%PDF-1.4 % 18 0 obj <> endobj 23 0 obj <> endobj 28 0 obj <> endobj 45 0 obj <> endobj 47 0 obj <> endobj 61 0 obj <>stream /P <>BDC q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS2 gs BT /TT2 1 Tf 9 0 0 9 36 603.0262 Tm 0 0 0 1 k -.005 Tc 0 Tw [(It is impor)-24.4(tant t)9.8(o)0( know if one)39.1()54.7(s)0( organization is)]TJ ET EMC /P <>BDC BT 9 0 0 9 214.9922 603.0262 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 591.0262 Tm -.005 Tc [(r)9.8(obust enough t)9.8(o)0( sur)-8.8(vive in the e)6.3(vent of a security)]TJ ET EMC /P <>BDC BT 9 0 0 9 231.8773 591.0262 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 579.0262 Tm -.005 Tc [(e)6.3(vent, let alone expand and impr)9.8(o)7.3(ve. Many)]TJ ET EMC /P <>BDC BT 9 0 0 9 203.644 579.0262 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 567.0262 Tm -.005 Tc (reputable cybersecurity organizations are)Tj ET EMC /P <>BDC BT 9 0 0 9 199.043 567.0262 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 555.0262 Tm -.005 Tc [(publishing guidance on how t)9.8(o)0( respond in the e)6.3(vent)]TJ ET EMC /P <>BDC BT 9 0 0 9 238.5844 555.0262 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 543.0262 Tm -.005 Tc (of a theft or data breach. If sensitive enterprise data)Tj ET EMC /P <>BDC BT 9 0 0 9 240.2446 543.0262 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 531.0262 Tm -.005 Tc [(or accounts ha)7.3(ve been compr)9.8(omised because of)]TJ ET EMC /P <>BDC BT 9 0 0 9 228.4699 531.0262 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 519.0262 Tm -.005 Tc [(theft or loss of a lapt)9.8(op, smar)-24.4(tphone or other)]TJ ET EMC /P <>BDC BT 9 0 0 9 212.8673 519.0262 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 507.0263 Tm -.005 Tc [(de)6.3(vice, or because of a breach of network security)]TJ ET EMC /P <>BDC BT 9 0 0 9 233.6449 507.0263 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 495.0263 Tm -.005 Tc [(or an account, actions t)9.8(o)0( take include:)]TJ ET EMC /P <>BDC BT 5.4 0 0 5.4 185.3869 498.8012 Tm 0 Tc (1)Tj ET EMC /P <>BDC BT 5.4 0 0 5.4 188.374 498.8012 Tm ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 477.0503 Tm -.005 Tc [(Repor)-24.4(ting the loss or breach t)9.8(o)0( IT)19.5( or security)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 221.8486 477.0503 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 36 477.0503 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 47.016 465.0503 Tm 0 0 0 1 k -.005 Tc [(personnel immediately, and t)9.8(o)0( the bank )]TJ ET EMC /LBody <>BDC BT 9 0 0 9 204.0097 465.0503 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 453.0503 Tm -.005 Tc [(when appr)9.8(opriate)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 115.9452 453.0503 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 435.0743 Tm -.005 Tc [(Changing all passwords used t)9.8(o)0( log on t)9.8(o)0( the)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 224.4786 435.0743 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 36 435.0743 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 47.016 423.0743 Tm 0 0 0 1 k -.005 Tc [(affected de)6.3(vice)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 107.7857 423.0743 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 405.0982 Tm -.005 Tc [(Contacting the ser)-8.8(vice pr)9.8(o)7.3(vider for help in wiping)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 239.3391 405.0982 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 36 405.0982 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 47.016 393.0982 Tm 0 0 0 1 k -.005 Tc [(the data fr)9.8(om affected smar)-24.4(tphones and other)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 230.3101 393.0982 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 381.0982 Tm -.005 Tc [(mobile de)6.3(vices)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 106.2705 381.0982 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 363.0982 Tm -.005 Tc [(F)12.7(r)9.8(om an engineering point of view)60.5(, it is also helpful)]TJ ET EMC /P <>BDC BT 9 0 0 9 234.9382 363.0982 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 351.0982 Tm -.005 Tc [(t)9.8(o)0( know how t)9.8(o)0( maintain the ability t)9.8(o)0( )24.4(anticipate,)]TJ ET EMC /P <>BDC BT 9 0 0 9 229.3021 351.0982 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 339.0983 Tm -.005 Tc [(withstand, reco)7.3(ver fr)9.8(om and adapt t)9.8(o)0( adverse)]TJ ET EMC /P <>BDC BT 9 0 0 9 214.715 339.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 327.0982 Tm -.005 Tc [(conditions, stresses, attacks or compr)9.8(omises on)]TJ ET EMC /P <>BDC BT 9 0 0 9 227.4298 327.0982 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 315.0982 Tm -.005 Tc (systems that use or are enabled by)Tj ET EMC /P <>BDC BT 9 0 0 9 173.619 315.0982 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 303.0983 Tm -.005 Tc [(cyberresour)9.3(ces.)83()]TJ ET EMC /P <>BDC BT 5.4 0 0 5.4 101.5761 306.8732 Tm 0 Tc (2)Tj ET EMC /P <>BDC BT 9 0 0 9 104.5635 303.0983 Tm -.005 Tc ( An organization can identify and)Tj ET EMC /P <>BDC BT 9 0 0 9 233.9175 303.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 291.0983 Tm -.005 Tc [(plan use cases t)9.8(o)0( test its cyberresilience as it)]TJ ET EMC /P <>BDC BT 9 0 0 9 214.5352 291.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 279.0983 Tm -.005 Tc [(matures its baseline le)6.3(vel or appr)9.8(oach, and it can)]TJ ET EMC /P <>BDC BT 9 0 0 9 228.367 279.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 267.0983 Tm -.005 Tc [(spend an inordinate amount of funds t)9.8(o)0( pr)9.8(otect its)]TJ ET EMC /P <>BDC BT 9 0 0 9 234.1502 267.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 255.0983 Tm -.005 Tc [(infr)19.5(astructure and other related assets. Howe)6.3(ver)60.1(,)]TJ ET EMC /P <>BDC BT 9 0 0 9 227.7617 255.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 243.0983 Tm -.005 Tc [(there is no guar)19.5(antee that an organization can)]TJ ET EMC /P <>BDC BT 9 0 0 9 217.0597 243.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 231.0983 Tm -.005 Tc [(withstand and adapt t)9.8(o)0( adverse e)6.3(vents.)]TJ ET EMC /P <>BDC BT 9 0 0 9 190.8765 231.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 207.0983 Tm -.005 Tc [(The digital world has re)6.3(v)7.3(olutionized how people live,)]TJ ET EMC /P <>BDC BT 9 0 0 9 240.6204 207.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 195.0983 Tm -.005 Tc [(work and play. Howe)6.3(ver)60.1(, it)54.7(s a digital world that is)]TJ ET EMC /P <>BDC BT 9 0 0 9 228.5671 195.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 183.0983 Tm -.005 Tc [(constantly open t)9.8(o)0( attack, and because there are so)]TJ ET EMC /P <>BDC BT 9 0 0 9 239.4667 183.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 171.0983 Tm -.005 Tc [(many potential attackers, it is necessary t)9.8(o)0( ensure)]TJ ET EMC /P <>BDC BT 9 0 0 9 233.3099 171.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 159.0983 Tm -.005 Tc [(that the right security is in place t)9.8(o)0( pre)6.3(vent systems)]TJ ET EMC /P <>BDC BT 9 0 0 9 238.8878 159.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 147.0983 Tm -.005 Tc [(and networks fr)9.8(om being compr)9.8(omised.)]TJ ET EMC /P <>BDC BT 9 0 0 9 193.9636 147.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 135.0983 Tm -.005 Tc [(Unfor)-24.4(tunately, there is no single method that can)]TJ ET EMC /P <>BDC BT 9 0 0 9 227.6563 135.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 123.0983 Tm -.005 Tc [(successfully pr)9.8(otect against e)6.3(very single type of)]TJ ET EMC /P <>BDC BT 9 0 0 9 225.226 123.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 111.0983 Tm -.005 Tc [(attack. )19.5(This is where a defense in depth \(DiD\))]TJ ET EMC /P <>BDC BT 9 0 0 9 214.3087 111.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 99.0983 Tm -.005 Tc [(ar)9.3(chitecture comes int)9.8(o play.)]TJ ET EMC /P <>BDC BT 5.4 0 0 5.4 150.2542 102.8732 Tm 0 Tc (3)Tj ET EMC /P <>BDC BT 5.4 0 0 5.4 153.2414 102.8732 Tm ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 75.0983 Tm -.02 Tc [(DiD is )24.4(an appr)9.8(oach t)9.8(o)0( cybersecurity in which a series)]TJ ET EMC /P <>BDC BT 9 0 0 9 238.6075 75.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 63.0983 Tm -.02 Tc [(of defensive mechanisms are layered in order t)9.8(o)]TJ ET EMC /P <>BDC BT 9 0 0 9 219.4942 63.0983 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 253.3623 603.0262 Tm -.02 Tc [(pr)9.8(otect v)7.3(aluable data and information. If one)]TJ ET EMC /P <>BDC BT 9 0 0 9 422.3718 603.0262 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 253.3623 591.0262 Tm -.02 Tc [(mechanism fails, another steps up immediately t)9.8(o)]TJ ET EMC /P <>BDC BT 9 0 0 9 443.5583 591.0262 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 253.3623 579.0262 Tm -.02 Tc [(thwar)-24.4(t an attack. DiD is commonly referred t)9.8(o)0( as the)]TJ ET EMC /P <>BDC BT 9 0 0 9 451.7902 579.0262 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 253.3623 567.0262 Tm -.02 Tc [(castle appr)9.8(oach because it mirr)9.8(ors the layered)]TJ ET EMC /P <>BDC BT 9 0 0 9 429.7108 567.0262 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 253.3623 555.0262 Tm -.02 Tc [(defenses of a medie)6.3(v)7.3(al castle. Before a castle can be)]TJ ET EMC /P <>BDC BT 9 0 0 9 456.154 555.0262 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 253.3623 543.0262 Tm -.02 Tc [(penetr)19.5(ated, attackers face moats, r)19.5(ampar)-24.4(ts, dr)19.5(aw)]TJ ET EMC /P <>BDC BT 9 0 0 9 440.6448 543.0262 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 253.3623 531.0262 Tm -.02 Tc [(bridges, t)9.8(owers, battlements and other )]TJ ET EMC /P <>BDC BT 9 0 0 9 401.791 531.0262 Tm -.005 Tc (defenses.)Tj ET EMC /P <>BDC BT 5.4 0 0 5.4 440.5062 534.8011 Tm 0 Tc (4)Tj ET EMC /P <>BDC BT 5.4 0 0 5.4 443.4935 534.8011 Tm ( )Tj ET EMC /P <>BDC /GS1 gs BT /TT10 1 Tf 30 0 0 30 36 671.9586 Tm .761 .549 .11 0 k -.02 Tc [(Cyberresilience in an E)12.7(v)7.3(olving)]TJ ET EMC /P <>BDC BT 30 0 0 30 404.1652 671.9586 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 30 0 0 30 36 637.9586 Tm -.02 Tc (Threat Landscape)Tj ET EMC /Artifact <>BDC .8 .871 .22 0 k 253.362 59.499 349.498 253.325 re f EMC /P <>BDC BT /TT6 1 Tf 11 0 0 11 266.5235 290.749 Tm 0 0 0 0 k (Larry Marks,)Tj ET EMC /P <>BDC BT /TT2 1 Tf 11 0 0 11 325.7857 290.749 Tm [( CISA, CRISC, CGEIT)106.4(, CFE, CISSP)158.2(, CSTE, ITIL, PMP)]TJ ET EMC /P <>BDC BT 11 0 0 11 552.2213 290.749 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 279.949 Tm -.02 Tc [(Has focused his career on leading thr)9.8(ough collabor)19.5(ation t)9.8(o)0( ensure that best)]TJ ET EMC /P <>BDC BT 9 0 0 9 553.6332 279.949 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 269.1489 Tm -.02 Tc [(pr)19.5(actices are implemented t)9.8(o)0( assist compliance and pr)9.8(ocess impr)9.8(o)7.3(vement. He)]TJ ET EMC /P <>BDC BT 9 0 0 9 566.8562 269.1489 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 258.3488 Tm -.02 Tc [(has focused on audit, security, risk, compliance, priv)7.3(acy and pr)9.8(ogr)19.5(am/pr)9.8(oject)]TJ ET EMC /P <>BDC BT 9 0 0 9 557.9095 258.3488 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 247.549 Tm -.02 Tc [(management acr)9.8(oss )]TJ /TT11 1 Tf 9.0243 0 TD 0 Tc ()Tj /TT2 1 Tf .5337 0 TD -.02 Tc [(nancial ser)-8.8(vices, healthcare and telecommunications.)]TJ ET EMC /P <>BDC BT 9 0 0 9 557.1524 247.549 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 236.7488 Tm -.02 Tc (Marks has extensive experience in designing, managing, auditing and)Tj ET EMC /P <>BDC BT 9 0 0 9 529.7781 236.7488 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 225.9489 Tm -.02 Tc [(implementing IT)19.5( pr)9.8(ocesses, policies, contr)9.8(ols and technology. He has)]TJ ET EMC /P <>BDC BT 9 0 0 9 530.0287 225.9489 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 215.1489 Tm -.02 Tc [(managed teams, priorities and expectations acr)9.8(oss business and IT)19.5( leadership)]TJ ET EMC /P <>BDC BT 9 0 0 9 565.8765 215.1489 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 204.3488 Tm -.02 Tc (while delivering )Tj /TT11 1 Tf 6.7596 0 TD 0 Tc ()Tj /TT2 1 Tf .5337 0 TD -.02 Tc [(t-for-purpose ser)-8.8(vices. He is a peer re)6.3(viewer for the )]TJ ET EMC /P <>BDC BT /TT4 1 Tf 9 0 0 9 528.0652 204.3488 Tm (ISACA)Tj ET EMC /P <>BDC BT 5.4 0 0 5.4 552.0121 207.3189 Tm 0 Tc ()Tj ET EMC /P <>BDC BT 9 0 0 9 555.977 204.3488 Tm ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 193.549 Tm -.02 Tc (Journal)Tj ET EMC /P <>BDC BT /TT2 1 Tf 9 0 0 9 294.817 193.549 Tm [( and the Association of Cer)-24.4(ti)]TJ /TT11 1 Tf 12.0104 0 TD 0 Tc ()Tj /TT2 1 Tf .5337 0 TD -.02 Tc [(ed F)12.7(r)19.5(aud Examiners \(ACFE\) )]TJ ET EMC /P <>BDC BT /TT4 1 Tf 9 0 0 9 514.4404 193.549 Tm [(F)12.7(r)19.5(aud)]TJ ET EMC /P <>BDC BT 9 0 0 9 535.7328 193.549 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 182.7488 Tm -.02 Tc (Magazine)Tj ET EMC /P <>BDC BT /TT2 1 Tf 9 0 0 9 303.3425 182.7488 Tm [(. Marks is also associate edit)9.8(or for )]TJ ET EMC /P <>BDC BT /TT4 1 Tf 9 0 0 9 436.4954 182.7488 Tm (Information Security Journal: A)Tj ET EMC /P <>BDC BT 9 0 0 9 552.381 182.7488 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 171.9489 Tm -.02 Tc (Global Perspective)Tj ET EMC /P <>BDC BT /TT2 1 Tf 9 0 0 9 336.5453 171.9489 Tm [(, published by \(ISC)12.7(\))]TJ ET EMC /P <>BDC BT 5.4 0 0 5.4 409.3094 174.9188 Tm 0 Tc (2)Tj ET EMC /P <>BDC BT 9 0 0 9 412.1617 171.9489 Tm -.02 Tc [(, and contributes book re)6.3(views t)9.8(o)]TJ ET EMC /P <>BDC BT 9 0 0 9 537.7377 171.9489 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT /TT4 1 Tf 9 0 0 9 266.5235 161.1489 Tm -.02 Tc [(InfoSecurity Pr)9.8(ofessional)]TJ ET EMC /P <>BDC BT /TT2 1 Tf 9 0 0 9 360.5143 161.1489 Tm [(. Marks was recently selected t)9.8(o)0( be a member of the)]TJ ET EMC /P <>BDC BT 9 0 0 9 559.8077 161.1489 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 150.3488 Tm -.02 Tc (Rutgers University Cyber Advisory Council \(New Brunswick, New Jersey, USA\).)Tj ET EMC /P <>BDC BT 9 0 0 9 563.6791 150.3488 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 139.5488 Tm -.02 Tc [(He currently holds a leadership position in the ACFE New Jersey \(USA\) chapter)60.1(.)]TJ ET EMC /P <>BDC BT 9 0 0 9 567.4413 139.5488 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 128.7488 Tm -.02 Tc [(He has contributed t)9.8(o)0( ISACA)]TJ ET EMC /P <>BDC BT 5.4 0 0 5.4 375.399 131.7188 Tm 0 Tc ()Tj ET EMC /P <>BDC BT 9 0 0 9 379.4643 128.7488 Tm -.02 Tc ( white papers and has authored/coauthored)Tj ET EMC /P <>BDC BT 9 0 0 9 546.8206 128.7488 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 117.9489 Tm -.02 Tc [(ISACA audit pr)9.8(ogr)19.5(ams. Marks ser)-8.8(ved on the Cer)-24.4(ti)]TJ /TT11 1 Tf 20.772 0 TD 0 Tc ()Tj /TT2 1 Tf .5337 0 TD -.02 Tc (ed in Risk and Information)Tj ET EMC /P <>BDC BT 9 0 0 9 558.0891 117.9489 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 107.1489 Tm -.02 Tc [(Systems Contr)9.8(ol)]TJ ET EMC /P <>BDC BT 5.4 0 0 5.4 329.698 110.1188 Tm 0 Tc ()Tj ET EMC /P <>BDC BT 9 0 0 9 333.7631 107.1489 Tm -.02 Tc ( \(CRISC)Tj ET EMC /P <>BDC BT 5.4 0 0 5.4 362.8519 110.1188 Tm 0 Tc ()Tj ET EMC /P <>BDC BT 9 0 0 9 366.9171 107.1489 Tm -.02 Tc [(\) exam-writing team and is par)-24.4(t of the Pr)9.8(oject)]TJ ET EMC /P <>BDC BT 9 0 0 9 538.8798 107.1489 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 96.3488 Tm -.02 Tc [(Management Institute)39.1()54.7(s)0( ISO Committee. He is also a blogger and contribut)9.8(or t)9.8(o)]TJ ET EMC /P <>BDC BT 9 0 0 9 566.2371 96.3488 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 85.5488 Tm -.02 Tc [(the leadership section of Pr)9.8(ojectManagement.com. His work has been)]TJ ET EMC /P <>BDC BT 9 0 0 9 534.8888 85.5488 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 266.5235 74.7488 Tm -.02 Tc (published in the )Tj ET EMC /P <>BDC BT /TT4 1 Tf 9 0 0 9 328.8326 74.7488 Tm [(\(ISC)12.7(\))]TJ ET EMC /P <>BDC BT 5.4 0 0 5.4 347.295 77.7188 Tm 0 Tc (2)Tj ET EMC /P <>BDC BT 9 0 0 9 350.0841 74.7488 Tm -.02 Tc ( Security Journal)Tj ET EMC /P <>BDC BT /TT2 1 Tf 9 0 0 9 412.582 74.7488 Tm (, the )Tj ET EMC /P <>BDC BT /TT4 1 Tf 9 0 0 9 430.3898 74.7488 Tm (PMI Journal)Tj ET EMC /P <>BDC BT /TT2 1 Tf 9 0 0 9 475.8007 74.7488 Tm ( and the )Tj ET EMC /P <>BDC BT /TT4 1 Tf 9 0 0 9 508.4672 74.7488 Tm (ISACA Journal)Tj ET EMC /P <>BDC BT /TT2 1 Tf 9 0 0 9 562.7333 74.7488 Tm 0 Tc (.)Tj ET EMC /Figure <>BDC Q q 1 i 241.483 528.665 405 -227.88 re W n 253.5 513.582 349.502 -186.86 re 565.102 74.749 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS1 gs q 350.4 0 0 187.38 253.183 326.525 cm /Im1 Do Q EMC /Artifact <>BDC Q q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 k /GS1 gs 514.284 692.116 53.716 54.884 re f EMC /Figure <>BDC Q /GS1 gs BT /F1 1 Tf 9 0 0 9 514.2844 721.5889 Tm .78824 .85098 .17255 .043137 k .0249 Tc 0 Tw (FEATURE)Tj ET q 1 i 514.299 746.986 53.701 -54.87 re W n q 1 0 0 1 568 747 cm 0 0 m 0 -54.884 l -9.375 -54.884 l -9.375 -9.9448 l -49.977 -9.9448 l -49.977 0 l 0 0 l f Q EMC /P <>BDC Q q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS2 gs BT /TT2 1 Tf 7 0 0 7 491.5321 20.6188 Tm 0 0 0 1 k 0 Tc (ISACA )Tj ET EMC /P <>BDC BT 7 0 0 7 513.0106 20.6188 Tm (JOURNAL)Tj ET EMC /P <>BDC /GS1 gs BT 7 0 0 7 543.8578 20.6188 Tm .761 .549 .11 0 k [( V)6.3(OL 3)]TJ ET EMC /Artifact <>BDC 0 0 0 1 k /GS2 gs 572.901 .014984 .51599 30.955 re f EMC /P <>BDC /GS1 gs BT 7 0 0 7 587.8536 20.6188 Tm .761 .549 .11 0 k (1)Tj ET EMC /P <>BDC /GS2 gs BT 7 0 0 7 36 21.767 Tm 0 0 0 1 k [( 2021 ISACA. All rights reser)-8.8(ved. )]TJ ET EMC /P <>BDC BT /TT4 1 Tf 7 0 0 7 143.6318 21.767 Tm [(www)60.5(.isaca.org)]TJ ET EMC Q endstream endobj 62 0 obj <>/XObject<>/ExtGState<>>> endobj 109 0 obj <> endobj 114 0 obj <> endobj 119 0 obj <>stream /P <>BDC q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS2 gs BT /TT2 1 Tf 7 0 0 7 39.4019 20.9698 Tm 0 0 0 1 k 0 Tc 0 Tw (ISACA )Tj ET EMC /P <>BDC BT 7 0 0 7 60.8804 20.9698 Tm (JOURNAL)Tj ET EMC /P <>BDC /GS1 gs BT 7 0 0 7 91.7275 20.9698 Tm .761 .549 .11 0 k [( V)6.3(OL 3)]TJ ET EMC /Artifact <>BDC 0 0 0 1 k /GS2 gs 30.069 .014984 .51505 31.516 re f EMC /P <>BDC /GS1 gs BT 7 0 0 7 12.8637 20.9698 Tm .761 .549 .11 0 k (2)Tj ET EMC /P <>BDC /GS2 gs BT 7 0 0 7 415.3383 21.3673 Tm 0 0 0 1 k [( 2021 ISACA. All rights reser)-8.8(ved. )]TJ ET EMC /P <>BDC BT /TT4 1 Tf 7 0 0 7 522.9701 21.3673 Tm [(www)60.5(.isaca.org)]TJ ET EMC /P <>BDC BT /TT2 1 Tf 9 0 0 9 144 663.4303 Tm -.005 Tc [(Other than DiD, the current appr)9.8(oach that)]TJ ET EMC /P <>BDC BT 9 0 0 9 305.4169 663.4303 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 651.4303 Tm -.005 Tc [(pr)9.8(ofessionals are discussing is t)9.8(o)0( expect that a)]TJ ET EMC /P <>BDC BT 9 0 0 9 329.6499 651.4303 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 639.4303 Tm -.005 Tc [(cyber)19.5(attacker has been in the organization)39.1()54.7(s)]TJ ET EMC /P <>BDC BT 9 0 0 9 316.8792 639.4303 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 627.4303 Tm -.005 Tc [(envir)9.8(onment and remains there, waiting for the)]TJ ET EMC /P <>BDC BT 9 0 0 9 327.714 627.4303 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 615.4303 Tm -.005 Tc [(security pr)9.8(ofessional t)9.8(o)0( unco)7.3(ver the attacker)]TJ ET EMC /P <>BDC BT 9 0 0 9 319.5852 615.4303 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 603.4303 Tm -.005 Tc [(thr)9.8(ough v)7.3(arious means. How can the organization)]TJ ET EMC /P <>BDC BT 9 0 0 9 340.2902 603.4303 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 591.4303 Tm -.005 Tc [(anticipate and reco)7.3(ver fr)9.8(om the stresses of a)]TJ ET EMC /P <>BDC BT 9 0 0 9 320.8113 591.4303 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 579.4303 Tm -.005 Tc (relentless attacker such as a nation-state?)Tj ET EMC /P <>BDC BT 9 0 0 9 310.5696 579.4303 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 555.4302 Tm -.005 Tc (The US National Institute of Standards and)Tj ET EMC /P <>BDC BT 9 0 0 9 312.2186 555.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 543.4302 Tm -.005 Tc (Technology \(NIST\) issued guidance that)Tj ET EMC /P <>BDC BT 9 0 0 9 302.1241 543.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 531.4302 Tm -.005 Tc [(recommends organizations bake in)50.8()]TJ ET EMC /P <>BDC BT 9 0 0 9 288.892 531.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 519.4302 Tm -.005 Tc [(cyberresilience t)9.8(o)0( their policies, pr)9.8(ocesses,)]TJ ET EMC /P <>BDC BT 9 0 0 9 312.5144 519.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 507.4301 Tm -.005 Tc [(pr)9.8(ocedures and applications. Organizations should)]TJ ET EMC /P <>BDC BT 9 0 0 9 344.454 507.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 495.4301 Tm -.005 Tc (ensure that cyberresilience is a priority during their)Tj ET EMC /P <>BDC BT 9 0 0 9 342.8361 495.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 483.4301 Tm -.005 Tc [(systems de)6.3(velopment life cycle, fr)9.8(om ar)9.3(chitectur)19.5(al)]TJ ET EMC /P <>BDC BT 9 0 0 9 342.2514 483.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 471.4301 Tm -.005 Tc [(decisions t)9.8(o)0( stakeholder requirements. )19.5(The NIST)]TJ ET EMC /P <>BDC BT 9 0 0 9 336.0582 471.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 459.4302 Tm -.005 Tc [(guidance can be used t)9.8(o)0( identify a pr)19.5(actical)]TJ ET EMC /P <>BDC BT 9 0 0 9 314.884 459.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 447.4302 Tm -.005 Tc [(appr)9.8(oach for its application. F)10.2(or example, should)]TJ ET EMC /P <>BDC BT 9 0 0 9 336.2319 447.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 435.4302 Tm -.005 Tc (cyberresilience be implemented for all systems or)Tj ET EMC /P <>BDC BT 9 0 0 9 340.0331 435.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 423.4302 Tm -.005 Tc (only critical systems? )Tj ET EMC /P <>BDC BT 9 0 0 9 231.0713 423.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC /GS1 gs BT /TT6 1 Tf 11 0 0 11 144 397.4302 Tm .8 .871 .22 0 k -.005 Tc [(How Cyberresilience Differs F)12.7(r)17.6(om Other)]TJ ET EMC /P <>BDC BT 11 0 0 11 338.4016 397.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 11 0 0 11 144 383.4302 Tm -.005 Tc (Types of Contingency Planning)Tj ET EMC /P <>BDC BT 11 0 0 11 296.5077 383.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 144 365.4302 Tm 0 0 0 1 k -.005 Tc [(Cyberresilience refers t)9.8(o)0( the oper)19.5(ational response)]TJ ET EMC /P <>BDC BT 9 0 0 9 340.1595 365.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 353.4302 Tm -.005 Tc [(and reco)7.3(very planning effor)-24.4(ts stemming fr)9.8(om a)]TJ ET EMC /P <>BDC BT 9 0 0 9 329.8816 353.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 341.4302 Tm -.005 Tc [(cyber)19.5(attack. Although the concept of cybersecurity)]TJ ET EMC /P <>BDC BT 9 0 0 9 344.453 341.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 329.4302 Tm -.005 Tc [(has matured int)9.8(o an accepted pr)9.8(ofession and a)]TJ ET EMC /P <>BDC BT 9 0 0 9 329.9827 329.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 317.4302 Tm -.005 Tc [(component of a good risk technology pr)9.8(ogr)19.5(am,)]TJ ET EMC /P <>BDC BT 9 0 0 9 328.6257 317.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 305.4302 Tm -.005 Tc [(cyberresilience is an e)6.3(v)7.3(olution in maturity. In a way,)]TJ ET EMC /P <>BDC BT 9 0 0 9 345.2618 305.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 293.4302 Tm -.005 Tc [(it follows the e)6.3(v)7.3(olution of business continuity as a)]TJ ET EMC /P <>BDC BT 9 0 0 9 340.7244 293.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 281.4302 Tm -.005 Tc [(separ)19.5(ate and distinct idea fr)9.8(om IT)19.5( disaster reco)7.3(very.)]TJ ET EMC /P <>BDC BT 9 0 0 9 348.8665 281.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 144 257.4302 Tm -.005 Tc [(Incident management is the pr)9.8(ocess of managing)]TJ ET EMC /P <>BDC BT 9 0 0 9 339.922 257.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 663.4303 Tm -.005 Tc [(IT)19.5( ser)-8.8(vice disruptions and rest)9.8(oring ser)-8.8(vices within)]TJ ET EMC /P <>BDC BT 9 0 0 9 561.3577 663.4303 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 651.4303 Tm -.02 Tc [(agreed ser)-8.8(vice le)6.3(vel agreements \(SL)-9.3(As\). The scope)]TJ ET EMC /P <>BDC BT 9 0 0 9 559.8922 651.4303 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 639.4303 Tm -.02 Tc [(of incident management star)-24.4(ts with an end user)]TJ ET EMC /P <>BDC BT 9 0 0 9 544.1459 639.4303 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 627.4303 Tm -.02 Tc [(repor)-24.4(ting an issue and ends with a ser)-8.8(vice desk team)]TJ ET EMC /P <>BDC BT 9 0 0 9 563.8696 627.4303 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 615.4303 Tm -.02 Tc [(member resolving that issue.)83()]TJ ET EMC /P <>BDC BT 5.4 0 0 5.4 474.4628 619.2052 Tm 0 Tc (5)Tj ET EMC /P <>BDC BT 9 0 0 9 477.3151 615.4303 Tm -.02 Tc [( Enterprises de)6.3(veloping)]TJ ET EMC /P <>BDC BT 9 0 0 9 566.2738 615.4303 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 603.4303 Tm -.02 Tc [(or testing their incident management gener)19.5(ally)]TJ ET EMC /P <>BDC BT 9 0 0 9 538.6835 603.4303 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 591.4303 Tm -.02 Tc [(de)6.3(velop a limited set of use cases t)9.8(o)0( ensure a)]TJ ET EMC /P <>BDC BT 9 0 0 9 535.3349 591.4303 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 579.4303 Tm -.02 Tc [(consistent and effective appr)9.8(oach in the e)6.3(vent of a)]TJ ET EMC /P <>BDC BT 9 0 0 9 554.0784 579.4303 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 567.4302 Tm -.02 Tc [(security breach, determine how their infr)19.5(astructure)]TJ ET EMC /P <>BDC BT 9 0 0 9 553.3665 567.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 555.4302 Tm -.02 Tc [(can respond and identify how t)9.8(o)0( impr)9.8(o)7.3(ve this)]TJ ET EMC /P <>BDC BT 9 0 0 9 532.6977 555.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 543.4302 Tm -.02 Tc [(pr)9.8(ocess. )19.5(The enterprise then convenes a lessons)]TJ ET EMC /P <>BDC BT 9 0 0 9 547.5826 543.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 531.4302 Tm -.02 Tc [(learned session t)9.8(o)0( ensure that it was able t)9.8(o)0( reco)7.3(ver)]TJ ET EMC /P <>BDC BT 9 0 0 9 559.6248 531.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 519.4302 Tm -.02 Tc [(fr)9.8(om the incident in a timely and effective manner)60.1(.)]TJ ET EMC /P <>BDC BT 9 0 0 9 552.0175 519.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 495.4301 Tm -.02 Tc [(Alternatively, many organizations ha)7.3(ve issued)]TJ ET EMC /P <>BDC BT 9 0 0 9 535.1281 495.