framework-mcp 2.4.2 → 2.4.4

package/src/core/safeguard-manager.ts

@@ -1461,7 +1461,7 @@ export class SafeguardManager {
     title: "Establish and Maintain a Data Management Process",
     description: "Establish and maintain a documented data management process. In the process, address data sensitivity, data owner, handling of data, data retention limits, and disposal requirements, based on sensitivity and retention standards for the enterprise. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.",
     implementationGroup: "IG1",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Govern"],
     governanceElements: [ // Orange - MUST be met
       "Establish",
@@ -1469,20 +1469,15 @@ export class SafeguardManager {
       "Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard"
     ],
     coreRequirements: [ // Green - The "what"
-      "documented data management process",
-      "address data sensitivity, data owner, handling of data, data retention limits, and disposal requirements, based on sensitivity and retention standards for the enterprise"
+      "documented data management process"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
-      "Documented Data management process",
       "Data Sensitivity",
       "Data Owner",
       "Data Handling",
       "Data Retention Limits",
       "Disposal Requirements",
-      "Retention Standards",
-      "Review and update documentation",
-      "Annually",
-      "When significant enterprise changes occur that could impact this Safeguard"
+      "Retention Standards"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
     ],
@@ -1572,7 +1567,7 @@ export class SafeguardManager {
     title: "Establish and Maintain a Data Inventory",
     description: "Establish and maintain a data inventory based on the enterprise's data management process. Inventory sensitive data, at a minimum. Review and update inventory annually, at a minimum, with a priority on sensitive data.",
     implementationGroup: "IG1",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Identify"],
     governanceElements: [ // Orange - MUST be met
       "Establish",
@@ -1580,16 +1575,11 @@ export class SafeguardManager {
       "Review and update inventory annually, at a minimum, with a priority on sensitive data"
     ],
     coreRequirements: [ // Green - The "what"
-      "data inventory based on the enterprise's data management process",
-      "inventory sensitive data, at a minimum"
+      "data inventory"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
-      "Data Inventory",
       "Based on Data Management process",
-      "Sensitive Data at a Minimum",
-      "Review and update inventory",
-      "Annually, at a minimum",
-      "Priority on sensitive data"
+      "Sensitive Data at a Minimum"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
     ],
@@ -1679,14 +1669,13 @@ export class SafeguardManager {
     title: "Configure Data Access Control Lists",
     description: "Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.",
     implementationGroup: "IG1",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
-      "Configure",
-      "Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications"
+      "Configure"
     ],
     coreRequirements: [ // Green - The "what"
-      "data access control lists based on a user's need to know"
+      "data access control lists"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
       "Data Access control lists",
@@ -1785,7 +1774,7 @@ export class SafeguardManager {
     title: "Enforce Data Retention",
     description: "Retain data according to the enterprise's documented data management process. Data retention must include both minimum and maximum timelines.",
     implementationGroup: "IG1",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Retain",
@@ -1798,7 +1787,6 @@ export class SafeguardManager {
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
       "Data Retention",
-      "Must Include",
       "Minimum Timelines",
       "Maximum timelines"
     ],
@@ -1890,19 +1878,17 @@ export class SafeguardManager {
     title: "Securely Dispose of Data",
     description: "Securely dispose of data as outlined in the enterprise's data management process. Ensure the disposal process and method are commensurate with the data sensitivity.",
     implementationGroup: "IG1",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
-      "Securely dispose of data",
+      "Disposal process and method are commensurate with the data sensitivity",
       "Ensure"
     ],
     coreRequirements: [ // Green - The "what"
-      "as outlined in the enterprise's data management process",
-      "the disposal process and method are commensurate with the data sensitivity"
+      "Securely Dispose of Data"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
-      "Securely dispose of data",
-      "Disposal process and method are commensurate with the data sensitivity"
+      "Securely dispose of Data"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
     ],
@@ -1992,17 +1978,17 @@ export class SafeguardManager {
     title: "Encrypt Data on End-User Devices",
     description: "Encrypt data on end-user devices containing sensitive data. Example implementations can include: Windows BitLocker®, Apple FileVault®, Linux® dm-crypt.",
     implementationGroup: "IG1",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Encrypt"
     ],
     coreRequirements: [ // Green - The "what"
-      "data on end-user devices containing sensitive data"
+      "data on end-user devices"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
       "Data on end-user devices",
-      "Sensitive data"
+      "that contain Sensitive data"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
       "Windows Bitlocker",
@@ -2095,7 +2081,7 @@ export class SafeguardManager {
     title: "Establish and Maintain a Data Classification Scheme",
     description: "Establish and maintain an overall data classification scheme for the enterprise. Enterprises may use labels, such as \"Sensitive,\" \"Confidential,\" and \"Public,\" and classify their data according to those labels. Review and update the classification scheme annually, or when significant enterprise changes occur that could impact this Safeguard.",
     implementationGroup: "IG2",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Identify"],
     governanceElements: [ // Orange - MUST be met
       "Establish",
@@ -2103,15 +2089,10 @@ export class SafeguardManager {
       "Review and update the classification scheme annually, or when significant enterprise changes occur that could impact this Safeguard"
     ],
     coreRequirements: [ // Green - The "what"
-      "overall data classification scheme for the enterprise",
-      "classify their data according to those labels"
+      "data classification scheme"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
-      "Data classification scheme",
-      "Classify their data according to labels",
-      "Review and update classification scheme",
-      "Annually",
-      "When significant enterprise changes occur that could impact this Safeguard"
+      "Classify their data according to labels"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
       "Sensitive",
@@ -2204,27 +2185,19 @@ export class SafeguardManager {
     title: "Document Data Flows",
     description: "Document data flows. Data flow documentation includes service provider data flows and should be based on the enterprise's data management process. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.",
     implementationGroup: "IG2",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Identify"],
     governanceElements: [ // Orange - MUST be met
-      "Document data flows",
-      "Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard"
+      "Document data flows"
     ],
     coreRequirements: [ // Green - The "what"
-      "Data flow documentation includes service provider data flows and should be based on the enterprise's data management process"
+      "Document Data Flows"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
-      "Document data flows",
       "Enterprise Data Flows",
-      "Service Provider Data Flows",
-      "Review and update documentation",
-      "Annually",
-      "When significant enterprise changes occur that could impact this Safeguard"
+      "Service Provider Data Flows"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
