Canonical catalogue of application criticality classification requirements (CLA-001 to CLA-008), with applicability by risk level and acceptance criteria for formal classification, reclassification, residual risk and proportionality of controls.
Determining the criticality of applications in order to apply proportionality in security controls
Minimum mandatory requirements by application criticality classification
Proportional application of the monitoring and response controls according to the application's risk classification.
Why — determining the criticality of applications in order to apply proportionality in security controls
This matrix defines the minimum floor of security controls expected, by technical domain, according to the application's risk level (L1–L3), as determined in Chapter 01.
Definition, application, validation and traceability of application security requirements by risk level