framework-mcp 2.4.3 → 2.4.5

package/dist/core/safeguard-manager.js

@@ -1974,19 +1974,17 @@ export class SafeguardManager {
                 title: "Establish and Maintain a Secure Configuration Process",
                 description: "Establish and maintain a documented secure configuration process for enterprise assets (end-user devices, including portable and mobile; non-computing/IoT devices; and servers) and software (operating systems and applications). Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.",
                 implementationGroup: "IG1",
-                assetType: ["end-user devices", "network devices", "IoT devices", "servers", "Software"],
+                assetType: ["Docuemntation"],
                 securityFunction: ["Govern"],
                 governanceElements: [
                     "Establish",
                     "Maintain",
-                    "Documented Secure Configuration Process",
                     "Review and update documentation",
                     "Annually",
                     "When significant enterprise changes occur that could impact this Safeguard"
                 ],
                 coreRequirements: [
-                    "documented secure configuration process for enterprise assets",
-                    "documented secure configuration process for software"
+                    "documented secure configuration process"
                 ],
                 subTaxonomicalElements: [
                     "Enterprise assets",
@@ -1996,12 +1994,9 @@ export class SafeguardManager {
                     "Portable",
                     "Non-computing/IoT devices",
                     "Servers",
-                    "OS",
-                    "Software"
+                    "OS"
                 ],
-                implementationSuggestions: [
-                    "Secure Configuration Policy / Process",
-                    "Configuration Management Tool"
+                implementationSuggestions: [ // Gray - Implementation suggestions
                 ],
                 relatedSafeguards: ["1.1", "2.1", "4.2", "4.3", "4.4", "4.5", "4.6", "4.7", "4.8", "4.9", "4.10", "4.11", "4.12"],
                 systemPromptFull: {
@@ -2055,25 +2050,22 @@ export class SafeguardManager {
                 title: "Establish and Maintain a Secure Configuration Process for Network Infrastructure",
                 description: "Establish and maintain a documented secure configuration process for network devices. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.",
                 implementationGroup: "IG1",
-                assetType: ["network devices"],
+                assetType: ["Documentation"],
                 securityFunction: ["Govern"],
                 governanceElements: [
                     "Establish",
                     "Maintain",
-                    "Documented Secure Network Configuration Process",
                     "Review and update documentation",
                     "Annually",
                     "When significant enterprise changes occur that could impact this Safeguard"
                 ],
                 coreRequirements: [
-                    "documented secure configuration process for network devices"
+                    "documented secure configuration process"
                 ],
                 subTaxonomicalElements: [
                     "Network devices"
                 ],
-                implementationSuggestions: [
-                    "Secure Configuration Policy / Process",
-                    "Configuration Management Tool"
+                implementationSuggestions: [ // Gray - Implementation suggestions
                 ],
                 relatedSafeguards: ["1.1", "2.1", "3.10", "4.1", "6.4", "8.1", "12.1", "12.2", "12.3", "12.4", "12.5", "13.3", "13.4", "13.6", "13.8", "13.9", "13.10"],
                 systemPromptFull: {
@@ -2127,7 +2119,7 @@ export class SafeguardManager {
                 title: "Configure Automatic Session Locking on Enterprise Assets",
                 description: "Configure automatic session locking on enterprise assets after a defined period of inactivity. For general purpose operating systems, the period Must Not Exceed 15 minutes. For mobile end-user devices, the period must not exceed 2 minutes.",
                 implementationGroup: "IG1",
-                assetType: ["devices"],
+                assetType: ["Devices"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "Configure",
@@ -2135,18 +2127,14 @@ export class SafeguardManager {
                     "Period must not exceed for 2 Minutes"
                 ],
                 coreRequirements: [
-                    "automatic session locking on enterprise assets after a defined period of inactivity",
-                    "general purpose operating systems",
-                    "mobile end-user devices"
+                    "automatic session locking on enterprise assets"
                 ],
                 subTaxonomicalElements: [
-                    "Automatic Session Locking",
                     "Period of inactivity",
                     "General Purpose OSs",
                     "Mobile end-user devices"
                 ],
-                implementationSuggestions: [
-                    "Configuration Management Tool"
+                implementationSuggestions: [ // Gray - Implementation suggestions
                 ],
                 relatedSafeguards: ["4.1"],
                 systemPromptFull: {
@@ -2200,7 +2188,7 @@ export class SafeguardManager {
                 title: "Implement and Manage a Firewall on Servers",
                 description: "Implement and manage a firewall on servers, where supported. Example implementations include a virtual firewall, operating system firewall, or a third-party firewall agent.",
                 implementationGroup: "IG1",
-                assetType: ["devices"],
+                assetType: ["Devices"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "Implement",
@@ -2217,8 +2205,6 @@ export class SafeguardManager {
                     "Virtual Firewall",
                     "OS Firewall",
                     "Third Party Firewall",
-                    "Firewall",
-                    "Configuration Management Tool"
                 ],
                 relatedSafeguards: ["4.1"],
                 systemPromptFull: {
@@ -2272,21 +2258,18 @@ export class SafeguardManager {
                 title: "Implement and Manage a Firewall on End-User Devices",
                 description: "Implement and manage a host-based firewall or port-filtering tool on end-user devices, with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed.",
                 implementationGroup: "IG1",
-                assetType: ["devices"],
+                assetType: ["Devices"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "Implement",
-                    "Manage",
-                    "Default deny rule that drops all traffic",
-                    "Except Explicitly Allowed"
+                    "Manage"
                 ],
                 coreRequirements: [
                     "host-based firewall or port-filtering tool on end-user devices"