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 483.4301 Tm -.02 Tc (guidance on continuity planning.)Tj ET EMC /P <>BDC BT 5.4 0 0 5.4 485.0059 487.2052 Tm 0 Tc (6)Tj ET EMC /P <>BDC BT 9 0 0 9 487.8582 483.4301 Tm -.02 Tc [( IT)19.5( continuity)]TJ ET EMC /P <>BDC BT 9 0 0 9 536.6799 483.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 471.4301 Tm -.02 Tc [(planning is the pr)9.8(ocess of ensuring continuous)]TJ ET EMC /P <>BDC BT 9 0 0 9 539.6722 471.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 459.4302 Tm -.02 Tc [(oper)19.5(ations of business applications and suppor)-24.4(ting IT)]TJ ET EMC /P <>BDC BT 9 0 0 9 566.6649 459.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 447.4302 Tm -.02 Tc [(systems \(e.g., deskt)9.8(ops, printers, network de)6.3(vices\). IT)]TJ ET EMC /P <>BDC BT 9 0 0 9 564.802 447.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 435.4302 Tm -.02 Tc (continuity planning is a subset of enterprise business)Tj ET EMC /P <>BDC BT 9 0 0 9 563.8833 435.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 423.4302 Tm -.02 Tc (continuity planning \(BCP\). A business continuity plan)Tj ET EMC /P <>BDC BT 9 0 0 9 562.6043 423.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 411.4302 Tm -.02 Tc [(is an enterprisewide gr)9.8(oup of pr)9.8(ocesses and)]TJ ET EMC /P <>BDC BT 9 0 0 9 530.4343 411.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 399.4302 Tm -.02 Tc [(instructions used t)9.8(o)0( ensure the continuation of)]TJ ET EMC /P <>BDC BT 9 0 0 9 539.2022 399.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 387.4302 Tm -.02 Tc [(business pr)9.8(ocesses in the e)6.3(vent of an interruption. It)]TJ ET EMC /P <>BDC BT 9 0 0 9 560.3809 387.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 375.4302 Tm -.02 Tc [(pr)9.8(o)7.3(vides the plans for the enterprise t)9.8(o)0( reco)7.3(ver fr)9.8(om)]TJ ET EMC /P <>BDC BT 9 0 0 9 559.2822 375.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 363.4302 Tm -.02 Tc (minor incidents \(e.g., localized disruptions of)Tj ET EMC /P <>BDC BT 9 0 0 9 531.9028 363.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 351.4302 Tm -.02 Tc (business components\) and major disruptions \(e.g.,)Tj ET EMC /P <>BDC BT 9 0 0 9 555.2603 351.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT /TT11 1 Tf 9 0 0 9 361.5 339.4302 Tm ()Tj /TT2 1 Tf .5337 0 TD -.02 Tc [(re, natur)19.5(al disasters, extended power failures,)]TJ ET EMC /P <>BDC BT 9 0 0 9 538.0247 339.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 327.4302 Tm -.02 Tc [(equipment or telecommunications failure\). )19.5(The plan)]TJ ET EMC /P <>BDC BT 9 0 0 9 558.9957 327.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 315.4302 Tm -.02 Tc (is usually owned and managed by the business units)Tj ET EMC /P <>BDC BT 9 0 0 9 561.9313 315.4302 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 303.4301 Tm -.02 Tc [(and a disaster management or risk pre)6.3(vention)]TJ ET EMC /P <>BDC BT 9 0 0 9 536.7275 303.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 291.4301 Tm -.02 Tc (function in the enterprise.)Tj ET EMC /P <>BDC BT 9 0 0 9 458.6685 291.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 267.4301 Tm -.005 Tc [(The IT)19.5( continuity plan addresses IT)19.5( exposures and)]TJ ET EMC /P <>BDC BT 9 0 0 9 559.5635 267.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 255.4301 Tm -.005 Tc [(solutions based on the priorities and fr)19.5(amework of)]TJ ET EMC /P <>BDC BT 9 0 0 9 560.2391 255.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 243.4301 Tm -.005 Tc [(the business continuity plan. )19.5(The r)9.8(ole of the IT)]TJ ET EMC /P <>BDC BT 9 0 0 9 542.9135 243.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 231.4301 Tm -.005 Tc [(audit/assur)19.5(ance function is t)9.8(o)0( pr)9.8(o)7.3(vide assur)19.5(ance)]TJ ET EMC /P <>BDC BT 9 0 0 9 554.1988 231.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 219.4301 Tm -.005 Tc (that the risk has been addressed by the business/IT)Tj ET EMC /P <>BDC BT 9 0 0 9 565.0634 219.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 207.4301 Tm -.005 Tc [(owners. As a best pr)19.5(actice, the business continuity)]TJ ET EMC /P <>BDC BT 9 0 0 9 560.9457 207.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 195.4301 Tm -.005 Tc [(plan should be e)6.3(v)7.3(aluated for any guidance)]TJ ET EMC /P <>BDC BT 9 0 0 9 527.6455 195.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 183.4301 Tm -.005 Tc [(addressing its fr)19.5(amework, priorities, responsibilities)]TJ ET EMC /P <>BDC BT 9 0 0 9 564.4054 183.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 171.4301 Tm -.005 Tc (and objectives.)Tj ET EMC /P <>BDC BT 9 0 0 9 421.061 171.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 147.4301 Tm -.005 Tc [(The IT)19.5( continuity plan must be aligned with the)]TJ ET EMC /P <>BDC BT 9 0 0 9 545.1647 147.4301 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 361.5 135.4301 Tm -.005 Tc [(business continuity plan t)9.8(o)0( ensure that:)]TJ ET EMC /P <>BDC BT 9 0 0 9 516.0757 135.4301 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 372.516 117.4542 Tm -.005 Tc [(Risk is appr)9.8(opriately identi)]TJ /TT11 1 Tf 11.5226 0 TD 0 Tc ()Tj /TT2 1 Tf .5487 0 TD -.005 Tc [(ed and e)6.3(v)7.3(aluated by)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 559.8008 117.4542 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 361.5 117.4542 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 372.516 105.4542 Tm 0 0 0 1 k -.005 Tc [(focusing on the impact on business pr)9.8(ocesses)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 556.3638 105.4542 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 372.516 93.4542 Tm -.005 Tc (for known and potential risk)Tj ET EMC /LBody <>BDC BT 9 0 0 9 482.2887 93.4542 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 372.516 75.4782 Tm -.005 Tc (The costs of implementing and managing)Tj ET EMC /LBody <>BDC BT 9 0 0 9 537.0298 75.4782 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 361.5 75.4782 Tm .49 .04 0 .05 k ()Tj ET EMC /Artifact <>BDC .761 .549 .11 0 k 144.512 69.452 203.988 161.955 re f EMC /P <>BDC BT /TT13 1 Tf 47 0 0 47 150.8309 188.3355 Tm .49 .04 0 .05 k ()Tj ET EMC /P <>BDC BT /TT2 1 Tf 14 0 0 14 164.7382 208.3359 Tm 0 0 0 0 k [( AL)134.3(THOUGH )19.5(THE CONCEPT)]TJ ET EMC /P <>BDC BT 14 0 0 14 335.1924 208.3359 Tm ( )Tj ET EMC /P <>BDC BT 14 0 0 14 150.8309 190.3359 Tm [(OF CYBERSECURIT)-7.8(Y H)-8.8(A)0(S)]TJ ET EMC /P <>BDC BT 14 0 0 14 309.2333 190.3359 Tm ( )Tj ET EMC /P <>BDC BT 14 0 0 14 150.8309 172.3359 Tm [(MA)63(TURED INT)13.7(O AN ACCEPTED)]TJ ET EMC /P <>BDC BT 14 0 0 14 345.2176 172.3359 Tm ( )Tj ET EMC /P <>BDC BT 14 0 0 14 150.8309 154.3359 Tm (PROFESSION AND A)Tj ET EMC /P <>BDC BT 14 0 0 14 277.9862 154.3359 Tm ( )Tj ET EMC /P <>BDC BT 14 0 0 14 150.8309 136.3359 Tm [(COMPONENT)19.5( OF A GOOD RISK)]TJ ET EMC /P <>BDC BT 14 0 0 14 344.0829 136.3359 Tm ( )Tj ET EMC /P <>BDC BT 14 0 0 14 150.8309 118.3358 Tm [(TECHNOL)31.7(OGY PROGRAM,)]TJ ET EMC /P <>BDC BT 14 0 0 14 313.3007 118.3358 Tm ( )Tj ET EMC /P <>BDC BT 14 0 0 14 150.8309 100.3358 Tm (CYBERRESILIENCE IS AN)Tj ET EMC /P <>BDC BT 14 0 0 14 306.8407 100.3358 Tm ( )Tj ET EMC /P <>BDC BT 14 0 0 14 150.8309 82.3358 Tm [(EV)6.3(OL)26.4(UTION IN MA)63(TURIT)-7.8(Y)103(.)0( )]TJ ET EMC /P <>BDC BT /TT13 1 Tf 47 0 0 47 318.8719 62.3355 Tm .49 .04 0 .05 k ()Tj ET EMC Q endstream endobj 120 0 obj <>/ExtGState<>>> endobj 139 0 obj <> endobj 144 0 obj <> endobj 149 0 obj <> endobj 158 0 obj <> endobj 163 0 obj <> endobj 168 0 obj <> endobj 181 0 obj <> endobj 186 0 obj <> endobj 191 0 obj <> endobj 196 0 obj <> endobj 201 0 obj <> endobj 206 0 obj <> endobj 211 0 obj <> endobj 216 0 obj <> endobj 221 0 obj <> endobj 226 0 obj <> endobj 231 0 obj <> endobj 232 0 obj <> endobj 234 0 obj <>stream /P <>BDC q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS2 gs BT /TT2 1 Tf 7 0 0 7 490.9954 20.9379 Tm 0 0 0 1 k 0 Tc 0 Tw (ISACA )Tj ET EMC /P <>BDC BT 7 0 0 7 512.4738 20.9379 Tm (JOURNAL)Tj ET EMC /P <>BDC /GS1 gs BT 7 0 0 7 543.321 20.9379 Tm .761 .549 .11 0 k [( V)6.3(OL 3)]TJ ET EMC /Artifact <>BDC 0 0 0 1 k /GS2 gs 572.364 .014984 .51599 31.274 re f EMC /P <>BDC /GS1 gs BT 7 0 0 7 587.3169 20.9379 Tm .761 .549 .11 0 k (3)Tj ET EMC /P <>BDC /GS2 gs BT 7 0 0 7 36.9471 21.3673 Tm 0 0 0 1 k [( 2021 ISACA. All rights reser)-8.8(ved. )]TJ ET EMC /P <>BDC BT /TT4 1 Tf 7 0 0 7 144.579 21.3673 Tm [(www)60.5(.isaca.org)]TJ ET EMC /LBody <>BDC BT /TT2 1 Tf 9 0 0 9 47.016 663.4303 Tm -.005 Tc [(continuity assur)19.5(ance are less than the expected)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 234.7676 663.4303 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 651.4303 Tm -.005 Tc [(losses and within management)54.7(s risk t)9.8(oler)19.5(ance)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 231.6187 651.4303 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 633.4542 Tm -.005 Tc (The business priorities are addressed \(i.e.,)Tj ET EMC /LBody <>BDC BT 9 0 0 9 213.523 633.4542 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 36 633.4542 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 47.016 621.4542 Tm 0 0 0 1 k -.005 Tc [(critical applications, interim pr)9.8(ocesses,)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 200.3603 621.4542 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 609.4542 Tm -.005 Tc [(rest)9.8(or)19.5(ation activities, mandated deadlines\))]TJ ET EMC /LBody <>BDC BT 9 0 0 9 214.9568 609.4542 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 591.4783 Tm -.005 Tc [(Manual inter)-7.3(faces t)9.8(o)0( aut)9.8(omated pr)9.8(ocesses are)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 231.4573 591.4783 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 36 591.4783 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 47.016 579.4783 Tm 0 0 0 1 k -.005 Tc (identi)Tj /TT11 1 Tf 2.4275 0 TD 0 Tc ()Tj /TT2 1 Tf .5487 0 TD -.005 Tc [(ed, personnel are tr)19.5(ained and pr)19.5(actice)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 221.8365 579.4783 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 567.4783 Tm -.005 Tc (drills are conducted)Tj ET EMC /LBody <>BDC BT 9 0 0 9 124.9366 567.4783 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 549.5023 Tm -.005 Tc (Expectations are managed with realistic goals)Tj ET EMC /LBody <>BDC BT 9 0 0 9 228.481 549.5023 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 36 549.5023 Tm .49 .04 0 .05 k ()Tj ET EMC /P <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 36 525.5023 Tm 0 0 0 1 k -.005 Tc [(Why is the difference between cyberresilience, BCP)158.2(,)]TJ ET EMC /P <>BDC BT 9 0 0 9 237.6208 525.5023 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 513.5023 Tm -.005 Tc [(IT)19.5( continuity planning and incident response)]TJ ET EMC /P <>BDC BT 9 0 0 9 210.048 513.5023 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 501.5023 Tm -.005 Tc [(planning impor)-24.4(tant? )]TJ ET EMC /P <>BDC BT 9 0 0 9 117.3264 501.5023 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 483.5262 Tm -.005 Tc (There is currently an emergence of)Tj ET EMC /LBody <>BDC BT 9 0 0 9 184.0901 483.5262 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 36 483.5262 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 47.016 471.5262 Tm 0 0 0 1 k -.005 Tc (cyberresilience, which is seen as a discipline that)Tj ET EMC /LBody <>BDC BT 9 0 0 9 239.7864 471.5262 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 459.5262 Tm -.005 Tc (can be impacted and in)Tj /TT1 1 Tf 10.2123 0 TD 0 Tc <0001>Tj /TT2 1 Tf .5629 0 TD -.005 Tc (uenced by related)Tj ET EMC /LBody <>BDC BT 9 0 0 9 213.9183 459.5262 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 447.5262 Tm -.005 Tc [(pr)9.8(ogr)19.5(ams. )19.5(These related pr)9.8(ogr)19.5(ams include)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 214.3184 447.5262 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 435.5262 Tm -.005 Tc [(cybersecurity, IT)19.5( disaster reco)7.3(very, BCP)158.2(,)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 202.2937 435.5262 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 423.5262 Tm -.005 Tc (crisis/incident management, and third- and)Tj ET EMC /LBody <>BDC BT 9 0 0 9 216.2981 423.5262 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 411.5262 Tm -.005 Tc [(four)-24.4(th-par)-24.4(ty risk management.)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 167.2643 411.5262 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 393.5503 Tm -.005 Tc [(Cyberresilience goes beyond the typical pre)6.3(vent,)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 236.5287 393.5503 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 36 393.5503 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 47.016 381.5503 Tm 0 0 0 1 k -.005 Tc (detect and respond models found in)Tj ET EMC /LBody <>BDC BT 9 0 0 9 189.5436 381.5503 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 369.5503 Tm -.005 Tc [(cybersecurity and requires an oper)19.5(ational)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 209.7689 369.5503 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 357.5503 Tm -.005 Tc [(resilience pr)9.8(ogr)19.5(am t)9.8(o)0( ensure that critical)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 206.0501 357.5503 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 345.5503 Tm -.005 Tc [(business pr)9.8(ocesses can reco)7.3(ver fr)9.8(om)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 194.9524 345.5503 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 333.5503 Tm -.005 Tc [(cyber)19.5(attacks with minimal disruptions and within)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 240.0223 333.5503 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 321.5502 Tm -.005 Tc [(prescribed reco)7.3(very time objectives.)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 189.2911 321.5502 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 303.5742 Tm -.005 Tc [(Cyberresilience requires enterprises t)9.8(o)0( consider)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 234.8191 303.5742 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 36 303.5742 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 47.016 291.5742 Tm 0 0 0 1 k -.005 Tc (threats and risk that may impact their enterprise)Tj ET EMC /LBody <>BDC BT 9 0 0 9 236.475 291.5742 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 47.016 279.5742 Tm -.005 Tc [(risk fr)19.5(amework and the fr)19.5(ameworks of their third-)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 47.016 267.5742 Tm [(par)-24.4(ty suppliers and vendors.)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 158.6652 267.5742 Tm 0 Tc ( )Tj ET EMC /P <>BDC /GS1 gs BT /TT6 1 Tf 11 0 0 11 36 241.5742 Tm .8 .871 .22 0 k -.005 Tc [(Why Is NIST)29.3( Guidance Impor)-24.4(tant?)]TJ ET EMC /P <>BDC BT 11 0 0 11 200.5202 241.5742 Tm 0 Tc ( )Tj ET EMC /P <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 36 223.5742 Tm 0 0 0 1 k -.005 Tc [(NIST)19.5( expanded its guidance t)9.8(o)0( ensure that)]TJ ET EMC /P <>BDC BT 9 0 0 9 203.2221 223.5742 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 211.5742 Tm -.005 Tc [(organizations goals, str)19.5(ategies and systems)]TJ ET EMC /P <>BDC BT 9 0 0 9 211.3005 211.5742 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36 199.5742 Tm -.005 Tc [(incorpor)19.5(ate cyberresilience analysis and appr)9.8(oach.)]TJ ET EMC /P <>BDC BT 9 0 0 9 236.0268 199.5742 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 254.5 663.4303 Tm -.005 Tc [(NIST)19.5( suggests that the objectives of cyberresilience)]TJ ET EMC /P <>BDC BT 9 0 0 9 459.0246 663.4303 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 254.5 651.4303 Tm -.005 Tc [(are pre)6.3(vent or a)7.3(v)7.3(oid, prepare, continue, and)]TJ ET EMC /P <>BDC BT 9 0 0 9 423.6175 651.4303 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 254.5 639.4303 Tm -.005 Tc [(constr)19.5(ain \()]TJ ET EMC /P <>BDC BT /TT14 1 Tf 9 0 0 9 296.6146 639.4303 Tm 0 Tc ()Tj /TT6 1 Tf .6034 0 TD -.005 Tc (gure 1)Tj ET EMC /P <>BDC BT /TT2 1 Tf 9 0 0 9 327.5009 639.4303 Tm (\).)Tj ET EMC /P <>BDC BT 5.4 0 0 5.4 332.9085 643.2052 Tm 0 Tc (7)Tj ET EMC /P <>BDC BT 5.4 0 0 5.4 335.8957 643.2052 Tm ( )Tj ET EMC /P <>BDC BT 9 0 0 9 254.5 627.4303 Tm -.005 Tc [(These objectives co)7.3(ver se)6.3(ver)19.5(al areas, including:)]TJ ET EMC /P <>BDC BT 9 0 0 9 441.5386 627.4303 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 265.5159 609.4542 Tm .49 .04 0 .05 k -.005 Tc [(A)23.4(nalytic monit)14.6(oring)]TJ ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 343.7893 609.4542 Tm 0 0 0 1 k [(Monit)9.8(or and analyze a wide)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 458.7353 609.4542 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 254.5 609.4542 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 265.5159 597.4542 Tm 0 0 0 1 k -.005 Tc [(r)19.5(ange of pr)9.8(oper)-24.4(ties and beha)7.3(viors on an ongoing)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 456.9019 597.4542 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 265.5159 585.4542 Tm -.005 Tc (basis and in a coordinated way.)Tj ET EMC /LBody <>BDC BT 9 0 0 9 389.8666 585.4542 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 265.5159 567.4783 Tm .49 .04 0 .05 k -.005 Tc (Contextual awareness)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 354.2208 567.4783 Tm 0 0 0 1 k (Construct and maintain)Tj ET EMC /LBody <>BDC BT 9 0 0 9 453.72 567.4783 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 254.5 567.4783 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 265.5159 555.4783 Tm 0 0 0 1 k -.005 Tc (current representations of the posture of)Tj ET EMC /LBody <>BDC BT 9 0 0 9 425.7157 555.4783 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 265.5159 543.4783 Tm -.005 Tc (missions or business functions considering)Tj ET EMC /LBody <>BDC BT 9 0 0 9 437.1931 543.4783 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 265.5159 531.4783 Tm -.005 Tc [(threat e)6.3(vents and courses of action.)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 407.2594 531.4783 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 265.5159 513.5023 Tm .49 .04 0 .05 k -.005 Tc [(Coordinated pr)17.6(otection)]TJ ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 357.853 513.5023 Tm 0 0 0 1 k [(Ensure that pr)9.8(otection)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 452.3116 513.5023 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 254.5 513.5023 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 265.5159 501.5023 Tm 0 0 0 1 k -.005 Tc [(mechanisms oper)19.5(ate in a coordinated and)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 431.7734 501.5023 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 265.5159 489.5023 Tm -.005 Tc [(effective manner)60.1(.)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 334.0839 489.5023 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 265.5159 471.5262 Tm .49 .04 0 .05 k -.005 Tc (Deception)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 306.0067 471.5262 Tm 0 0 0 1 k (Mislead, confuse, hide critical assets)Tj ET EMC /LBody <>BDC BT 9 0 0 9 457.9993 471.5262 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 254.5 471.5262 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 265.5159 459.5262 Tm 0 0 0 1 k -.005 Tc [(fr)9.8(om or expose co)7.3(ver)-24.4(tly tainted assets t)9.8(o)0( the)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 441.6857 459.5262 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 265.5159 447.5262 Tm -.005 Tc (adversary.)Tj ET EMC /LBody <>BDC BT 9 0 0 9 306.4187 447.5262 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 265.5159 429.5503 Tm .49 .04 0 .05 k -.005 Tc (Diversity)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 300.6147 429.5503 Tm 0 0 0 1 k [(Use heter)9.8(ogeneity t)9.8(o)0( minimize)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 427.1855 429.5503 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 254.5 429.5503 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 265.5159 417.5503 Tm 0 0 0 1 k -.005 Tc [(common mode failures, par)-24.4(ticularly threat e)6.3(vents)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 459.1552 417.5503 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 265.5159 405.5503 Tm -.005 Tc [(exploiting common vulner)19.5(abilities.)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 400.5861 405.5503 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 265.5159 387.5742 Tm .49 .04 0 .05 k -.005 Tc (Dynamic positioning)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 347.2962 387.5742 Tm 0 0 0 1 k (Distribute and dynamically)Tj ET EMC /LBody <>BDC BT 9 0 0 9 458.6167 387.5742 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 254.5 387.5742 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 265.5159 375.5742 Tm 0 0 0 1 k -.005 Tc [(relocate functionality or system resour)9.3(ces.)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 433.6985 375.5742 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 265.5159 357.5983 Tm .49 .04 0 .05 k -.005 Tc (Nonpersistence)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 328.7299 357.5983 Tm 0 0 0 1 k [(Gener)19.5(ate and retain resour)9.3(ces)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 454.5626 357.5983 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 254.5 357.5983 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 265.5159 345.5983 Tm 0 0 0 1 k -.005 Tc (as needed or for a limited time.)Tj ET EMC /LBody <>BDC BT 9 0 0 9 388.1517 345.5983 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 265.5159 327.6223 Tm .49 .04 0 .05 k -.005 Tc (Privilege restriction)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 344.2091 327.6223 Tm 0 0 0 1 k (Restrict privileges based)Tj ET EMC /LBody <>BDC BT 9 0 0 9 447.9546 327.6223 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 254.5 327.6223 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 265.5159 315.6223 Tm 0 0 0 1 k -.005 Tc (on attributes of users and system elements as)Tj ET EMC /LBody <>BDC BT 9 0 0 9 448.3961 315.6223 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 265.5159 303.6223 Tm -.005 Tc [(well as on envir)9.8(onmental fact)9.8(ors.)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 396.2235 303.6223 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 265.5159 285.6461 Tm .49 .04 0 .05 k -.005 Tc (Realignment)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 316.1428 285.6461 Tm 0 0 0 1 k [(Align system resour)9.3(ces with)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 434.4585 285.6461 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 254.5 285.6461 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 265.5159 273.6461 Tm 0 0 0 1 k -.005 Tc (current organizational mission or business)Tj ET EMC /LBody <>BDC BT 9 0 0 9 433.572 273.6461 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 265.5159 261.6461 Tm -.005 Tc [(function needs t)9.8(o)0( reduce risk.)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 382.397 261.6461 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 265.5159 243.6702 Tm .49 .04 0 .05 k -.005 Tc (Redundancy)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 314.9705 243.6702 Tm 0 0 0 1 k [(Pr)9.8(o)7.3(vide multiple pr)9.8(otected)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 425.8297 243.6702 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 254.5 243.6702 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 265.5159 231.6702 Tm 0 0 0 1 k -.005 Tc [(instances of critical resour)9.3(ces.)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 386.5828 231.6702 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 265.5159 213.6943 Tm .49 .04 0 .05 k -.02 Tc (Segmentation)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 320.0106 213.6943 Tm 0 0 0 1 k (De)Tj /TT11 1 Tf 1.9063 0 TD 0 Tc ()Tj /TT2 1 Tf .5337 0 TD -.02 Tc [(ne and separ)19.5(ate system)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 433.3287 213.6943 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 254.5 213.6943 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 265.5159 201.6943 Tm 0 0 0 1 k -.02 Tc [(elements based on criticality and trustwor)-24.4(thiness.)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 455.4355 201.6943 Tm 0 Tc ( )Tj ET EMC /Figure <>BDC Q .76471 .54118 .098039 .007843 k /GS1 gs 36.015 165.426 422.585 18.479 re f q 1 i 36.015 183.905 422.585 -123.53 re W n .78824 .85098 .17255 .043137 k 36 165.426 78.1 -17.431 re 114.1 165.426 344.5 -17.431 re f .16863 .031373 .023529 0 k 36 147.996 78.1 -17.431 re 114.1 147.996 344.5 -17.431 re 36 113.134 78.1 -17.431 re 114.1 113.134 344.5 -17.431 re f .082353 .011765 .007843 0 k 36 130.565 78.1 -17.431 re 114.1 130.565 344.5 -17.431 re 36 95.704 78.1 -17.431 re 114.1 95.704 344.5 -17.431 re f 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d q 1 0 0 1 36 165.427 cm 0 0 m 78.1 0 l S 1 0 0 1 78.1 0 cm 0 0 m 344.5 0 l S Q 1 w q 1 0 0 1 36 147.996 cm 0 0 m 422.6 0 l S 1 0 0 1 0 -17.431 cm 0 0 m 422.6 0 l S 1 0 0 1 0 -17.431 cm 0 0 m 422.6 0 l S 1 0 0 1 0 -17.431 cm 0 0 m 422.6 0 l S 1 0 0 1 0 -17.431 cm 0 0 m 78.1 0 l S 1 0 0 1 78.1 0 cm 0 0 m 344.5 0 l S Q Q 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d 1 i q 1 0 0 1 114.1 148.496 cm 0 0 m 0 15.931 l S 1 0 0 1 0 -17.431 cm 0 0 m 0 16.431 l S 1 0 0 1 0 -17.431 cm 0 0 m 0 16.431 l S 1 0 0 1 0 -17.431 cm 0 0 m 0 16.431 l S 1 0 0 1 0 -17.431 cm 0 0 m 0 16.431 l S Q BT /F2 1 Tf 10 0 0 10 176.609 169.426 Tm 0 0 0 0 k -.015 Tc .022 Tw (Figure 1Cyberresiliency Objectives)Tj 9 0 0 9 58.4468 151.9953 Tm -.0099 Tc 0 Tw [(Objective)-19396.6(D)-1.3(escription)]TJ ET /GS2 gs BT /F3 1 Tf 9 0 0 9 39.9971 134.5622 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [(Pre)5.9(vent or a)7.1(v)7.5(oid)-2452.8(Preclude the successful execution of an attack or the realization of adverse conditions.)]TJ 0 -1.937 TD [(Prepare)-5675.6(Maintain a set of realistic courses of action that address predicted or anticipated adversity.)]TJ T* [(Continue)-5240.2(Maximize the dur)19.7(a).3(tion and viability of essential mission or business functions during adversity.)]TJ T* [(Constr)19.7(ain)-4981.2(Limit damage fr)9.8(om adversity.)]TJ 6 0 0 6 40 67.9855 Tm [(Sour)9.1(ce: National Institute of Standards and )19.9(Technology \(NIST\), SP 800-160 v)8.3(o)-.6(l. 2, )]TJ /F4 1 Tf 31.6273 0 TD -.0092 Tc -.0011 Tw [(De)6.3(veloping Cyber Resilient Systems: A Systems Security Engineering Appr)10.6(oach)]TJ /F3 1 Tf 29.6402 0 TD -.0096 Tc .0006 Tw [(, USA, No)8.2(vember)-10.5( )]TJ -61.2675 -1 TD -.0091 Tc 0 Tw (2019, )Tj /F4 1 Tf 2.34 0 TD [(https:/)109.1(/)-.2(csr)10.5(c).5(.nist.go)7.3(v/publications/detail/sp/800-160/v)8.5(ol-2/final)]TJ ET EMC endstream endobj 235 0 obj <>/ExtGState<>>> endobj 258 0 obj <> endobj 263 0 obj <> endobj 270 0 obj <> endobj 276 0 obj <>stream /P <>BDC q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS2 gs BT /TT2 1 Tf 7 0 0 7 39.4019 20.9698 Tm 0 0 0 1 k 0 Tc 0 Tw (ISACA )Tj ET EMC /P <>BDC BT 7 0 0 7 60.8804 20.9698 Tm (JOURNAL)Tj ET EMC /P <>BDC /GS1 gs BT 7 0 0 7 91.7275 20.9698 Tm .761 .549 .11 0 k [( V)6.3(OL 3)]TJ ET EMC /Artifact <>BDC 0 0 0 1 k /GS2 gs 30.069 .014984 .51505 31.516 re f EMC /P <>BDC /GS1 gs BT 7 0 0 7 12.8637 20.9698 Tm .761 .549 .11 0 k (4)Tj ET EMC /P <>BDC /GS2 gs BT 7 0 0 7 415.3383 21.3673 Tm 0 0 0 1 k [( 2021 ISACA. All rights reser)-8.8(ved. )]TJ ET EMC /P <>BDC BT /TT4 1 Tf 7 0 0 7 522.9701 21.3673 Tm [(www)60.5(.isaca.org)]TJ ET EMC /LBody <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 153.5589 293.6066 Tm .49 .04 0 .05 k -.005 Tc (Substantiated integrity)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 244.8622 293.6066 Tm 0 0 0 1 k [(Ascer)-24.4(tain whether)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 323.7473 293.6066 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 142.5429 293.6066 Tm .49 .04 0 .05 k ()Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 153.5589 281.6066 Tm 0 0 0 1 k -.005 Tc [(critical system elements ha)7.3(ve been corrupted.)