-      "Data management systems",
-      "Data flow mapping tools",
-      "Service provider documentation"
     ],
     relatedSafeguards: ["3.1", "3.2", "3.7", "3.9", "3.10", "3.11"],
     systemPromptFull: {
@@ -2312,16 +2285,16 @@ export class SafeguardManager {
     title: "Encrypt Data on Removable Media",
     description: "Encrypt Data on Removable Media",
     implementationGroup: "IG2",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
-      "Encrypt Data on Removable Media"
+      "Encrypt"
     ],
     coreRequirements: [ // Green - The "what"
+      "Encrypt Data on Removable Media"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
       "Data on Removable Media",
-      "Maintain"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
     ],
@@ -2411,13 +2384,13 @@ export class SafeguardManager {
     title: "Encrypt Sensitive Data in Transit",
     description: "Encrypt sensitive data in transit. Example implementations can include: Transport Layer Security (TLS) and Open Secure Shell (OpenSSH).",
     implementationGroup: "IG2",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Encrypt"
     ],
     coreRequirements: [ // Green - The "what"
-      "sensitive data in transit"
+      "Encrypt sensitive data in transit"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
       "Sensitive data in transit"
@@ -2512,23 +2485,21 @@ export class SafeguardManager {
     title: "Encrypt Sensitive Data at Rest",
     description: "Encrypt sensitive data at rest on servers, applications, and databases. Storage-layer encryption, also known as server-side encryption, meets the minimum requirement of this Safeguard. Additional encryption methods may include application-layer encryption, also known as client-side encryption, where access to the data storage device(s) does not permit access to the plain-text data.",
     implementationGroup: "IG2",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Encrypt",
-      "meets the minimum requirement of this Safeguard"
+      "Minimum Requirement"
     ],
     coreRequirements: [ // Green - The "what"
-      "sensitive data at rest on servers, applications, and databases",
-      "Storage-layer encryption, also known as server-side encryption"
+      "Encrypt sensitive data at rest"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
-      "Encrypt Sensitive Data At Rest",
+      "Sensitive Data At Rest",
       "Servers",
-      "Software", 
+      "Applications", 
       "Databases",
-      "Storage Layer (server side) encryption",
-      "Minimum Requirement"
+      "Storage Layer (server side) encryption"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
       "Application layer (client-side) encryption",
@@ -2620,19 +2591,17 @@ export class SafeguardManager {
     title: "Segment Data Processing and Storage Based on Sensitivity",
     description: "Segment data processing and storage based on the sensitivity of the data. Do not process sensitive data on enterprise assets intended for lower sensitivity data.",
     implementationGroup: "IG2",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
-      "Segment data processing and storage based on the sensitivity of the data",
       "Do not process sensitive data on enterprise assets intended for lower sensitivity data"
     ],
     coreRequirements: [ // Green - The "what"
+      "Segment Data Processing",
+      "Segment Data Storage",
+      "Based on Sensitivity"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
-      "Based on the sensitivity of data",
-      "Segment data processing (compute)",
-      "Segment Storage",
-      "Do not process sensitive data on enterprise assets intended for lower sensitivity data"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
     ],
@@ -2722,17 +2691,15 @@ export class SafeguardManager {
     title: "Deploy a Data Loss Prevention Solution",
     description: "Implement an automated tool, such as a host-based Data Loss Prevention (DLP) tool to identify all sensitive data stored, processed, or transmitted through enterprise assets, including those located onsite or at a remote service provider, and update the enterprise's data inventory.",
     implementationGroup: "IG3",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
-      "Implement",
-      "Update Data Inventory"
+      "Implement"
     ],
     coreRequirements: [ // Green - The "what"
-      "automated tool to identify all sensitive data stored, processed, or transmitted through enterprise assets, including those located onsite or at a remote service provider"
+      "automated tool to identify all sensitive data"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
-      "Automated DLP Tool",
       "Identify all sensitive Data",
       "Stored",
       "Processed",
@@ -2830,19 +2797,15 @@ export class SafeguardManager {
     title: "Log Sensitive Data Access",
     description: "Log sensitive data access, including modification and disposal.",
     implementationGroup: "IG3",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Detect"],
     governanceElements: [ // Orange - MUST be met
       "Log"
     ],
     coreRequirements: [ // Green - The "what"
-      "sensitive data access, including modification and disposal"
+      "Log sensitive data access, including modification and disposal"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
-      "Sensitive Data access",
-      "Access",
-      "Modification",
-      "Disposal"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
     ],
@@ -2932,19 +2895,17 @@ export class SafeguardManager {
     title: "Establish and Maintain a Secure Configuration Process",
     description: "Establish and maintain a documented secure configuration process for enterprise assets (end-user devices, including portable and mobile; non-computing/IoT devices; and servers) and software (operating systems and applications). Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.",
     implementationGroup: "IG1",
-    assetType: ["end-user devices", "network devices", "IoT devices", "servers", "Software"],
+    assetType: ["Docuemntation"],
     securityFunction: ["Govern"],
     governanceElements: [ // Orange - MUST be met
       "Establish",
       "Maintain",
-      "Documented Secure Configuration Process",
       "Review and update documentation",
       "Annually",
       "When significant enterprise changes occur that could impact this Safeguard"
     ],
     coreRequirements: [ // Green - The "what"
-      "documented secure configuration process for enterprise assets",
-      "documented secure configuration process for software"
+      "documented secure configuration process"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
       "Enterprise assets",
@@ -2954,12 +2915,9 @@ export class SafeguardManager {
       "Portable",
       "Non-computing/IoT devices",
       "Servers",
-      "OS",
-      "Software"
+      "OS"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
-      "Secure Configuration Policy / Process",
-      "Configuration Management Tool"
     ],
     relatedSafeguards: ["1.1", "2.1", "4.2", "4.3", "4.4", "4.5", "4.6", "4.7", "4.8", "4.9", "4.10", "4.11", "4.12"],
     systemPromptFull: {
@@ -3047,25 +3005,22 @@ export class SafeguardManager {
     title: "Establish and Maintain a Secure Configuration Process for Network Infrastructure",
     description: "Establish and maintain a documented secure configuration process for network devices. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.",
     implementationGroup: "IG1",
-    assetType: ["network devices"],
+    assetType: ["Documentation"],
     securityFunction: ["Govern"],
     governanceElements: [ // Orange - MUST be met
       "Establish",
       "Maintain",
-      "Documented Secure Network Configuration Process",
       "Review and update documentation",
       "Annually",
       "When significant enterprise changes occur that could impact this Safeguard"
     ],
     coreRequirements: [ // Green - The "what"
-      "documented secure configuration process for network devices"
+      "documented secure configuration process"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
       "Network devices"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
-      "Secure Configuration Policy / Process",
-      "Configuration Management Tool"
     ],