                 ],
                 subTaxonomicalElements: [
-                    "Host-based Firewall",
-                    "Port Filtering Tool",
-                    "End User Devices",
+                    "Default Deny Rule that drops all traffic",
+                    "Except Explicitly Allowed",
                     "Services",
                     "Ports"
                 ],
@@ -2346,7 +2329,7 @@ export class SafeguardManager {
                 title: "Securely Manage Enterprise Assets and Software",
                 description: "Securely manage enterprise assets and software. Example implementations include managing configuration through version-controlled- Infrastructure-as-Code (IaC) and accessing administrative interfaces over secure network protocols, such as Secure Shell (SSH) and Hypertext Transfer Protocol Secure (HTTPS). Do not use insecure management protocols, such as Telnet (Teletype Network) and HTTP, unless operationally essential.",
                 implementationGroup: "IG1",
-                assetType: ["devices", "Software"],
+                assetType: ["Devices"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "Do not use insecure management protocols",
@@ -2356,16 +2339,14 @@ export class SafeguardManager {
                     "Securely manage enterprise assets and software"
                 ],
                 subTaxonomicalElements: [
-                    "Securely manage enterprise assets and software"
+                    "Securely manage enterprise assets and software",
+                    "Do not use insecure management protocols unless operationally essential"
                 ],
                 implementationSuggestions: [
                     "Manage configuration through version-controlled Infrastructure-as-Code (IaC)",
                     "Accessing administrative interfaces over secure network protocols",
-                    "SSH",
-                    "HTTPS",
-                    "Telnet (Teletype Network)",
-                    "HTTP",
-                    "Configuration Management Tool"
+                    "SSH instead of TELNET",
+                    "HTTPS instead of HTTP",
                 ],
                 relatedSafeguards: ["4.1", "12.3"],
                 systemPromptFull: {
@@ -2419,26 +2400,22 @@ export class SafeguardManager {
                 title: "Manage Default Accounts on Enterprise Assets and Software",
                 description: "Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.",
                 implementationGroup: "IG1",
-                assetType: ["devices", "Software", "users"],
+                assetType: ["Users"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "Manage"
                 ],
                 coreRequirements: [
-                    "default accounts on enterprise assets and software"
+                    "default accounts"
                 ],
                 subTaxonomicalElements: [
-                    "Default accounts",
                     "Enterprise assets",
-                    "Software",
-                    "Root",
-                    "Administrator",
-                    "Other pre-configured vendor accounts"
+                    "Software"
                 ],
                 implementationSuggestions: [
-                    "Disabling",
-                    "Unusable",
-                    "Configuration Management Tool"
+                    "Disabling them",
+                    "making them Unusable",
+                    "Root, Administrator, or other pre-configured vendor accounts"
                 ],
                 relatedSafeguards: ["4.1"],
                 systemPromptFull: {
@@ -2492,25 +2469,23 @@ export class SafeguardManager {
                 title: "Uninstall or Disable Unnecessary Services on Enterprise Assets and Software",
                 description: "Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function.",
                 implementationGroup: "IG2",
-                assetType: ["devices", "Software"],
+                assetType: ["Devices", "Software"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "Uninstall",
                     "Disable"
                 ],
                 coreRequirements: [
-                    "unnecessary services on enterprise assets and software"
+                    "unnecessary services"
                 ],
                 subTaxonomicalElements: [
-                    "Unnecessary Services",
                     "Enterprise assets",
-                    "Software",
-                    "Unused file sharing service",
-                    "Web application module",
-                    "Service function"
+                    "Software"
                 ],
                 implementationSuggestions: [
-                    "Configuration Management Tool"
+                    "Unused File Sharing Services",
+                    "Web Application Module",
+                    "Service Function"
                 ],
                 relatedSafeguards: ["4.1"],
                 systemPromptFull: {
@@ -2564,22 +2539,20 @@ export class SafeguardManager {
                 title: "Configure Trusted DNS Servers on Enterprise Assets",
                 description: "Configure trusted DNS servers on enterprise assets. Example implementations include: configuring assets to use enterprise-controlled DNS servers and/or reputable externally accessible DNS servers.",
                 implementationGroup: "IG2",
-                assetType: ["devices"],
+                assetType: ["Devices"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "Configure"
                 ],
                 coreRequirements: [
-                    "trusted DNS servers on enterprise assets"
+                    "trusted DNS servers"
                 ],
                 subTaxonomicalElements: [
-                    "Trusted DNS Servers",
                     "Enterprise assets"
                 ],
                 implementationSuggestions: [
                     "Configuring assets to use enterprise-controlled DNS servers",
-                    "Reputable externally accessible DNS servers",
-                    "Configuration Management Tool"
+                    "Reputable externally accessible DNS servers"
                 ],
                 relatedSafeguards: ["4.1", "8.6", "9.2"],
                 systemPromptFull: {
@@ -2633,7 +2606,7 @@ export class SafeguardManager {
                 title: "Enforce Automatic Device Lockout on Portable End-User Devices",
                 description: "Enforce automatic device lockout following a predetermined threshold of local failed authentication attempts on portable end-user devices, where supported. For laptops, do not allow more than 20 failed authentication attempts; for tablets and smartphones, no more than 10 failed authentication attempts. Example implementations include Microsoft® InTune Device Lock and Apple® Configuration Profile maxFailedAttempts.",
                 implementationGroup: "IG2",
-                assetType: ["devices"],
+                assetType: ["Devices"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "Enforce",
