Israel CDMO v1.0

Why does it matter?

Version 1.0 builds on the idea of the organization as a whole: defend functional continuity and business objectives, not only individual systems. Its five tenets (clause 2) are management's responsibility, defense according to potential damage, a defense based on Israeli knowledge and experience, proactive defense with prevention, detection, response and recovery controls, and a multilayer defense across people, products and processes. NIST's account of version 2.0 adds that harmonizing with the NIST Cybersecurity Framework gives Israeli industry, academia and government a shared international language for cyber defense.

Key benefits include:

• Defense scaled to damage

Controls carry levels from 1 to 4, and an asset needs every control at or below its own value level (clause 5.2, stage 3).

• A lighter path for Category A

Smaller-exposure organizations follow ten categories of protection (Appendix C) instead of the full control chapters.

• A common language with NIST

Controls sit under Identify, Protect, Detect, Respond and Recover, so they line up with the NIST Cybersecurity Framework (clause 3.2).

• Mapped to NIST and ISO

Appendix D says INCD mapped the controls to equivalent controls in NIST SP 800-53 and ISO 27001.

• A route to national help

Appendix G points organizations to the national CERT for incident handling, recovery assistance and vulnerability handling.

How does it work?

The cyclical defense process (clause 3.1) has three stages: planning and assessment, which covers defense objectives, risk assessment, inspection of existing controls and a work plan; execution, which covers process development, systems setup and organizational integration; and keeping defenses up to date through continuous assessment and monitoring. Clause 4 splits planning into five stages: what is there to defend, the impact on the organization's objectives, how to protect correctly, ideal versus real to find gaps, and designing a project plan.

Clause 5 sorts organizations with one question: if a cyber incident occurred, would the cost of handling it exceed NIS 500,000? A negative answer makes the organization Category A and an affirmative one Category B, and existing regulation can move an organization from A to B. A Category B organization maps its assets, including OT and cloud assets, rates each from 1 to 4 against confidentiality, integrity and availability damage, takes the highest score as the asset's impact and calculates risk as impact multiplied by three plus the average of ten exposure questions.

Chapter 6 lists the controls in families, each with a level from 1 to 4, and marks the controls with the highest cost-benefit with a key icon. The organization compares its existing controls with those its assets require, builds a gap list and ranks the work plan by asset risk level, cost and speed of implementation. According to NIST, version 2.0 layers each control with its requirement, an organizational maturity model, explanations and examples, links to best practices, example templates, relevance to confidentiality, integrity and availability, and compatibility with standards and regulations.

Key Elements

• Category A and Category B

Split by the NIS 500,000 incident-cost question in clause 5; regulatory obligations can move an organization up to Category B.

• Asset value levels 1 to 4

Scored by a damage questionnaire; level 4 means a clear and present danger to the lives of many people or estimated economic damage over NIS 20,000,000.

• Control clusters by NIST function

Identify, Protect, Detect, Respond and Recover clusters, from board responsibility and risk assessment to access control, encryption, event management and business continuity.

• Ten protection categories (Category A)

Management responsibility, malicious code, encryption, cloud computing and software purchase, data protection, computer protection, human resources, documentation and monitoring, network security and business continuity.

• Controls bank layers

Each control is described by its confidentiality, integrity or availability aspect, cyber kill chain stage, asset category, risk level, control type and standards compliance (Appendix F).

• Version 2.0 basis

NIST Cybersecurity Framework 1.1, NIST SP 800-53 Rev. 5 and further NIST standards, with threat-informed defense and zero-trust (NIST success story).

What does it cover?

The methodology is a recommendation for all organizations in Israel, written for boards of directors, managements, cyber defense managers, contractors and IT providers. It looks at the organization as a whole, including IT and OT assets and assets held in the cloud, and sets minimum protection requirements in line with the potential for damage. Regulated organizations may carry further duties: the document says existing regulation can move an organization from Category A to Category B, and that an organization may require its suppliers to meet Category B requirements.

What are its objectives?

The Executive Summary states the purpose of the methodology.

Minimize cyber risks for organizations in Israel.

Guide corporate responsibility for a multi-year work plan to protect the organization.

Let the organization recognize its relevant risks, formulate a defense response and carry out a program that reduces them.

Show which controls reduce the risks the organization is exposed to, so that those controls become its work plan.

Keep defenses current as technology and threats change (clause 3.1).

Framework in Context

Version 1.0 draws its knowledge base from NIST SP 800-53 and ISO 27001 (Appendix D), organizes its controls under the NIST Cybersecurity Framework (clause 3.2) and points to the SANS Critical Security Controls for its highest cost-benefit controls (Appendix E). Appendix D also lists Israeli banking and capital market circulars and guidelines of the privacy regulator as documents to be mapped next. NIST reports that for version 2.0 INCD built on its experience with critical information infrastructure, local regulations, ISO 27001 and the NIST Risk Management Framework, and added threat-informed defense and zero-trust to the NIST Cybersecurity Framework 1.1 and SP 800-53 Rev. 5 base.

Common Framework Mappings

Organizations map the methodology to the frameworks below. INCD itself mapped the version 1.0 controls to NIST SP 800-53 and ISO 27001 (Appendix D); the other mappings are made by the adopting organization.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

ISO 27001:2022

ISO 27002:2022

MITRE ATT&CK

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2