     relatedSafeguards: ["1.1", "2.1", "3.10", "4.1", "6.4", "8.1", "12.1", "12.2", "12.3", "12.4", "12.5", "13.3", "13.4", "13.6", "13.8", "13.9", "13.10"],
     systemPromptFull: {
@@ -3153,7 +3108,7 @@ export class SafeguardManager {
     title: "Configure Automatic Session Locking on Enterprise Assets",
     description: "Configure automatic session locking on enterprise assets after a defined period of inactivity. For general purpose operating systems, the period Must Not Exceed 15 minutes. For mobile end-user devices, the period must not exceed 2 minutes.",
     implementationGroup: "IG1",
-    assetType: ["devices"],
+    assetType: ["Devices"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Configure",
@@ -3161,18 +3116,14 @@ export class SafeguardManager {
       "Period must not exceed for 2 Minutes"
     ],
     coreRequirements: [ // Green - The "what"
-      "automatic session locking on enterprise assets after a defined period of inactivity",
-      "general purpose operating systems",
-      "mobile end-user devices"
+      "automatic session locking on enterprise assets"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
-      "Automatic Session Locking",
       "Period of inactivity",
       "General Purpose OSs",
       "Mobile end-user devices"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
-      "Configuration Management Tool"
     ],
     relatedSafeguards: ["4.1"],
     systemPromptFull: {
@@ -3260,7 +3211,7 @@ export class SafeguardManager {
     title: "Implement and Manage a Firewall on Servers",
     description: "Implement and manage a firewall on servers, where supported. Example implementations include a virtual firewall, operating system firewall, or a third-party firewall agent.",
     implementationGroup: "IG1",
-    assetType: ["devices"],
+    assetType: ["Devices"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Implement",
@@ -3277,8 +3228,6 @@ export class SafeguardManager {
       "Virtual Firewall",
       "OS Firewall", 
       "Third Party Firewall",
-      "Firewall",
-      "Configuration Management Tool"
     ],
     relatedSafeguards: ["4.1"],
     systemPromptFull: {
@@ -3366,21 +3315,18 @@ export class SafeguardManager {
     title: "Implement and Manage a Firewall on End-User Devices",
     description: "Implement and manage a host-based firewall or port-filtering tool on end-user devices, with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed.",
     implementationGroup: "IG1",
-    assetType: ["devices"],
+    assetType: ["Devices"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Implement",
-      "Manage",
-      "Default deny rule that drops all traffic",
-      "Except Explicitly Allowed"
+      "Manage"
     ],
     coreRequirements: [ // Green - The "what"
       "host-based firewall or port-filtering tool on end-user devices"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
-      "Host-based Firewall",
-      "Port Filtering Tool",
-      "End User Devices",
+      "Default Deny Rule that drops all traffic",
+      "Except Explicitly Allowed",
       "Services",
       "Ports"
     ],
@@ -3474,7 +3420,7 @@ export class SafeguardManager {
     title: "Securely Manage Enterprise Assets and Software",
     description: "Securely manage enterprise assets and software. Example implementations include managing configuration through version-controlled- Infrastructure-as-Code (IaC) and accessing administrative interfaces over secure network protocols, such as Secure Shell (SSH) and Hypertext Transfer Protocol Secure (HTTPS). Do not use insecure management protocols, such as Telnet (Teletype Network) and HTTP, unless operationally essential.",
     implementationGroup: "IG1",
-    assetType: ["devices", "Software"],
+    assetType: ["Devices"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Do not use insecure management protocols",
@@ -3484,16 +3430,14 @@ export class SafeguardManager {
       "Securely manage enterprise assets and software"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
-      "Securely manage enterprise assets and software"
+      "Securely manage enterprise assets and software",
+      "Do not use insecure management protocols unless operationally essential"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
       "Manage configuration through version-controlled Infrastructure-as-Code (IaC)",
       "Accessing administrative interfaces over secure network protocols",
-      "SSH",
-      "HTTPS",
-      "Telnet (Teletype Network)",
-      "HTTP",
-      "Configuration Management Tool"
+      "SSH instead of TELNET",
+      "HTTPS instead of HTTP",
     ],
     relatedSafeguards: ["4.1", "12.3"],
     systemPromptFull: {
@@ -3581,26 +3525,22 @@ export class SafeguardManager {
     title: "Manage Default Accounts on Enterprise Assets and Software",
     description: "Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.",
     implementationGroup: "IG1",
-    assetType: ["devices", "Software", "users"],
+    assetType: ["Users"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Manage"
     ],
     coreRequirements: [ // Green - The "what"
-      "default accounts on enterprise assets and software"
+      "default accounts"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
-      "Default accounts",
       "Enterprise assets",
-      "Software",
-      "Root",
-      "Administrator",
-      "Other pre-configured vendor accounts"
+      "Software"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
-      "Disabling",
-      "Unusable",
-      "Configuration Management Tool"
+      "Disabling them",
+      "making them Unusable",
+      "Root, Administrator, or other pre-configured vendor accounts"
     ],
     relatedSafeguards: ["4.1"],
     systemPromptFull: {
@@ -3688,25 +3628,23 @@ export class SafeguardManager {
     title: "Uninstall or Disable Unnecessary Services on Enterprise Assets and Software",
     description: "Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function.",
     implementationGroup: "IG2",
-    assetType: ["devices", "Software"],
+    assetType: ["Devices", "Software"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Uninstall",
       "Disable"
     ],
     coreRequirements: [ // Green - The "what"
-      "unnecessary services on enterprise assets and software"
+      "unnecessary services"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
-      "Unnecessary Services",
       "Enterprise assets",
-      "Software",
-      "Unused file sharing service",
-      "Web application module",
-      "Service function"
+      "Software"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
-      "Configuration Management Tool"
+      "Unused File Sharing Services",
+      "Web Application Module",
+      "Service Function"
     ],
     relatedSafeguards: ["4.1"],
     systemPromptFull: {
@@ -3794,22 +3732,20 @@ export class SafeguardManager {
     title: "Configure Trusted DNS Servers on Enterprise Assets",
     description: "Configure trusted DNS servers on enterprise assets. Example implementations include: configuring assets to use enterprise-controlled DNS servers and/or reputable externally accessible DNS servers.",
     implementationGroup: "IG2",
-    assetType: ["devices"],
+    assetType: ["Devices"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Configure"
     ],
     coreRequirements: [ // Green - The "what"
-      "trusted DNS servers on enterprise assets"
+      "trusted DNS servers"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
-      "Trusted DNS Servers",
       "Enterprise assets"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
       "Configuring assets to use enterprise-controlled DNS servers",
-      "Reputable externally accessible DNS servers",
-      "Configuration Management Tool"
+      "Reputable externally accessible DNS servers"
     ],
     relatedSafeguards: ["4.1", "8.6", "9.2"],
     systemPromptFull: {
@@ -3897,7 +3833,7 @@ export class SafeguardManager {
     title: "Enforce Automatic Device Lockout on Portable End-User Devices",
     description: "Enforce automatic device lockout following a predetermined threshold of local failed authentication attempts on portable end-user devices, where supported. For laptops, do not allow more than 20 failed authentication attempts; for tablets and smartphones, no more than 10 failed authentication attempts. Example implementations include Microsoft® InTune Device Lock and Apple® Configuration Profile maxFailedAttempts.",
