← Frameworks / CBE CSF / Control Mappings

Central Bank of Egypt Financial Cybersecurity Framework

Mandatory cybersecurity framework for all banks, financial institutions, and payment service providers regulated by the Central Bank of Egypt. 5 functions (governance, risk management, technology and operations, cyber defence, outsourcing and vendor management) across 23 domains covering leadership, compliance, asset management, IAM, data protection, cryptography, application security, network security, SOC, incident management, and business resilience. Built on NIST CSF, ISO 27001, and SWIFT CSCF.

Controls: 220
Total Mappings: 312
Publisher: Central Bank of Egypt (CBE) Version: 2022
CBE CSF → SP 800-53 SP 800-53 → CBE CSF Coverage Analysis
AC (19) AT (6) AU (11) CA (8) CM (14) CP (12) IA (11) IR (9) MA (6) MP (7) PE (17) PL (7) PM (20) PS (9) PT (8) RA (9) SA (12) SC (17) SI (13) SR (5)

AC Access Control

Control Name CBE CSF References
AC-01 Access Control Policies and Procedures
CTO-1
AC-02 Account Management
CD-1CTO-1
AC-03 Access Enforcement
CTO-1CTO-5
AC-04 Information Flow Enforcement
CTO-1CTO-2CTO-5CTO-6CTO-8
AC-05 Separation Of Duties
CD-1CTO-1
AC-06 Least Privilege
CD-1CTO-1
AC-07 Unsuccessful Login Attempts
CTO-1
AC-08 System Use Notification
CTO-1
AC-10 Concurrent Session Control
CTO-1
AC-11 Session Lock
CTO-1
AC-12 Session Termination
CTO-1
AC-14 Permitted Actions Without Identification Or Authentication
CTO-1
AC-16 Automated Labeling
CTO-2
AC-17 Remote Access
CTO-1CTO-5CTO-6
AC-18 Wireless Access Restrictions
CTO-6
AC-19 Access Control For Portable And Mobile Devices
CTO-1CTO-7
AC-20 Use Of External Information Systems
CTO-1CTO-11
AC-23 Data Mining Protection
CTO-2
AC-24 Access Control Decisions
CTO-1

AT Awareness and Training

Control Name CBE CSF References
AT-01 Security Awareness And Training Policy And Procedures
GOV-4
AT-02 Security Awareness
CTO-8GOV-4
AT-03 Security Training
GOV-4
AT-04 Security Training Records
GOV-4
AT-05 Contacts With Security Groups And Associations
GOV-4
AT-06 Training Feedback
GOV-4

AU Audit and Accountability

Control Name CBE CSF References
AU-02 Auditable Events
CD-1CTO-5
AU-03 Content Of Audit Records
CD-1CTO-5
AU-04 Audit Storage Capacity
CD-1
AU-05 Response To Audit Processing Failures
CD-1
AU-06 Audit Monitoring, Analysis, And Reporting
CD-1
AU-07 Audit Reduction And Report Generation
CD-1
AU-08 Time Stamps
CD-1
AU-09 Protection Of Audit Information
CD-1
AU-12 Audit Record Generation
CD-1
AU-13 Monitoring for Information Disclosure
CD-1
AU-14 Session Audit
CD-1

CA Security Assessment and Authorization

Control Name CBE CSF References
CA-01 Certification, Accreditation, And Security Assessment Policies And Procedures
GOV-3
CA-02 Security Assessments
GOV-3OVM-3
CA-03 Information System Connections
CTO-11GOV-3
CA-05 Plan Of Action And Milestones
CRM-1GOV-3
CA-06 Security Accreditation
GOV-3
CA-07 Continuous Monitoring
CD-1GOV-3OVM-3
CA-08 Penetration Testing
OVM-3
CA-09 Internal System Connections
CTO-11OVM-3

CM Configuration Management

Control Name CBE CSF References
CM-01 Configuration Management Policy And Procedures
CTO-12
CM-02 Baseline Configuration
CTO-12CTO-7
CM-03 Configuration Change Control
CTO-12CTO-7CTO-9
CM-04 Monitoring Configuration Changes
CTO-12CTO-9
CM-05 Access Restrictions For Change
CTO-12
CM-06 Configuration Settings
CTO-12CTO-6CTO-7
CM-07 Least Functionality
CTO-6CTO-7
CM-08 Information System Component Inventory
CRM-2
CM-09 Configuration Management Plan
CRM-2CTO-12
CM-10 Software Usage Restrictions
CTO-7
CM-11 User-Installed Software
CTO-7
CM-12 Information Location
CRM-2CTO-2
CM-13 Data Action Mapping
CRM-2
CM-14 Signed Components
CTO-4

CP Contingency Planning

Control Name CBE CSF References
CP-01 Contingency Planning Policy And Procedures
OVM-2
CP-02 Contingency Plan
OVM-2
CP-03 Contingency Training
OVM-2
CP-04 Contingency Plan Testing And Exercises
OVM-2
CP-06 Alternate Storage Site
OVM-2
CP-07 Alternate Processing Site
OVM-2
CP-08 Telecommunications Services
OVM-2
CP-09 Information System Backup
OVM-2
CP-10 Information System Recovery And Reconstitution
OVM-2
CP-11 Alternate Communications Protocols
OVM-2
CP-12 Safe Mode
OVM-2
CP-13 Alternative Security Mechanisms
OVM-2