@@ -2642,14 +2615,13 @@ export class SafeguardManager {
                     "No more than 10 Failed Authentication Attempts"
                 ],
                 coreRequirements: [
-                    "automatic device lockout following a predetermined threshold of local failed authentication attempts on portable end-user devices"
+                    "automatic device lockout"
                 ],
                 subTaxonomicalElements: [
-                    "Automatic Device Lockout",
-                    "Predetermined threshold of local failed authentication attempts",
-                    "Portable end-user devices",
-                    "Laptops",
-                    "Tablets and smartphones"
+                    "After a Predetermined threshold of local failed authentication attempts",
+                    "On Portable end-user devices",
+                    "Such as Laptops",
+                    "Such as Tablets and smartphones"
                 ],
                 implementationSuggestions: [
                     "Microsoft® InTune Device Lock",
@@ -2708,24 +2680,22 @@ export class SafeguardManager {
                 title: "Enforce Remote Wipe Capability on Portable End-User Devices",
                 description: "Remotely wipe enterprise data from enterprise-owned portable end-user devices when deemed appropriate such as lost or stolen devices, or when an individual no longer supports the enterprise.",
                 implementationGroup: "IG2",
-                assetType: ["devices"],
+                assetType: ["Devices"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "When deemed appropriate"
                 ],
                 coreRequirements: [
-                    "Remotely wipe enterprise data from enterprise-owned portable end-user devices"
+                    "Remotely wipe enterprise data"
                 ],
                 subTaxonomicalElements: [
-                    "Remotely Wipe enterprise data",
-                    "Portable end-user devices",
+                    "Portable end-user devices"
+                ],
+                implementationSuggestions: [
                     "Lost devices",
                     "Stolen devices",
                     "When an individual no longer supports the enterprise"
                 ],
-                implementationSuggestions: [
-                    "Configuration Management Tool"
-                ],
                 relatedSafeguards: ["4.1"],
                 systemPromptFull: {
                     role: "Vendor Description Assistant and expert on CIS Controls",
@@ -2778,7 +2748,7 @@ export class SafeguardManager {
                 title: "Separate Enterprise Workspaces on Mobile End-User Devices",
                 description: "Ensure separate enterprise workspaces are used on mobile end-user devices, where supported. Example implementations include using an Apple® Configuration Profile or AndroidTM Work Profile to separate enterprise applications and data from personal applications and data.",
                 implementationGroup: "IG3",
-                assetType: ["devices", "Data"],
+                assetType: ["Data"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "Ensure",
@@ -2788,17 +2758,12 @@ export class SafeguardManager {
                     "separate enterprise workspaces are used on mobile end-user devices"
                 ],
                 subTaxonomicalElements: [
-                    "Separate enterprise workspaces",
-                    "On Mobile Devices",
-                    "Enterprise Applications",
-                    "Enterprise Data",
-                    "Personal Applications",
-                    "Personal Data"
+                    "Enterprise Applications and Enterprise Data",
+                    "Seperate from Personal Applications and Personal Data"
                 ],
                 implementationSuggestions: [
                     "Apple® Configuration Profile",
-                    "AndroidTM Work Profile",
-                    "Configuration Management Tool"
+                    "AndroidTM Work Profile"
                 ],
                 relatedSafeguards: ["4.1"],
                 systemPromptFull: {
@@ -2852,36 +2817,26 @@ export class SafeguardManager {
                 title: "Establish and Maintain an Inventory of Accounts",
                 description: "Establish and maintain an inventory of all accounts managed in the enterprise. The inventory must include both user and administrator accounts. The inventory, at a minimum, should contain the person's name, username, start/stop dates, and department. Validate that all active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently.",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Identify"],
                 governanceElements: [
-                    "Establish and maintain an inventory of all accounts managed in the enterprise",
-                    "The inventory must include both user and administrator accounts",
-                    "At a minimum, should contain the person's name, username, start/stop dates, and department",
+                    "Establish and maintain",
+                    "Must include",
                     "Validate that all active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently"
                 ],
                 coreRequirements: [
                     "Inventory of Accounts"
                 ],
                 subTaxonomicalElements: [
-                    "Establish",
-                    "Maintain",
-                    "Validate that all active accounts are authorized",
-                    "Recurring schedule",
-                    "Must Include",
-                    "At a minimum",
-                    "Minimum Quarterly",
-                    "More Frequently",
                     "User Accounts",
                     "Administrator Accounts",
+                    "Service Accounts",
                     "Name",
                     "Username",
                     "Start Stop Dates",
                     "Department"
                 ],
-                implementationSuggestions: [
-                    "Account and Access Control Management",
-                    "Identity and Access Management Tool"
+                implementationSuggestions: [ // Gray - Implementation suggestions
                 ],
                 relatedSafeguards: ["1.1", "2.1", "5.2", "5.3", "5.4", "5.5", "5.6", "6.1", "6.2", "6.7", "12.8"],
                 systemPromptFull: {
@@ -2935,25 +2890,19 @@ export class SafeguardManager {
                 title: "Use Unique Passwords",
                 description: "Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts using Multi-Factor Authentication (MFA) and a 14-character password for accounts not using MFA.",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Protect"],
                 governanceElements: [
-                    "Use unique passwords for all enterprise assets",
-                    "Best practice implementation includes, at a minimum, an 8-character password for accounts using Multi-Factor Authentication (MFA) and a 14-character password for accounts not using MFA"