     implementationGroup: "IG2",
-    assetType: ["devices"],
+    assetType: ["Devices"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Enforce",
@@ -3906,14 +3842,13 @@ export class SafeguardManager {
       "No more than 10 Failed Authentication Attempts"
     ],
     coreRequirements: [ // Green - The "what"
-      "automatic device lockout following a predetermined threshold of local failed authentication attempts on portable end-user devices"
+      "automatic device lockout"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
-      "Automatic Device Lockout",
-      "Predetermined threshold of local failed authentication attempts",
-      "Portable end-user devices",
-      "Laptops",
-      "Tablets and smartphones"
+      "After a Predetermined threshold of local failed authentication attempts",
+      "On Portable end-user devices",
+      "Such as Laptops",
+      "Such as Tablets and smartphones"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
       "Microsoft® InTune Device Lock",
@@ -4006,24 +3941,22 @@ export class SafeguardManager {
     title: "Enforce Remote Wipe Capability on Portable End-User Devices",
     description: "Remotely wipe enterprise data from enterprise-owned portable end-user devices when deemed appropriate such as lost or stolen devices, or when an individual no longer supports the enterprise.",
     implementationGroup: "IG2",
-    assetType: ["devices"],
+    assetType: ["Devices"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "When deemed appropriate"
     ],
     coreRequirements: [ // Green - The "what"
-      "Remotely wipe enterprise data from enterprise-owned portable end-user devices"
+      "Remotely wipe enterprise data"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
-      "Remotely Wipe enterprise data",
-      "Portable end-user devices",
+      "Portable end-user devices"
+    ],
+    implementationSuggestions: [ // Gray - Implementation suggestions
       "Lost devices",
       "Stolen devices",
       "When an individual no longer supports the enterprise"
     ],
-    implementationSuggestions: [ // Gray - Implementation suggestions
-      "Configuration Management Tool"
-    ],
     relatedSafeguards: ["4.1"],
     systemPromptFull: {
 
@@ -4110,7 +4043,7 @@ export class SafeguardManager {
     title: "Separate Enterprise Workspaces on Mobile End-User Devices",
     description: "Ensure separate enterprise workspaces are used on mobile end-user devices, where supported. Example implementations include using an Apple® Configuration Profile or AndroidTM Work Profile to separate enterprise applications and data from personal applications and data.",
     implementationGroup: "IG3",
-    assetType: ["devices", "data"],
+    assetType: ["Data"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Ensure",
@@ -4120,17 +4053,12 @@ export class SafeguardManager {
       "separate enterprise workspaces are used on mobile end-user devices"
     ],
     subTaxonomicalElements: [ // Yellow - Sub-taxonomical elements
-      "Separate enterprise workspaces",
-      "On Mobile Devices",
-      "Enterprise Applications",
-      "Enterprise Data",
-      "Personal Applications",
-      "Personal Data"
+      "Enterprise Applications and Enterprise Data",
+      "Seperate from Personal Applications and Personal Data"
     ],
     implementationSuggestions: [ // Gray - Implementation suggestions
       "Apple® Configuration Profile",
-      "AndroidTM Work Profile",
-      "Configuration Management Tool"
+      "AndroidTM Work Profile"
     ],
     relatedSafeguards: ["4.1"],
     systemPromptFull: {
@@ -4218,7 +4146,7 @@ export class SafeguardManager {
     title: "Establish and Maintain an Inventory of Accounts",
     description: "Establish and maintain an inventory of all accounts managed in the enterprise. The inventory must include both user and administrator accounts. The inventory, at a minimum, should contain the person's name, username, start/stop dates, and department. Validate that all active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently.",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Identify"],
     governanceElements: [ // Orange - MUST be met
       "Establish and maintain an inventory of all accounts managed in the enterprise",
@@ -4335,7 +4263,7 @@ export class SafeguardManager {
     title: "Use Unique Passwords",
     description: "Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts using Multi-Factor Authentication (MFA) and a 14-character password for accounts not using MFA.",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Use unique passwords for all enterprise assets",
@@ -4441,7 +4369,7 @@ export class SafeguardManager {
     title: "Disable Dormant Accounts",
     description: "Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported.",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported"
@@ -4545,7 +4473,7 @@ export class SafeguardManager {
     title: "Restrict Administrator Privileges to Dedicated Administrator Accounts",
     description: "Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account.",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Restrict administrator privileges to dedicated administrator accounts on enterprise assets",
@@ -4655,7 +4583,7 @@ export class SafeguardManager {
     title: "Establish and Maintain an Inventory of Service Accounts",
     description: "Establish and maintain an inventory of service accounts. The inventory, at a minimum, must contain department owner, review date, and purpose. Perform service account reviews to validate that all active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently.",
     implementationGroup: "IG2",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Identify"],
     governanceElements: [ // Orange - MUST be met
       "Establish and maintain an inventory of service accounts",
@@ -4768,7 +4696,7 @@ export class SafeguardManager {
     title: "Centralize Account Management",
     description: "Centralize account management through a directory or identity service.",
     implementationGroup: "IG2",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Govern"],
     governanceElements: [ // Orange - MUST be met
       "Centralize account management through a directory or identity service"
@@ -4872,7 +4800,7 @@ export class SafeguardManager {
     title: "Establish an Access Granting Process",
     description: "Establish and follow a documented process, preferably automated, for granting access to enterprise assets upon new hire or role change of a user.",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Govern"],
     governanceElements: [ // Orange - MUST be met
       "Establish",
@@ -4983,7 +4911,7 @@ export class SafeguardManager {
     title: "Establish an Access Revoking Process",
     description: "Establish and follow a process, preferably automated, for revoking access to enterprise assets, through disabling accounts immediately upon termination, rights revocation, or role change of a user. Disabling accounts, instead of deleting accounts, may be necessary to preserve audit trails.",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Govern"],
     governanceElements: [ // Orange - MUST be met
       "Establish",
@@ -5099,7 +5027,7 @@ export class SafeguardManager {
     title: "Require MFA for Externally-Exposed Applications",
     description: "Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this Safeguard.",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Require",
@@ -5208,7 +5136,7 @@ export class SafeguardManager {
     title: "Require MFA for Remote Network Access",
     description: "Require MFA for remote network access.",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Require",
@@ -5312,7 +5240,7 @@ export class SafeguardManager {
     title: "Require MFA for Administrative Access",
     description: "Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site or through a service provider.",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Require",
@@ -5533,7 +5461,7 @@ export class SafeguardManager {
     title: "Centralize Access Control",
     description: "Centralize access control for all enterprise assets through a directory service or SSO provider, where supported.",
     implementationGroup: "IG2",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "Centralize",
@@ -5645,7 +5573,7 @@ export class SafeguardManager {
     title: "Define and Maintain Role-Based Access Control",
