rows_kept":267,"cut":false,"hidden":false,"merged":[[1,5,2,8],[3,5,4,8]]}
[]
[null,null,null,null,null,{"$f":"\"Results\"&IF(LEN(scope_area_of_assessment)=0,\"\",\" for \"&scope_area_of_assessment)","v":"Results"}]
[]
[null,null,null,null,null,"Maturity model for Phase 2 - Respond"]
[]
[]
["Order","FullQ","Type",null,null,null,"Response (0-3)","Weighted score (0-15)","Evidence supplied"]
[262,{"$f":"VLOOKUP(A8,contentref,2,FALSE)","v":"2.1"},{"$f":"VLOOKUP(A8,contentref,15,FALSE)","v":2},null,{"$f":"IF(C8=1,\"Phase \"&B8,IF(C8=2,\"Step \"&VLOOKUP(A8,contentref,4,FALSE),B8))","v":"Step 1"},{"$f":"VLOOKUP(A8,contentref,7,FALSE)","v":"Identification"},{"$f":"\"Maturity level:  \"&O8","v":"Maturity level:  Level 1"},null,null,null,null,{"$f":"TEXT(B8,\"0.0\")","v":"2.1"},{"$f":"SUMIF(U:U,L8,H:H)/(SUMIF(U:U,L8,X:X))","v":0},{"$f":"HLOOKUP(M8*100,level_ref,2,TRUE)","v":"Level 1"},{"$f":"IF(ISERROR(N8),\"\",N8)","v":"Level 1"},{"$f":"HLOOKUP(M8*100,level_ref,3,TRUE)","v":1},{"$f":"IF(ISERROR(P8),\"\",P8)","v":1},null,null,null,{"$f":"IF(AND(C8>4,VLOOKUP(B8,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B8,3),\"\")","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(B8,Weightings!T:X,5,FALSE)","v":{"$error":"#N/A"}},{"$f":"IF(VLOOKUP(B8,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$f":"W8*V8*3","v":{"$error":"#N/A"}}]
[263,"2.1.01",5,null,"2.1.01","Do you identify suspected cyber security incidents?",{"$f":"VLOOKUP(E9,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E9,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E9,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E9,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C9>4,VLOOKUP(B9,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B9,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B9,Weightings!T:X,5,FALSE)","v":1},{"$f":"IF(VLOOKUP(B9,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},3]
[264,"2.1.02",4,null,"2.1.02","Do you inform users that they should:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C10>4,VLOOKUP(B10,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B10,3),\"\")","v":""},{"$f":"VLOOKUP(B10,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B10,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[265,"2.1.02a",6,null,"2.1.02a","Report all suspected cyber security breaches to a central point (eg information failures; loss of services; detection of malicious code; denial of service attacks; errors from incomplete or inaccurate business data)?",{"$f":"VLOOKUP(E11,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E11,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E11,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E11,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C11>4,VLOOKUP(B11,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B11,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B11,Weightings!T:X,5,FALSE)","v":1},{"$f":"IF(VLOOKUP(B11,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},3]
[266,"2.1.02b",6,null,"2.1.02b","Note all important details (eg type of breach, messages on screen, and details of unusual occurrences)?",{"$f":"VLOOKUP(E12,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E12,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E12,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E12,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C12>4,VLOOKUP(B12,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B12,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B12,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B12,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[267,"2.1.02c",6,null,"2.1.02c","Restrain from attempting to take remedial actions themselves?",{"$f":"VLOOKUP(E13,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E13,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E13,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E13,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C13>4,VLOOKUP(B13,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B13,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B13,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B13,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[268,"2.1.03",5,null,"2.1.03","Do you identify cyber security incidents by analysing suspicious events reported by users to the IT help desk (or equivalent)?",{"$f":"VLOOKUP(E14,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E14,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E14,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E14,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C14>4,VLOOKUP(B14,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B14,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B14,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B14,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[269,"2.1.04",4,null,"2.1.04","Is this analysis based on:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C15>4,VLOOKUP(B15,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B15,3),\"\")","v":""},{"$f":"VLOOKUP(B15,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B15,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[270,"2.1.04a",6,null,"2.1.04a","Comparing characteristics of the suspicious event to known ‘normal’ system and network behaviour?",{"$f":"VLOOKUP(E16,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E16,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E16,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E16,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C16>4,VLOOKUP(B16,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B16,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B16,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B16,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[271,"2.1.04b",6,null,"2.1.04b","A good working knowledge of what indictors of compromise (IOCs) would look like?",{"$f":"VLOOKUP(E17,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E17,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E17,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E17,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C17>4,VLOOKUP(B17,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B17,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B17,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B17,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[272,"2.1.05",4,null,"2.1.05","To help identify potential cyber security incidents do you monitor information from a variety of sources, including:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C18>4,VLOOKUP(B18,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B18,3),\"\")","v":""},{"$f":"VLOOKUP(B18,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B18,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[273,"2.1.05a",6,null,"2.1.05a","System logs (eg operating system logs, service and application logs, network device logs and network flows)",{"$f":"VLOOKUP(E19,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E19,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E19,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E19,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C19>4,VLOOKUP(B19,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B19,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B19,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B19,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[274,"2.1.05b",6,null,"2.1.05b","Alerts generated by technical security software (eg IDS, IPS, DLP, SIEM, antivirus and spam software), file integrity checking software, monitoring services (often provided by a third party)?",{"$f":"VLOOKUP(E20,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E20,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E20,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E20,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C20>4,VLOOKUP(B20,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B20,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B20,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B20,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[275,"2.1.05c",6,null,"2.1.05c","Data provided by monitoring services or a Security Operations Centre (often provided by third parties)?",{"$f":"VLOOKUP(E21,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E21,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E21,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E21,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C21>4,VLOOKUP(B21,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B21,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B21,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B21,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[276,"2.1.05d",6,null,"2.1.05d","Publicly available information (eg information on new exploits, information exchange groups, third party organisations, governments)?",{"$f":"VLOOKUP(E22,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E22,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E22,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E22,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C22>4,VLOOKUP(B22,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B22,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B22,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B22,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[277,"2.1.05e",6,null,"2.1.05e","People from within your organisation?",{"$f":"VLOOKUP(E23,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E23,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E23,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E23,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C23>4,VLOOKUP(B23,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B23,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B23,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B23,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[278,"2.1.05f",6,null,"2.1.05f","A variety of third parties (eg customers, suppliers, IT providers, ISPs, partners; government bodies)?",{"$f":"VLOOKUP(E24,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E24,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E24,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E24,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C24>4,VLOOKUP(B24,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B24,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B24,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B24,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[279,"2.1.05g",6,null,"2.1.05g","Anomalies detected by audits, investigations or reviews?",{"$f":"VLOOKUP(E25,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E25,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E25,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E25,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C25>4,VLOOKUP(B25,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B25,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B25,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B25,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[280,"2.1.06",4,null,"2.1.06","Having identified a suspected cyber security incident, do you:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C26>4,VLOOKUP(B26,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B26,3),\"\")","v":""},{"$f":"VLOOKUP(B26,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B26,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[281,"2.1.06a",6,null,"2.1.06a","Investigate different types of technical information, such as IP addresses?",{"$f":"VLOOKUP(E27,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E27,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E27,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E27,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C27>4,VLOOKUP(B27,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B27,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B27,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B27,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[282,"2.1.06b",6,null,"2.1.06b","Analyse all available information related to a potential cyber security incident?",{"$f":"VLOOKUP(E28,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E28,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E28,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E28,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C28>4,VLOOKUP(B28,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B28,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B28,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B28,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[283,"2.1.06c",6,null,"2.1.06c","Determine what has actually happened (eg a DDOS, malware attack, system hack, session hijack or data corruption)?",{"$f":"VLOOKUP(E29,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E29,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E29,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E29,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C29>4,VLOOKUP(B29,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B29,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B29,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B29,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[284,"2.1.06d",6,null,"2.1.06d","Confirm that they have actually been subject to a cyber security attack or had a cyber-related breach (the unknown element)?",{"$f":"VLOOKUP(E30,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E30,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E30,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E30,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C30>4,VLOOKUP(B30,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B30,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B30,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B30,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[285,"2.1.07",4,null,"2.1.07","When monitoring information from relevant technical sources, such as specialised security software (eg SIEM or IDS) do you:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C31>4,VLOOKUP(B31,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B31,3),\"\")","v":""},{"$f":"VLOOKUP(B31,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B31,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[286,"2.1.07a",6,null,"2.1.07a","Monitor all relevant events?",{"$f":"VLOOKUP(E32,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E32,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E32,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E32,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C32>4,VLOOKUP(B32,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B32,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B32,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B32,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[287,"2.1.07b",6,null,"2.1.07b","Carry out monitoring regularly?",{"$f":"VLOOKUP(E33,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E33,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E33,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E33,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C33>4,VLOOKUP(B33,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B33,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B33,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B33,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[288,"2.1.07c",6,null,"2.1.07c","Carry out monitoring in an appropriate manner, focusing on finding anomalies?",{"$f":"VLOOKUP(E34,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E34,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E34,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E34,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C34>4,VLOOKUP(B34,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B34,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B34,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B34,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[289,"2.1.07d",6,null,"2.1.07d","Respond to alerts correctly (avoiding the risk of overlooking indicative alerts or over-reacting to benign alerts)?",{"$f":"VLOOKUP(E35,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E35,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E35,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E35,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C35>4,VLOOKUP(B35,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B35,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B35,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B35,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[290,"2.1.07e",6,null,"2.1.07e","Aggregate what may seem like benign alerts into what is a coherent threat message?",{"$f":"VLOOKUP(E36,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E36,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E36,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E36,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C36>4,VLOOKUP(B36,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B36,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B36,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B36,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[291,"2.1.08",4,null,"2.1.08","Do you take additional steps to identify cyber security incidents by:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C37>4,VLOOKUP(B37,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B37,3),\"\")","v":""},{"$f":"VLOOKUP(B37,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B37,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[292,"2.1.08a",6,null,"2.1.08a","Providing situational awareness (particularly through cyber intelligence)?",{"$f":"VLOOKUP(E38,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E38,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E38,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E38,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C38>4,VLOOKUP(B38,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B38,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B38,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B38,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[293,"2.1.08b",6,null,"2.1.08b","Continuously monitoring events that could result in your organisation being affected by a cyber security incident?",{"$f":"VLOOKUP(E39,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E39,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E39,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E39,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C39>4,VLOOKUP(B39,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B39,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B39,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B39,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[294,"2.1.08c",6,null,"2.1.08c","Evaluating threat analytics (typically based on the threat model of the behaviour of attacks), helping to determine both symptoms and behaviour?",{"$f":"VLOOKUP(E40,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E40,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E40,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E40,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C40>4,VLOOKUP(B40,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B40,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B40,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B40,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[295,"2.1.08d",6,null,"2.1.08d","Performing specialised analysis of host assets, network data and attack files (eg malware)?",{"$f":"VLOOKUP(E41,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E41,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E41,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E41,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C41>4,VLOOKUP(B41,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B41,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B41,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B41,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[296,"2.1.08e",6,null,"2.1.08e","Prioritising assets to be investigated?",{"$f":"VLOOKUP(E42,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E42,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E42,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E42,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C42>4,VLOOKUP(B42,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B42,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B42,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B42,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[297,"2.1.08f",6,null,"2.1.08f","Addressing unusual or novel problems (eg to do with bespoke file types or encryption)?",{"$f":"VLOOKUP(E43,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E43,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E43,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E43,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C43>4,VLOOKUP(B43,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B43,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B43,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B43,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[298,"2.1.09",5,null,"2.1.09","Do you use security analytics?",{"$f":"VLOOKUP(E44,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E44,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E44,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E44,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C44>4,VLOOKUP(B44,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B44,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B44,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B44,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[299,"2.1.10",4,null,"2.1.10","Does your security analytics include:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C45>4,VLOOKUP(B45,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B45,3),\"\")","v":""},{"$f":"VLOOKUP(B45,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B45,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[300,"2.1.10a",6,null,"2.1.10a","Testing for possible attackers or poor user behaviour (eg users opening ‘honey pot’ attachments, or similar)?",{"$f":"VLOOKUP(E46,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E46,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E46,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E46,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C46>4,VLOOKUP(B46,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B46,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B46,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B46,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[301,"2.1.10b",6,null,"2.1.10b","Automated analytics platform (more than just a SIEM)?",{"$f":"VLOOKUP(E47,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E47,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E47,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E47,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C47>4,VLOOKUP(B47,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B47,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B47,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B47,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[302,"2.1.10c",6,null,"2.1.10c","Evaluating threat analytics (typically based on the threat model of the behaviour of attacks), helping to determine both symptoms and behaviour?",{"$f":"VLOOKUP(E48,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E48,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E48,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E48,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C48>4,VLOOKUP(B48,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B48,3),\"\")","v":"2.1"},{"$f":"VLOOKUP(B48,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B48,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[303,"2.2",2,null,"Step 2","Investigation",{"$f":"\"Maturity level:  \"&O49","v":"Maturity level:  Level 1"},null,null,null,null,{"$f":"TEXT(B49,\"0.0\")","v":"2.2"},{"$f":"SUMIF(U:U,L49,H:H)/(SUMIF(U:U,L49,X:X))","v":0},{"$f":"HLOOKUP(M49*100,level_ref,2,TRUE)","v":"Level 1"},{"$f":"IF(ISERROR(N49),\"\",N49)","v":"Level 1"},{"$f":"HLOOKUP(M49*100,level_ref,3,TRUE)","v":1},{"$f":"IF(ISERROR(P49),\"\",P49)","v":1},null,null,null,{"$f":"IF(AND(C49>4,VLOOKUP(B49,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B49,3),\"\")","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(B49,Weightings!T:X,5,FALSE)","v":{"$error":"#N/A"}},{"$f":"IF(VLOOKUP(B49,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#N/A"}]
[304,"",3,null,"","Understanding",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C50>4,VLOOKUP(B50,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B50,3),\"\")","v":""},{"$f":"VLOOKUP(B50,Weightings!T:X,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(B50,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[305,"2.2.01",5,null,"2.2.01","Do you take steps to investigate the cyber security incident?",{"$f":"VLOOKUP(E51,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E51,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E51,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E51,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C51>4,VLOOKUP(B51,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B51,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B51,Weightings!T:X,5,FALSE)","v":1},{"$f":"IF(VLOOKUP(B51,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},3]