+                    "Use",
+                    "At a minimum, an 8-character password for accounts using Multi-Factor Authentication (MFA) and a 14-character password for accounts not using MFA"
                 ],
                 coreRequirements: [
                     "Unique Passwords"
                 ],
                 subTaxonomicalElements: [
-                    "Use",
-                    "At a minimum",
-                    "All Enterprise Assets",
-                    "8-character password for accounts using MFA",
-                    "14-character password for accounts not using MFA"
+                    "All Enterprise Assets"
                 ],
-                implementationSuggestions: [
-                    "Account and Access Control Management",
-                    "Password Management Tool"
+                implementationSuggestions: [ // Gray - Implementation suggestions
                 ],
                 relatedSafeguards: ["5.1"],
                 systemPromptFull: {
@@ -3007,10 +2956,11 @@ export class SafeguardManager {
                 title: "Disable Dormant Accounts",
                 description: "Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported.",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Protect"],
                 governanceElements: [
-                    "Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported"
+                    "after a period of 45 days of inactivity",
+                    "where supported"
                 ],
                 coreRequirements: [
                     "Dormant Accounts"
@@ -3021,9 +2971,7 @@ export class SafeguardManager {
                     "Period of 45 days of inactivity",
                     "Where Supported"
                 ],
-                implementationSuggestions: [
-                    "Account and Access Control Management",
-                    "Identity and Access Management Tool"
+                implementationSuggestions: [ // Gray - Implementation suggestions
                 ],
                 relatedSafeguards: ["5.1"],
                 systemPromptFull: {
@@ -3077,25 +3025,21 @@ export class SafeguardManager {
                 title: "Restrict Administrator Privileges to Dedicated Administrator Accounts",
                 description: "Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account.",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Protect"],
                 governanceElements: [
-                    "Restrict administrator privileges to dedicated administrator accounts on enterprise assets",
-                    "Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account"
+                    "Restrict"
                 ],
                 coreRequirements: [
                     "Administrator Privileges",
                     "Dedicated Admin Accounts"
                 ],
                 subTaxonomicalElements: [
-                    "Restrict",
                     "Enterprise assets",
                     "User's primary, non-privileged account",
                     "General Computing Activities"
                 ],
                 implementationSuggestions: [
-                    "Account and Access Control Management",
-                    "Identity and Access Management Tool",
                     "Such as",
                     "Internet browsing",
                     "Email",
@@ -3153,32 +3097,23 @@ export class SafeguardManager {
                 title: "Establish and Maintain an Inventory of Service Accounts",
                 description: "Establish and maintain an inventory of service accounts. The inventory, at a minimum, must contain department owner, review date, and purpose. Perform service account reviews to validate that all active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently.",
                 implementationGroup: "IG2",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Identify"],
                 governanceElements: [
-                    "Establish and maintain an inventory of service accounts",
-                    "The inventory, at a minimum, must contain department owner, review date, and purpose",
-                    "Perform service account reviews to validate that all active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently"
+                    "Establish and maintain",
+                    "at a minimum, must contain",
+                    "Perform service account reviews to validate that all active accounts are authorized",
+                    "recurring schedule at a minimum quarterly, or more frequently"
                 ],
                 coreRequirements: [
                     "Inventory of Service Accounts"
                 ],
                 subTaxonomicalElements: [
-                    "Establish",
-                    "Maintain",
-                    "At a Minimum Must Contain",
-                    "Perform service account reviews to validate that all active accounts are authorized",
-                    "On a recurring schedule",
                     "Department Owner",
                     "Review date",
-                    "Purpose",
-                    "At a minimum quarterly",
-                    "More frequently",
-                    "Or"
+                    "Purpose"
                 ],
-                implementationSuggestions: [
-                    "Account and Access Control Management",
-                    "Identity and Access Management Tool"
+                implementationSuggestions: [ // Gray - Implementation suggestions
                 ],
                 relatedSafeguards: ["5.1"],
                 systemPromptFull: {
@@ -3232,23 +3167,19 @@ export class SafeguardManager {
                 title: "Centralize Account Management",
                 description: "Centralize account management through a directory or identity service.",
                 implementationGroup: "IG2",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Govern"],
                 governanceElements: [
-                    "Centralize account management through a directory or identity service"
+                    "Centralize"
                 ],
                 coreRequirements: [
                     "Account Management"
                 ],
                 subTaxonomicalElements: [
-                    "Centralize",
                     "Directory Service",
-                    "Identity Service",
-                    "Or"
+                    "Identity Service"
                 ],
-                implementationSuggestions: [
-                    "Account and Access Control Management",
-                    "Identity and Access Management Tool"
+                implementationSuggestions: [ // Gray - Implementation suggestions
                 ],
                 relatedSafeguards: ["5.1", "6.6", "6.7", "12.5"],
                 systemPromptFull: {
@@ -3302,7 +3233,7 @@ export class SafeguardManager {
                 title: "Establish an Access Granting Process",