     description: "Define and maintain role-based access control, through determining and documenting the access rights necessary for each role within the enterprise to successfully carry out its assigned duties. Perform access control reviews of enterprise assets to validate that all privileges are authorized, on a recurring schedule at a minimum annually, or more frequently.",
     implementationGroup: "IG3",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Govern"],
     governanceElements: [ // Orange - MUST be met
       "Define",
@@ -5997,7 +5925,7 @@ export class SafeguardManager {
     title: "Perform Automated Operating System Patch Management",
     description: "Perform automated operating system patch management on enterprise assets",
     implementationGroup: "IG1",
-    assetType: ["devices"],
+    assetType: ["Devices"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "perform automated OS patch management",
@@ -6229,7 +6157,7 @@ export class SafeguardManager {
     title: "Perform Automated Vulnerability Scans of Internal Enterprise Assets",
     description: "Perform automated vulnerability scans of internal enterprise assets on a quarterly or more frequent basis",
     implementationGroup: "IG2",
-    assetType: ["devices", "Software"],
+    assetType: ["Devices", "Software"],
     securityFunction: ["Detect"],
     governanceElements: [ // Orange - MUST be met
       "perform automated vulnerability scans",
@@ -6345,7 +6273,7 @@ export class SafeguardManager {
     title: "Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets",
     description: "Perform automated vulnerability scans of externally-exposed enterprise assets using either an internal or external vulnerability scanning service",
     implementationGroup: "IG2",
-    assetType: ["devices", "Software"],
+    assetType: ["Devices", "Software"],
     securityFunction: ["Detect"],
     governanceElements: [ // Orange - MUST be met
       "perform automated vulnerability scans",
@@ -6577,7 +6505,7 @@ export class SafeguardManager {
     title: "Establish and Maintain an Audit Log Management Process",
     description: "Establish and maintain a documented audit log management process that defines the enterprise's logging requirements. At a minimum, address the collection, review, and retention of audit logs for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.",
     implementationGroup: "IG1",
-    assetType: ["enterprise assets", "data"],
+    assetType: ["enterprise assets", "Data"],
     securityFunction: ["Govern"],
     governanceElements: [
       "establish and maintain",
@@ -6687,7 +6615,7 @@ export class SafeguardManager {
     title: "Collect Audit Logs",
     description: "Collect audit logs. Ensure that logging, per the enterprise's audit log management process, has been enabled across enterprise assets.",
     implementationGroup: "IG1",
-    assetType: ["enterprise assets", "data"],
+    assetType: ["enterprise assets", "Data"],
     securityFunction: ["Detect"],
     governanceElements: [
       "per the enterprise's audit log management process"
@@ -6790,7 +6718,7 @@ export class SafeguardManager {
     title: "Ensure Adequate Audit Log Storage", 
     description: "Ensure that logging destinations maintain adequate storage to comply with the enterprise's audit log management process.",
     implementationGroup: "IG1",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Protect"],
     governanceElements: [
       "comply with the enterprise's audit log management process"
@@ -6894,7 +6822,7 @@ export class SafeguardManager {
     title: "Standardize Time Synchronization",
     description: "Standardize time synchronization. Configure at least two synchronized time sources across enterprise assets, where supported.",
     implementationGroup: "IG2", 
-    assetType: ["enterprise assets", "data"],
+    assetType: ["enterprise assets", "Data"],
     securityFunction: ["Protect"],
     governanceElements: [
       "standardize time synchronization"
@@ -7000,7 +6928,7 @@ export class SafeguardManager {
     title: "Collect Detailed Audit Logs",
     description: "Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation.",
     implementationGroup: "IG2",
-    assetType: ["enterprise assets", "data"],
+    assetType: ["enterprise assets", "Data"],
     securityFunction: ["Detect"], 
     governanceElements: [
       "configure detailed audit logging"
@@ -7109,7 +7037,7 @@ export class SafeguardManager {
     title: "Collect DNS Query Audit Logs", 
     description: "Collect DNS query audit logs on enterprise assets, where appropriate and supported.",
     implementationGroup: "IG2",
-    assetType: ["enterprise assets", "data"],
+    assetType: ["enterprise assets", "Data"],
     securityFunction: ["Detect"],
     governanceElements: [
       "where appropriate and supported"
@@ -7214,7 +7142,7 @@ export class SafeguardManager {
     title: "Collect URL Request Audit Logs",
     description: "Collect URL request audit logs on enterprise assets, where appropriate and supported.",
     implementationGroup: "IG2",
-    assetType: ["enterprise assets", "data"],
+    assetType: ["enterprise assets", "Data"],
     securityFunction: ["Detect"],
     governanceElements: [
       "where appropriate and supported"
@@ -7319,7 +7247,7 @@ export class SafeguardManager {
     title: "Collect Command-Line Audit Logs",
     description: "Collect command-line audit logs. Example implementations include collecting audit logs from PowerShell®, BASH™, and remote administrative terminals.",
     implementationGroup: "IG2",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Detect"],
     governanceElements: [
       "collect command-line audit logs"
@@ -7423,7 +7351,7 @@ export class SafeguardManager {
     title: "Centralize Audit Logs",
     description: "Centralize, to the extent possible, audit log collection and retention across enterprise assets in accordance with the documented audit log management process. Example implementations include leveraging a SIEM tool to centralize multiple log sources.",
     implementationGroup: "IG2",
-    assetType: ["enterprise assets", "data"],
+    assetType: ["enterprise assets", "Data"],
     securityFunction: ["Detect"], 
     governanceElements: [
       "in accordance with documented audit log management process",
@@ -7529,7 +7457,7 @@ export class SafeguardManager {
     title: "Retain Audit Logs", 
     description: "Retain audit logs across enterprise assets for a minimum of 90 days.",
     implementationGroup: "IG2",
-    assetType: ["enterprise assets", "data"],
+    assetType: ["enterprise assets", "Data"],
     securityFunction: ["Protect"],
     governanceElements: [
       "minimum of 90 days"
@@ -7630,7 +7558,7 @@ export class SafeguardManager {
     title: "Conduct Audit Log Reviews",
     description: "Conduct reviews of audit logs to detect anomalies or abnormal events that could indicate a potential threat. Conduct reviews on a weekly, or more frequent, basis.",
     implementationGroup: "IG2",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Detect"],
     governanceElements: [
       "conduct reviews on a weekly, or more frequent, basis"
@@ -7734,7 +7662,7 @@ export class SafeguardManager {
     title: "Collect Service Provider Logs",
     description: "Collect service provider logs, where supported. Example implementations include collecting authentication and authorization events, data creation and disposal events, and user management events.",
     implementationGroup: "IG3",
-    assetType: ["data"], 
+    assetType: ["Data"], 
     securityFunction: ["Detect"],
     governanceElements: [
       "where supported"
@@ -7951,7 +7879,7 @@ export class SafeguardManager {
     title: "Use DNS Filtering Services",
     description: "Use DNS filtering services on all end-user devices, including remote and on-premise assets, to block access to known malicious domains",
     implementationGroup: "IG1",
-    assetType: ["devices", "network"],
+    assetType: ["Devices", "network"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "use DNS filtering services on all end-user devices",
@@ -8627,7 +8555,7 @@ export class SafeguardManager {
     title: "Deploy and Maintain Anti-Malware Software",
     description: "Deploy and maintain anti-malware software on all enterprise assets",
     implementationGroup: "IG1",
-    assetType: ["devices"],