[306,"2.2.02",4,null,"2.2.02","Does your investigation of the event include:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C52>4,VLOOKUP(B52,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B52,3),\"\")","v":""},{"$f":"VLOOKUP(B52,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B52,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[307,"2.2.02a",6,null,"2.2.02a","Establishing the objectives of the investigation?",{"$f":"VLOOKUP(E53,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E53,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E53,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E53,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C53>4,VLOOKUP(B53,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B53,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B53,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B53,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[308,"2.2.02b",6,null,"2.2.02b","Performing detailed analysis of the cyber security incident?",{"$f":"VLOOKUP(E54,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E54,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E54,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E54,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C54>4,VLOOKUP(B54,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B54,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B54,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B54,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[309,"2.2.02c",6,null,"2.2.02c","Placing priority on the speed of investigation?",{"$f":"VLOOKUP(E55,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E55,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E55,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E55,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C55>4,VLOOKUP(B55,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B55,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B55,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B55,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[310,"2.2.03",4,null,"2.2.03","Does your analysis of the cyber security incident include:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C56>4,VLOOKUP(B56,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B56,3),\"\")","v":""},{"$f":"VLOOKUP(B56,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B56,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[311,"2.2.03a",6,null,"2.2.03a","Identifying what systems, networks and information (assets) have been compromised?",{"$f":"VLOOKUP(E57,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E57,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E57,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E57,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C57>4,VLOOKUP(B57,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B57,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B57,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B57,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[312,"2.2.03b",6,null,"2.2.03b","Determining what information has been disclosed to unauthorised parties, stolen, deleted or corrupted?",{"$f":"VLOOKUP(E58,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E58,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E58,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E58,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C58>4,VLOOKUP(B58,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B58,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B58,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B58,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[313,"2.2.03c",6,null,"2.2.03c","Working out how it happened (eg how did the attacker gain entry to the system)?",{"$f":"VLOOKUP(E59,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E59,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E59,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E59,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C59>4,VLOOKUP(B59,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B59,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B59,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B59,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[314,"2.2.03d",6,null,"2.2.03d","Finding out who did it (ie which threat agent or agents)?",{"$f":"VLOOKUP(E60,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E60,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E60,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E60,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C60>4,VLOOKUP(B60,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B60,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B60,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B60,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[315,"2.2.03e",6,null,"2.2.03e","Determining why they did it, such as financial crime (eg fraud or extortion), theft of intellectual property, personal attack (eg revenge), or disruption to critical services?",{"$f":"VLOOKUP(E61,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E61,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E61,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E61,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C61>4,VLOOKUP(B61,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B61,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B61,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B61,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[316,"2.2.03f",6,null,"2.2.03f","Estimating the potential business impact of the cyber security incident?",{"$f":"VLOOKUP(E62,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E62,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E62,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E62,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C62>4,VLOOKUP(B62,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B62,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B62,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B62,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[317,"2.2.04",4,null,"2.2.04","Do your investigation determine what:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C63>4,VLOOKUP(B63,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B63,3),\"\")","v":""},{"$f":"VLOOKUP(B63,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B63,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[318,"2.2.04a",6,null,"2.2.04a","Methodologies the attackers are using?",{"$f":"VLOOKUP(E64,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E64,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E64,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E64,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C64>4,VLOOKUP(B64,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B64,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B64,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B64,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[319,"2.2.04b",6,null,"2.2.04b","Who their target is for the attack (eg an individual, the whole organisation, your market sector or the government)?",{"$f":"VLOOKUP(E65,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E65,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E65,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E65,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C65>4,VLOOKUP(B65,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B65,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B65,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B65,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[320,"2.2.05",5,null,"2.2.05","Do you have access to cyber threat intelligence?",{"$f":"VLOOKUP(E66,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E66,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E66,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E66,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C66>4,VLOOKUP(B66,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B66,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B66,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B66,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[321,"2.2.06",5,null,"2.2.06","Does your cyber threat intelligence come from a variety of reputable sources, such as government, CERTS, collaborative groups or expert third parties?",{"$f":"VLOOKUP(E67,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E67,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E67,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E67,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C67>4,VLOOKUP(B67,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B67,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B67,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B67,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[322,"2.2.07",4,null,"2.2.07","Does your cyber threat intelligence help you to determine the attacker(s):",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C68>4,VLOOKUP(B68,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B68,3),\"\")","v":""},{"$f":"VLOOKUP(B68,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B68,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[323,"2.2.07a",6,null,"2.2.07a","Capabilities (what can they actually do)?",{"$f":"VLOOKUP(E69,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E69,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E69,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E69,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C69>4,VLOOKUP(B69,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B69,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B69,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B69,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[324,"2.2.07b",6,null,"2.2.07b","Motives (why are they attacking you)?",{"$f":"VLOOKUP(E70,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E70,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E70,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E70,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C70>4,VLOOKUP(B70,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B70,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B70,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B70,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[325,"2.2.07c",6,null,"2.2.07c","Likely actions (eg their tactics, techniques and procedures)?",{"$f":"VLOOKUP(E71,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E71,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E71,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E71,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C71>4,VLOOKUP(B71,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B71,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B71,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B71,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[326,{"$f":"VLOOKUP(A72,contentref,2,FALSE)","v":""},{"$f":"VLOOKUP(A72,contentref,15,FALSE)","v":3},null,{"$f":"IF(C72=1,\"Phase \"&B72,IF(C72=2,\"Step \"&VLOOKUP(A72,contentref,4,FALSE),B72))","v":""},{"$f":"VLOOKUP(A72,contentref,7,FALSE)","v":"Triage"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C72>4,VLOOKUP(B72,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B72,3),\"\")","v":""},{"$f":"VLOOKUP(B72,Weightings!T:X,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(B72,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$f":"W72*V72*3","v":{"$error":"#VALUE!"}}]
[327,"2.2.08",5,null,"2.2.08","Do you perform Triage on the cyber security incident in the early part of an investigation?",{"$f":"VLOOKUP(E73,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E73,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E73,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E73,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C73>4,VLOOKUP(B73,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B73,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B73,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B73,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[328,"2.2.09",4,null,"2.2.09","Do the actions you carry out as part of Triage include:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C74>4,VLOOKUP(B74,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B74,3),\"\")","v":""},{"$f":"VLOOKUP(B74,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B74,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[329,"2.2.09a",6,null,"2.2.09a","Classifying cyber security incidents (eg critical, significant, normal or negligible impact)?",{"$f":"VLOOKUP(E75,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E75,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E75,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E75,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C75>4,VLOOKUP(B75,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B75,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B75,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B75,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[330,"2.2.09b",6,null,"2.2.09b","Prioritising these incidents (eg high, medium or low)?",{"$f":"VLOOKUP(E76,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E76,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E76,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E76,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C76>4,VLOOKUP(B76,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B76,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B76,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B76,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[331,"2.2.09c",6,null,"2.2.09c","Assigning incidents to appropriate personnel in terms of their legitimacy, correctness, constituency origin, severity or impact?",{"$f":"VLOOKUP(E77,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E77,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E77,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E77,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C77>4,VLOOKUP(B77,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B77,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B77,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B77,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[332,"",3,null,"","First response",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C78>4,VLOOKUP(B78,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B78,3),\"\")","v":""},{"$f":"VLOOKUP(B78,Weightings!T:X,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(B78,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[333,"2.2.10",5,null,"2.2.10","Do you have one or more named individuals (or a team) who are capable of dealing with the initial stages of cyber incident response (first responders)?",{"$f":"VLOOKUP(E79,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E79,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E79,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E79,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C79>4,VLOOKUP(B79,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B79,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B79,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B79,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[334,"2.2.11",4,null,"2.2.11","Are your first responders able to:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C80>4,VLOOKUP(B80,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B80,3),\"\")","v":""},{"$f":"VLOOKUP(B80,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B80,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[335,"2.2.11a",6,null,"2.2.11a","Classify and prioritise cyber security incidents?",{"$f":"VLOOKUP(E81,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E81,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E81,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E81,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C81>4,VLOOKUP(B81,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B81,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B81,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B81,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[336,"2.2.11b",6,null,"2.2.11b","Avoid taking the wrong initial action when a cyber security attack occurs (eg taking systems off the network or cleaning up systems, which could have a detrimental affect like alerting an attacker or destroying vital evidence)?",{"$f":"VLOOKUP(E82,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E82,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E82,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E82,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C82>4,VLOOKUP(B82,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B82,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B82,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B82,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[337,"2.2.11c",6,null,"2.2.11c","Identify quickly when the scope and severity is beyond local or in-house skills?",{"$f":"VLOOKUP(E83,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E83,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E83,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E83,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C83>4,VLOOKUP(B83,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B83,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B83,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B83,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[338,"2.2.12",4,null,"2.2.12","Have arrangements to have been made in advance so that expert investigators:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C84>4,VLOOKUP(B84,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B84,3),\"\")","v":""},{"$f":"VLOOKUP(B84,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B84,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[339,"2.2.12a",6,null,"2.2.12a","Are available at short notice?",{"$f":"VLOOKUP(E85,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E85,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E85,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E85,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C85>4,VLOOKUP(B85,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B85,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B85,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B85,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[340,"2.2.12b",6,null,"2.2.12b","Have enough prior information to be able to hit the ground running?",{"$f":"VLOOKUP(E86,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E86,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E86,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E86,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C86>4,VLOOKUP(B86,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B86,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B86,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B86,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[341,"2.2.13",5,null,"2.2.13","Are you able to quickly contact third parties that you may wish to get involved, such as technology forensics specialists, technology analysts (for example, database experts), information analysts (for example, accountants), legal experts and on-site police support?",{"$f":"VLOOKUP(E87,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E87,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E87,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E87,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C87>4,VLOOKUP(B87,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B87,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B87,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B87,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[342,"2.2.14",5,null,"2.2.14","Do you have a crisis management team (or equivalent) to support serious cyber security incidents?",{"$f":"VLOOKUP(E88,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E88,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E88,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E88,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C88>4,VLOOKUP(B88,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B88,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B88,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B88,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[343,"2.2.15",4,null,"2.2.15","Are you able to manage the cyber security incident:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C89>4,VLOOKUP(B89,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B89,3),\"\")","v":""},{"$f":"VLOOKUP(B89,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B89,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[344,"2.2.15a",6,null,"2.2.15a","Via one central point of contact?",{"$f":"VLOOKUP(E90,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E90,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E90,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E90,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C90>4,VLOOKUP(B90,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B90,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B90,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B90,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[345,"2.2.15b",6,null,"2.2.15b","From one central location?",{"$f":"VLOOKUP(E91,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E91,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E91,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E91,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C91>4,VLOOKUP(B91,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B91,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B91,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B91,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[346,"2.2.15c",6,null,"2.2.15c","In a specialised incident response location, such as a ‘war room’, if required?",{"$f":"VLOOKUP(E92,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E92,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E92,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E92,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C92>4,VLOOKUP(B92,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B92,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B92,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B92,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[347,"",3,null,"","Initial analysis",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C93>4,VLOOKUP(B93,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B93,3),\"\")","v":""},{"$f":"VLOOKUP(B93,Weightings!T:X,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(B93,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[348,"2.2.16",5,null,"2.2.16","Do you perform initial analysis to determine the precise nature of the incident?",{"$f":"VLOOKUP(E94,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E94,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E94,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E94,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C94>4,VLOOKUP(B94,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B94,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B94,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B94,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[349,"2.2.17",4,null,"2.2.17","Are your cyber security incident investigations:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C95>4,VLOOKUP(B95,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B95,3),\"\")","v":""},{"$f":"VLOOKUP(B95,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B95,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[350,"2.2.17a",6,null,"2.2.17a","Evidence-driven, based on information gathered from corporate infrastructure or applications (typically event logs)?",{"$f":"VLOOKUP(E96,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E96,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E96,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E96,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C96>4,VLOOKUP(B96,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B96,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B96,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B96,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[351,"2.2.17b",6,null,"2.2.17b","Intelligence driven, based on information gathered from: government agencies (eg CPNI), monitoring of internal resources, open source information or data provided internally?",{"$f":"VLOOKUP(E97,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E97,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E97,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E97,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C97>4,VLOOKUP(B97,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B97,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B97,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B97,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[352,"2.2.18",4,null,"2.2.18","Do your cyber security incident investigations include:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C98>4,VLOOKUP(B98,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B98,3),\"\")","v":""},{"$f":"VLOOKUP(B98,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B98,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[353,"2.2.18a",6,null,"2.2.18a","Considering all relevant event logs (eg logs generated by firewalls, web servers, traditional servers / workstations, business applications, email history and archives, network data, internet usage and building access)?",{"$f":"VLOOKUP(E99,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E99,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E99,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E99,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C99>4,VLOOKUP(B99,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B99,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B99,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B99,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[354,"2.2.18b",6,null,"2.2.18b","Examining important alerts or suspicious events in logs or technical security monitoring systems (eg IDS, IPS, DLP or SIEM)?",{"$f":"VLOOKUP(E100,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E100,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E100,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E100,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C100>4,VLOOKUP(B100,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B100,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B100,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B100,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[355,"2.2.18c",6,null,"2.2.18c","Correlating them with network data (including data from cloud service providers)?",{"$f":"VLOOKUP(E101,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E101,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E101,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E101,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C101>4,VLOOKUP(B101,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B101,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B101,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B101,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[356,"2.2.18d",6,null,"2.2.18d","Comparing these pieces of information against threat intelligence?",{"$f":"VLOOKUP(E102,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E102,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E102,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E102,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C102>4,VLOOKUP(B102,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B102,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B102,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B102,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[357,"2.2.19",4,null,"2.2.19","Do you thoroughly investigate each possible trigger event including:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C103>4,VLOOKUP(B103,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B103,3),\"\")","v":""},{"$f":"VLOOKUP(B103,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B103,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[358,"2.2.19a",6,null,"2.2.19a","Date/time?",{"$f":"VLOOKUP(E104,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E104,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E104,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E104,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C104>4,VLOOKUP(B104,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B104,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B104,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B104,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[359,"2.2.19b",6,null,"2.2.19b","Internet protocol (IP) address (internal or external)?",{"$f":"VLOOKUP(E105,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E105,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E105,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E105,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C105>4,VLOOKUP(B105,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B105,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B105,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B105,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[360,"2.2.19c",6,null,"2.2.19c","Port (source or destination), domain and file (eg exe, .dll)?",{"$f":"VLOOKUP(E106,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E106,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E106,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E106,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C106>4,VLOOKUP(B106,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B106,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B106,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B106,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[361,"2.2.19d",6,null,"2.2.19d","System (hardware vendor, operating system, applications, purpose, location)?",{"$f":"VLOOKUP(E107,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E107,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E107,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E107,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C107>4,VLOOKUP(B107,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B107,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B107,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B107,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[362,"2.2.20",4,null,"2.2.20","Do you retain relevant logs:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C108>4,VLOOKUP(B108,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B108,3),\"\")","v":""},{"$f":"VLOOKUP(B108,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B108,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[363,"2.2.20a",6,null,"2.2.20a","For as long as possible?",{"$f":"VLOOKUP(E109,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E109,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E109,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E109,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C109>4,VLOOKUP(B109,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B109,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B109,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B109,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[364,"2.2.20b",6,null,"2.2.20b","As part of an approved log retention policy?",{"$f":"VLOOKUP(E110,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E110,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E110,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E110,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C110>4,VLOOKUP(B110,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B110,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B110,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B110,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[365,"",3,null,"","Collaboration",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C111>4,VLOOKUP(B111,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B111,3),\"\")","v":""},{"$f":"VLOOKUP(B111,Weightings!T:X,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(B111,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[366,"2.2.21",5,null,"2.2.21","Do you analyse the possible systemic nature of the attack?",{"$f":"VLOOKUP(E112,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E112,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E112,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E112,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C112>4,VLOOKUP(B112,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B112,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B112,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B112,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[367,"2.2.22",4,null,"2.2.22","Does this analysis include:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C113>4,VLOOKUP(B113,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B113,3),\"\")","v":""},{"$f":"VLOOKUP(B113,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B113,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[368,"2.2.22a",6,null,"2.2.22a","Tying disparate events together into a coherent picture?",{"$f":"VLOOKUP(E114,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E114,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E114,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E114,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C114>4,VLOOKUP(B114,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B114,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B114,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B114,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[369,"2.2.22b",6,null,"2.2.22b","Linking events to possible related events in other organisations with which you are associated (eg other Banks if you are in the Banking sector)?",{"$f":"VLOOKUP(E115,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E115,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E115,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E115,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C115>4,VLOOKUP(B115,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B115,3),\"\")","v":"2.2"},{"$f":"VLOOKUP(B115,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B115,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[370,"2.3",2,null,"Step 3","Action",{"$f":"\"Maturity level:  \"&O116","v":"Maturity level:  Level 1"},null,null,null,null,{"$f":"TEXT(B116,\"0.0\")","v":"2.3"},{"$f":"SUMIF(U:U,L116,H:H)/(SUMIF(U:U,L116,X:X))","v":0},{"$f":"HLOOKUP(M116*100,level_ref,2,TRUE)","v":"Level 1"},{"$f":"IF(ISERROR(N116),\"\",N116)","v":"Level 1"},{"$f":"HLOOKUP(M116*100,level_ref,3,TRUE)","v":1},{"$f":"IF(ISERROR(P116),\"\",P116)","v":1},null,null,null,{"$f":"IF(AND(C116>4,VLOOKUP(B116,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B116,3),\"\")","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(B116,Weightings!T:X,5,FALSE)","v":{"$error":"#N/A"}},{"$f":"IF(VLOOKUP(B116,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#N/A"}]
[371,"",3,null,"","Containment",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C117>4,VLOOKUP(B117,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B117,3),\"\")","v":""},{"$f":"VLOOKUP(B117,Weightings!T:X,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(B117,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[372,"2.3.01",5,null,"2.3.01","Do you take steps to contain the damage being done by the cyber security incident?",{"$f":"VLOOKUP(E118,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E118,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E118,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E118,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C118>4,VLOOKUP(B118,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B118,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B118,Weightings!T:X,5,FALSE)","v":1},{"$f":"IF(VLOOKUP(B118,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},3]
[373,"2.3.02",4,null,"2.3.02","Does the objective of containment include:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C119>4,VLOOKUP(B119,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B119,3),\"\")","v":""},{"$f":"VLOOKUP(B119,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B119,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[374,"2.3.02a",6,null,"2.3.02a","Making best efforts to return to functionality as normal?",{"$f":"VLOOKUP(E120,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E120,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E120,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E120,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C120>4,VLOOKUP(B120,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B120,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B120,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B120,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[375,"2.3.02b",6,null,"2.3.02b","Returning to business as usual?",{"$f":"VLOOKUP(E121,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E121,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E121,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E121,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C121>4,VLOOKUP(B121,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B121,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B121,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B121,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[376,"2.3.02c",6,null,"2.3.02c","Continuing to analyse the incident?",{"$f":"VLOOKUP(E122,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E122,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E122,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E122,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C122>4,VLOOKUP(B122,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B122,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B122,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B122,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[377,"2.3.02d",6,null,"2.3.02d","Planning longer term remediation?",{"$f":"VLOOKUP(E123,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E123,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E123,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E123,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C123>4,VLOOKUP(B123,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B123,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B123,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B123,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[378,"2.3.03",4,null,"2.3.03","Does containment include stopping it from spreading to other:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C124>4,VLOOKUP(B124,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B124,3),\"\")","v":""},{"$f":"VLOOKUP(B124,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B124,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[379,"2.3.03a",6,null,"2.3.03a","Networks within your organisation?",{"$f":"VLOOKUP(E125,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E125,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E125,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E125,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C125>4,VLOOKUP(B125,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B125,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B125,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B125,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[380,"2.3.03b",6,null,"2.3.03b","Networks beyond your organisation?",{"$f":"VLOOKUP(E126,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E126,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E126,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E126,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C126>4,VLOOKUP(B126,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B126,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B126,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B126,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[381,"2.3.03c",6,null,"2.3.03c","Devices within your organisation?",{"$f":"VLOOKUP(E127,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E127,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E127,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E127,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C127>4,VLOOKUP(B127,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B127,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B127,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B127,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[382,"2.3.03d",6,null,"2.3.03d","Devices beyond your organisation?",{"$f":"VLOOKUP(E128,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E128,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E128,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E128,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C128>4,VLOOKUP(B128,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B128,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B128,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B128,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[383,"2.3.04",5,null,"2.3.04","Does containment include a number of concurrent actions aimed at reducing the immediate impact of the cyber security incident?",{"$f":"VLOOKUP(E129,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E129,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E129,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E129,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C129>4,VLOOKUP(B129,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B129,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B129,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B129,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[384,"2.3.05",5,null,"2.3.05","Does containment include removing the attacker’s access to your systems?",{"$f":"VLOOKUP(E130,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E130,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E130,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E130,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C130>4,VLOOKUP(B130,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B130,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B130,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B130,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[385,"2.3.06",4,null,"2.3.06","Do your methods of containment include:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C131>4,VLOOKUP(B131,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B131,3),\"\")","v":""},{"$f":"VLOOKUP(B131,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B131,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[386,"2.3.06a",6,null,"2.3.06a","Blocking (and logging) of unauthorised access?",{"$f":"VLOOKUP(E132,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E132,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E132,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E132,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C132>4,VLOOKUP(B132,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B132,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B132,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B132,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[387,"2.3.06b",6,null,"2.3.06b","Blocking malware sources (eg email addresses and websites)?",{"$f":"VLOOKUP(E133,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E133,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E133,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E133,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C133>4,VLOOKUP(B133,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B133,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B133,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B133,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[388,"2.3.06c",6,null,"2.3.06c","Closing particular ports and mail servers?",{"$f":"VLOOKUP(E134,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E134,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E134,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E134,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C134>4,VLOOKUP(B134,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B134,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B134,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B134,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[389,"2.3.06d",6,null,"2.3.06d","Firewall filtering?",{"$f":"VLOOKUP(E135,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E135,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E135,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E135,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C135>4,VLOOKUP(B135,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B135,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B135,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B135,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[390,{"$f":"VLOOKUP(A136,contentref,2,FALSE)","v":"2.3.06e"},{"$f":"VLOOKUP(A136,contentref,15,FALSE)","v":6},null,{"$f":"IF(C136=1,\"Phase \"&B136,IF(C136=2,\"Step \"&VLOOKUP(A136,contentref,4,FALSE),B136))","v":"2.3.06e"},{"$f":"VLOOKUP(A136,contentref,7,FALSE)","v":"Relocating website home pages?"},{"$f":"VLOOKUP(E136,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E136,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E136,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E136,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C136>4,VLOOKUP(B136,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B136,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B136,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B136,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$f":"W136*V136*3","v":12}]
[391,"2.3.06f",6,null,"2.3.06f","Isolating systems?",{"$f":"VLOOKUP(E137,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E137,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E137,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E137,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C137>4,VLOOKUP(B137,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B137,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B137,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B137,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[392,"2.3.06g",6,null,"2.3.06g","Taking back-ups?",{"$f":"VLOOKUP(E138,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E138,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E138,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E138,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C138>4,VLOOKUP(B138,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B138,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B138,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B138,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[393,"2.3.07",4,null,"2.3.07","Do you have separate containment strategies for different types of:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C139>4,VLOOKUP(B139,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B139,3),\"\")","v":""},{"$f":"VLOOKUP(B139,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B139,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[394,"2.3.07a",6,null,"2.3.07a","Cyber security attack?",{"$f":"VLOOKUP(E140,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E140,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E140,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E140,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C140>4,VLOOKUP(B140,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B140,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B140,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B140,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[395,"2.3.07b",6,null,"2.3.07b","Sources of attack (the attack agent)?",{"$f":"VLOOKUP(E141,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E141,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E141,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E141,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C141>4,VLOOKUP(B141,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B141,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B141,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B141,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[396,"2.3.08",5,null,"2.3.08","Do your containment strategies include clearly documented criteria to facilitate decision-making?",{"$f":"VLOOKUP(E142,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E142,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E142,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E142,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C142>4,VLOOKUP(B142,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B142,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B142,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B142,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[397,"2.3.09",4,null,"2.3.09","Do your containment strategies include evaluating the:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C143>4,VLOOKUP(B143,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B143,3),\"\")","v":""},{"$f":"VLOOKUP(B143,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B143,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[398,"2.3.09a",6,null,"2.3.09a","Potential damage to and theft of resources?",{"$f":"VLOOKUP(E144,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E144,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E144,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E144,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C144>4,VLOOKUP(B144,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B144,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B144,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B144,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[399,"2.3.09b",6,null,"2.3.09b","Need for evidence preservation?",{"$f":"VLOOKUP(E145,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E145,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E145,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E145,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C145>4,VLOOKUP(B145,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B145,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B145,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B145,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[400,"2.3.09c",6,null,"2.3.09c","Service availability (eg network connectivity, services provided to external parties)?",{"$f":"VLOOKUP(E146,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E146,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E146,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E146,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C146>4,VLOOKUP(B146,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B146,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B146,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B146,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[401,"2.3.09d",6,null,"2.3.09d","Time and resources needed to implement the strategy?",{"$f":"VLOOKUP(E147,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E147,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E147,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E147,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C147>4,VLOOKUP(B147,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B147,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B147,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B147,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[402,"2.3.09e",6,null,"2.3.09e","Effectiveness of the strategy (eg partial containment, full containment)?",{"$f":"VLOOKUP(E148,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E148,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E148,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E148,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C148>4,VLOOKUP(B148,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B148,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B148,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B148,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[403,"2.3.09f",6,null,"2.3.09f","Duration of the solution (eg emergency workaround to be removed in four hours, temporary workaround to be removed in two weeks, permanent solution)?",{"$f":"VLOOKUP(E149,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E149,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E149,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E149,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C149>4,VLOOKUP(B149,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B149,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B149,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B149,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[404,"2.3.10",4,null,"2.3.10","Does your approach to containing cyber security incidents include:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C150>4,VLOOKUP(B150,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B150,3),\"\")","v":""},{"$f":"VLOOKUP(B150,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B150,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[405,"2.3.10a",6,null,"2.3.10a","Identifying immediate actions to be performed (eg based on high risk assets, time dependant issues, business / commercial decisions)?",{"$f":"VLOOKUP(E151,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E151,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E151,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E151,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C151>4,VLOOKUP(B151,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B151,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B151,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B151,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[406,"2.3.10b",6,null,"2.3.10b","Ensuring that actions can be performed safely (eg by avoiding actions that can hamper response strategies, such as ‘seize and replace’)?",{"$f":"VLOOKUP(E152,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E152,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E152,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E152,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C152>4,VLOOKUP(B152,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B152,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B152,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B152,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[407,"2.3.10c",6,null,"2.3.10c","Minimising the risk that an attacker will respond/escalate?",{"$f":"VLOOKUP(E153,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E153,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E153,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E153,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C153>4,VLOOKUP(B153,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B153,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B153,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B153,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[408,"2.3.10d",6,null,"2.3.10d","Determining whether findings identified during the investigation are critical?",{"$f":"VLOOKUP(E154,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E154,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E154,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E154,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C154>4,VLOOKUP(B154,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B154,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B154,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B154,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[409,"2.3.10e",6,null,"2.3.10e","Reacting to critical findings during the investigation?",{"$f":"VLOOKUP(E155,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E155,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E155,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E155,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C155>4,VLOOKUP(B155,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B155,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B155,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B155,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[410,"2.3.10f",6,null,"2.3.10f","Duration