IA Identification and Authentication

Control Name CBE CSF References
IA-01 Identification And Authentication Policy And Procedures
CTO-1
IA-02 User Identification And Authentication
CTO-1CTO-5
IA-03 Device Identification And Authentication
CTO-1
IA-04 Identifier Management
CTO-1
IA-05 Authenticator Management
CTO-1CTO-5
IA-06 Authenticator Feedback
CTO-1
IA-07 Cryptographic Module Authentication
CTO-3
IA-08 Identification and Authentication (Non-Organizational Users)
CTO-1CTO-5
IA-09 Service Identification and Authentication
CTO-1
IA-11 Re-authentication
CTO-1
IA-12 Identity Proofing
CTO-1

IR Incident Response

Control Name CBE CSF References
IR-01 Incident Response Policy And Procedures
CD-2
IR-02 Incident Response Training
CD-2
IR-03 Incident Response Testing And Exercises
CD-2
IR-04 Incident Handling
CD-2
IR-05 Incident Monitoring
CD-2
IR-06 Incident Reporting
CD-2
IR-07 Incident Response Assistance
CD-2
IR-08 Incident Response Plan
CD-2
IR-09 Information Spillage Response
CD-2

MA Maintenance

Control Name CBE CSF References
MA-01 System Maintenance Policy And Procedures
CTO-10
MA-02 Controlled Maintenance
CTO-10
MA-03 Maintenance Tools
CTO-10
MA-04 Remote Maintenance
CTO-10
MA-05 Maintenance Personnel
CTO-10
MA-06 Timely Maintenance
CTO-10

MP Media Protection

Control Name CBE CSF References
MP-01 Media Protection Policy And Procedures
CTO-2
MP-02 Media Access
CTO-2
MP-03 Media Labeling
CTO-2
MP-04 Media Storage
CTO-2
MP-05 Media Transport
CTO-2
MP-06 Media Sanitization And Disposal
CTO-2
MP-07 Media Use
CTO-2

PE Physical and Environmental Protection

Control Name CBE CSF References
PE-01 Physical And Environmental Protection Policy And Procedures
CTO-10
PE-02 Physical Access Authorizations
CTO-10
PE-03 Physical Access Control
CTO-10
PE-04 Access Control For Transmission Medium
CTO-10
PE-05 Access Control For Display Medium
CTO-10
PE-06 Monitoring Physical Access
CD-1CTO-10
PE-07 Visitor Control
CTO-10
PE-08 Access Records
CTO-10
PE-09 Power Equipment And Power Cabling
CTO-10
PE-10 Emergency Shutoff
CTO-10
PE-11 Emergency Power
CTO-10
PE-12 Emergency Lighting
CTO-10
PE-13 Fire Protection
CTO-10
PE-14 Temperature And Humidity Controls
CTO-10
PE-15 Water Damage Protection
CTO-10
PE-17 Alternate Work Site
CTO-10
PE-18 Location Of Information System Components
CTO-10

PL Planning

Control Name CBE CSF References
PL-01 Security Planning Policy And Procedures
GOV-1GOV-3
PL-02 System Security Plan
GOV-1GOV-3
PL-04 Rules Of Behavior
GOV-3
PL-08 Security and Privacy Architectures
GOV-1
PL-09 Central Management
GOV-1
PL-10 Baseline Selection
CRM-1GOV-1
PL-11 Baseline Tailoring
CRM-1GOV-1

PM Program Management

Control Name CBE CSF References
PM-01 Information Security Program Plan
GOV-1
PM-02 Information Security Program Leadership Role
GOV-1GOV-2
PM-03 Information Security and Privacy Resources
GOV-1
PM-04 Plan of Action and Milestones Process
GOV-3
PM-05 System Inventory
CRM-2
PM-06 Measures of Performance
GOV-3
PM-08 Critical Infrastructure Plan
OVM-2
PM-09 Risk Management Strategy
CRM-1GOV-1
PM-10 Authorization Process
GOV-1GOV-3
PM-11 Mission and Business Process Definition
GOV-1OVM-2
PM-12 Insider Threat Program
CD-1
PM-13 Security and Privacy Workforce
GOV-1GOV-2GOV-4
PM-14 Testing, Training, and Monitoring
CD-1OVM-3
PM-15 Security and Privacy Groups and Associations
GOV-3GOV-4
PM-16 Threat Awareness Program
CD-1CTO-9
PM-28 Risk Framing
CRM-1GOV-1
PM-29 Risk Management Program Leadership Roles
GOV-1GOV-2
PM-30 Supply Chain Risk Management Strategy
CTO-11OVM-1
PM-31 Continuous Monitoring Strategy
CTO-11OVM-1
PM-32 Purposing
OVM-1