+    assetType: ["Devices"],
     securityFunction: ["Detect"],
     governanceElements: [ // Orange - MUST be met
       "deploy anti-malware software",
@@ -8740,7 +8668,7 @@ export class SafeguardManager {
     title: "Configure Automatic Anti-Malware Signature Updates",
     description: "Configure automatic updates for anti-malware signature files on all enterprise assets",
     implementationGroup: "IG1",
-    assetType: ["devices"],
+    assetType: ["Devices"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "configure automatic updates",
@@ -8848,7 +8776,7 @@ export class SafeguardManager {
     title: "Disable Autorun and Autoplay for Removable Media",
     description: "Disable autorun and autoplay auto-execute functionality for removable media",
     implementationGroup: "IG1",
-    assetType: ["devices"],
+    assetType: ["Devices"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "disable autorun functionality",
@@ -8961,7 +8889,7 @@ export class SafeguardManager {
     title: "Configure Automatic Anti-Malware Scanning of Removable Media", 
     description: "Configure anti-malware software to automatically scan removable media",
     implementationGroup: "IG2",
-    assetType: ["devices"],
+    assetType: ["Devices"],
     securityFunction: ["Detect"],
     governanceElements: [ // Orange - MUST be met
       "configure anti-malware software",
@@ -9073,7 +9001,7 @@ export class SafeguardManager {
     title: "Enable Anti-Exploitation Features",
     description: "Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™",
     implementationGroup: "IG2", 
-    assetType: ["devices"],
+    assetType: ["Devices"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "enable anti-exploitation features",
@@ -9187,7 +9115,7 @@ export class SafeguardManager {
     title: "Centrally Manage Anti-Malware Software", 
     description: "Centrally manage anti-malware software",
     implementationGroup: "IG2",
-    assetType: ["devices"],
+    assetType: ["Devices"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "centrally manage anti-malware",
@@ -9297,7 +9225,7 @@ export class SafeguardManager {
     title: "Use Behavior-Based Anti-Malware Software",
     description: "Use behavior-based anti-malware software", 
     implementationGroup: "IG2",
-    assetType: ["devices"],
+    assetType: ["Devices"],
     securityFunction: ["Detect"],
     governanceElements: [ // Orange - MUST be met
       "use behavior-based anti-malware",
@@ -9408,7 +9336,7 @@ export class SafeguardManager {
     title: "Establish and Maintain a Data Recovery Process",
     description: "Establish and maintain a documented data recovery process. In the process, address the scope of data recovery activities, recovery prioritization, and the security of backup data. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard",
     implementationGroup: "IG1",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Govern"],
     governanceElements: [ // Orange - MUST be met
       "establish documented data recovery process",
@@ -9525,7 +9453,7 @@ export class SafeguardManager {
     title: "Perform Automated Backups",
     description: "Perform automated backups of in-scope enterprise assets. Run backups weekly, or more frequently, based on the sensitivity of the data",
     implementationGroup: "IG1",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Recover"],
     governanceElements: [ // Orange - MUST be met
       "perform automated backups",
@@ -9640,7 +9568,7 @@ export class SafeguardManager {
     title: "Protect Recovery Data", 
     description: "Protect recovery data with equivalent controls to the original data. Reference encryption or data separation, based on requirements",
     implementationGroup: "IG1",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "protect recovery data",
@@ -9754,7 +9682,7 @@ export class SafeguardManager {
     title: "Establish and Maintain an Isolated Instance of Recovery Data",
     description: "Establish and maintain an isolated instance of recovery data. Example implementations include version controlling backup destinations through offline, cloud, or off-site systems or services",
     implementationGroup: "IG1", 
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Recover"],
     governanceElements: [ // Orange - MUST be met
       "establish isolated instance of recovery data",
@@ -9871,7 +9799,7 @@ export class SafeguardManager {
     title: "Test Data Recovery",
     description: "Test backup recovery quarterly, or more frequently, for a sampling of in-scope enterprise assets", 
     implementationGroup: "IG2",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Recover"],
     governanceElements: [ // Orange - MUST be met
       "test backup recovery quarterly or more frequently",
@@ -10673,7 +10601,7 @@ export class SafeguardManager {
     title: "Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure",
     description: "Require users to authenticate to enterprise-managed VPN and authentication services prior to accessing enterprise resources on end-user devices",
     implementationGroup: "IG2",
-    assetType: ["devices"],
+    assetType: ["Devices"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "require users to authenticate to enterprise-managed VPN",
@@ -10787,7 +10715,7 @@ export class SafeguardManager {
     title: "Establish and Maintain Dedicated Computing Resources for All Administrative Work",
     description: "Establish and maintain dedicated computing resources, either physically or logically separated, for all administrative tasks or tasks requiring administrative access. The computing resources should be segmented from the enterprise's primary network and not be allowed internet access",
     implementationGroup: "IG3",
-    assetType: ["devices"],
+    assetType: ["Devices"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "establish dedicated computing resources for administrative work",
@@ -10903,7 +10831,7 @@ export class SafeguardManager {
     title: "Centralize Security Event Alerting",
     description: "Centralize security event alerting across enterprise assets for log correlation and analysis. Security event alerting includes, at a minimum, active exploitation attempts of enterprise assets",
     implementationGroup: "IG2",
-    assetType: ["network", "devices"],
+    assetType: ["network", "Devices"],
     securityFunction: ["Detect"],
     governanceElements: [ // Orange - MUST be met
       "centralize security event alerting across enterprise assets",
@@ -11016,7 +10944,7 @@ export class SafeguardManager {
     title: "Deploy a Host-Based Intrusion Detection Solution",
     description: "Deploy a host-based intrusion detection solution on enterprise assets, where technically feasible",
     implementationGroup: "IG2",
-    assetType: ["devices"],
+    assetType: ["Devices"],
     securityFunction: ["Detect"],
     governanceElements: [ // Orange - MUST be met
       "deploy host-based intrusion detection solution",
@@ -11344,7 +11272,7 @@ export class SafeguardManager {
     title: "Manage Access Control for Remote Assets",
     description: "Manage access control for assets remotely connecting to enterprise networks. Determine amount of access to the enterprise network based on: up-to-date anti-malware software, up-to date system patches, up-to-date host-based firewall, and up-to-date host-based intrusion detection or intrusion prevention system",
     implementationGroup: "IG2",
-    assetType: ["devices", "network"],
+    assetType: ["Devices", "network"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "manage access control for assets remotely connecting to enterprise networks",
@@ -11566,7 +11494,7 @@ export class SafeguardManager {
     title: "Deploy a Host-Based Intrusion Prevention Solution",
     description: "Deploy a host-based intrusion prevention solution on enterprise assets, where technically feasible",
     implementationGroup: "IG3",
-    assetType: ["devices"],
+    assetType: ["Devices"],
     securityFunction: ["Respond"],
     governanceElements: [ // Orange - MUST be met
       "deploy host-based intrusion prevention solution",
@@ -12003,7 +11931,7 @@ export class SafeguardManager {
     title: "Tune Security Event Alerting Thresholds",
     description: "Tune security event alerting thresholds monthly, or more frequently",
     implementationGroup: "IG3",
-    assetType: ["network", "devices"],