of the solution (eg emergency workaround to be removed in four hours, temporary workaround to be removed in two weeks, permanent solution)?",{"$f":"VLOOKUP(E156,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E156,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E156,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E156,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C156>4,VLOOKUP(B156,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B156,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B156,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B156,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[411,"2.3.11",4,null,"2.3.11","Does your approach to containing cyber security incidents include analysing:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C157>4,VLOOKUP(B157,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B157,3),\"\")","v":""},{"$f":"VLOOKUP(B157,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B157,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[412,"2.3.11a",6,null,"2.3.11a","Events in relation to the ‘attacker kill chain’ (ie reconnaissance, weaponize, deliver, exploit, install, command & control and act on objectives)?",{"$f":"VLOOKUP(E158,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E158,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E158,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E158,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C158>4,VLOOKUP(B158,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B158,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B158,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B158,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[413,"2.3.11b",6,null,"2.3.11b","Both the attacker and defender aspects of an attack?",{"$f":"VLOOKUP(E159,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E159,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E159,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E159,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C159>4,VLOOKUP(B159,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B159,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B159,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B159,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[414,"",3,null,"","Eradication",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C160>4,VLOOKUP(B160,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B160,3),\"\")","v":""},{"$f":"VLOOKUP(B160,Weightings!T:X,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(B160,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[415,"2.3.12",5,null,"2.3.12","Do you take steps to eliminate the cause of the cyber security incident (eradication)?",{"$f":"VLOOKUP(E161,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E161,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E161,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E161,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C161>4,VLOOKUP(B161,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B161,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B161,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B161,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[416,"2.3.13",4,null,"2.3.13","Does eradication include (where necessary):",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C162>4,VLOOKUP(B162,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B162,3),\"\")","v":""},{"$f":"VLOOKUP(B162,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B162,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[417,"2.3.13a",6,null,"2.3.13a","Removing the attack from the network?",{"$f":"VLOOKUP(E163,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E163,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E163,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E163,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C163>4,VLOOKUP(B163,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B163,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B163,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B163,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[418,"2.3.13b",6,null,"2.3.13b","Deleting malware?",{"$f":"VLOOKUP(E164,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E164,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E164,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E164,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C164>4,VLOOKUP(B164,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B164,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B164,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B164,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[419,"2.3.13c",6,null,"2.3.13c","Disabling breached user accounts?",{"$f":"VLOOKUP(E165,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E165,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E165,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E165,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C165>4,VLOOKUP(B165,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B165,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B165,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B165,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[420,"2.3.13d",6,null,"2.3.13d","Identifying vulnerabilities that were exploited?",{"$f":"VLOOKUP(E166,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E166,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E166,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E166,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C166>4,VLOOKUP(B166,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B166,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B166,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B166,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[421,"2.3.13e",6,null,"2.3.13e","Mitigating vulnerabilities that were exploited?",{"$f":"VLOOKUP(E167,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E167,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E167,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E167,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C167>4,VLOOKUP(B167,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B167,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B167,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B167,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[422,"2.3.14",4,null,"2.3.14","Does the eradication process include:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C168>4,VLOOKUP(B168,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B168,3),\"\")","v":""},{"$f":"VLOOKUP(B168,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B168,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[423,"2.3.14a",6,null,"2.3.14a","Identifying all affected hosts within your organisation, so that they can be remediated?",{"$f":"VLOOKUP(E169,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E169,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E169,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E169,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C169>4,VLOOKUP(B169,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B169,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B169,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B169,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[424,"2.3.14b",6,null,"2.3.14b","Identifying all affected hosts beyond your organisation, so that they can be remediated?",{"$f":"VLOOKUP(E170,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E170,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E170,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E170,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C170>4,VLOOKUP(B170,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B170,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B170,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B170,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[425,"2.3.14c",6,null,"2.3.14c","Carrying out malware analysis?",{"$f":"VLOOKUP(E171,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E171,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E171,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E171,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C171>4,VLOOKUP(B171,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B171,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B171,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B171,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[426,"2.3.14d",6,null,"2.3.14d","Checking for any response from the attacker to your actions?",{"$f":"VLOOKUP(E172,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E172,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E172,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E172,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C172>4,VLOOKUP(B172,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B172,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B172,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B172,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[427,"2.3.14e",6,null,"2.3.14e","Developing a response (preferably in advance) if the attacker uses a different method of attack?",{"$f":"VLOOKUP(E173,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E173,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E173,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E173,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C173>4,VLOOKUP(B173,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B173,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B173,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B173,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[428,"2.3.14f",6,null,"2.3.14f","Allowing sufficient time to ensure that the network is secure and that there is no response from the attacker?",{"$f":"VLOOKUP(E174,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E174,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E174,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E174,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C174>4,VLOOKUP(B174,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B174,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B174,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B174,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[429,"2.3.15",5,null,"2.3.15","Do you produce an eradication plan?",{"$f":"VLOOKUP(E175,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E175,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E175,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E175,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C175>4,VLOOKUP(B175,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B175,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B175,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B175,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[430,"2.3.16",5,null,"2.3.16","Is the eradication plan executed with speed and precision?",{"$f":"VLOOKUP(E176,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E176,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E176,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E176,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C176>4,VLOOKUP(B176,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B176,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B176,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B176,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[431,"2.3.17",4,null,"2.3.17","Does the eradication plan enable actions to be taken to prevent attackers:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C177>4,VLOOKUP(B177,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B177,3),\"\")","v":""},{"$f":"VLOOKUP(B177,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B177,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[432,"2.3.17a",6,null,"2.3.17a","Sensing they have been discovered once eradication is underway?",{"$f":"VLOOKUP(E178,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E178,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E178,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E178,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C178>4,VLOOKUP(B178,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B178,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B178,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B178,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[433,"2.3.17b",6,null,"2.3.17b","Re-establishing a base and entrenching themselves into the network again?",{"$f":"VLOOKUP(E179,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E179,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E179,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E179,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C179>4,VLOOKUP(B179,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B179,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B179,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B179,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[434,"2.3.17c",6,null,"2.3.17c","Continuing the attack during eradication?",{"$f":"VLOOKUP(E180,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E180,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E180,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E180,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C180>4,VLOOKUP(B180,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B180,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B180,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B180,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[435,"2.3.17d",6,null,"2.3.17d","Avoiding identification during eradication?",{"$f":"VLOOKUP(E181,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E181,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E181,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E181,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C181>4,VLOOKUP(B181,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B181,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B181,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B181,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[436,"",3,null,"","Evidence",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C182>4,VLOOKUP(B182,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B182,3),\"\")","v":""},{"$f":"VLOOKUP(B182,Weightings!T:X,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(B182,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[437,"2.3.18",5,null,"2.3.18","Do you take steps to preserve evidence when dealing with the cyber security?",{"$f":"VLOOKUP(E183,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E183,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E183,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E183,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C183>4,VLOOKUP(B183,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B183,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B183,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B183,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[438,"2.3.19",5,null,"2.3.19","Do you have a formal process for handling evidence when dealing with the cyber security?",{"$f":"VLOOKUP(E184,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E184,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E184,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E184,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C184>4,VLOOKUP(B184,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B184,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B184,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B184,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[439,"2.3.20",4,null,"2.3.20","Does your process for handling evidence include:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C185>4,VLOOKUP(B185,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B185,3),\"\")","v":""},{"$f":"VLOOKUP(B185,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B185,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[440,"2.3.20a",6,null,"2.3.20a","Allowing for admissibility of evidence (whether or not the evidence can be used in court)?",{"$f":"VLOOKUP(E186,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E186,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E186,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E186,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C186>4,VLOOKUP(B186,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B186,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B186,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B186,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[441,"2.3.20b",6,null,"2.3.20b","Allowing for weight of evidence (the quality and completeness of evidence)?",{"$f":"VLOOKUP(E187,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E187,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E187,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E187,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C187>4,VLOOKUP(B187,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B187,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B187,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B187,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[442,"2.3.20c",6,null,"2.3.20c","Adherence to an approved set of guidelines, such as the Association of Chief Police Officers (ACPO) Guidelines on Computer Evidence (ACPO)?",{"$f":"VLOOKUP(E188,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E188,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E188,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E188,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C188>4,VLOOKUP(B188,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B188,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B188,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B188,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[443,"2.3.20d",6,null,"2.3.20d","Complying with relevant laws?",{"$f":"VLOOKUP(E189,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E189,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E189,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E189,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C189>4,VLOOKUP(B189,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B189,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B189,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B189,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[444,"2.3.21",4,null,"2.3.21","Does your process for handling evidence explicitly include complying with the:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C190>4,VLOOKUP(B190,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B190,3),\"\")","v":""},{"$f":"VLOOKUP(B190,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B190,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[445,"2.3.21a",6,null,"2.3.21a","Police and Criminal evidence act 1984 (PACE)?",{"$f":"VLOOKUP(E191,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E191,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E191,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E191,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C191>4,VLOOKUP(B191,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B191,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B191,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B191,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[446,"2.3.21b",6,null,"2.3.21b","Data Protection Act 1988?",{"$f":"VLOOKUP(E192,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E192,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E192,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E192,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C192>4,VLOOKUP(B192,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B192,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B192,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B192,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[447,"2.3.21c",6,null,"2.3.21c","Computer Misuse Act 1990?",{"$f":"VLOOKUP(E193,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E193,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E193,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E193,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C193>4,VLOOKUP(B193,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B193,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B193,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B193,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[448,"2.3.21d",6,null,"2.3.21d","Regulation of Investigatory Powers 2000 (RIPA)?",{"$f":"VLOOKUP(E194,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E194,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E194,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E194,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C194>4,VLOOKUP(B194,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B194,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B194,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B194,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[449,"2.3.22",4,null,"2.3.22","When handling evidence do you maintain a chain of evidence for:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C195>4,VLOOKUP(B195,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B195,3),\"\")","v":""},{"$f":"VLOOKUP(B195,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B195,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[450,"2.3.22a",6,null,"2.3.22a","Paper-based information?",{"$f":"VLOOKUP(E196,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E196,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E196,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E196,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C196>4,VLOOKUP(B196,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B196,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B196,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B196,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[451,"2.3.22b",6,null,"2.3.22b","Electronic information?",{"$f":"VLOOKUP(E197,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E197,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E197,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E197,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C197>4,VLOOKUP(B197,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B197,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B197,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B197,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[452,"2.3.23",5,null,"2.3.23","Do you keep a detailed written log of every action taken during the investigation?",{"$f":"VLOOKUP(E198,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E198,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E198,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E198,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C198>4,VLOOKUP(B198,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B198,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B198,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B198,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[453,"2.3.24",4,null,"2.3.24","Does this action log include:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C199>4,VLOOKUP(B199,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B199,3),\"\")","v":""},{"$f":"VLOOKUP(B199,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B199,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[454,{"$f":"VLOOKUP(A200,contentref,2,FALSE)","v":"2.3.24a"},{"$f":"VLOOKUP(A200,contentref,15,FALSE)","v":6},null,{"$f":"IF(C200=1,\"Phase \"&B200,IF(C200=2,\"Step \"&VLOOKUP(A200,contentref,4,FALSE),B200))","v":"2.3.24a"},{"$f":"VLOOKUP(A200,contentref,7,FALSE)","v":"Identifying information (eg the location, serial number, model number, hostname, media access control (MAC) addresses, and IP addresses of a computer)?"},{"$f":"VLOOKUP(E200,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E200,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E200,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E200,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C200>4,VLOOKUP(B200,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B200,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B200,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B200,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$f":"W200*V200*3","v":12}]