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 335.1515 281.6066 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 153.5589 263.6306 Tm .49 .04 0 .05 k -.005 Tc (Unpredictability)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 216.8191 263.6306 Tm 0 0 0 1 k [(Make changes r)19.5(andomly.)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 322.9759 263.6306 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT8 1 Tf 12 0 0 12 142.5429 263.6306 Tm .49 .04 0 .05 k ()Tj ET EMC /P <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 142.5429 245.6306 Tm 0 0 0 1 k -.02 Tc (The two cyberresilience techniques that only address)Tj ET EMC /P <>BDC BT 9 0 0 9 344.9609 245.6306 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 142.5429 233.6306 Tm -.02 Tc (adversarial threats are deception and unpredictability.)Tj ET EMC /P <>BDC BT 9 0 0 9 346.9654 233.6306 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 142.5429 221.6306 Tm -.02 Tc (Cyberresilience techniques are also interdependent.)Tj ET EMC /P <>BDC BT 9 0 0 9 339.6961 221.6306 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 142.5429 209.6306 Tm -.02 Tc [(F)10.2(or example, the analytic monit)9.8(oring technique)]TJ ET EMC /P <>BDC BT 9 0 0 9 320.7151 209.6306 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 142.5429 197.6306 Tm -.02 Tc [(suppor)-24.4(ts contextual awareness. Howe)6.3(ver)60.1(, the)]TJ ET EMC /P <>BDC BT 9 0 0 9 316.1926 197.6306 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 142.5429 185.6306 Tm -.02 Tc [(unpredictability technique is different fr)9.8(om the other)]TJ ET EMC /P <>BDC BT 9 0 0 9 340.391 185.6306 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 142.5429 173.6306 Tm -.02 Tc (techniques in that it is always applied in conjunction)Tj ET EMC /P <>BDC BT 9 0 0 9 340.3031 173.6306 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 142.5429 161.6306 Tm -.02 Tc (with some other technique, for example, working with)Tj ET EMC /P <>BDC BT 9 0 0 9 345.6641 161.6306 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 142.5429 149.6306 Tm -.02 Tc (the dynamic positioning technique.)Tj ET EMC /P <>BDC BT 9 0 0 9 275.9193 149.6306 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT /TT6 1 Tf 9 0 0 9 142.5429 125.6306 Tm -.005 Tc (Figure 2)Tj ET EMC /P <>BDC BT /TT2 1 Tf 9 0 0 9 175.2255 125.6306 Tm [( illustr)19.5(ates samples of metrics or key)]TJ ET EMC /P <>BDC BT 9 0 0 9 320.3594 125.6306 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 142.5429 113.6306 Tm -.005 Tc [(per)-7.3(formance indicat)9.8(ors \(KPIs\) that can be used t)9.8(o)]TJ ET EMC /P <>BDC BT 9 0 0 9 339.2484 113.6306 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 142.5429 101.6306 Tm -.005 Tc [(measure the o)7.3(ver)19.5(all objectives of cyberreslience. In)]TJ ET EMC /P <>BDC BT 9 0 0 9 344.141 101.6306 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 142.5429 89.6306 Tm -.005 Tc (fact, each of the main cyberresiliency objectives)Tj ET EMC /P <>BDC BT 9 0 0 9 331.5757 89.6306 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 360.0429 293.6066 Tm -.005 Tc [(can be decomposed int)9.8(o sub-objectives t)9.8(o)0( )]TJ ET EMC /P <>BDC BT 9 0 0 9 529.1547 293.6066 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 360.0429 281.6066 Tm -.005 Tc [(facilitate measurement, management, tr)19.5(acking )]TJ ET EMC /P <>BDC BT 9 0 0 9 546.0211 281.6066 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 360.0429 269.6066 Tm -.005 Tc (and prioritization.)Tj ET EMC /P <>BDC BT 9 0 0 9 429.0656 269.6066 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 360.0429 245.6066 Tm -.005 Tc [(The use of NIST)19.5( 800-160 objectives requires an)]TJ ET EMC /P <>BDC BT 9 0 0 9 546.587 245.6066 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 360.0429 233.6066 Tm -.005 Tc [(organization t)9.8(o)0( be pr)9.8(oactive in its cyberresiliency)]TJ ET EMC /P <>BDC BT 9 0 0 9 552.2244 233.6066 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 360.0429 221.6066 Tm -.005 Tc [(appr)9.8(oach and pr)9.8(ocess. )19.5(The NIST)19.5( appr)9.8(oach expands)]TJ ET EMC /P <>BDC BT 9 0 0 9 563.9708 221.6066 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 360.0429 209.6066 Tm -.005 Tc [(and matures the str)19.5(ategies identi)]TJ /TT11 1 Tf 14.4425 0 TD 0 Tc ()Tj /TT2 1 Tf .5487 0 TD -.005 Tc [(ed by \(ISC)12.7(\))]TJ ET EMC /P <>BDC BT 5.4 0 0 5.4 537.8121 212.5767 Tm 0 Tc (2)Tj ET EMC /P <>BDC BT 9 0 0 9 540.7994 209.6066 Tm -.005 Tc ( as)Tj ET EMC /P <>BDC BT 9 0 0 9 552.4287 209.6066 Tm 0 Tc ( )Tj ET EMC /Figure <>BDC Q q 1 i 33.912 630.16 532.5 -308.686 re W n 33.912 630.16 532.5 -308.701 re W n 33.912 630.16 532 -308.701 re 554.657 209.607 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n .76471 .54118 .098039 .007843 k /GS1 gs 33.912 611.681 532 18.479 re f Q q 1 i 33.912 630.16 532.5 -308.701 re W n 33.912 630.16 532 -308.701 re 554.657 209.607 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n .78824 .85098 .17255 .043137 k /GS1 gs 33.912 611.681 111.1 -17.431 re 145.012 611.681 159.6 -17.431 re 304.612 611.681 261.3 -17.431 re f .16863 .031373 .023529 0 k 33.912 594.251 111.1 -87.431 re 145.012 594.251 159.6 -87.431 re 304.612 594.251 261.3 -87.431 re 33.912 409.389 111.1 -87.431 re 145.012 409.389 159.6 -87.431 re 304.612 409.389 261.3 -87.431 re f .082353 .011765 .007843 0 k 33.912 506.82 111.1 -97.431 re 145.012 506.82 159.6 -97.431 re 304.612 506.82 261.3 -97.431 re f Q q 1 i 33.912 630.16 532.5 -308.686 re W n 33.912 630.16 532.5 -308.701 re W n 33.912 630.16 532 -308.701 re 554.657 209.607 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d /GS1 gs q 1 0 0 1 33.912 611.681 cm 0 0 m 111.1 0 l S Q Q q 1 i 33.912 630.16 532.5 -308.701 re W n 33.912 630.16 532 -308.701 re 554.657 209.607 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d /GS1 gs q 1 0 0 1 145.012 611.681 cm 0 0 m 159.6 0 l S 1 0 0 1 159.6 0 cm 0 0 m 261.3 0 l S Q 1 w q 1 0 0 1 145.012 409.89 cm 0 0 m 0 96.431 l S 1 0 0 1 159.6 0 cm 0 0 m 0 96.431 l S 1 0 0 1 -159.6 184.861 cm 0 0 m 0 15.931 l S 1 0 0 1 159.6 0 cm 0 0 m 0 15.931 l S Q Q q 1 i 33.912 630.16 532.5 -308.686 re W n 33.912 630.16 532.5 -308.701 re W n 33.912 630.16 532 -308.701 re 554.657 209.607 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 33.912 594.251 cm 0 0 m 111.1 0 l S Q Q q 1 i 33.912 630.16 532.5 -308.701 re W n 33.912 630.16 532 -308.701 re 554.657 209.607 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 145.012 594.251 cm 0 0 m 159.6 0 l S Q Q q 1 i 33.912 630.16 532.5 -308.686 re W n 33.912 630.16 532.5 -308.701 re W n 33.912 630.16 532 -308.701 re 554.657 209.607 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 304.612 594.251 cm 0 0 m 261.8 0 l S Q Q q 1 i 33.912 630.16 532.5 -308.701 re W n 33.912 630.16 532 -308.701 re 554.657 209.607 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 145.012 507.32 cm 0 0 m 0 86.431 l S 1 0 0 1 159.6 0 cm 0 0 m 0 86.431 l S Q Q q 1 i 33.912 630.16 532.5 -308.686 re W n 33.912 630.16 532.5 -308.701 re W n 33.912 630.16 532 -308.701 re 554.657 209.607 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 565.912 507.32 cm 0 0 m 0 86.431 l S 1 0 0 1 -532 -.5 cm 0 0 m 111.1 0 l S Q Q q 1 i 33.912 630.16 532.5 -308.701 re W n 33.912 630.16 532 -308.701 re 554.657 209.607 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 145.012 506.82 cm 0 0 m 159.6 0 l S Q Q q 1 i 33.912 630.16 532.5 -308.686 re W n 33.912 630.16 532.5 -308.701 re W n 33.912 630.16 532 -308.701 re 554.657 209.607 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 304.612 506.82 cm 0 0 m 261.8 0 l S 1 0 0 1 -270.7 -97.43 cm 0 0 m 111.1 0 l S Q Q q 1 i 33.912 630.16 532.5 -308.701 re W n 33.912 630.16 532 -308.701 re 554.657 209.607 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 145.012 409.39 cm 0 0 m 159.6 0 l S Q Q q 1 i 33.912 630.16 532.5 -308.686 re W n 33.912 630.16 532.5 -308.701 re W n 33.912 630.16 532 -308.701 re 554.657 209.607 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 304.612 409.39 cm 0 0 m 261.8 0 l S Q Q q 1 i 33.912 630.16 532.5 -308.701 re W n 33.912 630.16 532 -308.701 re 554.657 209.607 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 145.012 322.459 cm 0 0 m 0 86.431 l S 1 0 0 1 159.6 0 cm 0 0 m 0 86.431 l S Q Q q 1 i 33.912 630.16 532.5 -308.686 re W n 33.912 630.16 532.5 -308.701 re W n 33.912 630.16 532 -308.701 re 554.657 209.607 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 565.912 322.459 cm 0 0 m 0 86.431 l S 1 0 0 1 -532 -.5 cm 0 0 m 111.1 0 l S Q Q q 1 i 33.912 630.16 532.5 -308.701 re W n 33.912 630.16 532 -308.701 re 554.657 209.607 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 145.012 321.959 cm 0 0 m 159.6 0 l S Q Q q 1 i 33.912 630.16 532.5 -308.686 re W n 33.912 630.16 532.5 -308.701 re W n 33.912 630.16 532 -308.701 re 554.657 209.607 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 304.612 321.959 cm 0 0 m 261.8 0 l S Q Q q 1 i 33.912 630.16 532.5 -308.701 re W n 33.912 630.16 532 -308.701 re 554.657 209.607 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS1 gs BT /F2 1 Tf 10 0 0 10 220.0678 615.6815 Tm 0 0 0 0 k -.015 Tc .022 Tw (Figure 2Cyberresiliency Sub-Objectives)Tj 9 0 0 9 72.8586 598.2508 Tm -.0099 Tc -.0001 Tw [(Objective)-7154.6(R)-.8(epresentative Sub-Objectives)-10295.7(Representative Examples of Metrics)]TJ ET /GS2 gs BT 9 0 0 9 37.9117 580.8177 Tm 0 0 0 1 k 0 Tw [(Pre)6.9(v).2(ent or A)24.5(v)7.2(oid)]TJ /F3 1 Tf 0 -1.111 TD -.0095 Tc .0005 Tw [(Preclude the successful)-9( )]TJ T* .0004 Tw [(execution of an attack or)-9.3( )]TJ T* -.0093 Tc -.0008 Tw [(the realization of adverse)-10( )]TJ T* 0 Tw (conditions.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 149.0078 580.8171 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 153.4178 580.8171 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Apply basic pr)9.5(otection measures and)-9.7( )]TJ .219 -1.111 TD -.0007 Tw [(contr)9.7(ols tailored t)9.2(o).1( the risks of the)-10( )]TJ T* -.0097 Tc 0 Tw (system-of-interest.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 149.0078 550.8202 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 153.4178 550.8202 Tm 0 0 0 1 k -.0096 Tc -.0005 Tw [( )219.4(Limit exposure t)8.8(o)-.4( threat e)5.7(v)-.9(ents.)-9.7( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 149.0078 540.8211 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 153.4178 540.8211 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.5(Decrease the adversary)54.3(s)-.1( per)9.4(c)-.1(eived)-9.8( )]TJ .219 -1.111 TD 0 Tw (benefits.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 149.0078 520.823 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 153.4178 520.823 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.9(Modify configur)19.6(ations based on threat)-9.8( )]TJ .219 -1.111 TD 0 Tw (intelligence.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 308.6048 580.826 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 313.0148 580.826 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )20.5( )219.5(Time t)9.3(o)0( patch or t)9.3(o)-.1( apply configur)19.7(ation changes.)-9.2( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 308.6048 570.827 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 313.0148 570.827 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.9(Per)9.7(c).1(entage of resour)9.7(ces for which configur)19.6(ation changes are made)-10( )]TJ .219 -1.111 TD [(r)19.5(a).1(ndomly. Per)9.6(c)-.1(entage of resour)9.5(ces for which lifespan limits are)-10( )]TJ T* -.0098 Tc 0 Tw (applied.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 308.6048 540.8299 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 313.0148 540.8299 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.9(Per)9.7(c).1(entage of sensitive data assets that are encrypted. Adversary)-9.1( )]TJ .219 -1.111 TD [(dwell time in a deception envir)9.8(o).5(nment.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 308.6048 520.832 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 313.0148 520.832 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Per)9.6(c)0(entage of resour)9.6(ces t)9.1(o)0( which more restrictive privileges are)-10.1( )]TJ .219 -1.111 TD [(applied aut)9.3(o)0(matically in response t)9(o).1( threat indicat)9.2(o).5(rs.)]TJ /F2 1 Tf -30.787 -1.937 TD -.0099 Tc 0 Tw (Prepare)Tj /F3 1 Tf 0 -1.111 TD -.0092 Tc .0002 Tw [(Maintain a set of realistic)-8.7( )]TJ T* -.0095 Tc -.0006 Tw [(courses of action that)-9.9( )]TJ T* -.0096 Tc -.0005 Tw [(address predicted or)-10( )]TJ T* -.0098 Tc -.0003 Tw (anticipated adversity.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 148.9988 493.4 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 153.4088 493.4 Tm 0 0 0 1 k -.0095 Tc -.0006 Tw [( )219.4(Create and maintain cyber courses of)-10.1( )]TJ .219 -1.111 TD -.0091 Tc 0 Tw [(action.)-8.8( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 148.9988 473.402 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 153.4088 473.402 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Maintain the resour)9.7(ces needed t)9.2(o).1( execute)-10( )]TJ .219 -1.111 TD [(cyber courses of action.)-9.4( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 148.9988 453.404 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 153.4088 453.404 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(V)23.1(a).1(lidate the realism of cyber courses of)-10( )]TJ .219 -1.111 TD [(action using testing or exer)9.5(cises.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 308.5958 493.409 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 313.0058 493.409 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Number of cyber courses of action \(CCoAs\) in the cyber playbook.)-9.3( )]TJ .219 -1.111 TD [(Per)9.8(c).2(entage of identified threat types, categories of threat actions, or)-9.4( )]TJ T* [(T)-6.5(T)1.7(Ps \(with reference t)9.3(o).1( an identified threat model\) addressed by at)-9.9( )]TJ T* (least one CCoA in the cyber playbook.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 308.5958 453.413 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 313.0058 453.413 Tm 0 0 0 1 k -.0244 Tc -.0002 Tw [( )-14.3( )204.7(Per)8.9(c)-.6(entage of cyber resour)8.9(ces which are backed up. )19.7(Time since)-24.4( )]TJ .219 -1.111 TD -.0001 Tw [(last exer)8.6(cise of alternative communications paths. Per)8.7(c)-.3(entage of)-24.6( )]TJ T* -.0246 Tc 0 Tw [(administr)18.7(a)-.5(tive staff who ha)7.5(ve been tr)18.8(ained in their CCoA responsibilities.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 308.5958 423.416 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 313.0058 423.416 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )20.7( )219.7(Time since last \(r)19.7(andom, scheduled\) exer)9.7(cise or simulation of one or)-9.4( )]TJ .199 -1.111 TD -.0007 Tw (more CCoAs.)Tj /F2 1 Tf -30.767 -1.937 TD -.0098 Tc 0 Tw (Continue)Tj /F3 1 Tf 3.512 0 TD 0 Tc ( )Tj -3.512 -1.111 TD -.0093 Tc .0003 Tw [(Maximize the dur)19.6(a).2(tion and)-9.6( )]TJ T* [(viability of essential mission)-9.1( )]TJ T* [(or business functions during)-8.8( )]TJ T* -.0098 Tc 0 Tw (adversity.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 148.9898 395.984 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 153.3998 395.984 Tm 0 0 0 1 k -.0093 Tc -.0008 Tw [( )219.4(Minimize degr)19.8(adation of ser)-8.2(vice delivery.)-9.2( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 148.9898 385.985 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 153.3998 385.985 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.6(Minimize interruptions in ser)-8.3(vice delivery.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 148.9898 375.986 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 153.3998 375.986 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Ensure that ongoing functioning is)-9.1( )]TJ .219 -1.111 TD -.0096 Tc 0 Tw [(correct.)-9.6( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 308.5868 395.984 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 312.9968 395.984 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )20.5( )219.5(Time t)9.1(o)0( per)-7.5(f)0(orm mission or business function damage assessment.)-9.3( )]TJ .199 -1.111 TD [(Length of time per)-7.4(f)0(ormance of specified mission or business function)-9.1( )]TJ T* [(remained below acceptable le)6.1(vels.)-9.2( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 308.5868 365.987 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 312.9968 365.987 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )20.8( )219.8(Time fr)9.6(om initial disruption t)9.3(o).2( a)7.3(v)7.6(ailability \(at minimum le)6.1(vel of)-9.8( )]TJ .199 -1.111 TD (acceptability\) of essential functions.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 308.5868 345.989 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 312.9968 345.989 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.8(Per)9.6(c).1(entage of essential data assets for which data quality has been)-9( )]TJ .219 -1.111 TD [(v)7.6(a)-.9(lidated. Per)9.6(c).1(entage of essential pr)9.6(ocessing ser)-8.3(v)-.5(ices for which)-9( )]TJ T* [(correctness of functioning has been v)7.6(a)-.8(lidated.)]TJ ET EMC /Artifact <>BDC Q q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n .761 .549 .11 0 k /GS1 gs 363.012 76.515 203.988 123.793 re f EMC /P <>BDC BT /TT13 1 Tf 47 0 0 47 371.3309 157.2365 Tm .49 .04 0 .05 k 0 Tc 0 Tw ()Tj ET EMC /P <>BDC BT /TT2 1 Tf 14 0 0 14 385.2382 177.2368 Tm 0 0 0 0 k [( )19.5(THE ORGANIZ)-6.3(A)63(TION MUST)]TJ ET EMC /P <>BDC BT 14 0 0 14 558.5292 177.2368 Tm ( )Tj ET EMC /P <>BDC BT 14 0 0 14 371.3309 159.2368 Tm [(DEVEL)31.7(OP AN INVENT)13.7(OR)23.4(Y OF)]TJ ET EMC /P <>BDC BT 14 0 0 14 552.8729 159.2368 Tm ( )Tj ET EMC /P <>BDC BT 14 0 0 14 371.3309 141.2368 Tm (USE CASES FOR)Tj ET EMC /P <>BDC BT 14 0 0 14 472.4003 141.2368 Tm ( )Tj ET EMC /P <>BDC BT 14 0 0 14 371.3309 123.2368 Tm -.0195 Tw [(CYBERRESILIENCE TH)-8.8(A)63(T)19.5( )-19.5(IS)]TJ ET EMC /P <>BDC BT 14 0 0 14 542.7421 123.2368 Tm 0 Tw ( )Tj ET EMC /P <>BDC BT 14 0 0 14 371.3309 105.2368 Tm -.0195 Tw [(APPLIED T)13.7(O)0( )-19.5(BUSINESS)]TJ ET EMC /P <>BDC BT 14 0 0 14 515.5077 105.2368 Tm 0 Tw ( )Tj ET EMC /P <>BDC BT 14 0 0 14 371.3309 87.2368 Tm (PROCESSES )Tj ET EMC /P <>BDC BT /TT13 1 Tf 47 0 0 47 451.8172 67.2365 Tm .49 .04 0 .05 k ()Tj ET EMC Q endstream endobj 277 0 obj <>/ExtGState<>>> endobj 298 0 obj <> endobj 300 0 obj <>stream /P <>BDC q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS2 gs BT /TT2 1 Tf 7 0 0 7 490.9954 20.9379 Tm 0 0 0 1 k 0 Tc 0 Tw (ISACA )Tj ET EMC /P <>BDC BT 7 0 0 7 512.4738 20.9379 Tm (JOURNAL)Tj ET EMC /P <>BDC /GS1 gs BT 7 0 0 7 543.321 20.9379 Tm .761 .549 .11 0 k [( V)6.3(OL 3)]TJ ET EMC /Artifact <>BDC 0 0 0 1 k /GS2 gs 572.364 .014984 .51599 31.274 re f EMC /P <>BDC /GS1 gs BT 7 0 0 7 587.3827 20.9379 Tm .761 .549 .11 0 k (5)Tj ET EMC /P <>BDC /GS2 gs BT 7 0 0 7 36.9471 21.3673 Tm 0 0 0 1 k [( 2021 ISACA. All rights reser)-8.8(ved. )]TJ ET EMC /P <>BDC BT /TT4 1 Tf 7 0 0 7 144.579 21.3673 Tm [(www)60.5(.isaca.org)]TJ ET EMC /P <>BDC BT /TT2 1 Tf 9 0 0 9 35.543 203.5272 Tm -.005 Tc [(par)-24.4(t of the Cybersecurity W)15.1(orkfor)9.3(ce Study, which)]TJ ET EMC /P <>BDC BT 9 0 0 9 227.5121 203.5272 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 35.543 191.5272 Tm -.005 Tc [(studied the cybersecurity workfor)9.3(ce, gap estimates)]TJ ET EMC /P <>BDC BT 9 0 0 9 236.7123 191.5272 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 35.543 179.5272 Tm -.005 Tc [(and insights int)9.8(o methods for building a resilient)]TJ ET EMC /P <>BDC BT 9 0 0 9 225.4579 179.5272 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 35.543 167.5272 Tm -.005 Tc (team now and in the future.)Tj ET EMC /P <>BDC BT 5.4 0 0 5.4 143.7433 171.3023 Tm 0 Tc (8)Tj ET EMC /P <>BDC BT 5.4 0 0 5.4 146.7307 171.3023 Tm ( )Tj ET EMC /P <>BDC /GS1 gs BT /TT6 1 Tf 11 0 0 11 35.543 141.5273 Tm .8 .871 .22 0 k -.005 Tc [(The Impact of NIST)29.3( 800-160 on )]TJ ET EMC /P <>BDC BT 11 0 0 11 192.3998 141.5273 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 11 0 0 11 35.543 127.5272 Tm -.005 Tc (an Enterprise)Tj ET EMC /P <>BDC BT 11 0 0 11 100.3717 127.5272 Tm 0 Tc ( )Tj ET EMC /P <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 35.543 109.5272 Tm 0 0 0 1 k -.005 Tc [(When considering the t)9.8(opic of cyberresilience in)]TJ ET EMC /P <>BDC BT 9 0 0 9 224.2031 109.5272 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 35.543 97.5272 Tm -.005 Tc [(relation t)9.8(o)0( NIST)19.5( 800-160, the question t)9.8(o)0( answer is)]TJ ET EMC /P <>BDC BT 9 0 0 9 234.4041 97.5272 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 35.543 85.5272 Tm -.005 Tc (what are the key components, objectives and)Tj ET EMC /P <>BDC BT 9 0 0 9 213.0945 85.5272 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 35.543 73.5272 Tm -.005 Tc [(means t)9.8(o)0( implement the guidance. How does this)]TJ ET EMC /P <>BDC BT 9 0 0 9 231.1441 73.5272 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 253.043 203.5272 Tm -.005 Tc [(layer ont)9.8(o the cyberstr)19.5(ategies of information)]TJ ET EMC /P <>BDC BT 9 0 0 9 428.3029 203.5272 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 253.043 191.5272 Tm -.005 Tc [(security and the enterprise in gener)19.5(al? NIST)19.5( 800-)]TJ ET EMC /P <>BDC BT 9 0 0 9 253.043 179.5272 Tm [(160 pr)9.8(o)7.3(vides an appr)9.8(oach thr)9.8(ough the use of)]TJ ET EMC /P <>BDC BT 9 0 0 9 429.7243 179.5272 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 253.043 167.5272 Tm -.005 Tc (cyberresiliency constructs \()Tj ET EMC /P <>BDC BT /TT14 1 Tf 9 0 0 9 361.5456 167.5272 Tm 0 Tc ()Tj /TT6 1 Tf .6034 0 TD -.005 Tc (gure 3)Tj ET EMC /P <>BDC BT /TT2 1 Tf 9 0 0 9 392.4319 167.5272 Tm (\). Speci)Tj /TT11 1 Tf 3.2686 0 TD 0 Tc ()Tj /TT2 1 Tf .5487 0 TD -.005 Tc (cally,)Tj ET EMC /P <>BDC BT 9 0 0 9 446.5173 167.5272 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 253.043 155.5272 Tm -.005 Tc (enterprises can optionally select and implement the)Tj ET EMC /P <>BDC BT 9 0 0 9 456.6808 155.5272 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 253.043 143.5272 Tm -.005 Tc [(cyberresilience objectives, metrics and appr)9.8(oaches)]TJ ET EMC /P <>BDC BT 9 0 0 9 454.3969 143.5272 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 253.043 131.5273 Tm -.005 Tc [(on a phased appr)9.8(oach as they meet the enterprise)39.1()54.7(s)]TJ ET EMC /P <>BDC BT 9 0 0 9 455.9041 131.5273 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 253.043 119.5273 Tm -.005 Tc (needs and risk assessment.)Tj ET EMC /P <>BDC BT 9 0 0 9 363.3011 119.5273 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 253.043 95.5273 Tm -.005 Tc [(NIST)19.5( pr)9.8(o)7.3(vides examples of cyberresilient)]TJ ET EMC /P <>BDC BT 9 0 0 9 414.0786 95.5273 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 253.043 83.5273 Tm -.005 Tc [(appr)9.8(oaches as illustr)19.5(ated in )]TJ ET EMC /P <>BDC BT /TT14 1 Tf 9 0 0 9 364.0363 83.5273 Tm 0 Tc ()Tj /TT6 1 Tf .6034 0 TD -.005 Tc (gure 4)Tj ET EMC /P <>BDC BT /TT2 1 Tf 9 0 0 9 394.9226 83.5273 Tm 0 Tc (.)Tj ET EMC /P <>BDC BT 5.4 0 0 5.4 397.2462 87.3022 Tm (9)Tj ET EMC /P <>BDC BT 5.4 0 0 5.4 400.2335 87.3022 Tm ( )Tj ET EMC /Figure <>BDC Q q 1 i 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n .76471 .54118 .098039 .007843 k /GS1 gs 35.581 671.133 532 18.479 re f .78824 .85098 .17255 .043137 k 35.581 671.133 111.1 -17.431 re 146.681 671.133 159.6 -17.431 re 306.281 671.133 261.3 -17.431 re f .16863 .031373 .023529 0 k 35.581 653.703 111.1 -137.431 re 146.681 653.703 159.6 -137.431 re 306.281 653.703 261.3 -137.431 re 35.581 408.841 111.1 -87.431 re 146.681 408.841 159.6 -87.431 re 306.281 408.841 261.3 -87.431 re f .082353 .011765 .007843 0 k 35.581 516.272 111.1 -107.431 re 146.681 516.272 159.6 -107.431 re 306.281 516.272 261.3 -107.431 re 35.581 321.411 111.1 -77.431 re 146.681 321.411 159.6 -77.431 re 306.281 321.411 261.3 -77.431 re f Q q 1 i 35.581 689.612 532.5 -463.53 re W n 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d /GS1 gs q 1 0 0 1 35.581 671.134 cm 0 0 m 111.1 0 l S Q Q q 1 i 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d /GS1 gs q 1 0 0 1 146.681 671.134 cm 0 0 m 159.6 0 l S 1 0 0 1 159.6 0 cm 0 0 m 261.3 0 l S Q 1 w q 1 0 0 1 146.681 409.341 cm 0 0 m 0 106.432 l S 1 0 0 1 159.6 0 cm 0 0 m 0 106.432 l S 1 0 0 1 -159.6 -164.861 cm 0 0 m 0 76.431 l S 1 0 0 1 159.6 0 cm 0 0 m 0 76.431 l S Q Q q 1 i 35.581 689.612 532.5 -463.53 re W n 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 35.581 243.98 cm 0 0 m 111.1 0 l S Q Q q 1 i 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 146.681 243.98 cm 0 0 m 420.9 0 l S 1 0 0 1 0 410.223 cm 0 0 m 0 15.931 l S 1 0 0 1 159.6 0 cm 0 0 m 0 15.931 l S Q Q q 1 i 35.581 689.612 532.5 -463.53 re W n 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 35.581 653.703 cm 0 0 m 111.1 0 l S Q Q q 1 i 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 146.681 653.703 cm 0 0 m 159.6 0 l S Q Q q 1 i 35.581 689.612 532.5 -463.53 re W n 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 306.281 653.703 cm 0 0 m 261.8 0 l S Q Q q 1 i 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 146.681 516.772 cm 0 0 m 0 136.431 l S 1 0 0 1 159.6 0 cm 0 0 m 0 136.431 l S Q Q q 1 i 35.581 689.612 532.5 -463.53 re W n 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 567.581 516.772 cm 0 0 m 0 136.431 l S 1 0 0 1 -532 -.5 cm 0 0 m 111.1 0 l S Q Q q 1 i 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 146.681 516.272 cm 0 0 m 159.6 0 l S Q Q q 1 i 35.581 689.612 532.5 -463.53 re W n 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 306.281 516.272 cm 0 0 m 261.8 0 l S 1 0 0 1 -270.7 -107.431 cm 0 0 m 111.1 0 l S Q Q q 1 i 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 146.681 408.841 cm 0 0 m 159.6 0 l S Q Q q 1 i 35.581 689.612 532.5 -463.53 re W n 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 306.281 408.841 cm 0 0 m 261.8 0 l S Q Q q 1 i 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 146.681 321.911 cm 0 0 m 0 86.431 l S 1 0 0 1 159.6 0 cm 0 0 m 0 86.431 l S Q Q q 1 i 35.581 689.612 532.5 -463.53 re W n 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 567.581 321.911 cm 0 0 m 0 86.431 l S 1 0 0 1 -532 -.5 cm 0 0 m 111.1 0 l S Q Q q 1 i 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 146.681 321.411 cm 0 0 m 159.6 0 l S Q Q q 1 i 35.581 689.612 532.5 -463.53 re W n 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 306.281 321.411 cm 0 0 m 261.8 0 l S Q Q q 1 i 35.581 689.612 532.5 -463.545 re W n 35.581 689.612 532 -463.545 re 401.57 87.302 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS1 gs BT /F2 1 Tf 10 0 0 10 207.8433 675.1339 Tm 0 0 0 0 k -.015 Tc .022 Tw (Figure 2Cyberresiliency Sub-Objectives)Tj /F6 1 Tf 15.9525 0 TD [( \(cont.