+    assetType: ["network", "Devices"],
     securityFunction: ["Detect"],
     governanceElements: [ // Orange - MUST be met
       "tune security event alerting thresholds",
@@ -12111,7 +12039,7 @@ export class SafeguardManager {
     title: "Establish and Maintain a Security Awareness Program",
     description: "Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise's workforce on how to interact with enterprise assets and data in a secure manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, or when significant enterprise changes occur that could impact this Safeguard",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Govern"],
     governanceElements: [ // Orange - MUST be met
       "establish and maintain a security awareness program",
@@ -12227,7 +12155,7 @@ export class SafeguardManager {
     title: "Train Workforce Members to Recognize Social Engineering Attacks",
     description: "Train workforce members to recognize social engineering attacks, such as phishing, business email compromise (BEC), pretexting, and tailgating",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "train workforce members to recognize social engineering attacks",
@@ -12340,7 +12268,7 @@ export class SafeguardManager {
     title: "Train Workforce Members on Authentication Best Practices",
     description: "Train workforce members on authentication best practices. Example topics include MFA, password composition, and credential management",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "train workforce members on authentication best practices",
@@ -12451,7 +12379,7 @@ export class SafeguardManager {
     title: "Train Workforce on Data Handling Best Practices",
     description: "Train workforce members on how to identify and properly store, transfer, archive, and destroy sensitive data. This also includes training workforce members on clear screen and desk best practices, such as locking their screen when they step away from their enterprise asset, erasing physical and virtual whiteboards at the end of meetings, and storing data and assets securely",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "train workforce members on how to identify and properly store, transfer, archive, and destroy sensitive data",
@@ -12570,7 +12498,7 @@ export class SafeguardManager {
     title: "Train Workforce Members on Causes of Unintentional Data Exposure",
     description: "Train workforce members to be aware of causes for unintentional data exposure. Example topics include mis-delivery of sensitive data, losing a portable end-user device, or publishing data to unintended audiences",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "train workforce members to be aware of causes for unintentional data exposure",
@@ -12681,7 +12609,7 @@ export class SafeguardManager {
     title: "Train Workforce Members on Recognizing and Reporting Security Incidents",
     description: "Train workforce members to be able to recognize a potential incident and be able to report such an incident",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "train workforce members to be able to recognize a potential incident",
@@ -12790,7 +12718,7 @@ export class SafeguardManager {
     title: "Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates",
     description: "Train workforce to understand how to verify and report out-of-date software patches or any failures in automated processes and tools. Part of this training should include notifying IT personnel of any failures in automated processes and tools",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "train workforce to understand how to verify and report out-of-date software patches",
@@ -12905,7 +12833,7 @@ export class SafeguardManager {
     title: "Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks",
     description: "Train workforce members on the dangers of connecting to, and transmitting data over, insecure networks for enterprise activities. If the enterprise has remote workers, training must include guidance to ensure that all users securely configure their home network infrastructure",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "train workforce members on dangers of connecting to and transmitting data over insecure networks",
@@ -13019,7 +12947,7 @@ export class SafeguardManager {
     title: "Conduct Role-Specific Security Awareness and Skills Training",
     description: "Conduct role-specific security awareness and skills training. Example implementations include secure system administration courses for IT professionals, OWASP Top 10 vulnerability awareness and prevention training for web application developers, and advanced social engineering awareness training for high-profile roles",
     implementationGroup: "IG2",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "conduct role-specific security awareness and skills training",
@@ -13131,7 +13059,7 @@ export class SafeguardManager {
     title: "Establish and Maintain an Inventory of Service Providers",
     description: "Establish and maintain an inventory of service providers. The inventory is to list all known service providers, include classification(s), and designate an enterprise contact for each service provider. Review and update the inventory annually, or when significant enterprise changes occur that could impact this Safeguard",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Identify"],
     governanceElements: [ // Orange - MUST be met
       "establish and maintain an inventory of service providers",
@@ -13245,7 +13173,7 @@ export class SafeguardManager {
     title: "Establish and Maintain a Service Provider Management Policy",
     description: "Establish and maintain a service provider management policy. Ensure the policy addresses the classification, inventory, assessment, monitoring, and decommissioning of service providers. Review and update the policy annually, or when significant enterprise changes occur that could impact this Safeguard",
     implementationGroup: "IG2",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Govern"],
     governanceElements: [ // Orange - MUST be met
       "establish and maintain a service provider management policy",
@@ -13364,7 +13292,7 @@ export class SafeguardManager {
     title: "Classify Service Providers",
     description: "Classify service providers. Classification consideration may include one or more characteristics, such as data sensitivity, data volume, availability requirements, applicable regulations, inherent risk, and mitigated risk. Update and review classifications annually, or when significant enterprise changes occur that could impact this Safeguard",
     implementationGroup: "IG2",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Govern"],
     governanceElements: [ // Orange - MUST be met
       "classify service providers",
@@ -13481,7 +13409,7 @@ export class SafeguardManager {
     title: "Ensure Service Provider Contracts Include Security Requirements",
     description: "Ensure service provider contracts include security requirements. Example requirements may include minimum security program requirements, security incident and/or data breach notification and response, data encryption requirements, and data disposal commitments. These security requirements must be consistent with the enterprise's service provider management policy. Review service provider contracts annually to ensure contracts are not missing security requirements",
     implementationGroup: "IG2",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Govern"],
     governanceElements: [ // Orange - MUST be met
       "ensure service provider contracts include security requirements",
@@ -13597,7 +13525,7 @@ export class SafeguardManager {
     title: "Assess Service Providers",
     description: "Assess service providers consistent with the enterprise's service provider management policy. Assessment scope may vary based on classification(s), and may include review of standardized assessment reports, such as Service Organization Control 2 (SOC 2) and Payment Card Industry (PCI) Attestation of Compliance (AoC), customized questionnaires, or other appropriately rigorous processes. Reassess service providers annually, at a minimum, or with new and renewed contracts",
     implementationGroup: "IG3",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Govern"],
     governanceElements: [ // Orange - MUST be met
