Israel INCD

National Cyber Directorate: software component inventory, supply chain risk management.


Short name	INCD
Region	Middle East & Africa
Country or scope	Israel
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers INCD

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below, plus 11 controls from Safeguard's control catalog for INCD.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for INCD and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`IL-INCD-INV` Software Asset Inventory	Organizations must map and maintain an up-to-date inventory of the software assets and components in their environment (INCD Cyber Defense Methodology, asset management controls)	Scan
`IL-INCD-VER` Version and Patch Tracking	Patch management requires tracking the installed version of each software component to determine update status (INCD Cyber Defense Methodology, patch and update management controls)	Scan
`IL-INCD-SUP` Supply Chain Risk Management	Risks from suppliers and third-party software must be assessed and managed, presupposing that the supplier of each component is known (INCD supply chain risk management guidance)	Scan
`IL-INCD-INT` Software Integrity Verification	Software obtained and deployed must be verifiable as authentic and unmodified, supported by integrity hashes for components (INCD Cyber Defense Methodology, software integrity controls)	Scan
`IL-INCD-VULN` Vulnerability Identification	Organizations must identify vulnerabilities affecting their assets, which requires components identifiable against vulnerability databases via PURL or CPE (INCD Cyber Defense Methodology, vulnerability management controls)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`INCD-CDM-GOV`	Establish Organisational Cyber Governance
`INCD-CDM-RISK`	Conduct Cyber Risk Assessment Using INCD Methodology
`INCD-CDM-ASSET`	Identify and Classify Cyber Assets
`INCD-CDM-PROTECT`	Implement Baseline Cyber Protection Controls
`INCD-CDM-DETECT`	Deploy Cyber Threat Detection Capabilities
`INCD-CDM-IR`	Maintain Cyber Incident Response Capability
`INCD-SC-1`	Assess Cyber Risks in the ICT Supply Chain
`INCD-SC-2`	Secure Software Supply Chain and SBOM
`INCD-SC-3`	Govern Third-Party Remote Access to Critical Systems
`INCD-CDM-RECOV`	Establish Cyber Recovery and Resilience Plans
`INCD-TRAIN-1`	Conduct Cyber Awareness and Training Programme

Policy templates

Written for INCD:

Organisational Cyber Defence Policy (INCD Methodology)
ICT Supply Chain Cyber Security Policy (INCD)
Cyber Awareness, Training, and Recovery Policy (INCD)

And 22 from the standard set, adapted to INCD.