\))]TJ /F2 1 Tf 9 0 0 9 74.5281 657.7031 Tm -.0099 Tc -.0001 Tw [(Objective)-7154.6(R)-.8(epresentative Sub-Objectives)-10295.7(Representative Examples of Metrics)]TJ ET /GS2 gs BT 9 0 0 9 39.5813 640.27 Tm 0 0 0 1 k 0 Tw (Reconstitute)Tj /F3 1 Tf 0 -1.111 TD -.0095 Tc -.0006 Tw [(Rest)9.1(ore as much mission)-9.2( )]TJ T* -.0093 Tc .0003 Tw [(or business functionality as)-9( )]TJ T* [(possible after adversity.)-9.3( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 150.6773 640.27 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 155.0873 640.27 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.5(Identify untrustwor)-23.4(thy resour)9.6(ces and)-9.6( )]TJ .219 -1.111 TD -.0097 Tc 0 Tw (damage.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 150.6773 620.272 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 155.0873 620.272 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.5(Rest)9.2(ore functionality.)-9.3( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 150.6773 610.2729 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 155.0873 610.2729 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Heighten pr)9.7(otections during)-8.8( )]TJ .219 -1.111 TD 0 Tw (reconstitution.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 150.6773 590.275 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 155.0873 590.275 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.8(Determine the trustwor)-23.5(thiness of rest)9.2(ored)-9.7( )]TJ .219 -1.111 TD -.0006 Tw [(or reconstructed resour)9.3(ces.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 310.2743 640.2788 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 314.6843 640.2788 Tm 0 0 0 1 k -.0095 Tc .0005 Tw [( )20.6( )219.6(Time t)9(o)-.3( identify una)8(v)7.4(ailable resour)9.2(ces and represent damage in status)-9.3( )]TJ .199 -1.111 TD -.0092 Tc 0 Tw (visualization.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 310.2743 620.2808 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 314.6843 620.2808 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )20.9( )219.9(Time between initiation of reco)8.1(very pr)9.6(ocedures and completion of)-9.9( )]TJ .199 -1.111 TD -.0006 Tw [(documented milest)9(ones in the reco)7.9(very, contingency or continuity)-9.3( )]TJ T* .0004 Tw [(of oper)19.6(ations plan. Per)9.6(c).4(entage of cyber resour)9.6(ces for which access)-9.2( )]TJ T* [(contr)9.7(ol is maintained thr)9.7(o)0(ughout the reco)8(very pr)9.5(ocess.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 310.2743 580.2844 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 314.6843 580.2844 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.5(Per)9.7(c).1(entage of cyber resour)9.6(ces for which additional auditing or)-9.5( )]TJ .219 -1.111 TD -.0096 Tc .0006 Tw [(monit)8.8(oring is applied during and after the reco)7.6(very pr)9.2(ocess. )19.6(Time t)8.9(o)-9.4( )]TJ T* -.0094 Tc .0004 Tw [(bring online a backup network intrusion detection system. Per)9.5(c).4(entage)-10( )]TJ T* [(of reconstituted cyber resour)9.5(ces which are placed in a restricted)-9.7( )]TJ 0 -1.1109 TD [(encla)7.1(v)-.5(e for a period after reconstitution.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 310.2743 530.2903 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 314.6843 530.2903 Tm 0 0 0 1 k -.0245 Tc -.0001 Tw [( )204.3(Per)8.8(c)-.7(entage of rest)9.6(ored or reconstructed \(mission-critical, security-critical,)-24.4( )]TJ .2039 -1.111 TD [(suppor)-25.1(t).5(ing\) data assets for which data integrity/quality is checked.)]TJ /F2 1 Tf -30.7719 -1.9371 TD -.0099 Tc 0 Tw (Understand)Tj /F3 1 Tf 0 -1.111 TD -.0093 Tc .0003 Tw [(Maintain useful)-9.8( )]TJ T* -.0096 Tc -.0005 Tw [(representations of mission)-9.5( )]TJ T* -.0095 Tc -.0006 Tw [(and business dependencies)-9.4( )]TJ T* [(and the status of resour)9.3(ces)-9.4( )]TJ T* -.0097 Tc -.0004 Tw [(with respect t)8.7(o)-.5( possible)-10.5( )]TJ T* 0 Tw (adversity.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 150.6683 502.8664 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 155.0783 502.8664 Tm 0 0 0 1 k -.0096 Tc -.0005 Tw [( )219(Understand adversaries.)-9.7( )9( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 150.6683 492.8674 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 155.0783 492.8674 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Understand dependencies on and among)-8.8( )]TJ .219 -1.111 TD .0005 Tw [(systems containing cyber resour)9.3(ces.)-9.6( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 150.6683 472.8694 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 155.0783 472.8694 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.5(Understand the status of resour)9.5(ces with)-9.2( )]TJ .219 -1.111 TD -.0006 Tw [(respect t)8.9(o)-.2( threat e)5.8(v)-.8(ents)-9.4( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 150.6683 452.8714 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 155.0783 452.8714 Tm 0 0 0 1 k -.0095 Tc -.0006 Tw [( )219.4(Understand the effectiveness of security)-9.4( )]TJ .219 -1.111 TD .0005 Tw [(contr)9.5(ols and contr)9.5(ols suppor)-23.5(t)-.1(ing cyber)-9.6( )]TJ T* -.0093 Tc 0 Tw (resiliency.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 310.2653 502.8754 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 314.6753 502.8754 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )20.6( )219.6(Time between receipt of threat intelligence and determination of its)-9( )]TJ .199 -1.111 TD [(rele)6.2(v)7.6(ance. Adversary dwell time in deception envir)9.8(o)0(nment.)-9.1( )9.9( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 310.2653 482.8773 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 314.6753 482.8773 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )20.5( )219.5(Time since most recent refresh of mission dependency or functional)-9.9( )]TJ .199 -1.111 TD .0005 Tw [(dependency map. )19.9(Time since last cyber table-t)8.9(op exer)9.4(cise, Red )19.8(Team)-9.8( )]TJ T* .0004 Tw [(exer)9.6(cise, or execution of contr)9.6(olled aut)9.3(o).1(mated disruption.)-9.3( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 310.2653 452.8804 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 314.6753 452.8804 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.5(Per)9.6(c)0(entage of system elements for which failure or indication of)-10( )]TJ .219 -1.111 TD [(potential faults can be detected. Per)9.6(c)0(entage of cyber resour)9.6(ces)-9.2( )]TJ T* 0 Tw [(monit)9.1(ored.)-9.4( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 310.2653 422.8833 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 314.6753 422.8833 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.8(Number of attempted intrusions st)9.1(opped at a network perimeter)60.6(.)-9.4( )]TJ .219 -1.1111 TD [(A)24.4(v)-.4(er)19.8(age length of time t)9.4(o).2( reco)8.2(ver fr)9.7(om incidents.)]TJ /F2 1 Tf -30.787 -1.9369 TD -.0098 Tc 0 Tw [(T)31(r)14.5(ansform)]TJ /F3 1 Tf 4.064 0 TD 0 Tc ( )Tj -4.064 -1.111 TD -.0095 Tc .0005 Tw [(Modify mission or business)-9.4( )]TJ T* [(functions and suppor)-23.5(t)-.1(ing)-8.9( )]TJ T* -.0102 Tc -.0021 Tw [(pr)8.3(ocesses t)7.9(o)-1.2( handle adversity)-9.3( )]TJ T* -.0095 Tc .0005 Tw [(and address envir)9.3(o).3(nmental)-9( )]TJ T* -.0093 Tc .0003 Tw (changes more effectively.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 150.6593 395.4604 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 155.0693 395.4604 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Redefine mission/business pr)9.5(ocess)-9.2( )]TJ .219 -1.111 TD [(threads for agility.)-9.2( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 150.6593 375.4624 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 155.0693 375.4624 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.8(Redefine mission/business functions t)9.2(o)-9( )]TJ .219 -1.111 TD (mitigate risks.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 310.2563 395.4604 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 314.6663 395.4604 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Per)9.5(c)0(entage of mission or business pr)9.5(ocess threads which ha)7.2(ve been)-9.1( )]TJ .219 -1.111 TD [(analyzed with respect t)9.3(o).1( common dependencies and potential single)-9.9( )]TJ T* [(points of failure. Per)9.6(c)0(entage of mission or business pr)9.5(ocess threads)-9.2( )]TJ T* (for which alternative courses of action are documented.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 310.2563 355.4644 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 314.6663 355.4644 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Per)9.6(c).1(entage of essential functions for which no dependencies on)-9.1( )]TJ .219 -1.111 TD [(resour)9.6(ces shared with non-essential functions can be identified.)-9.2( )]TJ T* [(Per)9.6(c).1(entage of pr)9.6(oblematic data feeds t)9.3(o).1( which risk mitigations ha)7.2(ve)-10( )]TJ T* (been applied since last analysis.)Tj /F2 1 Tf -30.787 -1.9369 TD -.0097 Tc 0 Tw [(Re-Ar)9.9(c).3(hitect)-10.3( )]TJ /F3 1 Tf 0 -1.111 TD -.0004 Tw [(Modify ar)9.1(chitectures t)8.7(o)-9.5( )]TJ T* .0006 Tw [(handle adversity and address)-9.6( )]TJ T* -.0094 Tc .0004 Tw [(envir)9.5(o).4(nmental changes more)-10.1( )]TJ T* -.0092 Tc 0 Tw (effectively.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 150.6503 308.0344 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 155.0603 308.0344 Tm 0 0 0 1 k -.0095 Tc -.0006 Tw [( )219.4(Restructure systems or sub-systems t)8.9(o)-9.3( )]TJ .219 -1.111 TD (reduce risks.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 150.6503 288.0363 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 155.0603 288.0363 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.5(Modify systems or sub-systems t)9(o)-.1( reduce)-10.1( )]TJ .219 -1.111 TD 0 Tw [(risks.)-9.3( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 310.2473 308.0344 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 314.6573 308.0344 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.9(Size of the \(hardware, software, supply chain, user)60.7(, privileged)-9.6( )]TJ .219 -1.111 TD [(user\) attack sur)-7.5(f).1(ace. Per)9.6(c)0(entage of system components for which)-9.2( )]TJ T* [(pr)9.6(o)7.9(v)-.6(enance can be determined. Per)9.4(c).4(entage of system components)-9.1( )]TJ T* (which can be selectively isolated.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 310.2473 268.0384 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 314.6573 268.0384 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Per)9.5(c)0(entage of cyber resour)9.4(ces for which cust)9.2(om analytics ha)7.1(ve been)-9.2( )]TJ .219 -1.111 TD [(de)6.1(veloped. Per)9.6(c).1(entage of mission-critical components for which one or)-9.3( )]TJ T* [(more cust)9.2(om-built alternatives are implemented.)]TJ 6 0 0 6 39.5813 233.6934 Tm [(Sour)9.1(ce: National Institute of Standards and )19.9(Technology \(NIST\), SP 800-160 v)8.2(o)-.6(l. 2, )]TJ /F4 1 Tf 31.6273 0 TD -.0092 Tc -.0011 Tw [(De)6.3(veloping Cyber Resilient Systems: A Systems Security Engineering Appr)10.6(oach)]TJ /F3 1 Tf 29.6402 0 TD -.0094 Tc .0004 Tw [(, USA, No)8.5(vember 2019,)-10( )17.8( )]TJ /F4 1 Tf -61.2675 -1 TD -.0092 Tc 0 Tw [(https:/)109.1(/)-.2(csr)10.6(c).5(.nist.go)7.3(v/publications/detail/sp/800-160/v)8.5(ol-2/final)]TJ ET EMC Q endstream endobj 301 0 obj <>/ExtGState<>>> endobj 316 0 obj <> endobj 318 0 obj <> endobj 320 0 obj <>stream /P <>BDC q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS2 gs BT /TT2 1 Tf 7 0 0 7 39.4019 20.9698 Tm 0 0 0 1 k 0 Tc 0 Tw (ISACA )Tj ET EMC /P <>BDC BT 7 0 0 7 60.8804 20.9698 Tm (JOURNAL)Tj ET EMC /P <>BDC /GS1 gs BT 7 0 0 7 91.7275 20.9698 Tm .761 .549 .11 0 k [( V)6.3(OL 3)]TJ ET EMC /Artifact <>BDC 0 0 0 1 k /GS2 gs 30.069 .014984 .51505 31.516 re f EMC /P <>BDC /GS1 gs BT 7 0 0 7 12.8637 20.9698 Tm .761 .549 .11 0 k (6)Tj ET EMC /P <>BDC /GS2 gs BT 7 0 0 7 415.3383 21.3673 Tm 0 0 0 1 k [( 2021 ISACA. All rights reser)-8.8(ved. )]TJ ET EMC /P <>BDC BT /TT4 1 Tf 7 0 0 7 522.9701 21.3673 Tm [(www)60.5(.isaca.org)]TJ ET EMC /Figure <>BDC Q q 1 i 142.692 658.462 423.5 -323.545 re W n 144.812 658.462 420.879 -323.545 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n .76471 .54118 .098039 .007843 k /GS1 gs 144.81 639.983 420.882 18.479 re f .78824 .85098 .17255 .043137 k 143.692 639.983 42.9 -17.431 re 186.592 639.983 379.1 -17.431 re f .15686 .1098 .031373 0 k 143.692 622.553 42.9 -47.431 re 143.692 575.122 42.9 -222.292 re f .16863 .031373 .023529 0 k 186.592 622.553 379.1 -47.431 re 186.592 575.122 379.1 -77.43 re 246.592 497.691 319.1 -67.431 re 292.992 430.261 272.7 -77.432 re f .082353 .011765 .007843 0 k 186.592 352.829 60 144.862 re f .42353 .066667 .035294 0 k 246.592 352.829 46.4 77.432 re f Q q 1 i 142.707 658.462 423.485 -323.545 re W n 142.692 658.462 423.5 -323.545 re W n 144.812 658.462 420.879 -323.545 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d /GS1 gs q 1 0 0 1 143.692 640.983 cm 0 0 m 0 17.479 l S 1 0 0 1 -1 -1 cm 0 0 m 43.9 0 l S Q Q q 1 i 142.692 658.462 423.5 -323.545 re W n 144.812 658.462 420.879 -323.545 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d /GS1 gs q 1 0 0 1 186.592 639.983 cm 0 0 m 106.4 0 l S 1 0 0 1 106.4 0 cm 0 0 m 272.7 0 l S Q 1 w q 1 0 0 1 143.692 622.553 cm 0 0 m 42.9 0 l S 1 0 0 1 42.9 .5 cm 0 0 m 0 15.931 l S 1 0 0 1 0 -192.792 cm 0 0 m 0 66.93 l S 1 0 0 1 0 -77.431 cm 0 0 m 0 77.431 l S 1 0 0 1 60 77.931 cm 0 0 m 0 66.43 l S 1 0 0 1 0 -77.931 cm 0 0 m 0 76.931 l S 1 0 0 1 -102.9 222.292 cm 0 0 m 42.9 0 l S 1 0 0 1 102.4 -144.861 cm 0 0 m 46.9 0 l S 1 0 0 1 -59.5 192.292 cm 0 0 m 60 0 l S 1 0 0 1 60 0 cm 0 0 m 46.4 0 l S Q Q q 1 i 142.707 658.462 423.485 -323.545 re W n 142.692 658.462 423.5 -323.545 re W n 144.812 658.462 420.879 -323.545 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 292.992 622.553 cm 0 0 m 273.2 0 l S Q Q q 1 i 142.692 658.462 423.5 -323.545 re W n 144.812 658.462 420.879 -323.545 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 565.692 575.622 cm 0 0 m 0 46.431 l S 1 0 0 1 0 -77.431 cm 0 0 m 0 76.431 l S 1 0 0 1 -379.1 76.931 cm 0 0 m 60 0 l S 1 0 0 1 60 0 cm 0 0 m 46.4 0 l S Q Q q 1 i 142.707 658.462 423.485 -323.545 re W n 142.692 658.462 423.5 -323.545 re W n 144.812 658.462 420.879 -323.545 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 292.992 575.122 cm 0 0 m 273.2 0 l S Q Q q 1 i 142.692 658.462 423.5 -323.545 re W n 144.812 658.462 420.879 -323.545 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 186.092 497.691 cm 0 0 m 60.5 0 l S 1 0 0 1 60.5 0 cm 0 0 m 46.4 0 l S Q Q q 1 i 142.707 658.462 423.485 -323.545 re W n 142.692 658.462 423.5 -323.545 re W n 144.812 658.462 420.879 -323.545 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 292.992 497.691 cm 0 0 m 273.2 0 l S 1 0 0 1 0 -67.43 cm 0 0 m 273.2 0 l S Q Q q 1 i 142.692 658.462 423.5 -323.545 re W n 144.812 658.462 420.879 -323.545 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 565.692 353.33 cm 0 0 m 0 76.431 l S Q Q q 1 i 142.707 658.462 423.485 -323.545 re W n 142.692 658.462 423.5 -323.545 re W n 144.812 658.462 420.879 -323.545 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 292.992 352.83 cm 0 0 m 273.2 0 l S Q Q q 1 i 142.692 658.462 423.5 -323.545 re W n 144.812 658.462 420.879 -323.545 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS1 gs BT /F2 1 Tf 10 0 0 10 283.288 643.9835 Tm 0 0 0 0 k -.015 Tc .022 Tw (Figure 3Cyberresiliency Constructs)Tj 9 0 0 9 147.8976 626.5528 Tm -.0098 Tc -.0002 Tw [(Construct)-10551.4(D)-1(efinition, Purpose, and Application at the System Le)7(vel)]TJ ET /GS2 gs BT 9 0 0 9 147.6905 609.1197 Tm 0 0 0 1 k -.0095 Tc 0 Tw [(Goal)-2999(Definition:)]TJ /F3 1 Tf 8.8475 0 TD .0004 Tw [( A high-le)6(vel statement suppor)-23.5(t).2(ing \(or focusing on\) each aspect \(i.e., anticipate, withstand,)-9.9( )]TJ -4.0805 -1.111 TD -.0093 Tc [(reco)8(ver)60.6(,)0( adapt\) in the definition of cyberresiliency.)]TJ /F2 1 Tf T* -.0099 Tc 0 Tw (Purpose:)Tj /F3 1 Tf 3.512 0 TD -.0093 Tc .0003 Tw ( Align the definition of cyberresiliency with definitions of other types of resilience.)Tj /F2 1 Tf -3.512 -1.111 TD -.0096 Tc 0 Tw (Application:)Tj /F3 1 Tf 4.725 0 TD -.0093 Tc .0003 Tw [( Can be used t)9.2(o).1( express high-le)6.1(vel stakeholder concerns, goals or priorities.)]TJ /F2 1 Tf -9.492 -1.937 TD -.0244 Tc 0 Tw [(O)-14.4(b)-14(j)-14.6(e)-13.8(c)-15.5(t)-14.3(i)-15.6(v)-14.5(e)-1098.3(D).1(efinition:)]TJ /F3 1 Tf 8.683 0 TD -.0246 Tc [( A high-le)6.2(vel statement \(designed t)9.4(o)-.9( be restated in system-specific and stakeholder-specific terms\))-24.9( )]TJ -3.916 -1.1109 TD [(of what a system must achie)6.3(ve in its oper)18.7(ational envir)8.7(o)-.8(nment and thr)8.7(o)-.9(ughout its life cycle t)9.5(o)-.9( meet stakeholder)-25.2( )]TJ 0 -1.1111 TD -.0001 Tw [(needs for mission assur)18.7(ance and resilient security; the objectives are more specific than goals and more)-24.6( )]TJ T* -.0248 Tc .0002 Tw [(relatable t)9.1(o)-1.3( threats.)-24.5( )]TJ /F2 1 Tf T* 0 Tw (Purpose:)Tj /F3 1 Tf 3.392 0 TD .0001 Tw [( Enable stakeholders and systems engineers t)9.3(o)-1( reach a common understanding of cyber resiliency)-24( )]TJ -3.392 -1.111 TD [(concerns and priorities; facilitate definition of metrics or measures of effectiveness \(MOEs\).)-25.3( )]TJ /F2 1 Tf T* -.0245 Tc 0 Tw (Application:)Tj /F3 1 Tf 4.545 0 TD -.0247 Tc .0001 Tw ( Used in scoring methods or summaries of analyses \(e.g., cyberresiliency posture assessments\).)Tj /F2 1 Tf -4.545 -1.9369 TD -.0098 Tc 0 Tw [(Sub-Objective)-1132.7(D)-1.1(efinition:)]TJ /F3 1 Tf 10.7475 0 TD -.0093 Tc .0003 Tw [( A statement, subsidiary t)9.2(o).1( a cyberresiliency objective, which emphasizes)-9( )]TJ -4.0806 -1.111 TD [(different aspects of that objective or identifies methods t)9.2(o).1( achie)6.1(v)-.5(e that objective.)-9.3( )]TJ /F2 1 Tf T* -.0099 Tc 0 Tw (Purpose:)Tj /F3 1 Tf 3.5121 0 TD -.0093 Tc .0003 Tw [( Ser)-8.3(ve as a step in the hier)19.7(ar)9.7(chical refinement of an objective int)9.3(o).1( activities or)-9.4( )]TJ -3.5121 -1.111 TD [(capabilities for which per)-7.4(f)0(ormance measures can be defined.)]TJ /F2 1 Tf T* -.0095 Tc 0 Tw (Application:)Tj /F3 1 Tf 4.7251 0 TD -.0093 Tc .0003 Tw [( Used in scoring methods or analyses; may be reflected in system functional)-9.8( )]TJ -4.7251 -1.111 TD -.0095 Tc 0 Tw (requirements.)Tj /F2 1 Tf 0 -1.937 TD -.0006 Tw [(Activity or)-8.6( )]TJ 0 -1.111 TD -.0097 Tc 0 Tw (Capability)Tj 5.1561 1.111 TD -.0095 Tc (Definition:)Tj /F3 1 Tf 4.0804 0 TD -.0006 Tw [( A statement of a capability or action which suppor)-23.6(t)-.1(s the)-10( )]TJ -4.0804 -1.111 TD .0004 Tw [(achie)6(v)-.4(ement of a sub-objective and, hence, of an objective.)-9.2( )]TJ /F2 1 Tf T* -.0099 Tc 0 Tw (Purpose:)Tj /F3 1 Tf 3.512 0 TD -.0093 Tc .0003 Tw [( F)15.6(a)-.7(cilitate the definition of metrics or MOEs. While a representative)-9.9( )]TJ -3.512 -1.1111 TD -.0103 Tc -.0031 Tw [(set of activities or capabilities ha)6.9(ve been identified in [Bodeau18b], these are)-10.3( )]TJ T* -.0093 Tc .0003 Tw [(intended solely as a star)-23.2(ting point for selection, tailoring, and prioritization.)]TJ /F2 1 Tf T* -.0095 Tc 0 Tw (Application:)Tj /F3 1 Tf 4.7249 0 TD -.0093 Tc .0003 Tw [( Used in scoring methods or analyses; reflected in system)-9.3( )]TJ -4.7249 -1.111 TD -.0007 Tw (functional requirements.)Tj 6 0 0 6 147.692 342.543 Tm .0003 Tw [(Sour)9(ce: National Institute of Standards and )19.9(Technology \(NIST\), SP 800-160 v)8.1(o)-1(l. 2, )]TJ /F4 1 Tf 31.6273 0 TD -.0011 Tw [(De)6.3(veloping Cyber Resilient Systems: A Systems Security Engineering Appr)10.6(oac)]TJ /F3 1 Tf 29.1772 0 TD -.0095 Tc .0005 Tw [(h, USA, No)8.1(vember)-10.4( )]TJ -60.8045 -1 TD -.0091 Tc 0 Tw (2019, )Tj /F4 1 Tf 2.34 0 TD [(https:/)109.1(/)-.2(csr)10.5(c).5(.nist.go)7.3(v/publications/detail/sp/800-160/v)8.5(ol-2/final)]TJ ET EMC /Figure <>BDC Q q 1 i 31.417 309.823 533.485 -208.701 re W n 31.402 309.823 533.5 -208.701 re W n 31.402 309.823 533 -208.701 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n .2 .13725 .035294 0 k /GS1 gs 31.417 101.122 532.985 208.701 re f .76471 .54118 .098039 .007843 k 31.417 294.323 532.985 15.5 re f .78824 .85098 .17255 .043137 k 31.402 294.323 109.9 -17.431 re 141.302 294.323 156.1 -17.431 re 297.402 294.323 267 -17.431 re f .15686 .1098 .031373 0 k 31.417 104.6 109.885 172.292 re f Q q 1 i 31.402 309.823 533.5 -208.701 re W n 31.402 309.823 533 -208.701 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n .082353 .011765 .007843 0 k /GS1 gs 141.302 276.892 156.1 -57.431 re 141.302 219.462 156.1 -57.431 re 141.302 162.031 156.1 -57.431 re f .16863 .031373 .023529 0 k 297.402 276.892 267 -57.431 re 297.402 219.462 267 -57.431 re 297.402 162.031 267 -57.431 re f Q q 1 i 31.417 309.823 533.485 -208.701 re W n 31.402 309.823 533.5 -208.701 re W n 31.402 309.823 533 -208.701 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d /GS1 gs q 1 0 0 1 31.402 294.323 cm 0 0 m 109.9 0 l S Q Q q 1 i 31.402 309.823 533.5 -208.701 re W n 31.402 309.823 533 -208.701 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d /GS1 gs q 1 0 0 1 141.302 294.323 cm 0 0 m 156.1 0 l S 1 0 0 1 156.1 0 cm 0 0 m 267 0 l S Q 1 w q 1 0 0 1 141.302 219.962 cm 0 0 m 0 56.431 l S 1 0 0 1 0 -57.431 cm 0 0 m 0 56.431 l S 1 0 0 1 0 -57.931 cm 0 0 m 0 56.931 l S Q Q q 1 i 31.417 309.823 533.485 -208.701 re W n 31.402 309.823 533.5 -208.701 re W n 31.402 309.823 533 -208.701 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 297.402 276.892 cm 0 0 m 267.5 0 l S 1 0 0 1 267 -56.931 cm 0 0 m 0 56.431 l S 1 0 0 1 0 -57.431 cm 0 0 m 0 56.431 l S Q Q q 1 i 31.402 309.823 533.5 -208.701 re W n 31.402 309.823 533 -208.701 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 140.802 219.462 cm 0 0 m 156.6 0 l S Q Q q 1 i 31.417 309.823 533.485 -208.701 re W n 31.402 309.823 533.5 -208.701 re W n 31.402 309.823 533 -208.701 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 564.402 105.1 cm 0 0 m 0 56.431 l S 1 0 0 1 -267 114.362 cm 0 0 m 267.5 0 l S Q Q q 1 i 31.402 309.823 533.5 -208.701 re W n 31.402 309.823 533 -208.701 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 140.802 162.031 cm 0 0 m 156.6 0 l S Q Q q 1 i 31.417 309.823 533.485 -208.701 re W n 31.402 309.823 533.5 -208.701 re W n 31.402 309.823 533 -208.701 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 297.402 162.031 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -57.431 cm 0 0 m 267.5 0 l S 1 0 0 1 -266 172.292 cm 0 0 m 109.9 0 l S Q Q q 1 i 31.402 309.823 533.5 -208.701 re W n 31.402 309.823 533 -208.701 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 141.302 276.892 cm 0 0 m 156.1 0 l S 1 0 0 1 0 .5 cm 0 0 m 0 15.931 l S 1 0 0 1 156.1 0 cm 0 0 m 0 15.931 l S Q BT /F2 1 Tf 10 0 0 10 224.5568 298.3233 Tm 0 0 0 0 k -.015 Tc .023 Tw [(Figure 4Cyberresiliency Appr)17.7(oaches)]TJ 9 0 0 9 65.8784 280.8926 Tm -.0098 Tc 0 Tw [(Techniques)-10177.3(A)-.6(ppr)17.8(oaches)-19295.9(Examples)]TJ ET /GS2 gs BT 9 0 0 9 35.3955 263.4595 Tm 0 0 0 1 k -.0096 Tc -.0004 Tw (Adaptive Response)Tj /F3 1 Tf 0 -1.111 TD -.0005 Tw [(Implement agile courses)-9.6( )]TJ T* -.0095 Tc -.0006 Tw [(of action t)9(o)-.1( manage risk)-8.8( )]TJ T* 0 Tw [(fact)9.1(ors.)]TJ /F2 1 Tf 12.211 3.333 TD -.0096 Tc -.0004 Tw [(Dynamic Reconfigur)15.2(ation)]TJ /F3 1 Tf 0 -1.111 TD -.0093 Tc .0003 Tw [(Make changes t)9.3(o)0( individual systems,)-9.8( )]TJ T* [(system elements, components or sets of)-10( )]TJ T* [(cyber resour)9.6(ces t)9.2(o).1( change functionality or)-9.4( )]TJ T* -.0007 Tw [(beha)7.1(vior without interrupting ser)-8.4(vice.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 301.3909 263.4595 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 305.7998 263.4595 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Dynamically change r)9.6(o)0(uter rules, access contr)9.6(ol lists, intrusion detection)-9.1( )]TJ .219 -1.111 TD [(and pre)6.1(vention system par)19.6(a)-.3(meters, and filter rules for firewalls and)-9.6( )]TJ T* -.0092 Tc 0 Tw (gateways.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 301.3909 233.4625 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 305.7998 233.4625 Tm 0 0 0 1 k -.0094 Tc -.0007 Tw [( )219.2(Reassign cyberdefense responsibilities t)9.2(o)-.2( personnel or oper)19.6(ating)-8.9( )]TJ .219 -1.111 TD 0 Tw (centers.)Tj /F2 1 Tf -18.0529 -1.937 TD .0006 Tw [(Dynamic Resour)10.2(ce Allocation)]TJ /F3 1 Tf 0 -1.111 TD .0004 Tw [(Change the allocation of resour)9.6(ces t)9.2(o)-9( )]TJ T* [(tasks or functions without terminating)-8.9( )]TJ T* [(critical functions or pr)9.6(ocesses.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 301.3909 206.0303 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 305.7998 206.0303 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Employ dynamic pr)9.6(o)7.9(v)-.5(isioning.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 301.3909 196.0313 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 305.7998 196.0313 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.8(Reprioritize messages or ser)-8.5(v)-.4(ices.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 301.3909 186.0323 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 305.7998 186.0323 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.5(Implement load-balancing.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 301.3909 176.0333 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 305.7998 176.0333 Tm 0 0 0 1 k -.0096 Tc .0006 Tw [( )219.7(Pr)9.2(o)7.7(v)-.8(ide emergency shut)8.8(off capabilities.