ARK Controls Ontology
This ontology defines sets of Control classes and their hierachies, taken from the ISO27002 document, HSE documents, that are used on the ARK Platform. Due to copyright restrictions, no definitions are provided for ISO controls.
ISO 27002:2022(E), https://www2.healthservice.hse.ie/organisation/national-pppgs/hse-integrated-risk-management-policy/, https://www.cdc.gov/niosh/learning/safetyculturehc/module-3/2.html
Links a https://openark.adaptcentre.ie/Ontologies/ARKCube#Person to an action
has action owner
Links a control to a contorl group
has control
Links a https://openark.adaptcentre.ie/Ontologies/ARKCube#Person to a control
has control owner
Links a status to an action
has status
Link to create contorl group hierarchy
has sub control group
Links an action to a risk
has target risk
See ISO27002:2022(E)
Acceptable use of information and other associated assets
Access control
Access rights
Access to source code
Actions are a future measure that will maintain and/or modify a risk. In the HSE, an action is a future measure to further reduce either the likelihood or impact of a risk.
Action
A person responsible for particular action
Action owner
Addressing information security within supplier agreements
Administrative controls change the way work is done or give workers more information by providing workers with relevant procedures, training, or warnings. They’re often used together with higher-level controls.
Administrative Control
Application security requirements
Assessment and decision on information security events
Authentication information
Cabling security
Capacity management
Change management
Classification of information
Clear desk and clear screen
Clock synchronization
Collection of evidence
Compliance with policies, rules and standards for information security
Confidentiality or non-disclosure agreements
Configuration management
Contact with authorities
Contact with special interest groups
A group that persons can share controls with each other, add metameta to describe the controls in the group, and create custom control hierachies.
Control group
Control owner
Corrective
Corrective controls are designed to correct errors or undesirable events which have occurred and will prevent further occurrences.
Corrective control
Data leakage prevention
Data masking
Detective
Detective controls are designed to search for and identify errors or undesirable events after they have occurred so that corrective actions can be taken.
Detective control
Directive controls give direction. These can be, for example, statutory obligations, regulatory standards including professional standards, or other organisational requirements or instructions, many of which are converted into policies, procedures, circulars, standard operating procedures and training.
Directive control
Disciplinary process
Documented operating procedures
Elimination makes sure the hazard no longer exists. Most effective method
Elimination
Engineering controls reduce exposure by preventing hazards from coming into contact with workers. They still allow workers to do their jobs, though.
Engineering Control
Equipment maintenance
Equipment siting and protection
assurance from external independent assurance providers such as Regulators.
External Assurance providers
Controls are measures that maintain and/or modify risk. In the HSE, a control is a measure that is in place, is working effectively and operating to reduce either the likelihood or impact of a risk.
HSE ERM Control
ICT readiness for business continuity
An ISO control is defined as a measure that modifies or maintains risk. Some of the controls in this document are controls that modify risk, while others maintain risk. An information security policy, for example, can only maintain risk, whereas compliance with the information security policy can modify risk. Moreover, some controls describe the same generic measure in different risk contexts. This document provides a generic mixture of organizational, people, physical and technological information security controls derived from internationally recognized best practices.
ISO Control
Identity management
Independent review of information security
Information access restriction
Information backup
Information deletion
Information security awareness, education and training
Information security during disruption
Information security event reporting
Information security for use of cloud services
Information security in project management
Information security in supplier relationships
Information security incident management planning and preparation
Information security roles and responsibilities
Information transfer
Installation of software on operational systems
Intellectual property rights
Inventory of information and other associated assets
Labelling of information
Learning from information security incidents
Legal, statutory, regulatory and contractual requirements
Logging
Management of technical vulnerabilities
Management responsibilities
Managing information security in the ICT supply chain
Monitoring activities
Monitoring, review and change management of supplier services
Networks security
Controls are measures that maintain and/or modify risk. In the NIOSH hierarchy, a control is a measure that is in place, is working effectively and operating to reduce either the likelihood or impact of a risk.
NIOSH Control
Organizational control
Outsourced development
People control
Personal protective equipment (PPE) includes clothing and devices to protect workers. PPE needs constant effort and attention (including proper use and training) from workers. Higher-level controls aren’t always feasible, and PPE might be needed in conjunction with other control measures. Least effective contols.
Personal protective equipment
Physical control
Physical entry
Physical security monitoring
Physical security perimeters
Policies for information security
Preventative controls are controls designed to stop, discourage, pre-empt or limit the possibility of an undesirable event before it occurs.
Preventative control
Preventive
Privacy and protection of PII
Privileged access rights
Proactive controls are put in place before the risk materialises
Proactive control
Protecting against physical and environmental threats
Protection against malware
Protection of information systems during audit testing
Protection of records
Reactive controlsfocus on what happens after the risk occurs or which identify weaknesses in our current controls
Reactive control
Redundancy of information processing facilities
Remote working
Response to information security incidents
Responsibilities after termination or change of employment
Return of assets
Risk treatment is the process to modify risk.
Risk treatment
Screening
Secure authentication
Secure coding
Secure development life cycle
Secure disposal or re-use of equipment
Secure system architecture and engineering principles
Securing offices, rooms and facilities
Security of assets off-premises
Security of network services
Security testing in development and acceptance
Segregation of duties
Segregation of networks
Separation of development, test and production environments
A class that indicates an action's status
Status
Storage media
Substitution means changing out a material or process to reduce the hazard.
Substitution
Supporting utilities
Technological control
Terms and conditions of employment
Test information
Threat intelligence
treatment plans detail both action and effective control plans, to minimise the likelihood and impact of the identified risk.
Treatment plan
Use of cryptography
Use of privileged utility programs
User endpoint devices
Web filtering
Working in secure areas
©2024 ARK
The status of an action is Completed
Completed
The status of an action is Open
Open
Text that describes edit history/update of an action
has action update