TABLE OF CONTENTS Table of Contents 11 A. OVERVIEW 14 1. Introduction & Scope 15 2. Usage of this Manual 15 3. Ownership & Maintenance 16 4. References 16 B. SECURITY GOVERNANCE & SECURITY PROCESSES 18 1. Governance Structure [IG] 18 1.1. Policy Objective 18 1.2. Policy & Baseline Controls 18 2. Risk Management [RM] 19 2.1. Policy Objective 19 2.2. Policy & Baseline Controls 19 3. Third Party Security Management [TM] 3.1. Policy Objective 19 3.2. Policy & Baseline Controls 19 4. Data Labelling [DL] 20 4.1. Policy Objective 20 4.2. Policy & Baseline Controls 20 5. Change Management [CM] 20 5.1. Policy Objective 20 5.2. Policy & Baseline Controls 20 6. Personnel Security [PS] 21 6.1. Policy Objective 21 6.2. Policy & Baseline Controls 21 7. Security Awareness [SA] 22 7.1. Policy Objective 22 7.2. Policy & Baseline Controls 22 8. Incident Management [IM] 23 8.1. Policy Objective 23 8.2. Policy & Baseline Controls 23 9. Business Continuity Management [BC] 23 9.1. Policy Objective 23 9.2. Policy & Baseline Controls 24 10. Logging & Security Monitoring [SM] 11 19 24 10.1. Policy Objective 24 10.2. Policy & Baseline Controls 24 NATIONAL INFORMATION ASSURANCE MANUAL