{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"cyber_security","domain":["Secure Development (SDLC) & Application Security","Business Continuity & Disaster Recovery","Incident Management & Response"],"inherent_rating":"critical","taxonomy":["basel-operational-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Asdlc-ransomware","description":"Criminal groups deploy ransomware that encrypts systems and data, disrupting operations, causing losses, and demanding extortion payment — a high-impact convergence of malware, availability, and continuity risk.","details":{"category":"cyber_security","impact":"critical","inherent_rating":"critical","likelihood":"medium","risk_id":"sdlc-ransomware","taxonomies":["basel-operational-risk","coso-erm-risk"],"treatment":"mitigate"},"id":"risk:sdlc-ransomware","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Asdlc-ransomware","sourceIds":["aiuc-1","cobit-2019","dora","eu-ai-act","iso-27001","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Ransomware disrupting operations and data availability","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0877664bb92df798db309d36f4b43b4d88786ce0578a1cc5d1467e61bf2f99dd","properties":{"rationale":"executing recovery to a verified known-good state restores operations after ransomware","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-07-e5d74596.json","sourceId":"uc:UC-BCDR-07","targetDetailPath":"/data/v1/records/risk-sdlc-ransomware-32ab67f4.json","targetId":"risk:sdlc-ransomware","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:429055b510c5d2ecd7e7e6e78338ed050d10ad73d27812fb5fe186d51da02645","properties":{"rationale":"Isolating affected systems halts ransomware encryption spread and eradication removes the malware, directly limiting availability/continuity impact.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-06-0b166c2a.json","sourceId":"uc:UC-IR-06","targetDetailPath":"/data/v1/records/risk-sdlc-ransomware-32ab67f4.json","targetId":"risk:sdlc-ransomware","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:46327c078d832e7f157f0d88155885716e16da99b452054af3f8a553b24bbda6","properties":{"rationale":"backups kept separate and protected from modification, integrity-verified before use, enable clean restore after ransomware encryption","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-03-d30f4ccf.json","sourceId":"uc:UC-BCDR-03","targetDetailPath":"/data/v1/records/risk-sdlc-ransomware-32ab67f4.json","targetId":"risk:sdlc-ransomware","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a823227bef104ee8b1ec5e45cf9214e64c74bbba8b49797e77874e3716a32f26","properties":{"rationale":"severity-based incident response contains and escalates a ransomware event toward restoration","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-06-c505e5bd.json","sourceId":"uc:UC-BCDR-06","targetDetailPath":"/data/v1/records/risk-sdlc-ransomware-32ab67f4.json","targetId":"risk:sdlc-ransomware","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c21783fc09d54611907bb103862ddfdb2438c2ff11698ba1a2300b79fb97c033","properties":{"rationale":"Hardware-enforced separation and non-modifiable executables resist ransomware tampering with and spreading through critical code.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-net-06-f006626f.json","sourceId":"uc:UC-NET-06","targetDetailPath":"/data/v1/records/risk-sdlc-ransomware-32ab67f4.json","targetId":"risk:sdlc-ransomware","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d1ef145c300c5ec43c8583463713c61a943f0db18419510d23051ebd9fe3ae60","properties":{"rationale":"Partitioning the system into separate domains of differing sensitivity limits ransomware lateral spread and blast radius (mustKeep).","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-net-04-d99d6d16.json","sourceId":"uc:UC-NET-04","targetDetailPath":"/data/v1/records/risk-sdlc-ransomware-32ab67f4.json","targetId":"risk:sdlc-ransomware","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d83d297744c90208bca35c4fa450a549a85896fcc320e3709101742f684460d9","properties":{"rationale":"Assessing encryption scope and service disruption sizes ransomware impact so containment and recovery can be prioritized.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-05-0e11ebf5.json","sourceId":"uc:UC-IR-05","targetDetailPath":"/data/v1/records/risk-sdlc-ransomware-32ab67f4.json","targetId":"risk:sdlc-ransomware","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:dcceeec6be320731d92fb2efa866b3bb71d2a6fc366ab3d58cf1f8ecd316b5f1","properties":{"rationale":"Isolation of execution domains and least privilege limit ransomware lateral spread and impact.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-04-ee9d76b1.json","sourceId":"uc:UC-SDLC-04","targetDetailPath":"/data/v1/records/risk-sdlc-ransomware-32ab67f4.json","targetId":"risk:sdlc-ransomware","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e24ce36670cc51b40478fe74ee4ee3acc2c28621fa5df534736bb12c574adbc4","properties":{"rationale":"Restoring affected systems and data to a verified known-good state directly reverses ransomware's availability and continuity impact.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-09-6caefe96.json","sourceId":"uc:UC-IR-09","targetDetailPath":"/data/v1/records/risk-sdlc-ransomware-32ab67f4.json","targetId":"risk:sdlc-ransomware","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e78a4d35bd24379ec35c8a3737e150f0b0889825e8d4c04f79adaad5d8d9e222","properties":{"rationale":"Reducing exploitable input/coding defects narrows the initial-access vulnerabilities ransomware exploits.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-05-053afd62.json","sourceId":"uc:UC-SDLC-05","targetDetailPath":"/data/v1/records/risk-sdlc-ransomware-32ab67f4.json","targetId":"risk:sdlc-ransomware","type":"mitigates"}],"schemaVersion":1}