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 301.3909 166.0343 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 305.7998 166.0343 Tm 0 0 0 1 k -.0095 Tc .0005 Tw [( )219.5(Preempt communications.)]TJ /F2 1 Tf -17.8339 -1.937 TD -.0097 Tc -.0003 Tw (Adaptive Management)Tj /F3 1 Tf 0 -1.111 TD -.0093 Tc .0003 Tw [(Change how mechanisms are used)-9.5( )]TJ T* [(based on changes in the oper)19.6(ational)-9.9( )]TJ T* -.0007 Tw [(envir)9.8(o).4(nment as well as changes in the)-9.9( )]TJ T* [(threat envir)9.5(o).4(nment.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 301.3909 148.6013 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 305.7998 148.6013 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Disable access dynamically.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 301.3909 138.6023 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 305.7998 138.6023 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.6(Implement adaptive authentication.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 301.3909 128.6033 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 305.7998 128.6033 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Pr)9.5(o)8(v)-.5(ide for aut)9.1(o)-.1(matic disabling of the system.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 301.3909 118.6043 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 305.7998 118.6043 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Pr)9.5(o)8(v)-.5(ide dynamic deployment of new or replacement resour)9.6(ces or)-9.6( )]TJ .219 -1.111 TD 0 Tw (capabilities.)Tj ET EMC Q endstream endobj 321 0 obj <>/ExtGState<>>> endobj 335 0 obj <> endobj 337 0 obj <>stream /P <>BDC q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS2 gs BT /TT2 1 Tf 7 0 0 7 490.9954 20.9379 Tm 0 0 0 1 k 0 Tc 0 Tw (ISACA )Tj ET EMC /P <>BDC BT 7 0 0 7 512.4738 20.9379 Tm (JOURNAL)Tj ET EMC /P <>BDC /GS1 gs BT 7 0 0 7 543.321 20.9379 Tm .761 .549 .11 0 k [( V)6.3(OL 3)]TJ ET EMC /Artifact <>BDC 0 0 0 1 k /GS2 gs 572.364 .014984 .51599 31.274 re f EMC /P <>BDC /GS1 gs BT 7 0 0 7 587.3827 20.9379 Tm .761 .549 .11 0 k (7)Tj ET EMC /P <>BDC /GS2 gs BT 7 0 0 7 36.9471 21.3673 Tm 0 0 0 1 k [( 2021 ISACA. All rights reser)-8.8(ved. )]TJ ET EMC /P <>BDC BT /TT4 1 Tf 7 0 0 7 144.579 21.3673 Tm [(www)60.5(.isaca.org)]TJ ET EMC /Figure <>BDC Q q 1 i 35.397 658.462 534 -588.424 re W n 35.397 658.462 534 -587.924 re 189.556 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n .76471 .54118 .098039 .007843 k /GS1 gs 35.897 639.982 533 18.479 re f .78824 .85098 .17255 .043137 k 35.897 639.982 109.9 -17.431 re 145.797 639.982 156.1 -17.431 re 301.897 639.982 267 -17.431 re f .15686 .1098 .031373 0 k 35.897 622.553 109.9 -212.292 re 35.897 410.261 109.9 -339.723 re f .082353 .011765 .007843 0 k 145.797 622.553 156.1 -97.431 re 145.797 525.122 156.1 -57.432 re 145.797 467.69 156.1 -57.43 re 145.797 410.261 156.1 -77.431 re 145.797 332.83 156.1 -107.432 re 145.797 225.398 156.1 -87.43 re 145.797 137.969 156.1 -67.431 re f .16863 .031373 .023529 0 k 301.897 622.553 267 -97.431 re 301.897 525.122 267 -57.432 re 301.897 467.69 267 -57.43 re 301.897 410.261 267 -77.431 re 301.897 332.83 267 -107.432 re 301.897 225.398 267 -87.43 re 301.897 137.969 267 -67.431 re f Q q 1 i 35.397 658.462 534 -588.409 re W n 35.397 658.462 534 -588.424 re W n 35.397 658.462 534 -587.924 re 189.556 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 1 K 0 J 0 j 1 w 10 M [] 0 d /GS2 gs q 1 0 0 1 35.897 639.983 cm 0 0 m 0 18.479 l S 1 0 0 1 533 0 cm 0 0 m 0 18.479 l S 1 0 0 1 -533 -16.931 cm 0 0 m 0 16.931 l S 1 0 0 1 533 0 cm 0 0 m 0 16.931 l S Q Q q 1 i 35.397 658.462 534 -588.424 re W n 35.397 658.462 534 -587.924 re 189.556 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d /GS1 gs q 1 0 0 1 36.397 639.983 cm 0 0 m 265.5 0 l S 1 0 0 1 265.5 0 cm 0 0 m 266.5 0 l S Q 1 w q 1 0 0 1 35.897 410.26 cm 0 0 m 109.9 0 l S 1 0 0 1 109.9 115.362 cm 0 0 m 0 96.431 l S 1 0 0 1 -.5 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 .5 -56.931 cm 0 0 m 0 56.431 l S 1 0 0 1 -.5 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 .5 -56.931 cm 0 0 m 0 56.431 l S 1 0 0 1 0 -.5 cm 0 0 m 156.1 0 l S 1 0 0 1 0 -76.93 cm 0 0 m 0 76.431 l S 1 0 0 1 -.5 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 .5 -106.931 cm 0 0 m 0 106.431 l S 1 0 0 1 -.5 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 .5 -86.93 cm 0 0 m 0 86.43 l S 1 0 0 1 -.5 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 .5 -67.431 cm 0 0 m 0 66.931 l S Q Q q 1 i 35.397 658.462 534 -588.409 re W n 35.397 658.462 534 -588.424 re W n 35.397 658.462 534 -587.924 re 189.556 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 301.897 622.552 cm 0 0 m 267.5 0 l S 1 0 0 1 267 -96.93 cm 0 0 m 0 96.431 l S 1 0 0 1 0 -57.431 cm 0 0 m 0 56.431 l S 1 0 0 1 0 -57.431 cm 0 0 m 0 56.431 l S 1 0 0 1 0 -77.43 cm 0 0 m 0 76.431 l S 1 0 0 1 0 -107.431 cm 0 0 m 0 106.431 l S 1 0 0 1 0 -87.43 cm 0 0 m 0 86.43 l S 1 0 0 1 0 -67.431 cm 0 0 m 0 66.431 l S 1 0 0 1 -267 454.084 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -57.431 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -57.431 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -77.43 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -107.431 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -87.43 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -67.431 cm 0 0 m 267.5 0 l S 1 0 0 1 -266.5 552.014 cm 0 0 m 110.4 0 l S Q Q q 1 i 35.397 658.462 534 -588.424 re W n 35.397 658.462 534 -587.924 re 189.556 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 145.797 622.552 cm 0 0 m 156.1 0 l S 1 0 0 1 0 .4999 cm 0 0 m 0 15.931 l S 1 0 0 1 156.1 0 cm 0 0 m 0 15.931 l S Q BT /F2 1 Tf 10 0 0 10 215.1587 643.9828 Tm 0 0 0 0 k -.015 Tc .022 Tw [(Figure 4Cyberresiliency Appr)17.8(oaches)]TJ /F6 1 Tf 14.6525 0 TD [( \(cont.\))]TJ /F2 1 Tf 9 0 0 9 70.3738 626.5522 Tm -.0098 Tc 0 Tw [(Techniques)-10177.4(A)-.6(ppr)17.9(oaches)-19297(Examples)]TJ ET /GS2 gs BT 9 0 0 9 39.8903 609.1191 Tm 0 0 0 1 k -.0096 Tc -.0004 Tw [(A)23(n).7(alytic Monit)14(oring)]TJ /F3 1 Tf 0 -1.111 TD [(Monit)8.7(o)-.4(r and analyze a wide)-10.5( )]TJ T* -.0005 Tw [(r)19.2(a)-.2(nge of pr)9.2(oper)-23.8(ties and)-10( )]TJ T* [(beha)7(viors on an ongoing)-9( )]TJ T* -.0004 Tw [(basis and in a coordinated)-10.1( )]TJ T* -.0094 Tc 0 Tw (way.)Tj /F2 1 Tf 12.211 5.556 TD -.0098 Tc -.0002 Tw [(Monit)13.6(oring and damage assessment)]TJ /F3 1 Tf 0 -1.111 TD -.0093 Tc .0003 Tw [(Monit)9.3(o).2(r and analyze beha)7.3(vior and)-9.5( )]TJ T* [(char)19.7(acteristics of components and)-9.5( )]TJ T* [(resour)9.6(ces t)9.2(o).1( look for indicat)9.2(o).4(rs of)-9.9( )]TJ T* .0002 Tw [(adversary activity and t)9.4(o).1( detect and)-9.5( )]TJ T* .0003 Tw [(assess damage fr)9.6(om adversity.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8857 609.1373 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2957 609.1373 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.5(Use hardware fault detection.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8857 599.1382 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2957 599.1382 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Employ continuous diagnostics and mitigation \(CDM\) or other)-9.5( )]TJ .219 -1.111 TD [(vulner)19.8(ability scanning t)9.5(ools.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8857 579.1401 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2957 579.1401 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Deploy intrusion detection systems \(IDSs\) and other monit)9.2(oring t)9.3(o)-.1(ols.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8857 569.1412 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2957 569.1412 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Use insider threat monit)9.2(oring t)9.2(o)0(ols.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8857 559.1422 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2957 559.1422 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Per)-7.4(f)0(orm telemetry analysis.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8857 549.1429 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2957 549.1429 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Detect malware beaconing.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8857 539.1439 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2957 539.1439 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Monit)9.1(o)0(r open-sour)9.5(c)0(e information for indicat)9.2(o).4(rs of disclosure or)-9.6( )]TJ .219 -1.111 TD -.0097 Tc 0 Tw [(compr)9.2(omise.)]TJ /F2 1 Tf -18.053 -1.937 TD -.0003 Tw (Sensor fusion and analysis)Tj /F3 1 Tf 0 -1.111 TD -.0093 Tc .0003 Tw [(F)10.8(u).5(se and analyze monit)9.3(oring data and)-9.6( )]TJ T* [(analysis results fr)9.7(om different information)-9( )]TJ T* -.0095 Tc .0005 Tw [(sour)9.3(ces or at different times t)8.9(o)-.2(gether with)-9.3( )]TJ T* -.0093 Tc .0003 Tw [(externally pr)9.6(o)8(v)-.4(ided threat intelligence.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8857 511.712 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2957 511.712 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Enable organizationwide situational awareness.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8857 501.713 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2957 501.713 Tm 0 0 0 1 k -.0094 Tc -.0007 Tw [( )219.3(Implement cr)9.6(oss-organizational auditing.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8857 491.714 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2957 491.714 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.6(Correlate data fr)9.6(om different t)9.3(ools.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8857 481.715 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2957 481.715 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(F)9.7(u).5(se data fr)9.6(om physical access contr)9.6(ol systems and information)-9.1( )]TJ .219 -1.111 TD 0 Tw (systems.)Tj /F2 1 Tf -18.053 -1.937 TD -.0097 Tc -.0003 Tw [(F)10.4(o)-.8(rensic and beha)7.9(vior)14.9(al analysis)]TJ /F3 1 Tf 0 -1.111 TD -.0093 Tc .0003 Tw [(Analyze adversary )20(T)-6.5(T)1.6(Ps, including)-8.8( )]TJ T* [(obser)-8.3(v)-.5(ed beha)7.2(vior as well as malware)-10( )]TJ T* -.0095 Tc .0005 Tw [(and other ar)-23.6(tifacts left behind by adverse)-10.3( )]TJ T* -.0158 Tc 0 Tw [(ev)-6.6(e)-6(n)-6.3(t)-5.9(s)-5.2(.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8857 454.283 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2957 454.283 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.8(Deploy an integr)19.7(ated team of forensic and malware analysts, de)6.1(velopers,)-9.8( )]TJ .219 -1.111 TD [(and oper)19.6(ations personnel.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8857 434.285 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2957 434.285 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Use re)6.1(verse engineering and other malware analysis t)9.4(o)-.1(ols.)]TJ /F2 1 Tf -30.046 -4.159 TD -.0098 Tc -.0002 Tw [(Coordinated Pr)17.7(otection)]TJ /F3 1 Tf 0 -1.111 TD -.0004 Tw [(Ensure that pr)9.1(otection)-9.6( )]TJ T* -.0094 Tc -.0007 Tw [(mechanisms oper)19.6(ate in a)-9.8( )]TJ T* .0005 Tw [(coordinated and effective)-10.3( )]TJ T* 0 Tw [(manner)59.5(.)]TJ /F2 1 Tf 12.211 4.444 TD -.0097 Tc -.0003 Tw [(Calibr)14.8(a)-.2(ted defense in depth)]TJ /F3 1 Tf 0 -1.111 TD -.0094 Tc .0004 Tw [(Pr)9.6(o)7.9(v)-.5(ide complementary pr)9.5(otective)-10.1( )]TJ T* [(mechanisms at different ar)9.6(chitectur)19.7(a)-.3(l)-9.8( )]TJ T* [(layers or in different locations, calibr)19.7(a)-.3(ting)-8.7( )]TJ T* -.0006 Tw [(the strength and number of mechanisms)-9.3( )]TJ 0 -1.1111 TD .0003 Tw [(t)9.2(o).1( resour)9.6(ce v)7.6(alue.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 396.862 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 396.862 Tm 0 0 0 1 k -.0095 Tc -.0006 Tw [( )219.4(Design for defense in depth.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 386.863 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 386.863 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.6(Employ multiple, distinct authentication challenges o)8.1(v)-.4(er the course of a)-9.8( )]TJ .219 -1.111 TD [(session t)9.3(o)0( confirm identity.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 366.8649 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 366.8649 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.8(Combine network and host-based intrusion detection.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 356.866 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 356.866 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Pr)9.7(o)8(v)-.4(ide increasing le)6.1(vels of pr)9.7(otection t)9.3(o).1( access more sensitive or)-9.5( )]TJ .219 -1.111 TD [(critical resour)9.5(ces.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 336.868 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 336.868 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.6(Conduct sensitivity and criticality analyses.)]TJ /F2 1 Tf -17.834 -1.937 TD -.0097 Tc -.0003 Tw (Consistency analysis)Tj /F3 1 Tf 0 -1.111 TD -.0095 Tc .0005 Tw [(Determine whether and how pr)9.5(otections)-9.3( )]TJ T* -.0017 Tw [(can be applied in a coordinated, consistent)-10( )]TJ T* -.0093 Tc .0003 Tw [(way that minimizes inter)-7.4(f).1(erence, potential)-9.8( )]TJ T* [(cascading failures, or co)8(ver)19.6(age gaps.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 319.435 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 319.435 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.6(Employ unified identity and access management \(IdAM\) administr)19.6(a).2(tion)-9.1( )]TJ .219 -1.111 TD -.009 Tc 0 Tw [(t)9.8(ools.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 299.437 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 299.437 Tm 0 0 0 1 k -.0096 Tc .0006 Tw [( )219.8(Analyze mission/business pr)9.3(ocess flows and threads.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 289.438 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 289.438 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Employ privilege analysis t)9.4(ools t)9.4(o).1( suppor)-23.2(t).4( an ongoing re)6.1(view of whether)-9.4( )]TJ .219 -1.111 TD -.0095 Tc .0005 Tw (user privileges are assigned consistently.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 269.4399 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 269.4399 Tm 0 0 0 1 k -.0096 Tc -.0005 Tw [( )219.3(Interpret attributes consistently.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 259.441 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 259.441 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Coordinate the planning, tr)19.5(aining and testing of incident response,)-9.8( )]TJ .219 -1.111 TD (contingency planning, etc.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 239.443 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 239.443 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.8(Design for facilitating coordination and mutual suppor)-23.4(t).2( among)-8.8( )]TJ .219 -1.111 TD 0 Tw (safeguards.)Tj /F2 1 Tf -18.053 -1.937 TD -.01 Tc [(Or)9.6(chestr)14.4(ation)]TJ /F3 1 Tf 0 -1.111 TD -.0095 Tc -.0006 Tw [(Coordinate the ongoing beha)7(vior)-9.5( )]TJ T* .0004 Tw [(of mechanisms and pr)9.7(ocesses at)-9.8( )]TJ T* -.0093 Tc [(different layers, in different locations,)-9.8( )]TJ T* -.0095 Tc .0005 Tw [(or implemented for different aspects)-9.4( )]TJ T* .0004 Tw [(of trustwor)-23.4(thiness t)9.2(o).1( a)7.2(v)7.5(oid causing)-8.8( )]TJ T* [(cascading failures, inter)-7.4(f)0(erence, or)-9.5( )]TJ T* -.0093 Tc [(co)8.2(ver)19.9(age gaps.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 212.02 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 212.02 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Coordinate incident handling with mission/business pr)9.5(ocess continuity)-9.2( )]TJ .219 -1.111 TD [(of oper)19.8(ations and organizational pr)9.8(ocesses.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 192.022 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 192.022 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Conduct co)8.1(ver)19.5(age planning and management for sensors.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 182.0229 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 182.0229 Tm 0 0 0 1 k -.0095 Tc .0005 Tw [( )219.7(Use cyber playbooks.)]TJ /F2 1 Tf -17.834 -6.381 TD -.0096 Tc 0 Tw (Self-challenge)Tj /F3 1 Tf 0 -1.111 TD -.0094 Tc .0004 Tw [(Affect mission/business pr)9.6(ocesses or)-9.5( )]TJ T* .0005 Tw [(system elements adversely in a contr)9.3(olled)-9.9( )]TJ T* -.0008 Tw [(manner t)9.3(o)0( v)7.5(alidate the effectiveness)-9.1( )]TJ T* -.0006 Tw [(of pr)9.4(otections and t)9(o)-.2( enable pr)9.4(oactive)-10.2( )]TJ T* .0004 Tw [(response and impr)9.5(o)8(v)-.6(ement.)-9.4( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 127.2749 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 127.2749 Tm 0 0 0 1 k -.0096 Tc -.0005 Tw [( )219.3(Hardware power-on self-test.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 117.2759 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 117.2759 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Conduct r)9.7(o).1(le-based tr)19.7(aining exer)9.7(cises.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 107.2769 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 107.2769 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Conduct penetr)19.7(ation testing and red team exer)9.7(cises.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 97.278 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 97.278 Tm 0 0 0 1 k -.0095 Tc .0005 Tw [( )21( )220(Test aut)8.9(o)-.3(mated incident response.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 87.279 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 87.279 Tm 0 0 0 1 k -.0095 Tc -.0006 Tw [( )219.3(Employ fault injection.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 305.8767 77.28 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 310.2867 77.28 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Conduct tablet)9.2(op exer)9.5(cises.)]TJ ET EMC Q endstream endobj 338 0 obj <>/ExtGState<>>> endobj 352 0 obj <> endobj 354 0 obj <>stream /P <>BDC q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS2 gs BT /TT2 1 Tf 7 0 0 7 39.4019 20.9698 Tm 0 0 0 1 k 0 Tc 0 Tw (ISACA )Tj ET EMC /P <>BDC BT 7 0 0 7 60.8804 20.9698 Tm (JOURNAL)Tj ET EMC /P <>BDC /GS1 gs BT 7 0 0 7 91.7275 20.9698 Tm .761 .549 .11 0 k [( V)6.3(OL 3)]TJ ET EMC /Artifact <>BDC 0 0 0 1 k /GS2 gs 30.069 .014984 .51505 31.516 re f EMC /P <>BDC /GS1 gs BT 7 0 0 7 12.8637 20.9698 Tm .761 .549 .11 0 k (8)Tj ET EMC /P <>BDC /GS2 gs BT 7 0 0 7 415.3383 21.3673 Tm 0 0 0 1 k [( 2021 ISACA. All rights reser)-8.8(ved. )]TJ ET EMC /P <>BDC BT /TT4 1 Tf 7 0 0 7 522.9701 21.3673 Tm [(www)60.5(.isaca.org)]TJ ET EMC /Figure <>BDC Q q 1 i 36.12 764.508 534 -723.008 re W n 36.12 764.508 534 -722.508 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n .76471 .54118 .098039 .007843 k /GS1 gs 36.619 746.029 533 18.479 re f .78824 .85098 .17255 .043137 k 36.619 746.029 109.9 -17.431 re 146.519 746.029 156.1 -17.431 re 302.619 746.029 267 -17.431 re f .15686 .1098 .031373 0 k 36.619 728.599 109.9 -162.292 re 36.619 566.307 109.9 -249.723 re 36.619 316.584 109.9 -274.584 re f .082353 .011765 .007843 0 k 146.52 728.599 156.1 -47.431 re 146.52 681.168 156.1 -47.431 re 146.52 633.737 156.1 -67.431 re 146.52 566.307 156.1 -107.431 re 146.52 458.876 156.1 -37.431 re 146.52 421.445 156.1 -47.431 re 146.52 374.015 156.1 -57.431 re 146.52 316.584 156.1 -57.431 re 146.52 259.153 156.1 -57.431 re 146.52 201.723 156.1 -37.431 re 146.52 164.292 156.1 -37.431 re 146.52 126.861 156.1 -47.431 re 146.52 79.431 156.1 -37.431 re f .16863 .031373 .023529 0 k 302.62 728.599 267 -47.431 re 302.62 681.168 267 -47.431 re 302.62 633.737 267 -67.431 re 302.62 566.307 267 -107.431 re 302.62 458.876 267 -37.431 re 302.62 421.445 267 -47.431 re 302.62 374.015 267 -57.431 re 302.62 316.584 267 -57.431 re 302.62 259.153 267 -57.431 re 302.62 201.723 267 -37.431 re 302.62 164.292 267 -37.431 re 302.62 126.861 267 -47.431 re 302.62 79.431 267 -37.431 re f Q q 1 i 36.12 764.508 534 -722.993 re W n 36.12 764.508 534 -723.008 re W n 36.12 764.508 534 -722.508 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 1 K 0 J 0 j 1 w 10 M [] 0 d /GS2 gs q 1 0 0 1 36.619 746.029 cm 0 0 m 0 18.479 l S 1 0 0 1 533 0 cm 0 0 m 0 18.479 l S 1 0 0 1 -533 -16.931 cm 0 0 m 0 16.931 l S 1 0 0 1 533 0 cm 0 0 m 0 16.931 l S Q Q q 1 i 36.12 764.508 534 -723.008 re W n 36.12 764.508 534 -722.508 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d /GS1 gs q 1 0 0 1 37.119 746.029 cm 0 0 m 265.5 0 l S 1 0 0 1 265.5 0 cm 0 0 m 266.5 0 l S Q 1 w q 1 0 0 1 146.02 421.445 cm 0 0 m 156.6 0 l S 1 0 0 1 0 -47.431 cm 0 0 m 156.6 0 l S 1 0 0 1 .5 -57.43 cm 0 0 m 156.1 0 l S 1 0 0 1 -.5 -57.43 cm 0 0 m 156.6 0 l S 1 0 0 1 0 -57.431 cm 0 0 m 156.6 0 l S 1 0 0 1 0 -37.431 cm 0 0 m 156.6 0 l S 1 0 0 1 0 -37.43 cm 0 0 m 156.6 0 l S 1 0 0 1 0 -47.431 cm 0 0 m 156.6 0 l S 1 0 0 1 0 601.737 cm 0 0 m 156.6 0 l S 1 0 0 1 0 -47.431 cm 0 0 m 156.6 0 l S 1 0 0 1 .5 -67.431 cm 0 0 m 156.1 0 l S 1 0 0 1 -.5 -107.43 cm 0 0 m 156.6 0 l S 1 0 0 1 .5 222.792 cm 0 0 m 0 46.431 l S 1 0 0 1 0 -47.431 cm 0 0 m 0 46.431 l S 1 0 0 1 0 -67.431 cm 0 0 m 0 66.431 l S 1 0 0 1 0 -107.43 cm 0 0 m 0 106.431 l S 1 0 0 1 0 -37.431 cm 0 0 m 0 36.431 l S 1 0 0 1 0 -47.431 cm 0 0 m 0 46.431 l S 1 0 0 1 0 -57.43 cm 0 0 m 0 56.431 l S 1 0 0 1 0 -57.43 cm 0 0 m 0 56.43 l S 1 0 0 1 0 -57.431 cm 0 0 m 0 56.431 l S 1 0 0 1 0 -37.431 cm 0 0 m 0 36.431 l S 1 0 0 1 0 -37.43 cm 0 0 m 0 36.43 l S 1 0 0 1 0 -47.431 cm 0 0 m 0 46.431 l S 1 0 0 1 0 -37.931 cm 0 0 m 0 36.931 l S 1 0 0 1 -109.9 524.306 cm 0 0 m 109.9 0 l S 1 0 0 1 0 -249.722 cm 0 0 m 109.9 0 l S Q Q q 1 i 36.12 764.508 534 -722.993 re W n 36.12 764.508 534 -723.008 re W n 36.12 764.508 534 -722.508 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 302.62 728.598 cm 0 0 m 267.5 0 l S 1 0 0 1 267 -46.931 cm 0 0 m 0 46.431 l S 1 0 0 1 0 -47.431 cm 0 0 m 0 46.431 l S 1 0 0 1 0 -67.431 cm 0 0 m 0 66.431 l S 1 0 0 1 0 -107.43 cm 0 0 m 0 106.431 l S 1 0 0 1 0 -37.431 cm 0 0 m 0 36.431 l S 1 0 0 1 0 -47.431 cm 0 0 m 0 46.431 l S 1 0 0 1 0 -57.43 cm 0 0 m 0 56.431 l S 1 0 0 1 0 -57.43 cm 0 0 m 0 56.43 l S 1 0 0 1 0 -57.431 cm 0 0 m 0 56.431 l S 1 0 0 1 0 -37.431 cm 0 0 m 0 36.431 l S 1 0 0 1 0 -37.43 cm 0 0 m 0 36.43 l S 1 0 0 1 0 -47.431 cm 0 0 m 0 46.431 l S 1 0 0 1 0 -37.431 cm 0 0 m 0 36.431 l S 1 0 0 1 -267 638.668 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -47.431 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -67.431 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -107.43 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -37.431 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -47.431 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -57.43 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -57.43 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -57.431 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -37.431 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -37.43 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -47.431 cm 0 0 m 267.5 0 l S 1 0 0 1 0 -37.431 cm 0 0 m 267.5 0 l S 1 0 0 1 -266.5 686.598 cm 0 0 m 110.4 0 l S Q Q q 1 i 36.12 764.508 534 -723.008 re W n 36.12 764.508 534 -722.508 re 567.947 21.367 m W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 146.52 728.598 cm 0 0 m 156.1 0 l S 1 0 0 1 0 .5 cm 0 0 m 0 15.931 l S 1 0 0 1 156.1 0 cm 0 0 m 0 15.931 l S Q BT /F2 1 Tf 10 0 0 10 215.8806 750.0289 Tm 0 0 0 0 k -.015 Tc .022 Tw [(Figure 4Cyberresiliency Appr)17.7(oaches)]TJ /F6 1 Tf 14.6525 0 TD [( \(cont.\))]TJ /F2 1 Tf 9 0 0 9 71.0962 732.5983 Tm -.0098 Tc 0 Tw [(Techniques)-10177.4(A)-.6(ppr)17.7(oaches)-19297.1(Examples)]TJ ET /GS2 gs BT 9 0 0 9 40.6133 715.1652 Tm 0 0 0 1 k -.0002 Tw (Contextual awareness)Tj /F3 1 Tf 0 -1.111 TD -.0094 Tc -.0007 Tw [(Construct and maintain)-9.2( )]TJ T* [(current representations of)-10.1( )]TJ T* -.0096 Tc -.0005 Tw [(the posture of missions)-9.5( )]TJ T* -.0095 Tc -.0006 Tw [(or business functions)-9.3( )]TJ T* [(considering threat e)5.8(v)-.6(ents)-9.3( )]TJ T* (and courses of action.)Tj /F2 1 Tf 12.211 6.6671 TD -.0098 Tc -.0002 Tw [(Dynamic resour)9.7(ce awareness)]TJ /F3 1 Tf 0 -1.111 TD -.0094 Tc .0004 Tw [(Maintain current information about)-9.8( )]TJ T* [(resour)9.4(ces, status of resour)9.4(ces, and)-9.8( )]TJ T* -.0006 Tw [(resour)9.5(ce connectivity.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.6086 715.174 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0176 715.174 Tm 0 0 0 1 k -.0093 Tc -.0008 Tw [( )219.4(Maintain real-time integr)19.6(ated situational awareness.)]TJ /F2 1 Tf -17.8339 -5.27 TD -.0098 Tc -.0002 Tw (Dynamic threat awareness)Tj /F3 1 Tf 0 -1.111 TD -.0094 Tc .0004 Tw [(Maintain current information about threat)-9.8( )]TJ T* -.0096 Tc .0006 Tw [(act)8.8(o)-.3(rs, indicat)8.8(o)-.3(rs, and potential, predicted,)-10.2( )]TJ T* -.0094 Tc .0004 Tw [(and obser)-8.6(v)-.6(ed adverse e)5.9(v)-.7(ents.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.6086 667.7437 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0176 667.7437 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )21.1( )220.1(T)37.4(r)19.5(ack predicted or impending natur)19.6(al disasters.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.6086 657.745 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0176 657.745 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Dynamically ingest incident and threat data.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.6086 647.746 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0176 647.746 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(F)15.8(a)-.7(cilitate integr)19.8(ated situational awareness of threats.)]TJ /F2 1 Tf -17.8339 -3.048 TD -.0097 Tc -.0003 Tw [(Mission dependency and status)-9.9( )]TJ 0 -1.111 TD 0 Tw (visualization)Tj /F3 1 Tf T* -.0094 Tc .0004 Tw [(Maintain current information about the)-10( )]TJ T* [(status of missions or business functions,)-9.9( )]TJ T* -.0098 Tc -.0025 Tw [(dependencies on resour)9(ces, and the status)-9.8( )]TJ T* -.0096 Tc .0006 Tw [(of those resour)9.2(ces with respect t)8.9(o)-.4( threats.