1 Scope
2 Normative references
3 Terms, definitions, abbreviated terms, acronyms, and
conventions
3.1 Terms and definitions
3.2 Abbreviated terms and acronyms
3.3 Conventions
4 Elements of a cyber security management system
4.1 Overview
4.2 Category: Risk analysis
4.2.1 Description of category
4.2.2 Element: Business rationale
4.2.3 Element: Risk identification, classification, and
assessment
4.3 Category: Addressing risk with the CSMS
4.3.1 Description of category
4.3.2 Element group: Security policy, organization, and
awareness
4.3.3 Element group: Selected security countermeasures
4.3.4 Element group: Implementation
4.4 Category: Monitoring and improving the CSMS
4.4.1 Description of category
4.4.2 Element: Conformance
4.4.3 Element: Review, improve, and maintain the CSMS
Annex A (informative) Guidance for developing the elements
of a CSMS
A.1 Overview
A.2 Category: Risk analysis
A.2.1 Description of category
A.2.2 Element: Business rationale
A.2.3 Element: Risk identification, classification, and
assessment
A.3 Category: Addressing risk with the CSMS
A.3.1 Description of category
A.3.2 Element group: Security policy, organization, and
awareness
A.3.3 Element group: Selected security countermeasures
A.3.4 Element group: Implementation
A.4 Category: Monitoring and improving the CSMS
A.4.1 Description of category
A.4.2 Element: Conformance
A.4.3 Element: Review, improve, and maintain the CSMS
Annex B (informative) Process to develop a CSMS
B.1 Overview
B.2 Description of the Process
B.3 Activity: Initiate CSMS program
B.4 Activity: High-level risk assessment
B.5 Activity: Detailed risk assessment
B.6 Activity: Establishing Security Policy, Organization,
and Awareness
B.7 Activity: Select and implement countermeasures
B.8 Activity: Maintain the CSMS