       "assess service providers consistent with enterprise's service provider management policy",
@@ -13713,7 +13641,7 @@ export class SafeguardManager {
     title: "Monitor Service Providers",
     description: "Monitor service providers consistent with the enterprise's service provider management policy. Monitoring may include periodic reassessment of service provider compliance, monitoring service provider release notes, and dark web monitoring",
     implementationGroup: "IG3",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Govern"],
     governanceElements: [ // Orange - MUST be met
       "monitor service providers consistent with enterprise's service provider management policy",
@@ -13824,7 +13752,7 @@ export class SafeguardManager {
     title: "Securely Decommission Service Providers",
     description: "Securely decommission service providers. Example considerations include user and service account deactivation, termination of data flows, and secure disposal of enterprise data within service provider systems",
     implementationGroup: "IG3",
-    assetType: ["data"],
+    assetType: ["Data"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "securely decommission service providers",
@@ -14836,7 +14764,7 @@ export class SafeguardManager {
     title: "Train Developers in Application Security Concepts and Secure Coding",
     description: "Ensure that all software development personnel receive training in writing secure code for their specific development environment and responsibilities. Training can include general security principles and application security standard practices. Conduct training at least annually and design in a way to promote security within the development team, and build a culture of security among the developers",
     implementationGroup: "IG2",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Protect"],
     governanceElements: [ // Orange - MUST be met
       "ensure that all software development personnel receive training in writing secure code",
@@ -15516,7 +15444,7 @@ export class SafeguardManager {
     title: "Designate Personnel to Manage Incident Handling",
     description: "Designate one key person, and at least one backup, who will manage the enterprise's incident handling process. Management personnel are responsible for the coordination and documentation of incident response and recovery efforts and can consist of employees internal to the enterprise, service providers, or a hybrid approach. If using a service provider, designate at least one person internal to the enterprise to oversee any third-party work. Review annually, or when significant enterprise changes occur that could impact this Safeguard",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Respond"],
     governanceElements: [ // Orange - MUST be met
       "designate one key person and at least one backup who will manage the enterprise's incident handling process",
@@ -15628,7 +15556,7 @@ export class SafeguardManager {
     title: "Establish and Maintain Contact Information for Reporting Security Incidents",
     description: "Establish and maintain contact information for reporting security incidents. This information must be available to all workforce members and should include various contact methods (e.g., phone, email) and be regularly updated. Consider the availability of these contact methods in different circumstances, such as when primary communication systems are compromised",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Respond"],
     governanceElements: [ // Orange - MUST be met
       "establish and maintain contact information for reporting security incidents",
@@ -15738,7 +15666,7 @@ export class SafeguardManager {
     title: "Establish and Maintain an Enterprise Process for Reporting Incidents",
     description: "Establish and maintain an documented enterprise process for the workforce to report security incidents. The process includes reporting timeframe, personnel to report to, mechanism for reporting, and the minimum information to be reported. Ensure the process is publicly available to all of the workforce. Review annually, or when significant enterprise changes occur that could impact this Safeguard",
     implementationGroup: "IG1",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Govern"],
     governanceElements: [ // Orange - MUST be met
       "establish and maintain a documented enterprise process for the workforce to report security incidents",
@@ -15850,7 +15778,7 @@ export class SafeguardManager {
     title: "Establish and Maintain an Incident Response Process",
     description: "Establish and maintain a documented incident response process that addresses roles and responsibilities, compliance requirements, and a communication plan. Review annually, or when significant enterprise changes occur that could impact this Safeguard",
     implementationGroup: "IG2",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Govern"],
     governanceElements: [ // Orange - MUST be met
       "establish and maintain a documented incident response process",
@@ -15959,7 +15887,7 @@ export class SafeguardManager {
     title: "Assign Key Roles and Responsibilities",
     description: "Assign key roles and responsibilities for incident response, including staff from legal, IT, information security, facilities, public relations, human resources, incident responders, and analysts. Review annually, or when significant enterprise changes occur that could impact this Safeguard",
     implementationGroup: "IG2",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Respond"],
     governanceElements: [ // Orange - MUST be met
       "assign key roles and responsibilities for incident response",
@@ -16071,7 +15999,7 @@ export class SafeguardManager {
     title: "Define Mechanisms for Communicating During Incident Response",
     description: "Determine which primary and secondary mechanisms will be used to communicate and report during a security incident. Mechanisms can include phone calls, emails, secure chat or notification letters. Keep in mind that certain mechanisms, such as emails, can be affected during a security incident. Review annually, or when significant enterprise changes occur that could impact this Safeguard",
     implementationGroup: "IG2",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Respond"],
     governanceElements: [ // Orange - MUST be met
       "determine which primary and secondary mechanisms will be used to communicate and report during a security incident",
@@ -16182,7 +16110,7 @@ export class SafeguardManager {
     title: "Conduct Routine Incident Response Exercises",
     description: "Plan and conduct routine incident response exercises and scenarios for key personnel involved in the incident response process to prepare for responding to real-world incidents. Exercises need to test communication channels, decision-making, and workflows. Conduct testing on an annual basis, at a minimum",
     implementationGroup: "IG2",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Recover"],
     governanceElements: [ // Orange - MUST be met
       "plan and conduct routine incident response exercises and scenarios for key personnel involved in the incident response process",
@@ -16293,7 +16221,7 @@ export class SafeguardManager {
     title: "Conduct Post-Incident Reviews",
     description: "Conduct post-incident reviews. Post-incident reviews help prevent incident recurrence through identifying lessons learned and follow-up action",
     implementationGroup: "IG2",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Recover"],
     governanceElements: [ // Orange - MUST be met
       "conduct post-incident reviews"
@@ -16400,7 +16328,7 @@ export class SafeguardManager {
     title: "Establish and Maintain Security Incident Thresholds",
     description: "Establish and maintain security incident thresholds, including, at a minimum, differentiating between an incident and an event. Examples can include: abnormal activity, security vulnerability, security weakness, data breach, privacy incident, etc. Review annually, or when significant enterprise changes occur that could impact this Safeguard",
     implementationGroup: "IG3",
-    assetType: ["users"],
+    assetType: ["Users"],
     securityFunction: ["Recover"],
     governanceElements: [ // Orange - MUST be met
       "establish and maintain security incident thresholds",