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.6086 620.323 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0176 620.323 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.8(Construct a br)9.5(oad \(mission/business functionwide, organizationwide\))-10.2( )]TJ .2191 -1.111 TD 0 Tw (perspective.)Tj /F2 1 Tf -30.2651 -6.381 TD -.0099 Tc (Deception)Tj /F3 1 Tf 0 -1.111 TD -.0096 Tc -.0005 Tw [(Mislead, confuse, hide)-9.4( )]TJ T* -.0093 Tc .0003 Tw [(critical assets fr)9.6(om, or)-9.4( )]TJ T* [(expose co)8.1(ver)-23.4(tly tainted)-9.6( )]TJ T* -.0095 Tc -.0006 Tw [(assets t)8.9(o)-.3( the adversary.)]TJ /F2 1 Tf 12.2111 4.444 TD -.0096 Tc 0 Tw (Obfuscation)Tj /F3 1 Tf 0 -1.111 TD -.0095 Tc .0005 Tw [(Hide, tr)19.4(ansform or other)-8.7(w)0(ise obfuscate)-10.3( )]TJ T* .0004 Tw [(information fr)9.6(om the adversary.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5987 552.8949 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0096 552.8949 Tm 0 0 0 1 k -.0095 Tc .0005 Tw [( )219.7(Encrypt data at rest.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5987 542.896 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0096 542.896 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.9(Encrypt tr)19.6(ansmitted data \(e.g., using a vir)-23.4(t)0(ual priv)7.5(ate network [VPN]\).)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5987 532.897 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0096 532.897 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Encrypt authenticat)9.2(o).4(rs.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5987 522.8979 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0096 522.8979 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.9(Conceal or r)19.7(a)-.9(ndomize communications patterns.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5987 512.8989 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0096 512.8989 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Conceal the presence of system components on an internal network.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5987 502.9 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0096 502.9 Tm 0 0 0 1 k -.0095 Tc .0005 Tw [( )219.6(Mask, encrypt, hash or replace identifiers.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5987 492.9009 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0096 492.9009 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.8(Obfuscate tr)19.6(affic via onion r)9.8(o).1(uting.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5987 482.902 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0096 482.902 Tm 0 0 0 1 k -.0095 Tc -.0006 Tw [( )219.5(Apply chaffing t)9.2(o)0( communications tr)19.6(affic.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5987 472.903 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0096 472.903 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Add a large amount of v)7.5(a)-.8(lid but useless information t)9.3(o)-.1( a data st)9.2(ore.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5987 462.9039 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0096 462.9039 Tm 0 0 0 1 k -.0096 Tc -.0005 Tw [( )219.5(Per)-7.9(f)-.3(orm encrypted pr)9.2(ocessing.)]TJ /F2 1 Tf -17.834 -1.9371 TD -.0095 Tc 0 Tw (Disinformation)Tj /F3 1 Tf 0 -1.111 TD -.0096 Tc .0006 Tw [(Pr)9.3(o)7.6(v)-.8(ide deliber)19.2(ately misleading)-9.2( )]TJ T* -.0093 Tc .0003 Tw [(information t)9.2(o).1( adversaries.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5987 445.47 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0096 445.47 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(P)6.5(o)0(st questions t)9.1(o)0( a public forum based on false information about the)-10( )]TJ .219 -1.111 TD 0 Tw (system.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5987 425.4719 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0096 425.4719 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.8(Create false \()28.8(canary\) credentials and t)9.3(o)-.1(kens \(e.g., honeyt)9.2(okens\).)]TJ /F2 1 Tf -17.834 -1.937 TD -.0098 Tc 0 Tw (Misdirection)Tj /F3 1 Tf 4.921 0 TD 0 Tc ( )Tj -4.921 -1.111 TD -.0094 Tc .0004 Tw [(Maintain deception resour)9.5(ces or)-9.5( )]TJ T* [(envir)9.6(o).1(nments and direct adversary)-9.1( )]TJ T* -.0092 Tc .0002 Tw (activities there.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5987 408.0389 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0096 408.0389 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.8(Establish and maintain honeypots, honeynets or decoy files.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5987 398.0399 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0096 398.0399 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Maintain a full-scale, all-encompassing deception envir)9.7(o).1(nment.)]TJ /F2 1 Tf -17.834 -4.159 TD -.0919 Tc 0 Tw [(Ta)-82.6(i)-83(n)-82.2(t)-81.5(i)-83(n)-82.2(g)]TJ /F3 1 Tf 3.16 0 TD 0 Tc ( )Tj -3.16 -1.111 TD -.0094 Tc .0004 Tw [(Embed co)7.9(ver)-23.5(t capabilities in resour)9.5(ces.)-9.4( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5987 360.609 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0096 360.609 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Use beacon tr)19.5(aps.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5987 350.61 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0096 350.61 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Employ internal network table cache poisoning \(e.g., Domain Name)-9.9( )]TJ .219 -1.111 TD [(System \(DNS\), Address Resolution Pr)9.5(ot)9.1(ocol \(ARP\)\).)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5987 330.612 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0096 330.612 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.8(Include false entries or steganogr)19.7(a)-.3(phic data in files t)9.3(o).1( enable them t)9.3(o).1( be)-9.9( )]TJ .219 -1.111 TD [(found via open-sour)9.7(c).2(e analysis.)]TJ /F2 1 Tf -30.265 -1.937 TD -.0097 Tc 0 Tw (Diversity)Tj /F3 1 Tf 3.456 0 TD 0 Tc ( )Tj -3.456 -1.111 TD -.0094 Tc .0004 Tw [(Use heter)9.4(o)-.1(geneity t)9(o)-9.2( )]TJ T* .0005 Tw [(minimize common mode)-10.1( )]TJ T* -.0098 Tc -.0003 Tw [(failures, par)-24.1(t)-.5(icularly threat)-10.5( )]TJ T* -.0094 Tc .0004 Tw [(e)5.9(v)-.5(ents exploiting common)-9.2( )]TJ T* -.0099 Tc 0 Tw [(vulner)18.8(abilities.)]TJ /F2 1 Tf 12.211 5.556 TD -.0097 Tc -.0003 Tw [(Ar)9.9(chitectur)14.9(a)-.1(l diversity)]TJ /F3 1 Tf 0 -1.111 TD .0007 Tw [(Use multiple sets of technical standards,)-10.3( )]TJ T* -.0093 Tc .0003 Tw [(different technologies, and different)-9.8( )]TJ T* -.0008 Tw [(ar)9.7(chitectur)19.7(al patterns.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5907 303.189 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0006 303.189 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Use auditing/logging systems on different OSs t)9.1(o)0( acquire and st)9.1(ore)-10.1( )]TJ .219 -1.111 TD (audit/logging data.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5907 283.1909 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0006 283.1909 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.5(Apply different audit/logging regimes at different ar)9.7(chitectur)19.6(al layers.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5907 273.192 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0006 273.192 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.8(Deploy diverse oper)19.5(ating systems.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5907 263.1929 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0006 263.1929 Tm 0 0 0 1 k -.0096 Tc .0006 Tw [( )219.8(Suppor)-23.8(t)-.2( multiple pr)9.3(ot)8.8(ocol standards.)]TJ /F2 1 Tf -17.834 -1.937 TD -.0003 Tw (Design diversity)Tj /F3 1 Tf 0 -1.111 TD -.0094 Tc .0004 Tw [(Use different designs t)9(o)-.2( meet the same)-10.2( )]TJ T* [(requirements or pr)9.5(o)8(v)-.5(ide equiv)7.5(a).1(lent)-9.9( )]TJ T* 0 Tw [(functionality.)-9.3( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5907 245.7599 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0006 245.7599 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Employ N-version pr)9.6(ogr)19.7(a).2(mming.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5907 235.761 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0006 235.761 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.5(Employ mixed-signal design diversity \(using both analog and digital)-9.9( )]TJ .219 -1.111 TD 0 Tw (signals\).)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5907 215.763 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0006 215.763 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.9(Employ mixed-le)6.1(vel design diversity \(using both hardware and software)-10( )]TJ .219 -1.111 TD 0 Tw (implementations\).)Tj /F2 1 Tf -18.053 -1.937 TD -.0097 Tc -.0003 Tw (Synthetic diversity)Tj /F3 1 Tf 0 -1.111 TD -.0094 Tc .0004 Tw [(T)37.6(r)19.5(ansform implementations of software t)9.1(o)-9.1( )]TJ T* .0005 Tw [(pr)9.3(oduce a v)7.3(a)0(riety of instances.)-9.6( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5907 188.3309 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0006 188.3309 Tm 0 0 0 1 k -.0094 Tc -.0007 Tw [( )219.4(Implement address space layout r)19.5(a).1(ndomization.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5907 178.332 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0006 178.332 Tm 0 0 0 1 k -.0095 Tc -.0006 Tw [( )219.3(Use r)19.3(a)-.5(ndomizing compilers.)]TJ /F2 1 Tf -17.834 -3.048 TD -.0098 Tc -.0002 Tw (Information diversity)Tj /F3 1 Tf 0 -1.111 TD -.0094 Tc .0004 Tw [(Pr)9.5(o)7.9(v)-.5(ide information fr)9.6(om different sour)9.5(ces)-9.2( )]TJ T* [(or tr)19.5(ansform information in different ways.)-9.4( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5907 150.9 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0006 150.9 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Apply different analog-t)9.2(o).5(-digital conversion methods t)9.3(o)-.1( non-digitally-)]TJ .219 -1.111 TD (obtained data.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5907 130.9019 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0006 130.9019 Tm 0 0 0 1 k -.0095 Tc .0005 Tw [( )219.5(Use multiple data sour)9.4(ces.)]TJ /F2 1 Tf -17.834 -1.9371 TD -.0096 Tc .0007 Tw [(P)6(a)-.2(th diversity)]TJ /F3 1 Tf 0 -1.111 TD -.0095 Tc .0005 Tw [(Pr)9.3(o)7.7(v)-.7(ide multiple independent paths for)-9.7( )]TJ T* [(command, contr)9.6(ol and communications.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5907 113.468 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0006 113.468 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Establish alternate telecommunications ser)-8.5(v)-.5(ices \(e.g., gr)9.6(ound-based)-9.7( )]TJ .219 -1.111 TD [(cir)9.5(c)0(uits, satellite communications\).)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5907 93.4699 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0006 93.4699 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.5(Employ alternate communications pr)9.6(ot)9.3(ocols.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5907 83.4709 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0006 83.4709 Tm 0 0 0 1 k -.0095 Tc .0005 Tw [( )219.6(Use out-of-band channels.)]TJ /F2 1 Tf -17.834 -1.9369 TD -.0097 Tc -.0003 Tw (Supply chain diversity)Tj /F3 1 Tf 0 -1.111 TD .0006 Tw [(Use multiple independent supply chains)-9.5( )]TJ T* -.0095 Tc .0005 Tw [(for critical components.)-9.5( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 306.5907 66.039 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.0006 66.039 Tm 0 0 0 1 k -.0095 Tc .0005 Tw [( )219.7(Use a diverse set of suppliers.)]TJ ET EMC Q endstream endobj 355 0 obj <>/ExtGState<>>> endobj 369 0 obj <> endobj 371 0 obj <>stream /P <>BDC q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS2 gs BT /TT2 1 Tf 7 0 0 7 490.9954 20.9379 Tm 0 0 0 1 k 0 Tc 0 Tw (ISACA )Tj ET EMC /P <>BDC BT 7 0 0 7 512.4738 20.9379 Tm (JOURNAL)Tj ET EMC /P <>BDC /GS1 gs BT 7 0 0 7 543.321 20.9379 Tm .761 .549 .11 0 k [( V)6.3(OL 3)]TJ ET EMC /Artifact <>BDC 0 0 0 1 k /GS2 gs 572.364 .014984 .51599 31.274 re f EMC /P <>BDC /GS1 gs BT 7 0 0 7 587.3827 20.9379 Tm .761 .549 .11 0 k (9)Tj ET EMC /P <>BDC /GS2 gs BT 7 0 0 7 36.9471 21.3673 Tm 0 0 0 1 k [( 2021 ISACA. All rights reser)-8.8(ved. )]TJ ET EMC /P <>BDC BT /TT4 1 Tf 7 0 0 7 144.579 21.3673 Tm [(www)60.5(.isaca.org)]TJ ET EMC /Figure <>BDC Q .76471 .54118 .098039 .007843 k /GS1 gs 37.38 729.837 533 18.479 re f .78824 .85098 .17255 .043137 k 1 i 37.38 729.838 109.9 -17.431 re 147.28 729.838 156.1 -17.431 re 303.38 729.838 267 -17.431 re f q 36.88 748.316 534 -657.632 re W n .15686 .1098 .031373 0 k 37.38 712.406 109.9 -257.152 re 37.38 455.254 109.9 -142.293 re 37.38 312.961 109.9 -222.292 re f .082353 .011765 .007843 0 k 147.28 712.406 156.1 -47.431 re 147.28 664.975 156.1 -57.43 re 147.28 607.546 156.1 -67.432 re 147.28 540.114 156.1 -37.431 re 147.28 502.683 156.1 -47.431 re 147.28 455.254 156.1 -47.431 re 147.28 407.823 156.1 -47.432 re 147.28 360.391 156.1 -47.431 re 147.28 312.961 156.1 -57.43 re 147.28 255.531 156.1 -67.431 re 147.28 188.099 156.1 -97.432 re f .16863 .031373 .023529 0 k 303.38 712.406 267 -47.431 re 303.38 664.975 267 -57.43 re 303.38 607.546 267 -67.432 re 303.38 540.114 267 -37.431 re 303.38 502.683 267 -47.431 re 303.38 455.254 267 -47.431 re 303.38 407.823 267 -47.432 re 303.38 360.391 267 -47.431 re 303.38 312.961 267 -57.43 re 303.38 255.531 267 -67.431 re 303.38 188.099 267 -97.432 re f 0 0 0 1 K 0 J 0 j 1 w 10 M [] 0 d /GS2 gs q 1 0 0 1 37.38 729.837 cm 0 0 m 0 18.479 l S 1 0 0 1 533 0 cm 0 0 m 0 18.479 l S 1 0 0 1 -533 -16.931 cm 0 0 m 0 16.931 l S 1 0 0 1 533 0 cm 0 0 m 0 16.931 l S Q Q 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d q 1 0 0 1 37.88 729.837 cm 0 0 m 265.5 0 l S 1 0 0 1 265.5 0 cm 0 0 m 266.5 0 l S Q 1 w q 1 0 0 1 303.38 664.976 cm 0 0 m 267 0 l S 1 0 0 1 0 -57.431 cm 0 0 m 267 0 l S 1 0 0 1 0 -67.431 cm 0 0 m 267 0 l S 1 0 0 1 0 -37.43 cm 0 0 m 267 0 l S 1 0 0 1 0 -47.431 cm 0 0 m 267 0 l S 1 0 0 1 0 -47.43 cm 0 0 m 267 0 l S 1 0 0 1 0 -47.431 cm 0 0 m 267 0 l S 1 0 0 1 0 -47.431 cm 0 0 m 267 0 l S 1 0 0 1 0 -57.43 cm 0 0 m 267 0 l S 1 0 0 1 0 -67.431 cm 0 0 m 267 0 l S 1 0 0 1 0 477.376 cm 0 0 m 0 46.431 l S 1 0 0 1 -156.6 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 156.6 -56.931 cm 0 0 m 0 56.431 l S 1 0 0 1 -156.6 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 156.6 -66.931 cm 0 0 m 0 66.432 l S 1 0 0 1 -156.6 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 156.6 -36.93 cm 0 0 m 0 36.431 l S 1 0 0 1 -156.6 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 156.6 -46.931 cm 0 0 m 0 46.431 l S 1 0 0 1 -156.1 -.5 cm 0 0 m 156.1 0 l S 1 0 0 1 156.1 -46.93 cm 0 0 m 0 46.431 l S 1 0 0 1 -156.6 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 156.6 -46.931 cm 0 0 m 0 46.431 l S 1 0 0 1 -156.6 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 156.6 -46.931 cm 0 0 m 0 46.431 l S 1 0 0 1 -156.1 -.5 cm 0 0 m 156.1 0 l S 1 0 0 1 156.1 -56.93 cm 0 0 m 0 56.43 l S 1 0 0 1 -156.6 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 156.6 -66.931 cm 0 0 m 0 66.431 l S 1 0 0 1 -156.6 -.5 cm 0 0 m 156.6 0 l S Q q 36.88 748.316 534 -657.632 re W n q 1 0 0 1 303.38 90.669 cm 0 0 m 0 96.931 l S Q Q q 1 0 0 1 147.28 665.476 cm 0 0 m 0 46.431 l S 1 0 0 1 0 -57.431 cm 0 0 m 0 56.431 l S 1 0 0 1 0 -67.431 cm 0 0 m 0 66.432 l S 1 0 0 1 0 -37.43 cm 0 0 m 0 36.431 l S 1 0 0 1 0 -47.431 cm 0 0 m 0 46.431 l S 1 0 0 1 0 -47.43 cm 0 0 m 0 46.431 l S 1 0 0 1 0 -47.431 cm 0 0 m 0 46.431 l S 1 0 0 1 0 -47.431 cm 0 0 m 0 46.431 l S 1 0 0 1 0 -57.43 cm 0 0 m 0 56.43 l S 1 0 0 1 0 -67.431 cm 0 0 m 0 66.431 l S Q q 36.88 748.316 534 -657.632 re W n q 1 0 0 1 147.28 90.669 cm 0 0 m 0 96.931 l S Q Q q 1 0 0 1 37.38 455.253 cm 0 0 m 109.9 0 l S 1 0 0 1 0 -142.292 cm 0 0 m 109.9 0 l S Q q 36.88 748.316 534 -657.632 re W n q 1 0 0 1 36.88 712.406 cm 0 0 m 110.4 0 l S Q Q q 1 0 0 1 147.28 712.406 cm 0 0 m 156.1 0 l S Q q 36.88 748.316 534 -657.632 re W n q 1 0 0 1 303.38 712.406 cm 0 0 m 267.5 0 l S Q Q q 1 0 0 1 147.28 712.906 cm 0 0 m 0 15.931 l S 1 0 0 1 156.1 0 cm 0 0 m 0 15.931 l S Q BT /F2 1 Tf 10 0 0 10 216.641 733.8367 Tm 0 0 0 0 k -.015 Tc .023 Tw [(Figure 4Cyberresiliency Appr)17.7(oaches)]TJ /F6 1 Tf 14.6525 0 TD .022 Tw [( \(cont.\))]TJ /F2 1 Tf 9 0 0 9 71.8566 716.4058 Tm -.0098 Tc 0 Tw [(Techniques)-10177.3(A)-.6(ppr)17.8(oaches)-19295.9(Examples)]TJ ET /GS2 gs BT 9 0 0 9 41.3736 698.9733 Tm 0 0 0 1 k -.0096 Tc -.0004 Tw (Dynamic positioning)Tj /F3 1 Tf 0 -1.111 TD [(Distribute and dynamically)-9.6( )]TJ T* -.0094 Tc .0004 Tw [(relocate functionality or)-9.5( )]TJ T* -.0097 Tc -.0004 Tw [(system resour)8.9(ces.)]TJ /F2 1 Tf 12.211 3.333 TD -.01 Tc 0 Tw [(F)10(u)-.1(nctional relocation of sensors)]TJ /F3 1 Tf 0 -1.111 TD -.0094 Tc -.0007 Tw [(Relocate sensors or reallocate)-10( )]TJ T* .0004 Tw [(responsibility for specific sensing tasks t)9.2(o)-9.1( )]TJ T* [(look for indicat)9.2(o).1(rs of adverse e)6.1(v)-.5(ents.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.368 698.9727 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.778 698.9727 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.5(Relocate \(using vir)-23.3(t).1(ualization\) or reconfigure IDSs or IDS sensors.)]TJ /F2 1 Tf -17.8339 -5.27 TD -.0099 Tc -.0001 Tw [(F)10(unctional relocation of cyberresour)9.5(ces)]TJ /F3 1 Tf 0 -1.111 TD -.0095 Tc -.0006 Tw [(Change the location of cyberresour)9.4(ces)-9.3( )]TJ T* .0004 Tw [(that pr)9.6(o)8.1(v)-.5(ide functionality or information,)-9.8( )]TJ T* [(either by mo)7.8(ving the assets or by)-9.3( )]TJ T* [(tr)19.6(ansferring functional responsibility.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.368 651.5426 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.778 651.5426 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Change pr)9.8(ocessing locations \(e.g., switch t)9.4(o).2( a vir)-23.3(t).1(ual machine on a)-9.7( )]TJ .219 -1.111 TD (different physical component\).)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.368 631.5452 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.778 631.5452 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.8(Change st)9.3(or)19.6(age sites \(e.g., switch t)9.2(o).1( an alternate data st)9.3(ore on a)-9.8( )]TJ .219 -1.1111 TD [(different st)9.2(or)19.5(age area network\).)]TJ /F2 1 Tf -18.0529 -3.0479 TD -.0096 Tc -.0004 Tw (Asset mobility)Tj /F3 1 Tf 0 -1.111 TD -.0098 Tc .0008 Tw [(Securely mo)7.4(ve physical resour)9.1(ces.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.368 594.114 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.778 594.114 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Mo)8(ve a mobile de)6(vice or system component \(e.g., a r)9.5(o)-.1(uter\) fr)9.5(om one)-10.1( )]TJ .219 -1.111 TD [(r)9.4(oom in a facility t)9.2(o)-.1( another while monit)9.2(oring its mo)8(vement.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.368 574.1161 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.778 574.1161 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Mo)8(ve st)9.1(or)19.4(age media securely fr)9.5(om one r)9.4(oom or facility t)9.2(o)0( another r)9.5(oom)-9.5( )]TJ .219 -1.111 TD (or facility.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.368 554.1182 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.778 554.1182 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Mo)8.2(ve a platform or vehicle t)9.4(o).2( a)7.3(v)7.6(oid collision or other physical harm,)-9.7( )]TJ .219 -1.111 TD (while retaining knowledge of its location.)Tj /F2 1 Tf -18.0529 -1.937 TD -.0098 Tc 0 Tw [(F)12.2(r)14.7(agmentation)]TJ /F3 1 Tf 0 -1.111 TD -.0094 Tc -.0007 Tw [(F)12.7(r)19.5(agment information and distribute it)-9.9( )]TJ T* .0004 Tw [(acr)9.5(o)0(ss multiple components.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.368 526.686 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.778 526.686 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.9(Implement fr)19.5(agmentation and par)-23.5(t).3(itioning for distributed databases.)]TJ /F2 1 Tf -17.8339 -4.1591 TD -.0096 Tc -.0004 Tw (Distributed functionality)Tj /F3 1 Tf 0 -1.111 TD -.0095 Tc -.0006 Tw [(Decompose a function or application int)9.2(o)-9( )]TJ T* .0004 Tw [(smaller functions and distribute those)-10.1( )]TJ T* [(functions acr)9.7(o)0(ss multiple components.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.368 489.2541 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.778 489.2541 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Ar)9.6(chitect applications so that constituent functions can be located on)-9.1( )]TJ .219 -1.111 TD (different system components.)Tj /F2 1 Tf -30.265 -4.159 TD -.0099 Tc 0 Tw (Non-persistence)Tj /F3 1 Tf 0 -1.111 TD -.0095 Tc .0005 Tw [(Gener)19.3(a)1(te and retain)-9.4( )]TJ T* -.0006 Tw [(resour)9.3(ces as needed or for a)-9( )]TJ T* -.0099 Tc -.0002 Tw (limited time.)Tj /F2 1 Tf 12.2111 3.333 TD -.0001 Tw (Non-persistent information)Tj /F3 1 Tf 0 -1.111 TD -.0094 Tc .0004 Tw [(Refresh information periodically, or)-9.4( )]TJ T* [(gener)19.6(a)-.9(te information on demand and)-9.7( )]TJ T* (delete it when no longer needed.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.359 441.8241 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.77 441.8241 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.9(Delete high-v)7.4(alue mission information after it is pr)9.8(ocessed.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.359 431.825 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.77 431.825 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.6(Off-load audit records t)9.2(o).1( off-line st)9.3(or)19.6(age.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.359 421.8261 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.77 421.8261 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Use one-time passwords or nonces.)]TJ /F2 1 Tf -17.834 -3.048 TD -.0099 Tc -.0001 Tw [(Non-persistent ser)-8.5(v).2(ices)]TJ /F3 1 Tf 0 -1.111 TD -.0093 Tc .0003 Tw [(Refresh ser)-8.4(v)-.4(ices periodically, or gener)19.7(a)-.8(te)-10( )]TJ T* [(ser)-8.3(vices on demand and terminate)-9.9( )]TJ T* [(ser)-8.3(vices when no longer needed.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.359 394.394 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.77 394.394 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.8(Employ time-based or inactivity-based session termination.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.359 384.3952 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.77 384.3952 Tm 0 0 0 1 k -.0095 Tc -.0006 Tw [( )218.9(Re-image components.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.359 374.396 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.77 374.396 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Refresh ser)-8.5(v)-.4(ices using vir)-23.4(t).1(ualization.)]TJ /F2 1 Tf -17.834 -3.048 TD -.0098 Tc -.0002 Tw (Non-persistent connectivity)Tj /F3 1 Tf 0 -1.111 TD -.0094 Tc .0004 Tw [(Establish connections on demand, and)-9.6( )]TJ T* [(terminate connections when no longer)-9.3( )]TJ T* -.0098 Tc 0 Tw (needed.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.359 346.9642 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.77 346.9642 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Implement software-defined networking.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.359 336.9651 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.77 336.9651 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Employ time-based or inactivity-based network disconnection.)]TJ /F2 1 Tf -30.046 -4.159 TD .0005 Tw (Privilege restriction)Tj /F3 1 Tf 0 -1.111 TD -.0098 Tc .0008 Tw [(Restrict privileges based)-10.3( )]TJ T* -.0004 Tw [(on attributes of users and)-10.1( )]TJ T* .0007 Tw [(system elements as well as)-9.7( )]TJ T* -.0094 Tc -.0007 Tw [(on envir)9.6(o).4(nmental fact)9.2(ors.)]TJ /F2 1 Tf 12.211 4.444 TD -.0098 Tc -.0002 Tw [(T)31.4(r)-.2(ust-based privilege management)]TJ /F3 1 Tf 0 -1.111 TD -.0093 Tc .0003 Tw [(Define, assign and maintain privileges)-9.1( )]TJ T* [(associated with active entities based on)-9( )]TJ T* [(established trust criteria consistent with)-9.1( )]TJ T* (principles of least privilege.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.351 299.5341 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.761 299.5341 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Implement least privilege.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.351 289.5352 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.761 289.5352 Tm 0 0 0 1 k -.0094 Tc .0004 Tw ( Employ time-based account restrictions.)Tj /F2 1 Tf -17.834 -5.27 TD -.0097 Tc -.0003 Tw [(A)7.7(ttribute-based usage restriction)]TJ /F3 1 Tf 0 -1.111 TD -.0093 Tc .0003 Tw [(Define, assign, maintain and apply usage)-10( )]TJ T* (restrictions on systems containing )Tj T* [(cyber)-9.5(r).5(esour)9.5(c)0(es based on the criticality of)-10( )]TJ T* [(missions or business functions and other)-9.4( )]TJ T* -.0095 Tc .0005 Tw (attributes \(e.g., data sensitivity\).)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.351 242.1142 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.761 242.1142 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( Employ r)9.6(o).4(le-based access contr)9.6(ol \(RBAC)12.5(\))0(.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.351 232.1151 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.761 232.1151 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( Employ attribute-based access contr)9.5(ol \(ABAC)12.5(\))-.1(.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.351 222.116 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.761 222.116 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( Restrict the use of maintenance t)9.3(o).1(ols.)]TJ /F2 1 Tf -17.834 -5.2701 TD -.0095 Tc .0006 Tw (Dynamic privileges)Tj /F3 1 Tf 0 -1.1109 TD -.0093 Tc .0003 Tw [(Ele)6.1(v)7.5(ate or decrease privileges assigned)-9.6( )]TJ 0 -1.1111 TD -.0095 Tc .0005 Tw [(t)9(o)-.2( a user)60.3(, pr)9.4(ocess or ser)-8.7(v)-.7(ice based on)-9.4( )]TJ 0 -1.1109 TD .0004 Tw [(tr)19.6(ansient or contextual fact)9.3(ors.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.351 174.6852 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.761 174.6852 Tm 0 0 0 1 k -.0095 Tc .0005 Tw [( )219.7(Implement time-based adjustment t)9(o)-.2( privileges due t)9.1(o)-.4( status of mission)-9.4( )]TJ .219 -1.111 TD .0004 Tw (or business tasks.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.351 154.687 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.761 154.687 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.8(Employ dynamic account pr)9.7(o)8(visioning.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.351 144.6881 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.761 144.6881 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Disable privileges based on a determination that an individual or pr)9.7(ocess)-9( )]TJ .219 -1.111 TD (is high-risk.