PS Personnel Security

Control Name CBE CSF References
PS-01 Personnel Security Policy And Procedures
GOV-2
PS-02 Position Categorization
CD-1GOV-2
PS-03 Personnel Screening
CD-1GOV-2
PS-04 Personnel Termination
CD-1GOV-2
PS-05 Personnel Transfer
GOV-2
PS-06 Access Agreements
CD-1GOV-2
PS-07 Third-Party Personnel Security
GOV-2
PS-08 Personnel Sanctions
CD-1GOV-2
PS-09 Position Descriptions
GOV-1GOV-2

PT Personally Identifiable Information Processing and Transparency

Control Name CBE CSF References
PT-01 Policy and Procedures
CTO-2
PT-02 Authority to Process Personally Identifiable Information
CTO-2
PT-03 Personally Identifiable Information Processing Purposes
CTO-2
PT-04 Consent
CTO-2
PT-05 Privacy Notice
CTO-2
PT-06 System of Records Notice
CTO-2
PT-07 Specific Categories of Personally Identifiable Information
CTO-2
PT-08 Computer Matching Requirements
CTO-2

RA Risk Assessment

Control Name CBE CSF References
RA-01 Risk Assessment Policy And Procedures
CRM-1
RA-02 Security Categorization
CRM-1CRM-2
RA-03 Risk Assessment
CD-1CRM-1
RA-04 Risk Assessment Update
CRM-1
RA-05 Vulnerability Scanning
CRM-1CTO-9OVM-3
RA-06 Technical Surveillance Countermeasures Survey
CTO-9OVM-3
RA-07 Risk Response
CRM-1
RA-09 Criticality Analysis
CRM-1CRM-2OVM-3
RA-10 Threat Hunting
CD-1

SA System and Services Acquisition

Control Name CBE CSF References
SA-03 Life Cycle Support
CTO-4
SA-04 Acquisitions
CTO-11CTO-4OVM-1
SA-08 Security Engineering Principles
CTO-4
SA-09 External Information System Services
CTO-11OVM-1
SA-10 Developer Configuration Management
CTO-12CTO-4
SA-11 Developer Security Testing
CTO-4
SA-15 Development Process, Standards, and Tools
CTO-4
SA-16 Developer-Provided Training
CTO-4
SA-17 Developer Security and Privacy Architecture and Design
CTO-4
SA-20 Customized Development of Critical Components
CTO-4
SA-21 Developer Screening
CTO-4OVM-1
SA-22 Unsupported System Components
CRM-2CTO-9OVM-1

SC System and Communications Protection

Control Name CBE CSF References
SC-05 Denial Of Service Protection
CTO-6
SC-07 Boundary Protection
CRM-2CTO-11CTO-5CTO-6CTO-8
SC-08 Transmission Integrity
CTO-2CTO-3CTO-5CTO-6CTO-8
SC-12 Cryptographic Key Establishment And Management
CTO-3
SC-13 Use Of Cryptography
CTO-2CTO-3CTO-5
SC-17 Public Key Infrastructure Certificates
CTO-3
SC-20 Secure Name / Address Resolution Service (Authoritative Source)
CTO-6
SC-21 Secure Name / Address Resolution Service (Recursive Or Caching Resolver)
CTO-6
SC-22 Architecture And Provisioning For Name / Address Resolution Service
CTO-6
SC-23 Session Authenticity
CTO-5
SC-24 Fail in Known State
OVM-2
SC-26 Decoys
CD-1
SC-28 Protection of Information at Rest
CTO-2CTO-3
SC-39 Process Isolation
CTO-6
SC-40 Wireless Link Protection
CTO-3
SC-41 Port and I/O Device Access
CTO-6CTO-7
SC-44 Detonation Chambers
CD-1CTO-6

SI System and Information Integrity

Control Name CBE CSF References
SI-02 Flaw Remediation
CTO-9
SI-03 Malicious Code Protection
CTO-7CTO-8
SI-04 Information System Monitoring Tools And Techniques
CD-1CTO-6CTO-7CTO-8
SI-05 Security Alerts And Advisories
CD-1CTO-9
SI-07 Software And Information Integrity
CTO-7
SI-08 Spam Protection
CTO-8
SI-10 Information Accuracy, Completeness, Validity, And Authenticity
CTO-4CTO-5
SI-11 Error Handling
CTO-4
SI-12 Information Output Handling And Retention
CTO-2
SI-13 Predictable Failure Prevention
OVM-2
SI-15 Information Output Filtering
CTO-4
SI-16 Memory Protection
CTO-7
SI-17 Fail-safe Procedures
OVM-2

SR Supply Chain Risk Management

Control Name CBE CSF References
SR-01 Policy and Procedures
CTO-11OVM-1
SR-02 Supply Chain Risk Management Plan
OVM-1
SR-03 Supply Chain Controls and Processes
CTO-11OVM-1
SR-05 Acquisition Strategies, Tools, and Methods
OVM-1
SR-06 Supplier Assessments and Reviews
OVM-1