[455,"2.3.24b",6,null,"2.3.24b","Showing who did what, where, when, how and to what?",{"$f":"VLOOKUP(E201,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E201,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E201,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E201,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C201>4,VLOOKUP(B201,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B201,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B201,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B201,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[456,"2.3.24c",6,null,"2.3.24c","Identifying where, when and how certain actions were taken by the perpetrators, such as command and control; exfiltration?",{"$f":"VLOOKUP(E202,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E202,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E202,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E202,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C202>4,VLOOKUP(B202,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B202,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B202,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B202,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[457,"2.3.24d",6,null,"2.3.24d","Name, title, and phone number of each individual who collected or handled the evidence during the investigation?",{"$f":"VLOOKUP(E203,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E203,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E203,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E203,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C203>4,VLOOKUP(B203,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B203,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B203,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B203,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[458,"2.3.24e",6,null,"2.3.24e","Time and date (including time zone) of each occurrence of evidence handling?",{"$f":"VLOOKUP(E204,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E204,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E204,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E204,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C204>4,VLOOKUP(B204,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B204,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B204,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B204,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[459,"2.3.24f",6,null,"2.3.24f","Locations where the evidence was stored?",{"$f":"VLOOKUP(E205,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E205,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E205,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E205,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C205>4,VLOOKUP(B205,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B205,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B205,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B205,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[460,"2.3.25",4,null,"2.3.25","Does the content of the action log enable:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C206>4,VLOOKUP(B206,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B206,3),\"\")","v":""},{"$f":"VLOOKUP(B206,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B206,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[461,"2.3.25a",6,null,"2.3.25a","Clear and precise evidence to be referred to at a later date?",{"$f":"VLOOKUP(E207,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E207,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E207,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E207,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C207>4,VLOOKUP(B207,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B207,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B207,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B207,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[462,"2.3.25b",6,null,"2.3.25b","The sequence of events and actions taken to be repeated by opposition experts, if required?",{"$f":"VLOOKUP(E208,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E208,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E208,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E208,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C208>4,VLOOKUP(B208,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B208,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B208,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B208,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[463,"2.3.26",4,null,"2.3.26","When gathering data for a potential prosecution, do you ensure that:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C209>4,VLOOKUP(B209,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B209,3),\"\")","v":""},{"$f":"VLOOKUP(B209,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B209,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[464,"2.3.26a",6,null,"2.3.26a","Any systems under investigation are not turned off until an expert decision on the risk of doing so has been made?",{"$f":"VLOOKUP(E210,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E210,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E210,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E210,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C210>4,VLOOKUP(B210,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B210,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B210,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B210,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[465,"2.3.26b",6,null,"2.3.26b","Analysis is not performed on a live system under investigation before a forensically safe image has been taken?",{"$f":"VLOOKUP(E211,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E211,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E211,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E211,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C211>4,VLOOKUP(B211,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B211,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B211,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B211,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[466,"2.3.27",4,null,"2.3.27","When supporting forensic work, do you ensure that:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C212>4,VLOOKUP(B212,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B212,3),\"\")","v":""},{"$f":"VLOOKUP(B212,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B212,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[467,"2.3.27a",6,null,"2.3.27a","Forensic work is only being performed on copies of the evidential material (eg using imaging technology)?",{"$f":"VLOOKUP(E213,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E213,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E213,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E213,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C213>4,VLOOKUP(B213,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B213,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B213,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B213,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[468,"2.3.27b",6,null,"2.3.27b","The integrity of all evidential material is protected?",{"$f":"VLOOKUP(E214,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E214,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E214,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E214,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C214>4,VLOOKUP(B214,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B214,3),\"\")","v":"2.3"},{"$f":"VLOOKUP(B214,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B214,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[469,"2.4",2,null,"Step 4","Recovery",{"$f":"\"Maturity level:  \"&O215","v":"Maturity level:  Level 1"},null,null,null,null,{"$f":"TEXT(B215,\"0.0\")","v":"2.4"},{"$f":"SUMIF(U:U,L215,H:H)/(SUMIF(U:U,L215,X:X))","v":0},{"$f":"HLOOKUP(M215*100,level_ref,2,TRUE)","v":"Level 1"},{"$f":"IF(ISERROR(N215),\"\",N215)","v":"Level 1"},{"$f":"HLOOKUP(M215*100,level_ref,3,TRUE)","v":1},{"$f":"IF(ISERROR(P215),\"\",P215)","v":1},null,null,null,{"$f":"IF(AND(C215>4,VLOOKUP(B215,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B215,3),\"\")","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(B215,Weightings!T:X,5,FALSE)","v":{"$error":"#N/A"}},{"$f":"IF(VLOOKUP(B215,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#N/A"}]
[470,"",3,null,"","Objectives",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C216>4,VLOOKUP(B216,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B216,3),\"\")","v":""},{"$f":"VLOOKUP(B216,Weightings!T:X,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(B216,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[471,"2.4.01",5,null,"2.4.01","Do you take steps to recover from a cyber security incident quickly and effectively?",{"$f":"VLOOKUP(E217,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E217,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E217,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E217,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C217>4,VLOOKUP(B217,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B217,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B217,Weightings!T:X,5,FALSE)","v":1},{"$f":"IF(VLOOKUP(B217,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},3]
[472,"2.4.02",4,null,"2.4.02","Do your objectives for recovering from a cyber security incident cover immediate business requirements, including:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C218>4,VLOOKUP(B218,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B218,3),\"\")","v":""},{"$f":"VLOOKUP(B218,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B218,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[473,"2.4.02a",6,null,"2.4.02a","Restoring systems to normal operation as soon as possible?",{"$f":"VLOOKUP(E219,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E219,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E219,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E219,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C219>4,VLOOKUP(B219,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B219,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B219,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B219,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[474,"2.4.02b",6,null,"2.4.02b","Confirming that the systems are functioning normally?",{"$f":"VLOOKUP(E220,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E220,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E220,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E220,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C220>4,VLOOKUP(B220,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B220,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B220,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B220,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[475,"2.4.02c",6,null,"2.4.02c","Restricting the amount of financial loss?",{"$f":"VLOOKUP(E221,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E221,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E221,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E221,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C221>4,VLOOKUP(B221,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B221,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B221,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B221,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[476,"2.4.02d",6,null,"2.4.02d","Protecting the reputation of your organisation?",{"$f":"VLOOKUP(E222,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E222,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E222,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E222,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C222>4,VLOOKUP(B222,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B222,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B222,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B222,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[477,"2.4.02e",6,null,"2.4.02e","Protecting confidential information?",{"$f":"VLOOKUP(E223,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E223,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E223,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E223,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C223>4,VLOOKUP(B223,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B223,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B223,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B223,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[478,"2.4.02f",6,null,"2.4.02f","Complying with legal and regulatory requirements (eg PCI / DSS, NERC, ISO 27001, HIPAA or FISMA)?",{"$f":"VLOOKUP(E224,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E224,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E224,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E224,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C224>4,VLOOKUP(B224,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B224,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B224,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B224,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[479,"2.4.02g",6,null,"2.4.02g","Limiting liabilities if things go wrong - or if there is a court case (ie take ‘reasonable’ precautions)?",{"$f":"VLOOKUP(E225,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E225,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E225,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E225,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C225>4,VLOOKUP(B225,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B225,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B225,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B225,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[480,"2.4.02h",6,null,"2.4.02h","Providing assurance to third parties that everything is under control?",{"$f":"VLOOKUP(E226,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E226,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E226,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E226,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C226>4,VLOOKUP(B226,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B226,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B226,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B226,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[481,"2.4.03",4,null,"2.4.03","Do your objectives for recovering from a cyber security incident cover wider implications for reducing the likelihood of future attacks, including:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C227>4,VLOOKUP(B227,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B227,3),\"\")","v":""},{"$f":"VLOOKUP(B227,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B227,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[482,"2.4.03a",6,null,"2.4.03a","Remediating vulnerabilities to prevent similar incidents occurring?",{"$f":"VLOOKUP(E228,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E228,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E228,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E228,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C228>4,VLOOKUP(B228,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B228,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B228,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B228,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[483,"2.4.03b",6,null,"2.4.03b","Addressing similar weaknesses in your cyber security controls enterprise-wide and beyond?",{"$f":"VLOOKUP(E229,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E229,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E229,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E229,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C229>4,VLOOKUP(B229,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B229,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B229,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B229,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[484,"2.4.03c",6,null,"2.4.03c","Reducing the frequency and impact of future security incidents?",{"$f":"VLOOKUP(E230,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E230,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E230,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E230,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C230>4,VLOOKUP(B230,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B230,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B230,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B230,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[485,"2.4.03d",6,null,"2.4.03d","Proactively responding to the attack (eg by closing channels or 'attacking the attacker')?",{"$f":"VLOOKUP(E231,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E231,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E231,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E231,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C231>4,VLOOKUP(B231,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B231,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B231,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B231,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[486,"2.4.03e",6,null,"2.4.03e","Closing down any criminal operation?",{"$f":"VLOOKUP(E232,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E232,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E232,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E232,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C232>4,VLOOKUP(B232,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B232,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B232,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B232,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[487,"2.4.03f",6,null,"2.4.03f","Punishing offenders (eg prosecuting criminals, exposing national saboteurs and disciplining insiders?",{"$f":"VLOOKUP(E233,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E233,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E233,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E233,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C233>4,VLOOKUP(B233,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B233,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B233,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B233,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[488,"",3,null,"","Recovery Plan",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C234>4,VLOOKUP(B234,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B234,3),\"\")","v":""},{"$f":"VLOOKUP(B234,Weightings!T:X,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(B234,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[489,"2.4.04",5,null,"2.4.04","Do you have a formal recovery plan for recovering from a cyber security incident?",{"$f":"VLOOKUP(E235,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E235,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E235,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E235,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C235>4,VLOOKUP(B235,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B235,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B235,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B235,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[490,"2.4.05",4,null,"2.4.05","Does your recovery plan enable you to recover from a cyber security incident:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C236>4,VLOOKUP(B236,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B236,3),\"\")","v":""},{"$f":"VLOOKUP(B236,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B236,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[491,"2.4.05a",6,null,"2.4.05a","Quickly (ie within critical timescales)?",{"$f":"VLOOKUP(E237,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E237,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E237,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E237,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C237>4,VLOOKUP(B237,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B237,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B237,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B237,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[492,"2.4.05b",6,null,"2.4.05b","Effectively (ensuring that all services have been restored to working order)?",{"$f":"VLOOKUP(E238,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E238,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E238,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E238,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C238>4,VLOOKUP(B238,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B238,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B238,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B238,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[493,"2.4.05c",6,null,"2.4.05c","In a consistent manner?",{"$f":"VLOOKUP(E239,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E239,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E239,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E239,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C239>4,VLOOKUP(B239,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B239,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B239,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B239,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[494,"2.4.06",4,null,"2.4.06","Does your recovery plan cover basic recovery techniques including:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C240>4,VLOOKUP(B240,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B240,3),\"\")","v":""},{"$f":"VLOOKUP(B240,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B240,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[495,"2.4.06a",6,null,"2.4.06a","Rebuilding infected systems (often from known ‘clean’ sources)",{"$f":"VLOOKUP(E241,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E241,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E241,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E241,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C241>4,VLOOKUP(B241,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B241,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B241,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B241,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[496,"2.4.06b",6,null,"2.4.06b","Reconnecting networks",{"$f":"VLOOKUP(E242,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E242,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E242,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E242,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C242>4,VLOOKUP(B242,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B242,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B242,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B242,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[497,"2.4.06c",6,null,"2.4.06c","Restoring, recreating or correcting information?",{"$f":"VLOOKUP(E243,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E243,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E243,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E243,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C243>4,VLOOKUP(B243,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B243,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B243,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B243,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[498,"2.4.06d",6,null,"2.4.06d","Documenting changes made to the infrastructure?",{"$f":"VLOOKUP(E244,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E244,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E244,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E244,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C244>4,VLOOKUP(B244,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B244,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B244,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B244,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[499,"2.4.06e",6,null,"2.4.06e","Dealing with parts of your systems or networks that cannot be recovered?",{"$f":"VLOOKUP(E245,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E245,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E245,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E245,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C245>4,VLOOKUP(B245,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B245,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B245,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B245,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[500,"2.4.07",4,null,"2.4.07","Does your recovery plan cover additional recovery techniques including:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C246>4,VLOOKUP(B246,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B246,3),\"\")","v":""},{"$f":"VLOOKUP(B246,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B246,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[501,"2.4.07a",6,null,"2.4.07a","Replacing compromised files with clean versions?",{"$f":"VLOOKUP(E247,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E247,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E247,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E247,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C247>4,VLOOKUP(B247,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B247,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B247,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B247,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[502,"2.4.07b",6,null,"2.4.07b","Removing temporary constraints imposed during the containment period?",{"$f":"VLOOKUP(E248,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E248,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E248,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E248,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C248>4,VLOOKUP(B248,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B248,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B248,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B248,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[503,"2.4.07c",6,null,"2.4.07c","Resetting passwords on compromised accounts?",{"$f":"VLOOKUP(E249,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E249,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E249,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E249,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C249>4,VLOOKUP(B249,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B249,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B249,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B249,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[504,"2.4.07d",6,null,"2.4.07d","Installing patches, changing passwords and tightening network perimeter security, such as firewall rulesets?",{"$f":"VLOOKUP(E250,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E250,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E250,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E250,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C250>4,VLOOKUP(B250,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B250,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B250,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B250,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[505,"2.4.07e",6,null,"2.4.07e","Testing systems thoroughly – including security controls?",{"$f":"VLOOKUP(E251,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E251,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E251,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E251,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C251>4,VLOOKUP(B251,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B251,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B251,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B251,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[506,"2.4.07f",6,null,"2.4.07f","Confirming the integrity of business systems and controls?",{"$f":"VLOOKUP(E252,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E252,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E252,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E252,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C252>4,VLOOKUP(B252,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B252,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B252,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B252,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[507,"2.4.07g",6,null,"2.4.07g","Announcing the resumption of business services to all relevant stakeholders?",{"$f":"VLOOKUP(E253,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E253,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E253,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E253,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C253>4,VLOOKUP(B253,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B253,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B253,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B253,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[508,"2.4.08",4,null,"2.4.08","Is your recovery plan:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C254>4,VLOOKUP(B254,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B254,3),\"\")","v":""},{"$f":"VLOOKUP(B254,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B254,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[509,"2.4.08a",6,null,"2.4.08a","Linked to the nature of the attack",{"$f":"VLOOKUP(E255,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E255,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E255,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E255,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C255>4,VLOOKUP(B255,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B255,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B255,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B255,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[510,"2.4.08b",6,null,"2.4.08b","Based