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.351 124.6902 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.761 124.6902 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Implement dynamic re)5.9(v)7.6(o)0(cation of access authorizations.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.351 114.6911 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.761 114.6911 Tm 0 0 0 1 k -.0095 Tc -.0006 Tw [( )219.4(Implement dynamic association of attributes with cyberresour)9.5(ces and)-9.8( )]TJ .219 -1.1109 TD -.0092 Tc .0002 Tw (active entities.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 307.351 94.694 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 311.761 94.694 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.8(Implement dynamic credential binding.)]TJ ET EMC endstream endobj 372 0 obj <>/ExtGState<>>> endobj 386 0 obj <> endobj 388 0 obj <>stream /P <>BDC q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS2 gs BT /TT2 1 Tf 7 0 0 7 39.4019 20.9698 Tm 0 0 0 1 k 0 Tc 0 Tw (ISACA )Tj ET EMC /P <>BDC BT 7 0 0 7 60.8804 20.9698 Tm (JOURNAL)Tj ET EMC /P <>BDC /GS1 gs BT 7 0 0 7 91.7275 20.9698 Tm .761 .549 .11 0 k [( V)6.3(OL 3)]TJ ET EMC /Artifact <>BDC 0 0 0 1 k /GS2 gs 30.069 .014984 .51505 31.516 re f EMC /P <>BDC /GS1 gs BT 7 0 0 7 10.8984 20.9698 Tm .761 .549 .11 0 k (10)Tj ET EMC /P <>BDC /GS2 gs BT 7 0 0 7 415.3383 21.3673 Tm 0 0 0 1 k [( 2021 ISACA. All rights reser)-8.8(ved. )]TJ ET EMC /P <>BDC BT /TT4 1 Tf 7 0 0 7 522.9701 21.3673 Tm [(www)60.5(.isaca.org)]TJ ET EMC /Figure <>BDC Q .76471 .54118 .098039 .007843 k /GS1 gs 32.084 728.521 533 18.479 re f .78824 .85098 .17255 .043137 k 1 i 32.084 728.522 109.9 -17.431 re 141.984 728.522 156.1 -17.431 re 298.084 728.522 267 -17.431 re f .15686 .1098 .031373 0 k 32.084 711.091 109.9 -277.153 re 32.084 433.938 109.9 -192.292 re 32.084 241.646 109.9 -194.862 re f q 565.584 747 -534 -700.216 re 31.584 747 m W n 31.584 747 534 -700.216 re W n .082353 .011765 .007843 0 k 141.984 711.091 156.1 -57.431 re 141.984 653.66 156.1 -57.43 re 141.984 596.23 156.1 -57.431 re 141.984 538.799 156.1 -47.432 re 141.984 491.367 156.1 -57.43 re 141.984 433.938 156.1 -77.431 re 141.984 356.507 156.1 -37.432 re 141.984 319.075 156.1 -77.43 re 141.984 241.646 156.1 -137.431 re 141.984 104.215 156.1 -57.432 re f .16863 .031373 .023529 0 k 298.084 711.091 267 -57.431 re 298.084 653.66 267 -57.43 re 298.084 596.23 267 -57.431 re 298.084 538.799 267 -47.432 re 298.084 491.367 267 -57.43 re 298.084 433.938 267 -77.431 re 298.084 356.507 267 -37.432 re 298.084 319.075 267 -77.43 re 298.084 241.646 267 -137.431 re 298.084 104.215 267 -57.432 re f 0 0 0 1 K 0 J 0 j 1 w 10 M [] 0 d /GS2 gs q 1 0 0 1 32.084 728.521 cm 0 0 m 0 18.479 l S 1 0 0 1 533 0 cm 0 0 m 0 18.479 l S 1 0 0 1 -533 -16.931 cm 0 0 m 0 16.931 l S 1 0 0 1 533 0 cm 0 0 m 0 16.931 l S Q Q 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d q 1 0 0 1 32.584 728.521 cm 0 0 m 265.5 0 l S 1 0 0 1 265.5 0 cm 0 0 m 266.5 0 l S Q 1 w q 1 0 0 1 141.984 654.16 cm 0 0 m 0 56.431 l S 1 0 0 1 -.5 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 .5 -56.931 cm 0 0 m 0 56.431 l S 1 0 0 1 -.5 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 .5 -56.93 cm 0 0 m 0 56.43 l S 1 0 0 1 -.5 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 .5 -46.931 cm 0 0 m 0 46.431 l S 1 0 0 1 -.5 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 .5 -56.931 cm 0 0 m 0 56.431 l S 1 0 0 1 0 -.5 cm 0 0 m 156.1 0 l S 1 0 0 1 0 -76.93 cm 0 0 m 0 76.43 l S 1 0 0 1 -.5 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 .5 -36.932 cm 0 0 m 0 36.432 l S 1 0 0 1 -.5 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 .5 -76.93 cm 0 0 m 0 76.431 l S 1 0 0 1 0 -.5 cm 0 0 m 156.1 0 l S 1 0 0 1 0 -136.931 cm 0 0 m 0 136.432 l S 1 0 0 1 -.5 -.5 cm 0 0 m 156.6 0 l S Q q 565.584 747 -534 -700.216 re 31.584 747 m W n 31.584 747 534 -700.216 re W n q 1 0 0 1 141.984 46.783 cm 0 0 m 0 56.932 l S Q Q q 1 0 0 1 298.084 491.868 cm 0 0 m 0 46.431 l S 1 0 0 1 0 -57.431 cm 0 0 m 0 56.431 l S 1 0 0 1 0 -77.43 cm 0 0 m 0 76.43 l S 1 0 0 1 0 -37.432 cm 0 0 m 0 36.432 l S 1 0 0 1 0 -77.43 cm 0 0 m 0 76.431 l S 1 0 0 1 0 -137.431 cm 0 0 m 0 136.432 l S Q q 565.584 747 -534 -700.216 re 31.584 747 m W n 31.584 747 534 -700.216 re W n q 1 0 0 1 298.084 46.783 cm 0 0 m 0 56.932 l S Q Q q 1 0 0 1 298.084 491.368 cm 0 0 m 267 0 l S 1 0 0 1 0 -57.431 cm 0 0 m 267 0 l S 1 0 0 1 0 -77.43 cm 0 0 m 267 0 l S 1 0 0 1 0 -37.432 cm 0 0 m 267 0 l S 1 0 0 1 0 -77.43 cm 0 0 m 267 0 l S 1 0 0 1 0 -137.431 cm 0 0 m 267 0 l S 1 0 0 1 0 549.946 cm 0 0 m 0 56.431 l S 1 0 0 1 0 -57.431 cm 0 0 m 0 56.431 l S 1 0 0 1 0 -57.43 cm 0 0 m 0 56.43 l S 1 0 0 1 0 114.361 cm 0 0 m 267 0 l S 1 0 0 1 0 -57.431 cm 0 0 m 267 0 l S 1 0 0 1 0 -57.43 cm 0 0 m 267 0 l S 1 0 0 1 -266 -297.154 cm 0 0 m 109.9 0 l S 1 0 0 1 0 192.292 cm 0 0 m 109.9 0 l S Q q 565.584 747 -534 -700.216 re 31.584 747 m W n 31.584 747 534 -700.216 re W n q 1 0 0 1 31.584 711.091 cm 0 0 m 110.4 0 l S Q Q q 1 0 0 1 141.984 711.091 cm 0 0 m 156.1 0 l S Q q 565.584 747 -534 -700.216 re 31.584 747 m W n 31.584 747 534 -700.216 re W n q 1 0 0 1 298.084 711.091 cm 0 0 m 267.5 0 l S Q Q q 1 0 0 1 141.984 711.591 cm 0 0 m 0 15.931 l S 1 0 0 1 156.1 0 cm 0 0 m 0 15.931 l S Q BT /F2 1 Tf 10 0 0 10 211.3464 732.5204 Tm 0 0 0 0 k -.015 Tc .022 Tw [(Figure 4Cyberresiliency Appr)17.8(oaches)]TJ /F6 1 Tf 14.6524 0 TD [( \(cont.\))]TJ /F2 1 Tf 9 0 0 9 66.561 715.0897 Tm -.0098 Tc 0 Tw [(Techniques)-10177.3(A)-.6(ppr)18(oaches)-19295.9(Examples)]TJ ET /GS2 gs BT 9 0 0 9 36.078 697.6572 Tm 0 0 0 1 k (Realignment)Tj /F3 1 Tf 0 -1.111 TD -.0095 Tc .0005 Tw [(Align system resour)9.3(ces)-9.4( )]TJ T* .0004 Tw [(with current organizational)-9.8( )]TJ T* -.0006 Tw [(mission or business function)-9.3( )]TJ T* -.0098 Tc -.0003 Tw [(needs t)8.5(o)-.7( reduce risk.)]TJ /F2 1 Tf 12.211 4.444 TD 0 Tw (Purposing)Tj /F3 1 Tf 0 -1.111 TD -.0049 Tw [(Ensure systems containing cyberresour)9.1(ces)-9.5( )]TJ T* -.0093 Tc .0003 Tw [(are used consistently with mission or)-9.3( )]TJ T* [(business function purposes and appr)9.5(o)7.9(v)-.6(ed)-9.6( )]TJ T* 0 Tw (uses.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0734 697.6566 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4824 697.6566 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.8(Use whitelisting t)9.4(o).2( pre)6.1(vent installation of such unappr)9.6(o)8.1(v)-.4(ed applications)-8.9( )]TJ .2191 -1.111 TD [(as games or peer-t)9.2(o-peer music sharing.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0734 677.6587 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4824 677.6587 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.6(Use whitelisting t)9.4(o).2( restrict communications t)9.4(o).1( a specified set of)-9.8( )]TJ .2191 -1.111 TD -.0096 Tc 0 Tw (addresses.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0734 657.6605 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4824 657.6605 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Ensure that privileged accounts are not used for nonprivileged functions.)]TJ /F2 1 Tf -17.8339 -1.937 TD 0 Tw (Offloading)Tj /F3 1 Tf 0 -1.111 TD .0004 Tw [(Offload suppor)-23.5(t)0(ive but nonessential)-9.9( )]TJ T* -.0006 Tw [(functions t)9.2(o)-.1( other systems or t)9.2(o)0( an)-9.2( )]TJ T* .0003 Tw [(external pr)9.6(o)8.1(v)-.4(ider that is better able t)9.2(o)-9( )]TJ T* .0005 Tw [(suppor)-23.5(t)0( the functions.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0734 640.2279 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4824 640.2279 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.5(Outsour)9.6(c).1(e nonessential ser)-8.3(v)-.5(ices t)9.2(o)0( a managed ser)-8.5(v)-.4(ice pr)9.6(o)8.1(v)-.5(ider)60.5(.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0734 630.2289 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4824 630.2289 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Impose requirements on and per)-7.6(f)-.1(orm o)8(v)-.7(ersight of external system)-9.5( )]TJ .2191 -1.1111 TD -.0092 Tc 0 Tw [(ser)-8.2(vices.)]TJ /F2 1 Tf -18.053 -4.1589 TD -.0096 Tc (Restriction)Tj /F3 1 Tf 0 -1.111 TD -.0093 Tc .0003 Tw [(Remo)8.1(ve or disable unneeded functionality)-9.1( )]TJ T* -.0095 Tc -.0006 Tw [(or connectivity, or add mechanisms t)9.2(o)-9.1( )]TJ T* -.0093 Tc .0003 Tw [(reduce the chance of vulner)19.7(ability or)-9.3( )]TJ T* -.0097 Tc 0 Tw (failure.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0734 582.798 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4824 582.798 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.5(Configure the system t)9.3(o).1( pr)9.7(o)8.1(v)-.4(ide only essential capabilities.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0734 572.799 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4824 572.799 Tm 0 0 0 1 k -.0094 Tc -.0007 Tw [( )219.3(Minimize nonsecurity functionality.)]TJ /F2 1 Tf -17.8339 -5.27 TD -.0099 Tc 0 Tw (Replacement)Tj /F3 1 Tf 0 -1.111 TD -.0093 Tc .0003 Tw [(Replace low-assur)19.8(a)-.6(nce or poorly)-8.9( )]TJ T* [(underst)9.1(ood implementations with more)-10.1( )]TJ T* -.0096 Tc .0006 Tw [(trustwor)-23.8(thy implementations.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0734 525.3689 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4824 525.3689 Tm 0 0 0 1 k -.0095 Tc .0005 Tw [( )219.6(Remo)7.8(ve or replace unsuppor)-23.6(t)-.1(ed system components t)9(o)-.3( reduce risk.)]TJ /F2 1 Tf -17.8339 -5.27 TD -.0096 Tc 0 Tw (Specialization)Tj /F3 1 Tf 0 -1.111 TD -.0095 Tc -.0006 Tw [(Modify the design of, augment, or)-9.5( )]TJ T* .0004 Tw [(configure critical cyberresour)9.5(ces uniquely)-9.3( )]TJ T* [(for the mission or business function t)9.1(o)-9.1( )]TJ T* .0005 Tw [(impr)9.4(o)7.9(v)-.7(e trustwor)-23.6(thiness.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0734 477.939 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4824 477.939 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Re-implement or cust)9.3(om de)6.1(velop critical components.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0734 467.9399 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4824 467.9399 Tm 0 0 0 1 k -.0096 Tc -.0005 Tw [( )219.4(De)5.6(velop cust)8.8(om system elements co)7.6(ver)-23.8(tly.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0734 457.941 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4824 457.941 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.8(Define and apply cust)9.3(omized configur)19.6(ations.)]TJ /F2 1 Tf -30.0459 -4.159 TD 0 Tw (Redundancy)Tj /F3 1 Tf 0 -1.111 TD -.0096 Tc .0006 Tw [(Pr)9.2(o)7.6(v)-.8(ide multiple pr)9.2(otected)-10( )]TJ T* -.0093 Tc .0003 Tw [(instances of critical)-9.8( )]TJ T* 0 Tw [(resour)9.5(ces.)]TJ /F2 1 Tf 12.211 3.333 TD -.0098 Tc -.0002 Tw [(Pr)17.6(otected backup and rest)14.6(ore)]TJ /F3 1 Tf 0 -1.111 TD -.0094 Tc .0004 Tw [(Back up information and software)-10( )]TJ T* -.0006 Tw [(\(including configur)19.7(ation data and)-9.6( )]TJ T* -.0092 Tc .0002 Tw [(vir)-23.2(t).4(ualized resour)9.8(ces\) in a way that)-9.6( )]TJ T* .0003 Tw [(pr)9.6(otects its confidentiality, integrity and)-9.6( )]TJ T* [(authenticity, and enable rest)9.3(or)19.7(ation in)-9( )]TJ T* -.0095 Tc .0005 Tw [(case of disruption or corruption.)-9.4( )]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0634 420.5189 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4744 420.5189 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.5(Retain pre)5.7(v)-.5(ious baseline configur)19.5(ations.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0634 410.5199 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4744 410.5199 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.5(Maintain and pr)9.4(otect system le)6(vel backup information \(e.g., oper)19.5(ating)-8.8( )]TJ .2189 -1.111 TD [(system, application software, system configur)19.7(ation data\).)]TJ /F2 1 Tf -18.0529 -6.381 TD -.0097 Tc -.0003 Tw (Surplus capacity)Tj /F3 1 Tf 0 -1.111 TD -.0093 Tc .0003 Tw [(Maintain extr)19.8(a capacity for information)-9( )]TJ T* -.0095 Tc -.0006 Tw [(st)9.1(or)19.5(age, pr)9.6(ocessing or communications.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0634 343.092 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4744 343.092 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Maintain spare par)-23.4(t).2(s \(i.e., system components\).)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0634 333.093 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4744 333.093 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.6(Address surplus capacity in ser)-8.5(v)-.4(ice le)6.1(vel agreements with external)-9.8( )]TJ .2189 -1.111 TD -.0095 Tc 0 Tw (systems.)Tj /F2 1 Tf -18.0529 -1.937 TD -.0096 Tc (Replication)Tj /F3 1 Tf 0 -1.111 TD -.0094 Tc .0004 Tw [(Duplicate hardware, information, backups)-9.2( )]TJ T* -.0007 Tw [(or functionality in multiple locations, and)-9.7( )]TJ T* .0005 Tw [(keep them synchr)9.3(onized.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0634 305.6609 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4744 305.6609 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.5(Pr)9.6(o)8.1(v)-.4(ide alternate audit capability.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0634 295.662 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4744 295.662 Tm 0 0 0 1 k -.0093 Tc -.2197 Tw [( )-218.9( Maintain )-219(shadow )-219.9(database.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0634 285.6629 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4744 285.6629 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.5(Maintain one or more alternate st)9.3(or)19.6(age sites.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0634 275.6639 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4744 275.6639 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.5(Maintain one or more alternate pr)9.7(ocessing sites.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0634 265.6649 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4744 265.6649 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.6(Maintain a redundant secondary system.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0634 255.666 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4744 255.666 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.8(Pr)9.6(o)8.1(v)-.4(ide alternative security mechanisms.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0634 245.6669 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4744 245.6669 Tm 0 0 0 1 k -.0095 Tc .0005 Tw [( )219.8(Implement a redundant name and address resolution ser)-8.8(v)-.7(ice.)]TJ /F2 1 Tf -30.046 -1.9371 TD -.0097 Tc 0 Tw (Segmentation)Tj /F3 1 Tf 5.451 0 TD 0 Tc ( )Tj -5.451 -1.111 TD -.0098 Tc -.0003 Tw [(Define and separ)18.9(a).6(te system)-10.1( )]TJ T* -.0094 Tc -.0007 Tw [(elements based on criticality)-9.2( )]TJ T* -.0096 Tc .0006 Tw [(and trustwor)-23.8(thiness.)]TJ /F2 1 Tf 12.211 3.333 TD .0008 Tw (Predefined segmentation)Tj /F3 1 Tf 0 -1.111 TD -.0095 Tc -.0006 Tw [(Define encla)7(v)-.7(es, segments or other types)-9.3( )]TJ T* [(of resour)9.4(ce sets based on criticality)-9.3( )]TJ T* .0004 Tw [(and trustwor)-23.4(thiness so that they can be)-10.1( )]TJ T* -.0097 Tc -.0004 Tw [(pr)9.1(otected separ)19(ately and, if necessary,)-10.4( )]TJ T* -.0092 Tc 0 Tw (isolated.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0554 228.2419 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4654 228.2419 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.6(Use vir)-23.4(t).1(ualization t)9.2(o).1( maintain separ)19.5(a).2(te pr)9.6(ocessing domains based on)-9.1( )]TJ .219 -1.111 TD -.0098 Tc -.0003 Tw (user privileges.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0554 208.244 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4654 208.244 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Use crypt)9.3(o)-.1(gr)19.6(aphic separ)19.5(a)-.7(tion for maintenance.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0554 198.2449 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4654 198.2449 Tm 0 0 0 1 k -.0094 Tc -.0007 Tw [( )219.4(P)5.7(a)-.8(r)-23.4(t).3(ition application fr)9.6(om system functionality.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0554 188.246 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4654 188.246 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Isolate security functions fr)9.6(om nonsecurity functions.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0554 178.2469 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4654 178.2469 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.6(Isolate security t)9.3(ools and capabilities using physical separ)19.7(a)-.8(tion.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0554 168.2479 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4654 168.2479 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Isolate components based on mission or business function.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0554 158.2491 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4654 158.2491 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Separ)19.7(ate subnets that connect t)9.3(o)0( different security domains. In)-9.1( )]TJ .219 -1.111 TD [(par)-23.4(t).3(icular)60.7(, pr)9.6(o)8.1(v)-.5(ide a DMZ for Internet connectivity.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0554 138.251 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4654 138.251 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Employ system par)-23.4(t).2(itioning.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0554 128.2519 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4654 128.2519 Tm 0 0 0 1 k -.0095 Tc -.0006 Tw [( )219.3(Employ pr)9.6(ocess isolation.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0554 118.2529 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4654 118.2529 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Implement sandbo)10.9(xes and other confined envir)9.4(o)-.1(nments.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0554 108.254 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4654 108.254 Tm 0 0 0 1 k -.0095 Tc .0005 Tw [( )219.7(Implement memory pr)9.6(otection.)]TJ /F2 1 Tf -17.834 -1.937 TD .0006 Tw (Dynamic segmentation and isolation)Tj /F3 1 Tf 0 -1.111 TD -.0006 Tw [(Change the configur)19.6(ation of encla)7.2(ves or)-9.4( )]TJ T* .0005 Tw [(pr)9.4(otected segments, or isolate resour)9.3(ces)-9.4( )]TJ T* -.0093 Tc .0003 Tw [(while minimizing oper)19.7(ational disruption.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0554 90.821 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4654 90.821 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Implement dynamic isolation of components.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0554 80.8219 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4654 80.8219 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.5(Implement software-defined networking and VPNs t)9.2(o)0( define new)-8.9( )]TJ .219 -1.111 TD 0 Tw [(encla)7.4(v)-.3(es.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 302.0554 60.8239 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 306.4654 60.8239 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.6(Create a vir)-23.3(tualized sandbo)11.1(x or det)9.4(o).5(nation chamber for untrusted)-9.5( )]TJ .219 -1.111 TD -.0095 Tc .0005 Tw [(attachments or URLs.)-9.5( )]TJ ET EMC endstream endobj 389 0 obj <>/ExtGState<>>> endobj 403 0 obj <> endobj 411 0 obj <>stream /P <>BDC q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS2 gs BT /TT2 1 Tf 7 0 0 7 490.9954 20.9379 Tm 0 0 0 1 k 0 Tc 0 Tw (ISACA )Tj ET EMC /P <>BDC BT 7 0 0 7 512.4738 20.9379 Tm (JOURNAL)Tj ET EMC /P <>BDC /GS1 gs BT 7 0 0 7 543.321 20.9379 Tm .761 .549 .11 0 k [( V)6.3(OL 3)]TJ ET EMC /Artifact <>BDC 0 0 0 1 k /GS2 gs 572.364 .014984 .51599 31.274 re f EMC /P <>BDC /GS1 gs BT 7 0 0 7 585.4174 20.9379 Tm .761 .549 .11 0 k (11)Tj ET EMC /P <>BDC /GS2 gs BT 7 0 0 7 36.9471 21.3673 Tm 0 0 0 1 k [( 2021 ISACA. All rights reser)-8.8(ved. )]TJ ET EMC /P <>BDC BT /TT4 1 Tf 7 0 0 7 144.579 21.3673 Tm [(www)60.5(.isaca.org)]TJ ET EMC /Figure <>BDC Q .76471 .54118 .098039 .007843 k /GS1 gs 35 642.649 533 18.479 re f .78824 .85098 .17255 .043137 k 1 i 35 642.649 109.9 -17.431 re 144.9 642.649 156.1 -17.431 re 301 642.649 267 -17.431 re f .15686 .1098 .031373 0 k 35 625.22 109.9 -222.292 re 35 402.928 109.9 -94.861 re f .082353 .011765 .007843 0 k 144.9 625.22 156.1 -97.431 re 144.9 527.789 156.1 -67.432 re 144.9 460.357 156.1 -57.43 re 144.9 402.928 156.1 -47.431 re 144.9 355.497 156.1 -47.432 re f .16863 .031373 .023529 0 k 301 625.22 267 -97.431 re 301 527.789 267 -67.432 re 301 460.357 267 -57.43 re 301 402.928 267 -47.431 re 301 355.497 267 -47.432 re f q 34.5 661.129 534 -370.961 re W n 0 0 0 1 K 0 J 0 j 1 w 10 M [] 0 d /GS2 gs q 1 0 0 1 35 642.65 cm 0 0 m 0 18.479 l S 1 0 0 1 533 0 cm 0 0 m 0 18.479 l S 1 0 0 1 -533 -16.931 cm 0 0 m 0 16.931 l S 1 0 0 1 533 0 cm 0 0 m 0 16.931 l S Q Q 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d q 1 0 0 1 35.5 642.65 cm 0 0 m 265.5 0 l S 1 0 0 1 265.5 0 cm 0 0 m 266.5 0 l S Q q 34.5 661.129 534 -370.961 re W n 1 w q 1 0 0 1 34.5 625.219 cm 0 0 m 110.4 0 l S Q Q 1 w q 1 0 0 1 144.9 625.219 cm 0 0 m 156.1 0 l S 1 0 0 1 0 -96.93 cm 0 0 m 0 96.431 l S 1 0 0 1 -.5 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 .5 -66.931 cm 0 0 m 0 66.431 l S 1 0 0 1 -.5 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 .5 -56.931 cm 0 0 m 0 56.431 l S 1 0 0 1 0 -.5 cm 0 0 m 156.1 0 l S 1 0 0 1 0 -46.93 cm 0 0 m 0 46.431 l S 1 0 0 1 -.5 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 .5 -46.931 cm 0 0 m 0 46.431 l S 1 0 0 1 -.5 -.5 cm 0 0 m 156.6 0 l S 1 0 0 1 156.6 220.223 cm 0 0 m 0 96.431 l S 1 0 0 1 0 -67.431 cm 0 0 m 0 66.431 l S 1 0 0 1 0 -57.431 cm 0 0 m 0 56.431 l S 1 0 0 1 0 -47.43 cm 0 0 m 0 46.431 l S 1 0 0 1 0 -47.431 cm 0 0 m 0 46.431 l S Q q 34.5 661.129 534 -370.961 re W n q 1 0 0 1 301 625.219 cm 0 0 m 267.5 0 l S Q Q q 1 0 0 1 301 527.789 cm 0 0 m 267 0 l S 1 0 0 1 0 -67.431 cm 0 0 m 267 0 l S 1 0 0 1 0 -57.431 cm 0 0 m 267 0 l S 1 0 0 1 0 -47.43 cm 0 0 m 267 0 l S 1 0 0 1 0 -47.431 cm 0 0 m 267 0 l S 1 0 0 1 -156.1 317.653 cm 0 0 m 0 15.931 l S 1 0 0 1 156.1 0 cm 0 0 m 0 15.931 l S 1 0 0 1 -266 -222.792 cm 0 0 m 109.9 0 l S Q BT /F2 1 Tf 10 0 0 10 214.261 646.6509 Tm 0 0 0 0 k -.015 Tc .023 Tw [(Figure 4Cyberresiliency Appr)17.7(oaches)]TJ /F6 1 Tf 14.6525 0 TD .022 Tw [( \(cont.\))]TJ /F2 1 Tf 9 0 0 9 69.4766 629.2202 Tm -.0098 Tc 0 Tw [(Techniques)-10177.3(A)-.6(ppr)17.8(oaches)-19295.9(Examples)]TJ ET /GS2 gs BT 9 0 0 9 38.9936 611.787 Tm 0 0 0 1 k -.0096 Tc -.0004 Tw (Substantiated integrity)Tj /F3 1 Tf 0 -1.111 TD -.0094 Tc .0004 Tw [(Ascer)-23.5(tain whether critical)-9.9( )]TJ T* -.0007 Tw [(system elements ha)8.1(ve been)-9.3( )]TJ T* -.0096 Tc 0 Tw (corrupted.)Tj /F2 1 Tf 12.211 3.333 TD -.0099 Tc -.0001 Tw (Integrity checks)Tj /F3 1 Tf 0 -1.111 TD -.0093 Tc .0003 Tw [(Apply and v)7.6(a).2(lidate checks of the integrity)-9.1( )]TJ T* [(or quality of information, components or)-9.5( )]TJ T* -.0095 Tc 0 Tw [(ser)-8.7(v)-.7(ices.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.988 611.7866 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.398 611.7866 Tm 0 0 0 1 k -.0096 Tc -.0005 Tw [( )219.2(Use tamper-e)5.6(vident seals and anti-tamper coatings.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.988 601.7875 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.398 601.7875 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Use aut)9(o).1(mated t)9.3(ools for data quality checking.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.988 591.7886 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.398 591.7886 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Use block)10.5(chain technology.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.988 581.7896 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.398 581.7896 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.6(Use nonmodifiable executables.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.988 571.7904 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.398 571.7904 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.6(Use polling techniques t)9.2(o).1( identify potential damage.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.988 561.7914 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.398 561.7914 Tm 0 0 0 1 k -.0095 Tc -.0006 Tw [( )219.4(Implement crypt)8.9(o)-.1(gr)19.3(aphic hashes.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.988 551.7924 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.398 551.7924 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Employ information input v)7.5(a).2(lidation.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.988 541.7933 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.398 541.7933 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(V)23.1(alidate components as par)-23.4(t).2( of SCRM.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.988 531.7944 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.398 531.7944 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Employ integrity checking on external systems.)]TJ /F2 1 Tf -17.8339 -1.937 TD -.0099 Tc -.0001 Tw [(Pr)17.6(o)8(v).3(enance tr)14.6(acking)]TJ /F3 1 Tf 0 -1.111 TD -.0093 Tc .0003 Tw [(Identify and tr)19.7(ack the pr)9.7(o)8.1(v)-.3(enance of data,)-9.7( )]TJ T* (software or hardware elements.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.988 514.3613 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.398 514.3613 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.6(Employ component tr)19.5(aceability as par)-23.4(t).3( of Supply Chain Risk)-8.6( )]TJ .219 -1.111 TD (Management \(SCRM\).)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.988 494.3634 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.398 494.3634 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Employ pr)9.6(o)8.1(v)-.4(enance tr)19.6(acking as par)-23.4(t).2( of SCRM.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.988 484.3643 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.398 484.3643 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Implement anti-counter)-7.5(feit pr)9.6(otections.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.988 474.3654 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.398 474.3654 Tm 0 0 0 1 k -.0095 Tc .0005 Tw [( )219.7(Implement trusted path.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.988 464.3664 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.398 464.3664 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Implement code signing.)]TJ /F2 1 Tf -17.8339 -1.937 TD -.0098 Tc -.0002 Tw [(Beha)7.6(vior v)7.4(a)-.3(lidation)]TJ /F3 1 Tf 0 -1.111 TD -.0093 Tc .0003 Tw [(V)23.2(a).2(lidate the beha)7.2(vior of a system, ser)-8.4(v)-.4(ice,)-9.8( )]TJ T* -.0095 Tc .0005 Tw [(or de)5.8(vice against defined or emergent)-10.1( )]TJ T* -.0096 Tc .0006 Tw [(criteria \(e.g., requirements, patterns of)-10.3( )]TJ T* -.0094 Tc .0004 Tw (prior usage\).)