                 description: "Establish and follow a documented process, preferably automated, for granting access to enterprise assets upon new hire or role change of a user.",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Govern"],
                 governanceElements: [
                     "Establish",
@@ -3379,7 +3310,7 @@ export class SafeguardManager {
                 title: "Establish an Access Revoking Process",
                 description: "Establish and follow a process, preferably automated, for revoking access to enterprise assets, through disabling accounts immediately upon termination, rights revocation, or role change of a user. Disabling accounts, instead of deleting accounts, may be necessary to preserve audit trails.",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Govern"],
                 governanceElements: [
                     "Establish",
@@ -3461,7 +3392,7 @@ export class SafeguardManager {
                 title: "Require MFA for Externally-Exposed Applications",
                 description: "Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this Safeguard.",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "Require",
@@ -3536,7 +3467,7 @@ export class SafeguardManager {
                 title: "Require MFA for Remote Network Access",
                 description: "Require MFA for remote network access.",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "Require",
@@ -3606,7 +3537,7 @@ export class SafeguardManager {
                 title: "Require MFA for Administrative Access",
                 description: "Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site or through a service provider.",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "Require",
@@ -3759,7 +3690,7 @@ export class SafeguardManager {
                 title: "Centralize Access Control",
                 description: "Centralize access control for all enterprise assets through a directory service or SSO provider, where supported.",
                 implementationGroup: "IG2",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "Centralize",
@@ -3837,7 +3768,7 @@ export class SafeguardManager {
                 title: "Define and Maintain Role-Based Access Control",
                 description: "Define and maintain role-based access control, through determining and documenting the access rights necessary for each role within the enterprise to successfully carry out its assigned duties. Perform access control reviews of enterprise assets to validate that all privileges are authorized, on a recurring schedule at a minimum annually, or more frequently.",
                 implementationGroup: "IG3",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Govern"],
                 governanceElements: [
                     "Define",
@@ -4087,7 +4018,7 @@ export class SafeguardManager {
                 title: "Perform Automated Operating System Patch Management",
                 description: "Perform automated operating system patch management on enterprise assets",
                 implementationGroup: "IG1",
-                assetType: ["devices"],
+                assetType: ["Devices"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "perform automated OS patch management",
@@ -4251,7 +4182,7 @@ export class SafeguardManager {
                 title: "Perform Automated Vulnerability Scans of Internal Enterprise Assets",
                 description: "Perform automated vulnerability scans of internal enterprise assets on a quarterly or more frequent basis",
                 implementationGroup: "IG2",
-                assetType: ["devices", "Software"],
+                assetType: ["Devices", "Software"],
                 securityFunction: ["Detect"],
                 governanceElements: [
                     "perform automated vulnerability scans",
@@ -4333,7 +4264,7 @@ export class SafeguardManager {
                 title: "Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets",
                 description: "Perform automated vulnerability scans of externally-exposed enterprise assets using either an internal or external vulnerability scanning service",
                 implementationGroup: "IG2",
-                assetType: ["devices", "Software"],
+                assetType: ["Devices", "Software"],
                 securityFunction: ["Detect"],
                 governanceElements: [
                     "perform automated vulnerability scans",
@@ -5429,7 +5360,7 @@ export class SafeguardManager {
                 title: "Use DNS Filtering Services",
                 description: "Use DNS filtering services on all end-user devices, including remote and on-premise assets, to block access to known malicious domains",
                 implementationGroup: "IG1",
-                assetType: ["devices", "network"],
+                assetType: ["Devices", "network"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "use DNS filtering services on all end-user devices",
@@ -5901,7 +5832,7 @@ export class SafeguardManager {
                 title: "Deploy and Maintain Anti-Malware Software",
                 description: "Deploy and maintain anti-malware software on all enterprise assets",
                 implementationGroup: "IG1",
-                assetType: ["devices"],
+                assetType: ["Devices"],
                 securityFunction: ["Detect"],
                 governanceElements: [
                     "deploy anti-malware software",
@@ -5980,7 +5911,7 @@ export class SafeguardManager {
                 title: "Configure Automatic Anti-Malware Signature Updates",
                 description: "Configure automatic updates for anti-malware signature files on all enterprise assets",
                 implementationGroup: "IG1",
-                assetType: ["devices"],
+                assetType: ["Devices"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "configure automatic updates",
@@ -6054,7 +5985,7 @@ export class SafeguardManager {
                 title: "Disable Autorun and Autoplay for Removable Media",
                 description: "Disable autorun and autoplay auto-execute functionality for removable media",
                 implementationGroup: "IG1",
-                assetType: ["devices"],
+                assetType: ["Devices"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "disable autorun functionality",
@@ -6133,7 +6064,7 @@ export class SafeguardManager {
                 title: "Configure Automatic Anti-Malware Scanning of Removable Media",
                 description: "Configure anti-malware software to automatically scan removable media",
                 implementationGroup: "IG2",
-                assetType: ["devices"],
+                assetType: ["Devices"],
                 securityFunction: ["Detect"],
                 governanceElements: [
                     "configure anti-malware software",
@@ -6211,7 +6142,7 @@ export class SafeguardManager {
                 title: "Enable Anti-Exploitation Features",
                 description: "Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™",
                 implementationGroup: "IG2",
-                assetType: ["devices"],
+                assetType: ["Devices"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "enable anti-exploitation features",