on a risk-based approach to recovery?",{"$f":"VLOOKUP(E256,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E256,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E256,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E256,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C256>4,VLOOKUP(B256,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B256,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B256,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B256,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[511,"2.4.08c",6,null,"2.4.08c","Designed to prevent exacerbating current risks caused by the incident or introducing new risks?",{"$f":"VLOOKUP(E257,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E257,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E257,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E257,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C257>4,VLOOKUP(B257,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B257,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B257,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B257,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[512,"",3,null,"","Validation",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C258>4,VLOOKUP(B258,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B258,3),\"\")","v":""},{"$f":"VLOOKUP(B258,Weightings!T:X,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(B258,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[513,"2.4.09",4,null,"2.4.09","Do you validate that systems are operating normally again by:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C259>4,VLOOKUP(B259,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B259,3),\"\")","v":""},{"$f":"VLOOKUP(B259,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B259,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[514,"2.4.09a",6,null,"2.4.09a","Carrying out an independent penetration test of the affected systems?",{"$f":"VLOOKUP(E260,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E260,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E260,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E260,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C260>4,VLOOKUP(B260,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B260,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B260,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B260,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[515,"2.4.09b",6,null,"2.4.09b","Undertaking a security controls assessment?",{"$f":"VLOOKUP(E261,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E261,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E261,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E261,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C261>4,VLOOKUP(B261,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B261,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B261,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B261,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[516,"2.4.10",4,null,"2.4.10","To help detect further attacks (or attempted attacks) do you:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C262>4,VLOOKUP(B262,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B262,3),\"\")","v":""},{"$f":"VLOOKUP(B262,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B262,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[517,"2.4.10a",6,null,"2.4.10a","Retain cyber security threat intelligence (including network situational awareness)?",{"$f":"VLOOKUP(E263,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E263,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E263,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E263,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C263>4,VLOOKUP(B263,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B263,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B263,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B263,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[518,{"$f":"VLOOKUP(A264,contentref,2,FALSE)","v":"2.4.10b"},6,null,"2.4.10b","Monitor the network over an extended time?",{"$f":"VLOOKUP(E264,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E264,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E264,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E264,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C264>4,VLOOKUP(B264,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B264,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B264,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B264,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$f":"W264*V264*3","v":15}]
[519,"2.4.11",4,null,"2.4.11","Once systems have been recovered and controls have been tested do you:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C265>4,VLOOKUP(B265,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B265,3),\"\")","v":""},{"$f":"VLOOKUP(B265,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B265,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[520,"2.4.11a",6,null,"2.4.11a","Provided stakeholders with a brief summary of what took place?",{"$f":"VLOOKUP(E266,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E266,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E266,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E266,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C266>4,VLOOKUP(B266,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B266,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B266,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B266,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[521,"2.4.11b",6,null,"2.4.11b","Brief stakeholders within a day or so of the event?",{"$f":"VLOOKUP(E267,'Assessment - Phase 2'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E267,'Assessment - Phase 2'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E267,'Assessment - Phase 2'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E267,'Assessment - Phase 2'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C267>4,VLOOKUP(B267,'Assessment - Phase 2'!E:AA,23,FALSE)<>7),LEFT(B267,3),\"\")","v":"2.4"},{"$f":"VLOOKUP(B267,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B267,'Assessment - Phase 2'!B:AA,26,FALSE)=7,0,1)","v":1},9]

{"sheet":"Results - Phase 3","index":13,"n_rows":130,"n_cols":24,"rows_kept":130,"cut":false,"hidden":false,"merged":[[1,5,2,8],[3,5,4,8]]}
[]
[null,null,null,null,null,{"$f":"\"Results\"&IF(LEN(scope_area_of_assessment)=0,\"\",\" for \"&scope_area_of_assessment)","v":"Results"}]
[]
[null,null,null,null,null,"Maturity model for Phase 3 - Follow Up"]
[]
[]
["Order","FullQ","Type",null,null,null,"Response (0-3)","Weighted score (0-15)","Evidence supplied"]
[523,{"$f":"VLOOKUP(A8,contentref,2,FALSE)","v":"3.1"},{"$f":"VLOOKUP(A8,contentref,15,FALSE)","v":2},null,{"$f":"IF(C8=1,\"Phase \"&B8,IF(C8=2,\"Step \"&VLOOKUP(A8,contentref,4,FALSE),B8))","v":"Step 1"},{"$f":"VLOOKUP(A8,contentref,7,FALSE)","v":"Incident investigation"},{"$f":"\"Maturity level:  \"&O8","v":"Maturity level:  Level 1"},null,null,null,null,{"$f":"TEXT(B8,\"0.0\")","v":"3.1"},{"$f":"SUMIF(U:U,L8,H:H)/(SUMIF(U:U,L8,X:X))","v":0},{"$f":"HLOOKUP(M8*100,level_ref,2,TRUE)","v":"Level 1"},{"$f":"IF(ISERROR(N8),\"\",N8)","v":"Level 1"},{"$f":"HLOOKUP(M8*100,level_ref,3,TRUE)","v":1},{"$f":"IF(ISERROR(P8),\"\",P8)","v":1},null,null,null,{"$f":"IF(AND(C8>4,VLOOKUP(B8,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B8,3),\"\")","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(B8,Weightings!T:X,5,FALSE)","v":{"$error":"#N/A"}},{"$f":"IF(VLOOKUP(B8,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$f":"W8*V8*3","v":{"$error":"#N/A"}}]
[524,"3.1.01",5,null,"3.1.01","Do you investigate cyber security incidents more thoroughly after they have been resolved?",{"$f":"VLOOKUP(E9,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E9,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E9,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E9,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C9>4,VLOOKUP(B9,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B9,3),\"\")","v":"3.1"},{"$f":"VLOOKUP(B9,Weightings!T:X,5,FALSE)","v":1},{"$f":"IF(VLOOKUP(B9,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},3]
[525,"3.1.02",5,null,"3.1.02","Is your investigation carried out in a structured, systematic manner?",{"$f":"VLOOKUP(E10,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E10,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E10,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E10,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C10>4,VLOOKUP(B10,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B10,3),\"\")","v":"3.1"},{"$f":"VLOOKUP(B10,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B10,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[526,"3.1.03",5,null,"3.1.03","Do you perform problem cause analysis for cyber security incidents?",{"$f":"VLOOKUP(E11,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E11,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E11,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E11,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C11>4,VLOOKUP(B11,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B11,3),\"\")","v":"3.1"},{"$f":"VLOOKUP(B11,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B11,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[527,"3.1.04",5,null,"3.1.04","Does your problem cause analysis include using appropriate investigative techniques, such as:",{"$f":"VLOOKUP(E12,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E12,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E12,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E12,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C12>4,VLOOKUP(B12,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B12,3),\"\")","v":"3.1"},{"$f":"VLOOKUP(B12,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B12,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[528,"3.1.05",5,null,"3.1.05","Do you carry out root cause identification for cyber security incidents?",{"$f":"VLOOKUP(E13,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E13,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E13,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E13,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C13>4,VLOOKUP(B13,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B13,3),\"\")","v":"3.1"},{"$f":"VLOOKUP(B13,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B13,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[529,"3.1.06",5,null,"3.1.06","Does your root cause identification include using appropriate investigative techniques, such as:",{"$f":"VLOOKUP(E14,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E14,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E14,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E14,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C14>4,VLOOKUP(B14,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B14,3),\"\")","v":"3.1"},{"$f":"VLOOKUP(B14,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B14,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[530,"3.1.07",5,null,"3.1.07","Does your root cause identification help to identify previously unknown sources of cyber security incidents?",{"$f":"VLOOKUP(E15,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E15,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E15,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E15,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C15>4,VLOOKUP(B15,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B15,3),\"\")","v":"3.1"},{"$f":"VLOOKUP(B15,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B15,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[531,"3.1.08",5,null,"3.1.08","Do you quantify the business impact of cyber security incidents (eg in terms of financial, reputational, management or compliance impact)?",{"$f":"VLOOKUP(E16,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E16,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E16,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E16,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C16>4,VLOOKUP(B16,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B16,3),\"\")","v":"3.1"},{"$f":"VLOOKUP(B16,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B16,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[532,"3.1.09",5,null,"3.1.09","Do you carry out sufficient investigation to identify the perpetrators(s) of the cyber security incident, which may involve specialist support, such as from forensic investigators?",{"$f":"VLOOKUP(E17,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E17,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E17,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E17,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C17>4,VLOOKUP(B17,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B17,3),\"\")","v":"3.1"},{"$f":"VLOOKUP(B17,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B17,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[533,"3.1.10",5,null,"3.1.10","Does your investigation cover events in relation to the ‘attacker kill chain’ (ie reconnaissance, weaponize, deliver, exploit, install, command & control and act on objectives)?",{"$f":"VLOOKUP(E18,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E18,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E18,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E18,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C18>4,VLOOKUP(B18,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B18,3),\"\")","v":"3.1"},{"$f":"VLOOKUP(B18,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B18,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[534,"3.1.11",5,null,"3.1.11","Does your investigation link to wider problem management activities, such as those used in service management (eg ITIL approach)?",{"$f":"VLOOKUP(E19,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E19,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E19,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E19,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C19>4,VLOOKUP(B19,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B19,3),\"\")","v":"3.1"},{"$f":"VLOOKUP(B19,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B19,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[535,"3.2",2,null,"Step 2","Reporting",{"$f":"\"Maturity level:  \"&O20","v":"Maturity level:  Level 1"},null,null,null,null,{"$f":"TEXT(B20,\"0.0\")","v":"3.2"},{"$f":"SUMIF(U:U,L20,H:H)/(SUMIF(U:U,L20,X:X))","v":0},{"$f":"HLOOKUP(M20*100,level_ref,2,TRUE)","v":"Level 1"},{"$f":"IF(ISERROR(N20),\"\",N20)","v":"Level 1"},{"$f":"HLOOKUP(M20*100,level_ref,3,TRUE)","v":1},{"$f":"IF(ISERROR(P20),\"\",P20)","v":1},null,null,null,{"$f":"IF(AND(C20>4,VLOOKUP(B20,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B20,3),\"\")","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(B20,Weightings!T:X,5,FALSE)","v":{"$error":"#N/A"}},{"$f":"IF(VLOOKUP(B20,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#N/A"}]
[536,"3.2.01",5,null,"3.2.01","Are cyber security incidents reported to relevant internal stakeholders (eg information security, corporate IT departments and business units)?",{"$f":"VLOOKUP(E21,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E21,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E21,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E21,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C21>4,VLOOKUP(B21,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B21,3),\"\")","v":"3.2"},{"$f":"VLOOKUP(B21,Weightings!T:X,5,FALSE)","v":1},{"$f":"IF(VLOOKUP(B21,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},3]
[537,"3.2.02",4,null,"3.2.02","Are you aware of:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C22>4,VLOOKUP(B22,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B22,3),\"\")","v":""},{"$f":"VLOOKUP(B22,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B22,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[538,"3.2.02a",6,null,"3.2.02a","Your regulatory and legal reporting requirements (eg mandatory reporting to particular authorities)?",{"$f":"VLOOKUP(E23,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E23,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E23,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E23,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C23>4,VLOOKUP(B23,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B23,3),\"\")","v":"3.2"},{"$f":"VLOOKUP(B23,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B23,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[539,"3.2.02b",6,null,"3.2.02b","What types of cyber security incident need to be reported?",{"$f":"VLOOKUP(E24,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E24,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E24,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E24,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C24>4,VLOOKUP(B24,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B24,3),\"\")","v":"3.2"},{"$f":"VLOOKUP(B24,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B24,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[540,"3.2.02c",6,null,"3.2.02c","To which external body each type of cyber security incidents need to be reported?",{"$f":"VLOOKUP(E25,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E25,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E25,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E25,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C25>4,VLOOKUP(B25,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B25,3),\"\")","v":"3.2"},{"$f":"VLOOKUP(B25,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B25,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[541,"3.2.02d",6,null,"3.2.02d","The format in which cyber security incidents need to be reported?",{"$f":"VLOOKUP(E26,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E26,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E26,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E26,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C26>4,VLOOKUP(B26,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B26,3),\"\")","v":"3.2"},{"$f":"VLOOKUP(B26,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B26,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[542,"3.2.02e",6,null,"3.2.02e","The objectives of reporting cyber security incidents?",{"$f":"VLOOKUP(E27,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E27,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E27,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E27,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C27>4,VLOOKUP(B27,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B27,3),\"\")","v":"3.2"},{"$f":"VLOOKUP(B27,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B27,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[543,"3.2.03",5,null,"3.2.03","Do you report targeted cyber security incidents, to required authorities, such as GovCertUK (the Government’s Computer Emergency Response Team)?",{"$f":"VLOOKUP(E28,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E28,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E28,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E28,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C28>4,VLOOKUP(B28,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B28,3),\"\")","v":"3.2"},{"$f":"VLOOKUP(B28,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B28,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[544,"3.2.04",5,null,"3.2.04","Do you notify required authorities, such as GovCertUK (the Government’s Computer Emergency Response Team) of any other (non-targeted) cyber security incidents?",{"$f":"VLOOKUP(E29,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E29,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E29,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E29,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C29>4,VLOOKUP(B29,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B29,3),\"\")","v":"3.2"},{"$f":"VLOOKUP(B29,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B29,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[545,"3.2.05",4,null,"3.2.05","When reporting cyber security incidents, do you provide:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C30>4,VLOOKUP(B30,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B30,3),\"\")","v":""},{"$f":"VLOOKUP(B30,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B30,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[546,"3.2.05a",6,null,"3.2.05a","A full description of the nature of the incident, its history, and what actions were taken to recover?",{"$f":"VLOOKUP(E31,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E31,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E31,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E31,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C31>4,VLOOKUP(B31,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B31,3),\"\")","v":"3.2"},{"$f":"VLOOKUP(B31,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B31,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[547,"3.2.05b",6,null,"3.2.05b","A realistic estimate of the financial cost of the incident, as well as other impacts on the business, such as in terms of damage to reputation, loss of management control or impaired growth?",{"$f":"VLOOKUP(E32,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E32,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E32,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E32,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C32>4,VLOOKUP(B32,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B32,3),\"\")","v":"3.2"},{"$f":"VLOOKUP(B32,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B32,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[548,"3.2.05c",6,null,"3.2.05c","Recommendations regarding enhanced or additional controls required to prevent, detect, remediate or recover from cyber security incidents more effectively?",{"$f":"VLOOKUP(E33,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E33,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E33,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E33,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C33>4,VLOOKUP(B33,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B33,3),\"\")","v":"3.2"},{"$f":"VLOOKUP(B33,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B33,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[549,"3.2.06",5,null,"3.2.06","Do you voluntarily report cyber security incidents to important stakeholders, such as law enforcement agencies, specialised bodies (eg NIST, ENISA or CREST), regulatory bodies with particular market sectors (eg the FSA or Bank of England in Finance) or collaborative groups?",{"$f":"VLOOKUP(E34,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E34,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E34,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E34,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C34>4,VLOOKUP(B34,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B34,3),\"\")","v":"3.2"},{"$f":"VLOOKUP(B34,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B34,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[550,"3.2.07",5,null,"3.2.07","Do you provide recommendations to external bodies regarding enhanced or additional controls required to prevent, detect, remediate or recover from cyber security incidents more effectively?",{"$f":"VLOOKUP(E35,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E35,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E35,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E35,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C35>4,VLOOKUP(B35,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B35,3),\"\")","v":"3.2"},{"$f":"VLOOKUP(B35,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B35,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[551,"3.3",2,null,"Step 3","Post incident review",{"$f":"\"Maturity level:  \"&O36","v":"Maturity level:  Level 1"},null,null,null,null,{"$f":"TEXT(B36,\"0.0\")","v":"3.3"},{"$f":"SUMIF(U:U,L36,H:H)/(SUMIF(U:U,L36,X:X))","v":0},{"$f":"HLOOKUP(M36*100,level_ref,2,TRUE)","v":"Level 1"},{"$f":"IF(ISERROR(N36),\"\",N36)","v":"Level 1"},{"$f":"HLOOKUP(M36*100,level_ref,3,TRUE)","v":1},{"$f":"IF(ISERROR(P36),\"\",P36)","v":1},null,null,null,{"$f":"IF(AND(C36>4,VLOOKUP(B36,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B36,3),\"\")","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(B36,Weightings!T:X,5,FALSE)","v":{"$error":"#N/A"}},{"$f":"IF(VLOOKUP(B36,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#N/A"}]
[552,"3.3.01",5,null,"3.3.01","Do you carry out post incident reviews for particular cyber security incidents?",{"$f":"VLOOKUP(E37,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E37,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E37,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E37,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C37>4,VLOOKUP(B37,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B37,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B37,Weightings!T:X,5,FALSE)","v":1},{"$f":"IF(VLOOKUP(B37,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},3]
[553,"3.3.02",5,null,"3.3.02","Is your post incident review process formalised (eg documented and approved)?",{"$f":"VLOOKUP(E38,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E38,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E38,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E38,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C38>4,VLOOKUP(B38,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B38,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B38,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B38,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[554,"3.3.03",4,null,"3.3.03","Do your post incident reviews include analysing the incident management process to determine:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C39>4,VLOOKUP(B39,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B39,3),\"\")","v":""},{"$f":"VLOOKUP(B39,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B39,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[555,{"$f":"VLOOKUP(A40,contentref,2,FALSE)","v":"3.3.03a"},{"$f":"VLOOKUP(A40,contentref,15,FALSE)","v":6},null,{"$f":"IF(C40=1,\"Phase \"&B40,IF(C40=2,\"Step \"&VLOOKUP(A40,contentref,4,FALSE),B40))","v":"3.3.03a"},{"$f":"VLOOKUP(A40,contentref,7,FALSE)","v":"How quickly actions were taken to identify, respond to and recover from the incident?"},{"$f":"VLOOKUP(E40,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E40,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E40,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E40,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C40>4,VLOOKUP(B40,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B40,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B40,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B40,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$f":"W40*V40*3","v":9}]
