United Nations

Annex 2: List of Security Controls related to mitigations incl. examples
Note: text now included for this annex, this will need to be considered further and revised accordingly.


A.2.1 Security Controls based on ISO/IEC 27002
The following “security controls” can apply for implementing mitigations in Clause 6.4.
The selection of appropriate security controls and the application of the implementation guidance provided, will depend on a risk assessment and any legal, contractual, regulatory in a specific Intelligent Transport Systems / Automated Driving environment.
A2.1.1 Security policies...
Security Controls and the associated implementation guidance and other information specified in Clause 5 of ISO/IEC 27002 can apply. The following specific guidance also applies.

• 
  Policies for cybersecurity shall be defined and approved by management and communicated to employees
  
• 
  Policies to be reviewed at planned intervals or when significant changes occur to ensure their suitability, adequacy and effectiveness.
  

A2.1.2 Organizational security
Security Controls and the associated implementation guidance and other information specified in Clause 6 of ISO/IEC 27002 can apply. The following specific guidance also applies.

• 
  Cyber security roles and responsibilities to be defined and allocated
  
• 
  Segregation of duties to reduce opportunities for unauthorized/ unintentional modification/misuse of organization’s assets
  
• 
  Appropriate Contact with relevant authorities shall be made for activities like security incident management.
  
• 
  Contact with special interest groups, specialist security forums and professional associations shall be maintained for effective cybersecurity knowledge management.
  

A2.1.3 Human resource security and security awareness
Security Controls and the associated implementation guidance and other information specified in Clause 7 of ISO/IEC 27002 can apply. The following specific guidance also applies.