@@ -6291,7 +6222,7 @@ export class SafeguardManager {
                 title: "Centrally Manage Anti-Malware Software",
                 description: "Centrally manage anti-malware software",
                 implementationGroup: "IG2",
-                assetType: ["devices"],
+                assetType: ["Devices"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "centrally manage anti-malware",
@@ -6367,7 +6298,7 @@ export class SafeguardManager {
                 title: "Use Behavior-Based Anti-Malware Software",
                 description: "Use behavior-based anti-malware software",
                 implementationGroup: "IG2",
-                assetType: ["devices"],
+                assetType: ["Devices"],
                 securityFunction: ["Detect"],
                 governanceElements: [
                     "use behavior-based anti-malware",
@@ -7335,7 +7266,7 @@ export class SafeguardManager {
                 title: "Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure",
                 description: "Require users to authenticate to enterprise-managed VPN and authentication services prior to accessing enterprise resources on end-user devices",
                 implementationGroup: "IG2",
-                assetType: ["devices"],
+                assetType: ["Devices"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "require users to authenticate to enterprise-managed VPN",
@@ -7415,7 +7346,7 @@ export class SafeguardManager {
                 title: "Establish and Maintain Dedicated Computing Resources for All Administrative Work",
                 description: "Establish and maintain dedicated computing resources, either physically or logically separated, for all administrative tasks or tasks requiring administrative access. The computing resources should be segmented from the enterprise's primary network and not be allowed internet access",
                 implementationGroup: "IG3",
-                assetType: ["devices"],
+                assetType: ["Devices"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "establish dedicated computing resources for administrative work",
@@ -7497,7 +7428,7 @@ export class SafeguardManager {
                 title: "Centralize Security Event Alerting",
                 description: "Centralize security event alerting across enterprise assets for log correlation and analysis. Security event alerting includes, at a minimum, active exploitation attempts of enterprise assets",
                 implementationGroup: "IG2",
-                assetType: ["network", "devices"],
+                assetType: ["network", "Devices"],
                 securityFunction: ["Detect"],
                 governanceElements: [
                     "centralize security event alerting across enterprise assets",
@@ -7576,7 +7507,7 @@ export class SafeguardManager {
                 title: "Deploy a Host-Based Intrusion Detection Solution",
                 description: "Deploy a host-based intrusion detection solution on enterprise assets, where technically feasible",
                 implementationGroup: "IG2",
-                assetType: ["devices"],
+                assetType: ["Devices"],
                 securityFunction: ["Detect"],
                 governanceElements: [
                     "deploy host-based intrusion detection solution",
@@ -7802,7 +7733,7 @@ export class SafeguardManager {
                 title: "Manage Access Control for Remote Assets",
                 description: "Manage access control for assets remotely connecting to enterprise networks. Determine amount of access to the enterprise network based on: up-to-date anti-malware software, up-to date system patches, up-to-date host-based firewall, and up-to-date host-based intrusion detection or intrusion prevention system",
                 implementationGroup: "IG2",
-                assetType: ["devices", "network"],
+                assetType: ["Devices", "network"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "manage access control for assets remotely connecting to enterprise networks",
@@ -7956,7 +7887,7 @@ export class SafeguardManager {
                 title: "Deploy a Host-Based Intrusion Prevention Solution",
                 description: "Deploy a host-based intrusion prevention solution on enterprise assets, where technically feasible",
                 implementationGroup: "IG3",
-                assetType: ["devices"],
+                assetType: ["Devices"],
                 securityFunction: ["Respond"],
                 governanceElements: [
                     "deploy host-based intrusion prevention solution",
@@ -8257,7 +8188,7 @@ export class SafeguardManager {
                 title: "Tune Security Event Alerting Thresholds",
                 description: "Tune security event alerting thresholds monthly, or more frequently",
                 implementationGroup: "IG3",
-                assetType: ["network", "devices"],
+                assetType: ["network", "Devices"],
                 securityFunction: ["Detect"],
                 governanceElements: [
                     "tune security event alerting thresholds",
@@ -8331,7 +8262,7 @@ export class SafeguardManager {
                 title: "Establish and Maintain a Security Awareness Program",
                 description: "Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise's workforce on how to interact with enterprise assets and data in a secure manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, or when significant enterprise changes occur that could impact this Safeguard",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Govern"],
                 governanceElements: [
                     "establish and maintain a security awareness program",
@@ -8413,7 +8344,7 @@ export class SafeguardManager {
                 title: "Train Workforce Members to Recognize Social Engineering Attacks",
                 description: "Train workforce members to recognize social engineering attacks, such as phishing, business email compromise (BEC), pretexting, and tailgating",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "train workforce members to recognize social engineering attacks",
@@ -8492,7 +8423,7 @@ export class SafeguardManager {
                 title: "Train Workforce Members on Authentication Best Practices",
                 description: "Train workforce members on authentication best practices. Example topics include MFA, password composition, and credential management",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "train workforce members on authentication best practices",
@@ -8569,7 +8500,7 @@ export class SafeguardManager {
                 title: "Train Workforce on Data Handling Best Practices",
                 description: "Train workforce members on how to identify and properly store, transfer, archive, and destroy sensitive data. This also includes training workforce members on clear screen and desk best practices, such as locking their screen when they step away from their enterprise asset, erasing physical and virtual whiteboards at the end of meetings, and storing data and assets securely",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "train workforce members on how to identify and properly store, transfer, archive, and destroy sensitive data",