[556,"3.3.03b",6,null,"3.3.03b","How long attackers were in systems before detection?",{"$f":"VLOOKUP(E41,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E41,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E41,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E41,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C41>4,VLOOKUP(B41,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B41,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B41,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B41,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[557,"3.3.03c",6,null,"3.3.03c","What actions attackers took and planned to take",{"$f":"VLOOKUP(E42,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E42,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E42,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E42,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C42>4,VLOOKUP(B42,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B42,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B42,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B42,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[558,"3.3.03d",6,null,"3.3.03d","The level of protection maintained over critical systems and confidential information during the incident?",{"$f":"VLOOKUP(E43,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E43,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E43,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E43,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C43>4,VLOOKUP(B43,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B43,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B43,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B43,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[559,"3.3.03e",6,null,"3.3.03e","How well staff and management performed in dealing with the incident?",{"$f":"VLOOKUP(E44,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E44,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E44,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E44,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C44>4,VLOOKUP(B44,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B44,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B44,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B44,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[560,"3.3.03f",6,null,"3.3.03f","If all key discussions and decisions conducted during the eradication event were well documented?",{"$f":"VLOOKUP(E45,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E45,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E45,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E45,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C45>4,VLOOKUP(B45,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B45,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B45,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B45,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[561,"3.3.03g",6,null,"3.3.03g","The effectiveness of procedures?",{"$f":"VLOOKUP(E46,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E46,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E46,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E46,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C46>4,VLOOKUP(B46,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B46,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B46,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B46,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[562,"3.3.03h",6,null,"3.3.03h","If any steps or actions taken might have inhibited the recovery?",{"$f":"VLOOKUP(E47,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E47,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E47,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E47,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C47>4,VLOOKUP(B47,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B47,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B47,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B47,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[563,"3.3.03i",6,null,"3.3.03i","If any unforeseen events could have been prevented?",{"$f":"VLOOKUP(E48,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E48,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E48,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E48,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C48>4,VLOOKUP(B48,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B48,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B48,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B48,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[564,"3.3.04",4,null,"3.3.04","Do your post incident reviews include informing possible future actions by evaluating:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C49>4,VLOOKUP(B49,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B49,3),\"\")","v":""},{"$f":"VLOOKUP(B49,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B49,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[565,"3.3.04a",6,null,"3.3.04a","What the staff and management can do differently the next time a similar cyber security incident occurs?",{"$f":"VLOOKUP(E50,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E50,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E50,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E50,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C50>4,VLOOKUP(B50,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B50,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B50,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B50,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[566,"3.3.04b",6,null,"3.3.04b","How information sharing with other organisations can be improved?",{"$f":"VLOOKUP(E51,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E51,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E51,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E51,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C51>4,VLOOKUP(B51,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B51,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B51,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B51,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[567,"3.3.04c",6,null,"3.3.04c","What corrective actions can prevent similar incidents in the future?",{"$f":"VLOOKUP(E52,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E52,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E52,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E52,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C52>4,VLOOKUP(B52,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B52,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B52,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B52,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[568,"3.3.04d",6,null,"3.3.04d","Any precursors or indicators that should be watched for in the future to detect similar incidents?",{"$f":"VLOOKUP(E53,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E53,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E53,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E53,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C53>4,VLOOKUP(B53,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B53,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B53,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B53,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[569,"3.3.04e",6,null,"3.3.04e","How results can be fed back into your risk assessment methodology?",{"$f":"VLOOKUP(E54,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E54,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E54,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E54,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C54>4,VLOOKUP(B54,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B54,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B54,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B54,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[570,"3.3.05",5,null,"3.3.05","Is a report produced from your post incident review?",{"$f":"VLOOKUP(E55,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E55,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E55,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E55,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C55>4,VLOOKUP(B55,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B55,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B55,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B55,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[571,"3.3.06",5,null,"3.3.06","Are the results of your post implementation review report presented to all relevant stakeholders?",{"$f":"VLOOKUP(E56,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E56,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E56,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E56,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C56>4,VLOOKUP(B56,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B56,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B56,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B56,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[572,"3.3.07",5,null,"3.3.07","Is your post incident review process evaluated on a regular basis to identify any improvements that can be made to it)?",{"$f":"VLOOKUP(E57,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E57,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E57,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E57,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C57>4,VLOOKUP(B57,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B57,3),\"\")","v":"3.3"},{"$f":"VLOOKUP(B57,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B57,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[573,"3.4",2,null,"Step 4","Lessons learned",{"$f":"\"Maturity level:  \"&O58","v":"Maturity level:  Level 1"},null,null,null,null,{"$f":"TEXT(B58,\"0.0\")","v":"3.4"},{"$f":"SUMIF(U:U,L58,H:H)/(SUMIF(U:U,L58,X:X))","v":0},{"$f":"HLOOKUP(M58*100,level_ref,2,TRUE)","v":"Level 1"},{"$f":"IF(ISERROR(N58),\"\",N58)","v":"Level 1"},{"$f":"HLOOKUP(M58*100,level_ref,3,TRUE)","v":1},{"$f":"IF(ISERROR(P58),\"\",P58)","v":1},null,null,null,{"$f":"IF(AND(C58>4,VLOOKUP(B58,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B58,3),\"\")","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(B58,Weightings!T:X,5,FALSE)","v":{"$error":"#N/A"}},{"$f":"IF(VLOOKUP(B58,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#N/A"}]
[574,"3.4.01",5,null,"3.4.01","Do you identify lessons learned from cyber security incidents?",{"$f":"VLOOKUP(E59,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E59,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E59,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E59,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C59>4,VLOOKUP(B59,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B59,3),\"\")","v":"3.4"},{"$f":"VLOOKUP(B59,Weightings!T:X,5,FALSE)","v":1},{"$f":"IF(VLOOKUP(B59,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},3]
[575,"3.4.02",4,null,"3.4.02","Are lessons learned:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C60>4,VLOOKUP(B60,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B60,3),\"\")","v":""},{"$f":"VLOOKUP(B60,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B60,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[576,"3.4.02a",6,null,"3.4.02a","Formally documented?",{"$f":"VLOOKUP(E61,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E61,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E61,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E61,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C61>4,VLOOKUP(B61,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B61,3),\"\")","v":"3.4"},{"$f":"VLOOKUP(B61,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B61,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[577,"3.4.02b",6,null,"3.4.02b","Communicated to relevant stakeholders?",{"$f":"VLOOKUP(E62,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E62,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E62,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E62,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C62>4,VLOOKUP(B62,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B62,3),\"\")","v":"3.4"},{"$f":"VLOOKUP(B62,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B62,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[578,"3.4.02c",6,null,"3.4.02c","Built upon in the form of tangible actions?",{"$f":"VLOOKUP(E63,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E63,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E63,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E63,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C63>4,VLOOKUP(B63,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B63,3),\"\")","v":"3.4"},{"$f":"VLOOKUP(B63,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B63,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[579,"3.4.02d",6,null,"3.4.02d","Used to share both key issues and good practice across all areas of the business, not just within IT and cyber security teams?",{"$f":"VLOOKUP(E64,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E64,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E64,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E64,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C64>4,VLOOKUP(B64,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B64,3),\"\")","v":"3.4"},{"$f":"VLOOKUP(B64,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B64,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[580,"3.4.03",4,null,"3.4.03","Is communication to stakeholders about lessons learned:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C65>4,VLOOKUP(B65,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B65,3),\"\")","v":""},{"$f":"VLOOKUP(B65,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B65,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[581,"3.4.03a",6,null,"3.4.03a","Clear and concise?",{"$f":"VLOOKUP(E66,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E66,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E66,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E66,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C66>4,VLOOKUP(B66,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B66,3),\"\")","v":"3.4"},{"$f":"VLOOKUP(B66,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B66,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[582,"3.4.03b",6,null,"3.4.03b","Focused on problem resolution and control improvement?",{"$f":"VLOOKUP(E67,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E67,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E67,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E67,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C67>4,VLOOKUP(B67,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B67,3),\"\")","v":"3.4"},{"$f":"VLOOKUP(B67,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B67,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[583,"3.4.04",4,null,"3.4.04","Is communication to stakeholders about lessons learned used to:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C68>4,VLOOKUP(B68,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B68,3),\"\")","v":""},{"$f":"VLOOKUP(B68,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B68,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[584,"3.4.04a",6,null,"3.4.04a","Help identify any gaps that remain and proposed efforts to mitigate them?",{"$f":"VLOOKUP(E69,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E69,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E69,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E69,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C69>4,VLOOKUP(B69,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B69,3),\"\")","v":"3.4"},{"$f":"VLOOKUP(B69,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B69,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[585,"3.4.04b",6,null,"3.4.04b","Inform strategic security goals?",{"$f":"VLOOKUP(E70,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E70,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E70,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E70,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C70>4,VLOOKUP(B70,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B70,3),\"\")","v":"3.4"},{"$f":"VLOOKUP(B70,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B70,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[586,"3.4.05",5,null,"3.4.05","Are formal actions plans developed to help build on lessons learned?",{"$f":"VLOOKUP(E71,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E71,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E71,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E71,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C71>4,VLOOKUP(B71,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B71,3),\"\")","v":"3.4"},{"$f":"VLOOKUP(B71,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B71,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[587,{"$f":"VLOOKUP(A72,contentref,2,FALSE)","v":"3.4.06"},{"$f":"VLOOKUP(A72,contentref,15,FALSE)","v":4},null,{"$f":"IF(C72=1,\"Phase \"&B72,IF(C72=2,\"Step \"&VLOOKUP(A72,contentref,4,FALSE),B72))","v":"3.4.06"},{"$f":"VLOOKUP(A72,contentref,7,FALSE)","v":"Do actions plans:"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C72>4,VLOOKUP(B72,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B72,3),\"\")","v":""},{"$f":"VLOOKUP(B72,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B72,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$f":"W72*V72*3","v":{"$error":"#VALUE!"}}]
[588,"3.4.06a",6,null,"3.4.06a","Consider whether technical capability gaps contributed to the attacker’s success or whether people or process gaps were the main culprit?",{"$f":"VLOOKUP(E73,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E73,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E73,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E73,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C73>4,VLOOKUP(B73,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B73,3),\"\")","v":"3.4"},{"$f":"VLOOKUP(B73,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B73,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[589,"3.4.06b",6,null,"3.4.06b","Leverage lessons learned from the incident to become more resilient in the face of future cyber security attacks?",{"$f":"VLOOKUP(E74,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E74,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E74,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E74,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C74>4,VLOOKUP(B74,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B74,3),\"\")","v":"3.4"},{"$f":"VLOOKUP(B74,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B74,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[590,"3.4.07",4,null,"3.4.07","Do actions plans include projects or initiatives, technical and nontechnical that will help:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C75>4,VLOOKUP(B75,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B75,3),\"\")","v":""},{"$f":"VLOOKUP(B75,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B75,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[591,"3.4.07a",6,null,"3.4.07a","Reduce an attacker’s chance of success?",{"$f":"VLOOKUP(E76,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E76,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E76,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E76,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C76>4,VLOOKUP(B76,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B76,3),\"\")","v":"3.4"},{"$f":"VLOOKUP(B76,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B76,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[592,"3.4.07b",6,null,"3.4.07b","Respond to an attacker’s activities more rapidly and effectively?",{"$f":"VLOOKUP(E77,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E77,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E77,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E77,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C77>4,VLOOKUP(B77,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B77,3),\"\")","v":"3.4"},{"$f":"VLOOKUP(B77,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B77,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[593,"3.4.08",4,null,"3.4.08","Is each action:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C78>4,VLOOKUP(B78,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B78,3),\"\")","v":""},{"$f":"VLOOKUP(B78,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B78,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[594,"3.4.08a",6,null,"3.4.08a","Assigned to a named individual?",{"$f":"VLOOKUP(E79,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E79,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E79,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E79,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C79>4,VLOOKUP(B79,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B79,3),\"\")","v":"3.4"},{"$f":"VLOOKUP(B79,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B79,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[595,"3.4.08b",6,null,"3.4.08b","Given a suitable priority?",{"$f":"VLOOKUP(E80,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E80,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E80,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E80,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C80>4,VLOOKUP(B80,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B80,3),\"\")","v":"3.4"},{"$f":"VLOOKUP(B80,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B80,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[596,"3.4.08c",6,null,"3.4.08c","Allocated a completion date?",{"$f":"VLOOKUP(E81,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E81,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E81,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E81,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C81>4,VLOOKUP(B81,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B81,3),\"\")","v":"3.4"},{"$f":"VLOOKUP(B81,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B81,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[597,"3.4.08d",6,null,"3.4.08d","Monitored to ensure that it is being completed in a timely and effective manner?",{"$f":"VLOOKUP(E82,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E82,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E82,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E82,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C82>4,VLOOKUP(B82,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B82,3),\"\")","v":"3.4"},{"$f":"VLOOKUP(B82,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B82,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[598,"3.5",2,null,"Step 5","Updating",{"$f":"\"Maturity level:  \"&O83","v":"Maturity level:  Level 1"},null,null,null,null,{"$f":"TEXT(B83,\"0.0\")","v":"3.5"},{"$f":"SUMIF(U:U,L83,H:H)/(SUMIF(U:U,L83,X:X))","v":0},{"$f":"HLOOKUP(M83*100,level_ref,2,TRUE)","v":"Level 1"},{"$f":"IF(ISERROR(N83),\"\",N83)","v":"Level 1"},{"$f":"HLOOKUP(M83*100,level_ref,3,TRUE)","v":1},{"$f":"IF(ISERROR(P83),\"\",P83)","v":1},null,null,null,{"$f":"IF(AND(C83>4,VLOOKUP(B83,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B83,3),\"\")","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(B83,Weightings!T:X,5,FALSE)","v":{"$error":"#N/A"}},{"$f":"IF(VLOOKUP(B83,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#N/A"}]
[599,"3.5.01",5,null,"3.5.01","Following a cyber security incident, do you carry out any updates (eg to your cyber security incident response approaches, controls and related documents)?",{"$f":"VLOOKUP(E84,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E84,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E84,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E84,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C84>4,VLOOKUP(B84,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B84,3),\"\")","v":"3.5"},{"$f":"VLOOKUP(B84,Weightings!T:X,5,FALSE)","v":1},{"$f":"IF(VLOOKUP(B84,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},3]
[600,"3.5.02",4,null,"3.5.02","Following a cyber security incident, do you update your:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C85>4,VLOOKUP(B85,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B85,3),\"\")","v":""},{"$f":"VLOOKUP(B85,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B85,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[601,"3.5.02a",6,null,"3.5.02a","Cyber security incident management methodologies or processes?",{"$f":"VLOOKUP(E86,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E86,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E86,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E86,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C86>4,VLOOKUP(B86,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B86,3),\"\")","v":"3.5"},{"$f":"VLOOKUP(B86,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B86,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[602,"3.5.02b",6,null,"3.5.02b","Cyber security incident response plan?",{"$f":"VLOOKUP(E87,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E87,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E87,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E87,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C87>4,VLOOKUP(B87,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B87,3),\"\")","v":"3.5"},{"$f":"VLOOKUP(B87,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B87,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[603,"3.5.02c",6,null,"3.5.02c","Management controls (eg training and awareness)",{"$f":"VLOOKUP(E88,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E88,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E88,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E88,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C88>4,VLOOKUP(B88,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B88,3),\"\")","v":"3.5"},{"$f":"VLOOKUP(B88,Weightings!T:X,5,FALSE)","v":2},{"$f":"IF(VLOOKUP(B88,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},6]