@@ -8654,7 +8585,7 @@ export class SafeguardManager {
                 title: "Train Workforce Members on Causes of Unintentional Data Exposure",
                 description: "Train workforce members to be aware of causes for unintentional data exposure. Example topics include mis-delivery of sensitive data, losing a portable end-user device, or publishing data to unintended audiences",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "train workforce members to be aware of causes for unintentional data exposure",
@@ -8731,7 +8662,7 @@ export class SafeguardManager {
                 title: "Train Workforce Members on Recognizing and Reporting Security Incidents",
                 description: "Train workforce members to be able to recognize a potential incident and be able to report such an incident",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "train workforce members to be able to recognize a potential incident",
@@ -8806,7 +8737,7 @@ export class SafeguardManager {
                 title: "Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates",
                 description: "Train workforce to understand how to verify and report out-of-date software patches or any failures in automated processes and tools. Part of this training should include notifying IT personnel of any failures in automated processes and tools",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "train workforce to understand how to verify and report out-of-date software patches",
@@ -8887,7 +8818,7 @@ export class SafeguardManager {
                 title: "Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks",
                 description: "Train workforce members on the dangers of connecting to, and transmitting data over, insecure networks for enterprise activities. If the enterprise has remote workers, training must include guidance to ensure that all users securely configure their home network infrastructure",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "train workforce members on dangers of connecting to and transmitting data over insecure networks",
@@ -8967,7 +8898,7 @@ export class SafeguardManager {
                 title: "Conduct Role-Specific Security Awareness and Skills Training",
                 description: "Conduct role-specific security awareness and skills training. Example implementations include secure system administration courses for IT professionals, OWASP Top 10 vulnerability awareness and prevention training for web application developers, and advanced social engineering awareness training for high-profile roles",
                 implementationGroup: "IG2",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "conduct role-specific security awareness and skills training",
@@ -9045,7 +8976,7 @@ export class SafeguardManager {
                 title: "Establish and Maintain an Inventory of Service Providers",
                 description: "Establish and maintain an inventory of service providers. The inventory is to list all known service providers, include classification(s), and designate an enterprise contact for each service provider. Review and update the inventory annually, or when significant enterprise changes occur that could impact this Safeguard",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Identify"],
                 governanceElements: [
                     "establish and maintain an inventory of service providers",
@@ -9125,7 +9056,7 @@ export class SafeguardManager {
                 title: "Establish and Maintain a Service Provider Management Policy",
                 description: "Establish and maintain a service provider management policy. Ensure the policy addresses the classification, inventory, assessment, monitoring, and decommissioning of service providers. Review and update the policy annually, or when significant enterprise changes occur that could impact this Safeguard",
                 implementationGroup: "IG2",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Govern"],
                 governanceElements: [
                     "establish and maintain a service provider management policy",
@@ -9210,7 +9141,7 @@ export class SafeguardManager {
                 title: "Classify Service Providers",
                 description: "Classify service providers. Classification consideration may include one or more characteristics, such as data sensitivity, data volume, availability requirements, applicable regulations, inherent risk, and mitigated risk. Update and review classifications annually, or when significant enterprise changes occur that could impact this Safeguard",
                 implementationGroup: "IG2",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Govern"],
                 governanceElements: [
                     "classify service providers",
@@ -9293,7 +9224,7 @@ export class SafeguardManager {
                 title: "Ensure Service Provider Contracts Include Security Requirements",
                 description: "Ensure service provider contracts include security requirements. Example requirements may include minimum security program requirements, security incident and/or data breach notification and response, data encryption requirements, and data disposal commitments. These security requirements must be consistent with the enterprise's service provider management policy. Review service provider contracts annually to ensure contracts are not missing security requirements",
                 implementationGroup: "IG2",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Govern"],
                 governanceElements: [
                     "ensure service provider contracts include security requirements",
@@ -9375,7 +9306,7 @@ export class SafeguardManager {
                 title: "Assess Service Providers",
                 description: "Assess service providers consistent with the enterprise's service provider management policy. Assessment scope may vary based on classification(s), and may include review of standardized assessment reports, such as Service Organization Control 2 (SOC 2) and Payment Card Industry (PCI) Attestation of Compliance (AoC), customized questionnaires, or other appropriately rigorous processes. Reassess service providers annually, at a minimum, or with new and renewed contracts",
                 implementationGroup: "IG3",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Govern"],
                 governanceElements: [
                     "assess service providers consistent with enterprise's service provider management policy",
@@ -10240,7 +10171,7 @@ export class SafeguardManager {
                 title: "Train Developers in Application Security Concepts and Secure Coding",
                 description: "Ensure that all software development personnel receive training in writing secure code for their specific development environment and responsibilities. Training can include general security principles and application security standard practices. Conduct training at least annually and design in a way to promote security within the development team, and build a culture of security among the developers",
                 implementationGroup: "IG2",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Protect"],
                 governanceElements: [
                     "ensure that all software development personnel receive training in writing secure code",
@@ -10716,7 +10647,7 @@ export class SafeguardManager {
                 title: "Designate Personnel to Manage Incident Handling",
                 description: "Designate one key person, and at least one backup, who will manage the enterprise's incident handling process. Management personnel are responsible for the coordination and documentation of incident response and recovery efforts and can consist of employees internal to the enterprise, service providers, or a hybrid approach. If using a service provider, designate at least one person internal to the enterprise to oversee any third-party work. Review annually, or when significant enterprise changes occur that could impact this Safeguard",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Respond"],
                 governanceElements: [
                     "designate one key person and at least one backup who will manage the enterprise's incident handling process",
@@ -10794,7 +10725,7 @@ export class SafeguardManager {
                 title: "Establish and Maintain Contact Information for Reporting Security Incidents",
                 description: "Establish and maintain contact information for reporting security incidents. This information must be available to all workforce members and should include various contact methods (e.g., phone, email) and be regularly updated. Consider the availability of these contact methods in different circumstances, such as when primary communication systems are compromised",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Respond"],
                 governanceElements: [
                     "establish and maintain contact information for reporting security incidents",
@@ -10870,7 +10801,7 @@ export class SafeguardManager {
                 title: "Establish and Maintain an Enterprise Process for Reporting Incidents",
                 description: "Establish and maintain an documented enterprise process for the workforce to report security incidents. The process includes reporting timeframe, personnel to report to, mechanism for reporting, and the minimum information to be reported. Ensure the process is publicly available to all of the workforce. Review annually, or when significant enterprise changes occur that could impact this Safeguard",
                 implementationGroup: "IG1",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Govern"],
                 governanceElements: [
                     "establish and maintain a documented enterprise process for the workforce to report security incidents",
@@ -10948,7 +10879,7 @@ export class SafeguardManager {
                 title: "Establish and Maintain an Incident Response Process",
                 description: "Establish and maintain a documented incident response process that addresses roles and responsibilities, compliance requirements, and a communication plan. Review annually, or when significant enterprise changes occur that could impact this Safeguard",
                 implementationGroup: "IG2",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Govern"],
                 governanceElements: [
                     "establish and maintain a documented incident response process",
@@ -11023,7 +10954,7 @@ export class SafeguardManager {
                 title: "Assign Key Roles and Responsibilities",
                 description: "Assign key roles and responsibilities for incident response, including staff from legal, IT, information security, facilities, public relations, human resources, incident responders, and analysts. Review annually, or when significant enterprise changes occur that could impact this Safeguard",
                 implementationGroup: "IG2",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Respond"],
                 governanceElements: [
                     "assign key roles and responsibilities for incident response",
@@ -11101,7 +11032,7 @@ export class SafeguardManager {
                 title: "Define Mechanisms for Communicating During Incident Response",
                 description: "Determine which primary and secondary mechanisms will be used to communicate and report during a security incident. Mechanisms can include phone calls, emails, secure chat or notification letters. Keep in mind that certain mechanisms, such as emails, can be affected during a security incident. Review annually, or when significant enterprise changes occur that could impact this Safeguard",
                 implementationGroup: "IG2",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Respond"],
                 governanceElements: [
                     "determine which primary and secondary mechanisms will be used to communicate and report during a security incident",
@@ -11178,7 +11109,7 @@ export class SafeguardManager {
                 title: "Conduct Routine Incident Response Exercises",
                 description: "Plan and conduct routine incident response exercises and scenarios for key personnel involved in the incident response process to prepare for responding to real-world incidents. Exercises need to test communication channels, decision-making, and workflows. Conduct testing on an annual basis, at a minimum",
                 implementationGroup: "IG2",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Recover"],
                 governanceElements: [
                     "plan and conduct routine incident response exercises and scenarios for key personnel involved in the incident response process",
@@ -11255,7 +11186,7 @@ export class SafeguardManager {
                 title: "Conduct Post-Incident Reviews",
                 description: "Conduct post-incident reviews. Post-incident reviews help prevent incident recurrence through identifying lessons learned and follow-up action",
                 implementationGroup: "IG2",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Recover"],
                 governanceElements: [
                     "conduct post-incident reviews"
@@ -11328,7 +11259,7 @@ export class SafeguardManager {
                 title: "Establish and Maintain Security Incident Thresholds",
                 description: "Establish and maintain security incident thresholds, including, at a minimum, differentiating between an incident and an event. Examples can include: abnormal activity, security vulnerability, security weakness, data breach, privacy incident, etc. Review annually, or when significant enterprise changes occur that could impact this Safeguard",
                 implementationGroup: "IG3",
-                assetType: ["users"],
+                assetType: ["Users"],
                 securityFunction: ["Recover"],
                 governanceElements: [
                     "establish and maintain security incident thresholds",