[604,"3.5.02d",6,null,"3.5.02d","Technical controls (eg patching, configuring system logs, and use of intrusion prevention / detection tools)",{"$f":"VLOOKUP(E89,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E89,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E89,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E89,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C89>4,VLOOKUP(B89,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B89,3),\"\")","v":"3.5"},{"$f":"VLOOKUP(B89,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B89,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[605,"3.5.02e",6,null,"3.5.02e","Roles and responsibilities for handling incidents?",{"$f":"VLOOKUP(E90,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E90,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E90,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E90,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C90>4,VLOOKUP(B90,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B90,3),\"\")","v":"3.5"},{"$f":"VLOOKUP(B90,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B90,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[606,"3.5.03",5,null,"3.5.03","When updating controls, do you consider the attack vectors causing most concern, which often include:",{"$f":"VLOOKUP(E91,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E91,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E91,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E91,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C91>4,VLOOKUP(B91,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B91,3),\"\")","v":"3.5"},{"$f":"VLOOKUP(B91,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B91,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[607,"3.5.04",5,null,"3.5.04","When updating controls, do you:",{"$f":"VLOOKUP(E92,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E92,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E92,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E92,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C92>4,VLOOKUP(B92,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B92,3),\"\")","v":"3.5"},{"$f":"VLOOKUP(B92,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B92,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[608,"3.5.04a",6,null,"3.5.04a","Consider their effectiveness in relation to events in the ‘attacker kill chain’ (ie reconnaissance, weaponize, deliver, exploit, install, command & control and act on objectives)?",{"$f":"VLOOKUP(E93,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E93,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E93,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E93,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C93>4,VLOOKUP(B93,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B93,3),\"\")","v":"3.5"},{"$f":"VLOOKUP(B93,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B93,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[609,"3.5.04b",6,null,"3.5.04b","Review implications for tactical and short term security projects?",{"$f":"VLOOKUP(E94,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E94,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E94,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E94,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C94>4,VLOOKUP(B94,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B94,3),\"\")","v":"3.5"},{"$f":"VLOOKUP(B94,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B94,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[610,"3.5.05",4,null,"3.5.05","Following a cyber security incident, do you feed the results of incident analysis back into your:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C95>4,VLOOKUP(B95,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B95,3),\"\")","v":""},{"$f":"VLOOKUP(B95,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B95,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[611,"3.5.05a",6,null,"3.5.05a","Risk assessment methodologies?",{"$f":"VLOOKUP(E96,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E96,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E96,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E96,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C96>4,VLOOKUP(B96,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B96,3),\"\")","v":"3.5"},{"$f":"VLOOKUP(B96,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B96,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[612,"3.5.05b",6,null,"3.5.05b","Cyber security threat analysis?",{"$f":"VLOOKUP(E97,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E97,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E97,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E97,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C97>4,VLOOKUP(B97,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B97,3),\"\")","v":"3.5"},{"$f":"VLOOKUP(B97,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B97,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[613,"3.5.05c",6,null,"3.5.05c","Business continuity or crisis management arrangements?",{"$f":"VLOOKUP(E98,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E98,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E98,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E98,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C98>4,VLOOKUP(B98,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B98,3),\"\")","v":"3.5"},{"$f":"VLOOKUP(B98,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B98,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[614,"3.5.05d",6,null,"3.5.05d","Contractual arrangements with third party suppliers?",{"$f":"VLOOKUP(E99,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E99,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E99,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E99,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C99>4,VLOOKUP(B99,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B99,3),\"\")","v":"3.5"},{"$f":"VLOOKUP(B99,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B99,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[615,"3.5.05e",6,null,"3.5.05e","Business intelligence initiatives?",{"$f":"VLOOKUP(E100,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E100,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E100,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E100,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C100>4,VLOOKUP(B100,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B100,3),\"\")","v":"3.5"},{"$f":"VLOOKUP(B100,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B100,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[616,"3.5.06",4,null,"3.5.06","Are updates carried out:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C101>4,VLOOKUP(B101,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B101,3),\"\")","v":""},{"$f":"VLOOKUP(B101,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B101,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[617,"3.5.06a",6,null,"3.5.06a","Using a structured, systematic process?",{"$f":"VLOOKUP(E102,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E102,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E102,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E102,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C102>4,VLOOKUP(B102,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B102,3),\"\")","v":"3.5"},{"$f":"VLOOKUP(B102,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B102,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[618,"3.5.06b",6,null,"3.5.06b","In accordance with formally approved documentation?",{"$f":"VLOOKUP(E103,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E103,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E103,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E103,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C103>4,VLOOKUP(B103,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B103,3),\"\")","v":"3.5"},{"$f":"VLOOKUP(B103,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B103,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[619,{"$f":"VLOOKUP(A104,contentref,2,FALSE)","v":"3.5.07"},{"$f":"VLOOKUP(A104,contentref,15,FALSE)","v":5},null,{"$f":"IF(C104=1,\"Phase \"&B104,IF(C104=2,\"Step \"&VLOOKUP(A104,contentref,4,FALSE),B104))","v":"3.5.07"},{"$f":"VLOOKUP(A104,contentref,7,FALSE)","v":"Following a cyber security incident, do you review your state of readiness for handling a cyber security incident?"},{"$f":"VLOOKUP(E104,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E104,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E104,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E104,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C104>4,VLOOKUP(B104,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B104,3),\"\")","v":"3.5"},{"$f":"VLOOKUP(B104,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B104,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$f":"W104*V104*3","v":15}]
[620,"3.6",2,null,"Step 6","Trend analysis",{"$f":"\"Maturity level:  \"&O105","v":"Maturity level:  Level 1"},null,null,null,null,{"$f":"TEXT(B105,\"0.0\")","v":"3.6"},{"$f":"SUMIF(U:U,L105,H:H)/(SUMIF(U:U,L105,X:X))","v":0},{"$f":"HLOOKUP(M105*100,level_ref,2,TRUE)","v":"Level 1"},{"$f":"IF(ISERROR(N105),\"\",N105)","v":"Level 1"},{"$f":"HLOOKUP(M105*100,level_ref,3,TRUE)","v":1},{"$f":"IF(ISERROR(P105),\"\",P105)","v":1},null,null,null,{"$f":"IF(AND(C105>4,VLOOKUP(B105,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B105,3),\"\")","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(B105,Weightings!T:X,5,FALSE)","v":{"$error":"#N/A"}},{"$f":"IF(VLOOKUP(B105,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#N/A"}]
[621,"3.6.01",5,null,"3.6.01","Do you maintain a central register of all cyber security incidents?",{"$f":"VLOOKUP(E106,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E106,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E106,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E106,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C106>4,VLOOKUP(B106,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B106,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B106,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B106,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[622,"3.6.02",5,null,"3.6.02","Does this register link with the risk registers used to record cyber risks?",{"$f":"VLOOKUP(E107,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E107,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E107,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E107,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C107>4,VLOOKUP(B107,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B107,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B107,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B107,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[623,"3.6.03",4,null,"3.6.03","Do you analyse relevant cyber security incident data regularly (trend analysis) to help:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C108>4,VLOOKUP(B108,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B108,3),\"\")","v":""},{"$f":"VLOOKUP(B108,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B108,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[624,"3.6.03a",6,null,"3.6.03a","Evaluate patterns and trends of cyber security incidents?",{"$f":"VLOOKUP(E109,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E109,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E109,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E109,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C109>4,VLOOKUP(B109,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B109,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B109,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B109,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[625,"3.6.03b",6,null,"3.6.03b","Identify common factors that have influenced cyber security incidents?",{"$f":"VLOOKUP(E110,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E110,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E110,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E110,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C110>4,VLOOKUP(B110,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B110,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B110,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B110,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[626,"3.6.03c",6,null,"3.6.03c","Determine the effectiveness of controls (eg which controls are better at preventing, detecting and delaying cyber security incidents or minimising their business impact)?",{"$f":"VLOOKUP(E111,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E111,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E111,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E111,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C111>4,VLOOKUP(B111,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B111,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B111,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B111,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[627,"3.6.03d",6,null,"3.6.03d","Address attribution (eg their ability to bundle data together to produce meaningful conclusions)",{"$f":"VLOOKUP(E112,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E112,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E112,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E112,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C112>4,VLOOKUP(B112,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B112,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B112,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B112,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[628,"3.6.03e",6,null,"3.6.03e","Understand the costs and impacts associated with cyber security incidents?",{"$f":"VLOOKUP(E113,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E113,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E113,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E113,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C113>4,VLOOKUP(B113,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B113,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B113,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B113,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[629,"3.6.04",4,null,"3.6.04","Does your analysis of cyber security incident data include:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C114>4,VLOOKUP(B114,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B114,3),\"\")","v":""},{"$f":"VLOOKUP(B114,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B114,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[630,"3.6.04a",6,null,"3.6.04a","Searching your archived data, as required?",{"$f":"VLOOKUP(E115,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E115,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E115,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E115,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C115>4,VLOOKUP(B115,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B115,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B115,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B115,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[631,"3.6.04b",6,null,"3.6.04b","Protecting your archived data, as it is often sensitive?",{"$f":"VLOOKUP(E116,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E116,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E116,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E116,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C116>4,VLOOKUP(B116,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B116,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B116,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B116,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[632,"3.6.05",5,null,"3.6.05","Does your trend analysis:",{"$f":"VLOOKUP(E117,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E117,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E117,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E117,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C117>4,VLOOKUP(B117,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B117,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B117,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B117,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[633,"3.6.05a",6,null,"3.6.05a","Cover all types of technology, rather than just particular types or suppliers (ie it is technology agnostic)?",{"$f":"VLOOKUP(E118,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E118,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E118,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E118,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C118>4,VLOOKUP(B118,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B118,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B118,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B118,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[634,"3.6.05b",6,null,"3.6.05b","Evaluate the mean time of cyber security incident investigations (ie how long each investigation took to identify, respond to and recover from incidents)",{"$f":"VLOOKUP(E119,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E119,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E119,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E119,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C119>4,VLOOKUP(B119,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B119,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B119,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B119,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[635,"3.6.06",5,null,"3.6.06","Does your trend analysis include:",{"$f":"VLOOKUP(E120,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E120,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E120,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E120,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C120>4,VLOOKUP(B120,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B120,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B120,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B120,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[636,"3.6.06a",6,null,"3.6.06a","Looking for flaws across the entire organisation or over time, rather than just concentrating on what can be perceived as a single event?",{"$f":"VLOOKUP(E121,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E121,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E121,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E121,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C121>4,VLOOKUP(B121,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B121,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B121,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B121,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[637,"3.6.06b",6,null,"3.6.06b","Sharing information about your cyber security incidents with the wider community (eg in your markets sector, membership bodies, government and law enforcement)?",{"$f":"VLOOKUP(E122,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E122,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E122,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E122,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C122>4,VLOOKUP(B122,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B122,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B122,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B122,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[638,"3.6.07",4,null,"3.6.07","Do your objectives for sharing information include:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C123>4,VLOOKUP(B123,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B123,3),\"\")","v":""},{"$f":"VLOOKUP(B123,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B123,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[639,"3.6.07a",6,null,"3.6.07a","Gaining advice on reducing vulnerabilities in your organisation?",{"$f":"VLOOKUP(E124,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E124,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E124,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E124,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C124>4,VLOOKUP(B124,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B124,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B124,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B124,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[640,"3.6.07b",6,null,"3.6.07b","Learning how to configure systems to reduce the potential attack surface?",{"$f":"VLOOKUP(E125,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E125,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E125,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E125,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C125>4,VLOOKUP(B125,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B125,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B125,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B125,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[641,"3.6.07c",6,null,"3.6.07c","Getting hold of tools and services to help you fix problems?",{"$f":"VLOOKUP(E126,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E126,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E126,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E126,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C126>4,VLOOKUP(B126,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B126,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B126,Weightings!T:X,5,FALSE)","v":3},{"$f":"IF(VLOOKUP(B126,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},9]
[642,"3.6.08",4,null,"3.6.08","Do these activities include:",null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C127>4,VLOOKUP(B127,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B127,3),\"\")","v":""},{"$f":"VLOOKUP(B127,Weightings!T:X,5,FALSE)","v":"N/A"},{"$f":"IF(VLOOKUP(B127,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},{"$error":"#VALUE!"}]
[643,"3.6.08a",6,null,"3.6.08a","Taking part in external events, such as by attending conferences, enrolling in training programmes and subscribing to specialised services?",{"$f":"VLOOKUP(E128,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E128,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E128,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E128,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C128>4,VLOOKUP(B128,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B128,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B128,Weightings!T:X,5,FALSE)","v":4},{"$f":"IF(VLOOKUP(B128,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},12]
[644,"3.6.08b",6,null,"3.6.08b","Collaborating with relevant third parties, such as participating in information exchanges, contributing to scenario-based rehearsals and introducing two-way cyber security alert mechanisms?",{"$f":"VLOOKUP(E129,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E129,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E129,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E129,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C129>4,VLOOKUP(B129,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B129,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B129,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B129,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]
[645,"3.6.08c",6,null,"3.6.08c","Making use of the UK Government’s certified Cyber Incident Response (CIR) services?",{"$f":"VLOOKUP(E130,'Assessment - Phase 3'!E:AB,24,FALSE)","v":""},{"$f":"VLOOKUP(E130,'Assessment - Phase 3'!E:I,5,FALSE)","v":""},{"$f":"IF(VLOOKUP(E130,'Assessment - Phase 3'!$E:$J,6,FALSE)=0,\"\",VLOOKUP(E130,'Assessment - Phase 3'!$E:$J,6,FALSE))","v":""},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(AND(C130>4,VLOOKUP(B130,'Assessment - Phase 3'!E:AA,23,FALSE)<>7),LEFT(B130,3),\"\")","v":"3.6"},{"$f":"VLOOKUP(B130,Weightings!T:X,5,FALSE)","v":5},{"$f":"IF(VLOOKUP(B130,'Assessment - Phase 3'!B:AA,26,FALSE)=7,0,1)","v":1},15]

{"sheet":"MMAT ref","index":14,"n_rows":18,"n_cols":33,"rows_kept":18,"cut":false,"hidden":true,"merged":[]}
[null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(SUMIF(N:N,H1,X:X)=0,\"\",SUMIF(N:N,H1,X:X)/(MAX(T:T)*COUNTIF(N:N,H1)))","v":""},{"$f":"IF(ISERROR(L1),\"\",L1)","v":""},1,1,1,{"$f":"N1&\".\"&O1","v":"1.1"},{"$f":"VLOOKUP(Q1,INDIRECT(\"'Results - Phase \"&N1&\"'!B:Q\"),16,FALSE)","v":1},null,null,null,null,null,null,null,1,{"$f":"VLOOKUP(Z1,contentref,15,FALSE)","v":1},{"$f":"VLOOKUP(Z1,contentref,3,FALSE)","v":1},{"$f":"VLOOKUP(Z1,contentref,4,FALSE)","v":""},null,{"$f":"IF(AA1=1,AB1,AB1&\".\"&AC1)","v":1},{"$f":"VLOOKUP(AA1,Content!W$1:X$6,2,FALSE)&\" \"&IF(LEN(AC1)=0,AB1,AC1)","v":"Phase 1"},{"$f":"VLOOKUP(Z1,contentref,7,FALSE)","v":"Prepare"}]
[null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(SUMIF(N:N,H2,X:X)=0,\"\",SUMIF(N:N,H2,X:X)/(MAX(T:T)*COUNTIF(N:N,H2)))","v":""},"",1,2,2,{"$f":"N2&\".\"&O2","v":"1.2"},{"$f":"VLOOKUP(Q2,INDIRECT(\"'Results - Phase \"&N2&\"'!B:Q\"),16,FALSE)","v":1},null,null,null,null,null,null,null,2,2,1,1,1,{"$f":"IF(AA2=1,AB2,AB2&\".\"&AC2)","v":"1.1"},{"$f":"VLOOKUP(AA2,Content!W$1:X$6,2,FALSE)&\" \"&IF(LEN(AC2)=0,AB2,AC2)","v":"Step 1"},"Criticality assessment"]
[null,null,null,null,null,null,null,null,null,null,null,"","",1,3,3,"1.3",1,null,null,null,null,null,null,null,26,2,1,2,2,"1.2",{"$f":"VLOOKUP(AA3,Content!W$1:X$6,2,FALSE)&\" \"&IF(LEN(AC3)=0,AB3,AC3)","v":"Step 2"},"Threat analysis"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,1,4,4,"1.4",1,null,null,null,null,null,null,null,69,2,1,3,3,"1.3",{"$f":"VLOOKUP(AA4,Content!W$1:X$6,2,FALSE)&\" \"&IF(LEN(AC4)=0,AB4,AC4)","v":"Step 3"},"People, Process, Technology and Information"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,1,5,5,"1.5",1,null,null,null,null,null,null,null,187,2,1,4,4,"1.4",{"$f":"VLOOKUP(AA5,Content!W$1:X$6,2,FALSE)&\" \"&IF(LEN(AC5)=0,AB5,AC5)","v":"Step 4"},"Control environment"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,2,1,6,"2.1",1,null,null,null,null,null,null,null,227,2,1,5,5,"1.5",{"$f":"VLOOKUP(AA6,Content!W$1:X$6,2,FALSE)&\" \"&IF(LEN(AC6)=0,AB6,AC6)","v":"Step 5"},"Maturity assessment"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,2,2,7,"2.2",1,null,null,null,null,null,null,null,261,1,2,"",null,2,{"$f":"VLOOKUP(AA7,Content!W$1:X$6,2,FALSE)&\" \"&IF(LEN(AC7)=0,AB7,AC7)","v":"Phase 2"},"Respond"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,2,3,8,"2.3",1,null,null,null,null,null,null,null,262,2,2,1,6,"2.1",{"$f":"VLOOKUP(AA8,Content!W$1:X$6,2,FALSE)&\" \"&IF(LEN(AC8)=0,AB8,AC8)","v":"Step 1"},"Identification"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,2,4,9,"2.4",1,null,null,null,null,null,null,null,303,2,2,2,7,"2.2",{"$f":"VLOOKUP(AA9,Content!W$1:X$6,2,FALSE)&\" \"&IF(LEN(AC9)=0,AB9,AC9)","v":"Step 2"},"Investigation"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,3,1,10,"3.1",1,null,null,null,null,null,null,null,370,2,2,3,8,"2.3",{"$f":"VLOOKUP(AA10,Content!W$1:X$6,2,FALSE)&\" \"&IF(LEN(AC10)=0,AB10,AC10)","v":"Step 3"},"Action"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,3,2,11,"3.2",1,null,null,null,null,null,null,null,469,2,2,4,9,"2.4",{"$f":"VLOOKUP(AA11,Content!W$1:X$6,2,FALSE)&\" \"&IF(LEN(AC11)=0,AB11,AC11)","v":"Step 4"},"Recovery"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,3,3,12,"3.3",1,null,null,null,null,null,null,null,522,1,3,"",null,3,{"$f":"VLOOKUP(AA12,Content!W$1:X$6,2,FALSE)&\" \"&IF(LEN(AC12)=0,AB12,AC12)","v":"Phase 3"},"Follow up"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,3,4,13,"3.4",1,null,null,null,null,null,null,null,523,2,3,1,10,"3.1",{"$f":"VLOOKUP(AA13,Content!W$1:X$6,2,FALSE)&\" \"&IF(LEN(AC13)=0,AB13,AC13)","v":"Step 1"},"Incident investigation"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,3,5,14,"3.5",1,null,null,null,null,null,null,null,535,2,3,2,11,"3.2",{"$f":"VLOOKUP(AA14,Content!W$1:X$6,2,FALSE)&\" \"&IF(LEN(AC14)=0,AB14,AC14)","v":"Step 2"},"Reporting"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,3,6,15,"3.6",1,null,null,null,null,null,null,null,551,2,3,3,12,"3.3",{"$f":"VLOOKUP(AA15,Content!W$1:X$6,2,FALSE)&\" \"&IF(LEN(AC15)=0,AB15,AC15)","v":"Step 3"},"Post incident review"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,573,2,3,4,13,"3.4",{"$f":"VLOOKUP(AA16,Content!W$1:X$6,2,FALSE)&\" \"&IF(LEN(AC16)=0,AB16,AC16)","v":"Step 4"},"Lessons learned"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,598,2,3,5,14,"3.5",{"$f":"VLOOKUP(AA17,Content!W$1:X$6,2,FALSE)&\" \"&IF(LEN(AC17)=0,AB17,AC17)","v":"Step 5"},"Updating"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,620,2,3,6,15,"3.6",{"$f":"VLOOKUP(AA18,Content!W$1:X$6,2,FALSE)&\" \"&IF(LEN(AC18)=0,AB18,AC18)","v":"Step 6"},"Trend analysis"]