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.988 446.9333 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.398 446.9333 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Employ det)9.2(o)-.1(nation chambers.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.988 436.9344 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.398 436.9344 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.7(Implement function verification.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.988 426.9354 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.398 426.9354 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.5(Verify boot pr)9.6(ocess integrity.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.988 416.9363 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.398 416.9363 Tm 0 0 0 1 k -.0245 Tc -.0001 Tw [( )204.3(Implement fault injection t)9.8(o)-.8( obser)-9.3(v)-.1(e potential anomalies in err)8.7(o)-.3(r handling.)]TJ /F2 1 Tf -30.046 -3.048 TD -.0097 Tc 0 Tw (Unpredictability)Tj /F3 1 Tf 0 -1.111 TD -.0094 Tc .0004 Tw [(Make changes r)19.6(andomly or)-9.4( )]TJ T* 0 Tw (unpredictably.)Tj /F2 1 Tf 12.2111 2.222 TD -.0097 Tc -.0003 Tw [(Tempor)14.9(al unpredictability)]TJ /F3 1 Tf 0 -1.111 TD -.0093 Tc .0003 Tw [(Change beha)7.2(vior or state at times that)-9.8( )]TJ T* [(are determined r)19.5(a).1(ndomly or by complex)-9.9( )]TJ T* -.0095 Tc 0 Tw (functions.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.979 389.5044 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.39 389.5044 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Require re-authentication at r)19.4(a)-.4(ndom inter)-8.5(v)7.5(als.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.979 379.5054 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.39 379.5054 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Per)-7.3(f).3(orm r)9.6(o).2(utine actions at different times of day.)]TJ /F2 1 Tf -17.834 -4.159 TD -.0097 Tc -.0003 Tw (Contextual unpredictability)Tj /F3 1 Tf 0 -1.111 TD -.0093 Tc .0003 Tw [(Change beha)7.2(vior or state in ways that)-9.7( )]TJ T* -.0095 Tc .0005 Tw [(are determined r)19.3(a)0(ndomly or by complex)-9( )]TJ T* 0 Tw (functions.)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.979 342.0744 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.39 342.0744 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.5(Rotate r)9.6(o).5(les and responsibilities.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 304.979 332.0754 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 309.39 332.0754 Tm 0 0 0 1 k -.0095 Tc .0005 Tw [( )219.6(Implement r)19.5(a)-.5(ndom channel-hopping.)]TJ 6 0 0 6 39 297.7794 Tm -.0093 Tc .0003 Tw [(Sour)9(ce: National Institute of Standards and )19.8(Technology \(NIST\), SP 800-160 v)8.2(o)-.6(l. 2, )]TJ /F4 1 Tf 31.4083 0 TD -.0011 Tw [( De)6.6(veloping Cyber Resilient Systems: A Systems Security Engineering Appr)10.7(oach)]TJ /F3 1 Tf 29.6403 0 TD .0004 Tw [(, USA, No)8.5(vember 2019,)-10( )16.7( )]TJ /F4 1 Tf -61.0487 -1 TD 0 Tw [(https:/)109.1(/)-.2(csr)10.6(c).5(.nist.go)7.3(v/publications/detail/sp/800-160/v)8.5(ol-2/final)]TJ ET EMC /P <>BDC q 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n BT /TT2 1 Tf 9 0 0 9 36.9471 261.3532 Tm -.005 Tc [(The NIST)19.5( appr)9.8(oach is more threat based. E)12.7(very)]TJ ET EMC /P <>BDC BT 9 0 0 9 222.0948 261.3532 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36.9471 249.3532 Tm -.005 Tc (organization faces different internal and external)Tj ET EMC /P <>BDC BT 9 0 0 9 228.7385 249.3532 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36.9471 237.3532 Tm -.005 Tc (threats depending on the nature of the organization)Tj ET EMC /P <>BDC BT 9 0 0 9 239.4514 237.3532 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36.9471 225.3532 Tm -.005 Tc [(and its pr)9.8(ocesses. By using a threat-based)]TJ ET EMC /P <>BDC BT 9 0 0 9 203.821 225.3532 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36.9471 213.3532 Tm -.005 Tc [(appr)9.8(oach t)9.8(o)0( identify mitigating contr)9.8(ols and)]TJ ET EMC /P <>BDC BT 9 0 0 9 209.1233 213.3532 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36.9471 201.3532 Tm -.005 Tc [(business objectives, the organization de)6.3(velops an)]TJ ET EMC /P <>BDC BT 9 0 0 9 232.5013 201.3532 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36.9471 189.3532 Tm -.005 Tc [(invent)9.8(ory of use cases t)9.8(o)0( mitigate these threats)]TJ ET EMC /P <>BDC BT 9 0 0 9 224.2934 189.3532 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36.9471 177.3532 Tm -.005 Tc [(using a prioritized appr)9.8(oach. )19.5(The organization must)]TJ ET EMC /P <>BDC BT 9 0 0 9 240.0052 177.3532 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36.9471 165.3532 Tm -.005 Tc [(de)6.3(velop an invent)9.8(ory of use cases for)]TJ ET EMC /P <>BDC BT 9 0 0 9 183.9103 165.3532 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36.9471 153.3532 Tm -.005 Tc [(cyberresilience that is applied t)9.8(o)0( business)]TJ ET EMC /P <>BDC BT 9 0 0 9 201.803 153.3532 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36.9471 141.3532 Tm -.005 Tc [(pr)9.8(ocesses, perhaps initially addressing the critical)]TJ ET EMC /P <>BDC BT 9 0 0 9 233.0694 141.3532 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36.9471 129.3532 Tm -.005 Tc [(ones such as applications and suppor)-24.4(ting assets)]TJ ET EMC /P <>BDC BT 9 0 0 9 230.0469 129.3532 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36.9471 117.3532 Tm -.005 Tc [(and the infr)19.5(astructure suppor)-24.4(ting the business)]TJ ET EMC /P <>BDC BT 9 0 0 9 219.4262 117.3532 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36.9471 105.3532 Tm -.005 Tc [(objectives. It is necessary t)9.8(o)0( identify the gaps )]TJ ET EMC /P <>BDC BT 9 0 0 9 218.329 105.3532 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36.9471 93.3532 Tm -.005 Tc [(on a continual basis and continue t)9.8(o)0( impr)9.8(o)7.3(ve )]TJ ET EMC /P <>BDC BT 9 0 0 9 215.9161 93.3532 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 36.9471 81.3532 Tm -.005 Tc [(the pr)9.8(ocess.)]TJ ET EMC /P <>BDC BT 9 0 0 9 85.5689 81.3532 Tm 0 Tc ( )Tj ET EMC /P <>BDC /GS1 gs BT /TT6 1 Tf 11 0 0 11 254.4471 257.2575 Tm .8 .871 .22 0 k -.005 Tc [(Example Checklist for Re)6.3(viewing)]TJ ET EMC /P <>BDC BT 11 0 0 11 414.2678 257.2575 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 11 0 0 11 254.4471 243.2575 Tm -.005 Tc [(Cyberresilience Based on NIST)29.3( 800-160)]TJ ET EMC /P <>BDC BT 11 0 0 11 449.8383 243.2575 Tm 0 Tc ( )Tj ET EMC /P <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 254.4471 225.2575 Tm 0 0 0 1 k -.005 Tc [(NIST)19.5( 800-160 pr)9.8(o)7.3(vides design principles that can be)]TJ ET EMC /P <>BDC BT 9 0 0 9 459.6409 225.2575 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 254.4471 213.2575 Tm -.005 Tc [(used t)9.8(o)0( measure the cyberresilience of an)]TJ ET EMC /P <>BDC BT 9 0 0 9 419.2039 213.2575 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 254.4471 201.2575 Tm -.005 Tc (organization \()Tj ET EMC /P <>BDC BT /TT14 1 Tf 9 0 0 9 308.9732 201.2575 Tm 0 Tc ()Tj /TT6 1 Tf .6034 0 TD -.005 Tc (gure 5)Tj ET EMC /P <>BDC BT /TT2 1 Tf 9 0 0 9 339.8595 201.2575 Tm [(\). Again, any str)19.5(ategic design)]TJ ET EMC /P <>BDC BT 9 0 0 9 453.4534 201.2575 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 254.4471 189.2575 Tm -.005 Tc [(principles are driven by an organization)39.1()54.7(s)0( risk)]TJ ET EMC /P <>BDC BT 9 0 0 9 430.6367 189.2575 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 254.4471 177.2575 Tm -.005 Tc [(management str)19.5(ategy and its risk fr)19.5(aming. In this)]TJ ET EMC /P <>BDC BT 9 0 0 9 447.8392 177.2575 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 254.4471 165.2575 Tm -.005 Tc [(case, de)6.3(veloping and )]TJ /TT11 1 Tf 9.4375 0 TD 0 Tc ()Tj /TT2 1 Tf .5487 0 TD -.005 Tc (ne-tuning a risk management)Tj ET EMC /P <>BDC BT 9 0 0 9 459.4276 165.2575 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 254.4471 153.2575 Tm -.005 Tc [(str)19.5(ategy includes identifying the assumptions and)]TJ ET EMC /P <>BDC BT 9 0 0 9 450.4759 153.2575 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 254.4471 141.2575 Tm -.005 Tc [(dependencies, threats and o)7.3(ver)19.5(all risk that impact)]TJ ET EMC /P <>BDC BT 9 0 0 9 450.3561 141.2575 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 254.4471 129.2575 Tm -.005 Tc [(the organization, its cust)9.8(omer data and)]TJ ET EMC /P <>BDC BT 9 0 0 9 408.624 129.2575 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 254.4471 117.2575 Tm -.005 Tc (organizational priorities. )Tj ET EMC /P <>BDC BT 9 0 0 9 352.1624 117.2575 Tm 0 Tc ( )Tj ET EMC Q endstream endobj 412 0 obj <>/ExtGState<>>> endobj 428 0 obj <> endobj 430 0 obj <> endobj 432 0 obj <>stream /P <>BDC q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS2 gs BT /TT2 1 Tf 7 0 0 7 39.4019 20.9698 Tm 0 0 0 1 k 0 Tc 0 Tw (ISACA )Tj ET EMC /P <>BDC BT 7 0 0 7 60.8804 20.9698 Tm (JOURNAL)Tj ET EMC /P <>BDC /GS1 gs BT 7 0 0 7 91.7275 20.9698 Tm .761 .549 .11 0 k [( V)6.3(OL 3)]TJ ET EMC /Artifact <>BDC 0 0 0 1 k /GS2 gs 30.069 .014984 .51505 31.516 re f EMC /P <>BDC /GS1 gs BT 7 0 0 7 10.8984 20.9698 Tm .761 .549 .11 0 k (12)Tj ET EMC /P <>BDC /GS2 gs BT 7 0 0 7 415.3383 21.3673 Tm 0 0 0 1 k [( 2021 ISACA. All rights reser)-8.8(ved. )]TJ ET EMC /P <>BDC BT /TT4 1 Tf 7 0 0 7 522.9701 21.3673 Tm [(www)60.5(.isaca.org)]TJ ET EMC /Artifact <>BDC 0 0 0 0 k /GS1 gs 39.402 55.155 527.598 276.074 re f EMC /Figure <>BDC Q q 1 i 39.402 331.223 535.5 -271.17 re W n 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n .76471 .54118 .098039 .007843 k /GS1 gs 39.902 312.75 527.098 18.473 re f Q q 1 i 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n .78824 .85098 .17255 .043137 k /GS1 gs 39.902 312.751 85.9 -17.431 re 125.802 312.751 228 -17.431 re 353.802 312.751 220.6 -17.431 re f .16863 .031373 .023529 0 k 39.902 295.32 85.9 -54.631 re 125.802 295.32 228 -54.631 re 353.802 295.32 220.6 -54.631 re 39.902 204.659 85.9 -45.331 re 125.802 204.659 228 -45.331 re 353.802 204.659 220.6 -45.331 re 39.902 113.997 85.9 -36.031 re 125.802 113.997 228 -36.031 re 353.802 113.997 220.6 -36.031 re f .082353 .011765 .007843 0 k 39.902 240.689 85.9 -36.031 re 125.802 240.689 228 -36.031 re 353.802 240.689 220.6 -36.031 re 39.902 159.328 85.9 -45.331 re 125.802 159.328 228 -45.331 re 353.802 159.328 220.6 -45.331 re f 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d q 1 0 0 1 39.902 312.751 cm 0 0 m 313.9 0 l S 1 0 0 1 313.9 0 cm 0 0 m 220.6 0 l S Q 1 w q 1 0 0 1 125.802 295.82 cm 0 0 m 0 15.931 l S 1 0 0 1 228 0 cm 0 0 m 0 15.931 l S Q Q q 1 i 39.402 331.223 535.5 -271.17 re W n 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 39.402 295.32 cm 0 0 m 86.4 0 l S 1 0 0 1 .5 -54.131 cm 0 0 m 0 53.631 l S Q Q q 1 i 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 125.802 295.32 cm 0 0 m 228 0 l S 1 0 0 1 0 -54.131 cm 0 0 m 0 53.631 l S Q Q q 1 i 39.402 331.223 535.5 -271.17 re W n 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 353.802 295.32 cm 0 0 m 221.1 0 l S Q Q q 1 i 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 353.802 241.189 cm 0 0 m 0 53.631 l S Q Q q 1 i 39.402 331.223 535.5 -271.17 re W n 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 39.902 159.828 cm 0 0 m 0 44.331 l S Q Q q 1 i 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 125.802 159.828 cm 0 0 m 0 44.331 l S 1 0 0 1 228 0 cm 0 0 m 0 44.331 l S Q Q q 1 i 39.402 331.223 535.5 -271.17 re W n 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 39.902 78.467 cm 0 0 m 0 35.031 l S 1 0 0 1 -.5 -.5 cm 0 0 m 86.4 0 l S Q Q q 1 i 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 125.802 78.467 cm 0 0 m 0 35.031 l S 1 0 0 1 0 -.5 cm 0 0 m 228 0 l S 1 0 0 1 228 .5 cm 0 0 m 0 35.031 l S Q Q q 1 i 39.402 331.223 535.5 -271.17 re W n 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 353.802 77.967 cm 0 0 m 221.1 0 l S 1 0 0 1 -314.4 162.722 cm 0 0 m 86.4 0 l S Q Q q 1 i 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 125.802 240.689 cm 0 0 m 228 0 l S Q Q q 1 i 39.402 331.223 535.5 -271.17 re W n 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 353.802 240.689 cm 0 0 m 221.1 0 l S Q Q q 1 i 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 125.802 205.159 cm 0 0 m 0 35.03 l S 1 0 0 1 228 0 cm 0 0 m 0 35.03 l S Q Q q 1 i 39.402 331.223 535.5 -271.17 re W n 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 39.402 204.659 cm 0 0 m 86.4 0 l S Q Q q 1 i 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 125.802 204.659 cm 0 0 m 228 0 l S Q Q q 1 i 39.402 331.223 535.5 -271.17 re W n 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 353.802 204.659 cm 0 0 m 221.1 0 l S 1 0 0 1 -314.4 -45.331 cm 0 0 m 86.4 0 l S Q Q q 1 i 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 125.802 159.328 cm 0 0 m 228 0 l S Q Q q 1 i 39.402 331.223 535.5 -271.17 re W n 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 353.802 159.328 cm 0 0 m 221.1 0 l S Q Q q 1 i 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 125.802 114.497 cm 0 0 m 0 44.331 l S 1 0 0 1 228 0 cm 0 0 m 0 44.331 l S Q Q q 1 i 39.402 331.223 535.5 -271.17 re W n 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 39.402 113.997 cm 0 0 m 86.4 0 l S Q Q q 1 i 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 125.802 113.997 cm 0 0 m 228 0 l S Q Q q 1 i 39.402 331.223 535.5 -271.17 re W n 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 353.802 113.997 cm 0 0 m 221.1 0 l S Q Q q 1 i 39.402 331.229 535.5 -271.176 re W n 39.402 331.229 527.598 -276.074 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS1 gs BT /F2 1 Tf 10 0 0 10 196.7259 316.7509 Tm 0 0 0 0 k -.015 Tc .023 Tw [(Figure 6T)82.4(ailor)14.8(able Pr)17.9(ocess for Cyberresiliency A)23.3(n).1(alysis)-14.7( )]TJ 9 0 0 9 58.8838 299.3202 Tm -.0096 Tc -.0004 Tw [(A)22.8(n).5(alysis Step)-10827.2(Motiv)7.7(a).3(ting Question)-19830(T)82.5(asks)]TJ ET /GS2 gs BT 9 0 0 9 43.899 281.8871 Tm 0 0 0 1 k -.0098 Tc -.0002 Tw [(Understand the)-9( )]TJ 0 -1.033 TD -.0101 Tc 0 Tw (context.)Tj /F3 1 Tf 9.544 1.033 TD -.0095 Tc -.0006 Tw [(How do stakeholder concerns and priorities tr)19.4(anslate int)9(o)-9.2( )]TJ 0 -1.033 TD (cyberresiliency constructs and priorities?)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 357.7919 281.8871 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 362.2019 281.8871 Tm 0 0 0 1 k -.0095 Tc -.0006 Tw [( )219.2(Identify the pr)9.5(ogr)19.5(a)-.9(mmatic context.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 357.7919 272.5902 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 362.2019 272.5902 Tm 0 0 0 1 k -.0094 Tc -.0007 Tw [( )219.3(Identify the ar)9.5(chitectur)19.8(al context.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 357.7919 263.2934 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 362.2019 263.2934 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.5(Identify the oper)19.6(ational context.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 357.7919 253.996 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 362.2019 253.996 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.5(Identify the threat context.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 357.7919 244.6996 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 362.2019 244.6996 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.8(Interpret and prioritize cyberresiliency constructs.)]TJ /F2 1 Tf -35.368 -1.937 TD -.0097 Tc -.0003 Tw [(Establish the initial)-9.5( )]TJ 0 -1.033 TD .0009 Tw [(cyber resiliency)-10.5( )]TJ T* 0 Tw (baseline.)Tj /F3 1 Tf 9.544 2.0669 TD -.0246 Tc [(How well is the system doinghow well does it meet stakeholder)-25.4( )]TJ 0 -1.0329 TD -.0001 Tw [(needs and address stakeholder concernswith respect t)9.5(o)-.8( the)-24.7( )]TJ 0 -1.033 TD 0 Tw [(aspects of cyberresiliency that matter t)9.4(o)-1( stakeholders?)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 357.7829 227.2844 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 362.1929 227.2844 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.6(Identify existing capabilities.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 357.7829 217.9864 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 362.1929 217.9864 Tm 0 0 0 1 k -.0095 Tc .0005 Tw [( )219.5(Identify gaps and issues.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 357.7829 208.6894 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 362.0579 208.6894 Tm 0 0 0 1 k -.0247 Tc .0001 Tw [( )204.2(Define e)6(v)7.6(aluation criteria and make initial assessment.)]TJ /F2 1 Tf -35.353 -1.9369 TD -.0097 Tc -.0003 Tw [(A)22.6(nalyze the system.)]TJ /F3 1 Tf 9.544 0 TD -.0245 Tc -.0001 Tw (How do cyberrisk factors affect mission, business or )Tj 0 -1.2 TD [(oper)18.8(ational risk?)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 357.7739 191.2574 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 362.1839 191.2574 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Identify critical resour)9.7(ces, sour)9.7(ces of fr)19.6(agility and)-9.6( )37.7( )]TJ .219 -1.033 TD [(attack sur)-7.3(f).1(aces.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 357.7739 172.6634 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 362.1839 172.6634 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.8(Represent the adversary perspective.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 357.7739 163.3664 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 362.0479 163.3664 Tm 0 0 0 1 k -.0247 Tc .0001 Tw [( )204(Identify and prioritize oppor)-24.5(t).4(unities for impr)9.6(o)7(v)-.4(ement.)]TJ /F2 1 Tf -35.3529 -1.937 TD -.0097 Tc -.0003 Tw [(Define and analyze)-8.7( )]TJ 0 -1.033 TD -.0002 Tw (specific alternatives.)Tj /F3 1 Tf 9.544 1.033 TD -.0094 Tc .0004 Tw [(How can mission or oper)19.5(ational resilience be impr)9.5(o)8(v)-.6(ed by)-9.3( )]TJ 0 -1.033 TD [(impr)9.5(o)7.9(v)-.5(ing cyberresiliency?)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 357.7649 145.9334 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 362.1739 145.9334 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.8(Define potential technical and pr)9.7(ocedur)19.8(al solutions.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 357.7649 136.6364 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 362.1739 136.6364 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.6(Define potential solutions for suppor)-23.5(t)0(ing systems and)-9.7( )]TJ .2191 -1.033 TD -.0097 Tc 0 Tw [(pr)8.9(ocesses.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 357.7649 118.0424 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 362.1739 118.0424 Tm 0 0 0 1 k -.0093 Tc .0003 Tw [( )219.7(Analyze potential solutions with respect t)9.4(o).2( criteria.)]TJ /F2 1 Tf -35.3679 -1.937 TD -.0099 Tc 0 Tw [(De)7(velop)-10.3( )]TJ 0 -1.033 TD (recommendations.)Tj /F3 1 Tf 9.544 1.033 TD -.0094 Tc .0004 Tw (What is the recommended plan of action?)Tj ET /GS1 gs BT /F5 1 Tf 9 0 0 9 357.7559 100.6094 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 362.1659 100.6094 Tm 0 0 0 1 k -.0092 Tc .0002 Tw [( )219.7(Identify and analyze alternatives.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 357.7559 91.3124 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 362.1659 91.3124 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.5(Assess alternatives.)]TJ ET /GS1 gs BT /F5 1 Tf 9 0 0 9 357.7559 82.0154 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 9 0 0 9 362.1659 82.0154 Tm 0 0 0 1 k -.0094 Tc .0004 Tw [( )219.8(Recommend a plan of action.)]TJ 6 0 0 6 43.9019 67.6804 Tm [(Sour)9(ce: National Institute of Standards and )19.9(Technology \(NIST\), SP 800-160 v)8.2(o)-1(l. 2, )]TJ /F4 1 Tf 31.6273 0 TD -.0092 Tc -.0011 Tw [(De)6.3(veloping Cyber Resilient Systems: A Systems Security Engineering Appr)10.6(oach)]TJ /F3 1 Tf 29.6403 0 TD -.0094 Tc .0004 Tw [(, USA, No)8.5(vember 2019, )]TJ /F4 1 Tf 8.9427 0 TD -.0099 Tc 0 Tw [(https:/)108.3(/)-.7(csr)9.7(c).2(.nist.go)8.1(v/publications/detail/)]TJ -70.2103 -1 TD -.0091 Tc [(sp/800-160/v)8.6(ol-2/final)]TJ ET EMC /Artifact <>BDC Q q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 k /GS1 gs 30.81 343.258 536.19 404.555 re f EMC /Figure <>BDC Q q 1 i 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n .76471 .54118 .098039 .007843 k /GS1 gs 31.31 729.334 534.75 18.479 re f .78824 .85098 .17255 .043137 k 31.31 729.334 82.3 -27.431 re 113.61 729.334 226.225 -27.431 re 339.835 729.334 226.225 -27.431 re f .16863 .031373 .023529 0 k 31.31 701.903 82.3 -54.631 re 113.61 701.903 226.225 -54.631 re 339.835 701.903 226.225 -54.631 re 31.31 574.042 82.3 -68.179 re 113.61 574.042 226.225 -68.179 re 339.835 574.042 226.225 -68.179 re 31.31 451.232 82.3 -91.831 re 113.61 451.232 226.225 -91.831 re 339.835 451.232 226.225 -91.831 re f .082353 .011765 .007843 0 k 31.31 647.273 82.3 -73.231 re 113.61 647.273 226.225 -73.231 re 339.835 647.273 226.225 -73.231 re 31.31 505.863 82.3 -54.631 re 113.61 505.863 226.225 -54.631 re 339.835 505.863 226.225 -54.631 re f Q q 1 i 30.81 747.813 535.74 -406.309 re W n 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 1 K 0 J 0 j 1 w 10 M [] 0 d /GS2 gs q 1 0 0 1 566.06 702.403 cm 0 0 m 0 25.931 l S Q 0 0 0 0 K /GS1 gs q 1 0 0 1 30.81 701.903 cm 0 0 m 82.8 0 l S 1 0 0 1 .5 -54.13 cm 0 0 m 0 53.631 l S Q Q q 1 i 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 113.61 701.903 cm 0 0 m 226.225 0 l S 1 0 0 1 0 -54.13 cm 0 0 m 0 53.631 l S Q Q q 1 i 30.81 747.813 535.74 -406.309 re W n 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 339.835 701.903 cm 0 0 m 226.725 0 l S Q Q q 1 i 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 339.835 647.773 cm 0 0 m 0 53.631 l S Q Q q 1 i 30.81 747.813 535.74 -406.309 re W n 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 566.06 647.773 cm 0 0 m 0 53.631 l S 1 0 0 1 -534.75 -141.41 cm 0 0 m 0 67.179 l S Q Q q 1 i 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 113.61 506.363 cm 0 0 m 0 67.179 l S 1 0 0 1 226.225 0 cm 0 0 m 0 67.179 l S Q Q q 1 i 30.81 747.813 535.74 -406.309 re W n 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 566.06 506.363 cm 0 0 m 0 67.179 l S 1 0 0 1 -535.25 140.91 cm 0 0 m 82.8 0 l S Q Q q 1 i 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 113.61 647.273 cm 0 0 m 226.225 0 l S Q Q q 1 i 30.81 747.813 535.74 -406.309 re W n 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 339.835 647.273 cm 0 0 m 226.725 0 l S Q Q q 1 i 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 113.61 574.542 cm 0 0 m 0 72.231 l S 1 0 0 1 226.225 0 cm 0 0 m 0 72.231 l S Q Q q 1 i 30.81 747.813 535.74 -406.309 re W n 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 566.06 574.542 cm 0 0 m 0 72.231 l S 1 0 0 1 -535.25 -.5 cm 0 0 m 82.8 0 l S Q Q q 1 i 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 113.61 574.042 cm 0 0 m 226.225 0 l S Q Q q 1 i 30.81 747.813 535.74 -406.309 re W n 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 339.835 574.042 cm 0 0 m 226.725 0 l S Q Q q 1 i 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d /GS1 gs q 1 0 0 1 31.31 729.334 cm 0 0 m 82.3 0 l S 1 0 0 1 82.3 0 cm 0 0 m 226.225 0 l S Q Q q 1 i 30.81 747.813 535.74 -406.309 re W n 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d /GS1 gs q 1 0 0 1 339.835 729.334 cm 0 0 m 226.725 0 l S Q Q q 1 i 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 113.61 702.403 cm 0 0 m 0 25.931 l S 1 0 0 1 226.225 0 cm 0 0 m 0 25.931 l S Q Q q 1 i 30.81 747.813 535.74 -406.309 re W n 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 31.31 359.902 cm 0 0 m 0 90.831 l S 1 0 0 1 -.5 -.5 cm 0 0 m 82.8 0 l S Q Q q 1 i 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 113.61 359.902 cm 0 0 m 0 90.831 l S 1 0 0 1 0 -.5 cm 0 0 m 226.225 0 l S 1 0 0 1 226.225 .5 cm 0 0 m 0 90.831 l S Q Q q 1 i 30.81 747.813 535.74 -406.309 re W n 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 566.06 359.902 cm 0 0 m 0 90.831 l S 1 0 0 1 -226.225 -.5 cm 0 0 m 226.725 0 l S 1 0 0 1 -309.025 146.461 cm 0 0 m 82.8 0 l S Q Q q 1 i 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 113.61 505.863 cm 0 0 m 226.225 0 l S Q Q q 1 i 30.81 747.813 535.74 -406.309 re W n 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 339.835 505.863 cm 0 0 m 226.725 0 l S Q Q q 1 i 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 113.61 451.732 cm 0 0 m 0 53.631 l S 1 0 0 1 226.225 0 cm 0 0 m 0 53.631 l S Q Q q 1 i 30.81 747.813 535.74 -406.309 re W n 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 566.06 451.732 cm 0 0 m 0 53.631 l S 1 0 0 1 -535.25 -.5 cm 0 0 m 82.8 0 l S Q Q q 1 i 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 113.61 451.232 cm 0 0 m 226.225 0 l S Q Q q 1 i 30.81 747.813 535.74 -406.309 re W n 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n 0 0 0 0 K 0 J 0 j 1 w 10 M [] 0 d /GS1 gs q 1 0 0 1 339.835 451.232 cm 0 0 m 226.725 0 l S Q Q q 1 i 30.81 747.813 535.75 -406.324 re W n 30.81 747.813 536.19 -404.555 re W* n 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS1 gs BT /F2 1 Tf 10 0 0 10 195.772 733.3336 Tm 0 0 0 0 k -.015 Tc .022 Tw [(Figure 5Str)14.7(ategic Cyberresiliency Design Principles)]TJ 9 0 0 9 43.3881 715.9029 Tm -.0097 Tc -.0003 Tw [(Str)14.9(a).2(tegic Design)-9.7( )]TJ 1.257 -1.111 TD .0008 Tw [(Principles)-13271.6(K)0(ey Ideas)-13677.8(R)-.4(elated Design Principles F)12.4(r)17.9(om Other Disciplines)]TJ ET /GS2 gs BT 9 0 0 9 35.3061 688.4713 Tm 0 0 0 1 k .0007 Tw [(F)10.4(o)-.8(cus on common)-9.7( )]TJ 0 -1.033 TD -.0002 Tw (critical assets.)Tj /F3 1 Tf 9.144 1.033 TD -.0094 Tc .0004 Tw [(Limited organizational and pr)9.5(ogr)19.6(a)-1(mmatic resour)9.5(ces need t)9.2(o)-9.1( )]TJ 0 -1.033 TD [(be applied where they can pr)9.6(o)8.1(v)-.4(ide the greatest benefit. )19.9(This)-9.1( )]TJ T* [(results in a str)19.5(a).1(tegy of focusing first on assets which are both)-9.2( )]TJ T* [(critical and common, then on those which are either critical)-9.7( )46( )]TJ T* -.0098 Tc -.0003 Tw (or common.)Tj /F2 1 Tf 25.1359 4.133 TD 0 Tw (Security:)Tj /F3 1 Tf 3.4916 0 TD -.0094 Tc -.0007 Tw ( Inverse modification threshold)Tj /F2 1 Tf -3.4916 -1.033 TD -.0099 Tc -.0001 Tw (Resilience Engineering:)Tj /F3 1 Tf 9.192 0 TD -.0093 Tc .0003 Tw [( Physical redundancy, layered defense,)-9.8( )]TJ -9.192 -1.033 TD (loose coupling)Tj /F2 1 Tf T* -.0097 Tc 0 Tw [(Sur)-8(v)-.4(iv)6.7(ability:)]TJ /F3 1 Tf 5.1242 0 TD -.0093 Tc .0003 Tw [( F)16.8(a)-.7(ilure mode reduction, fail-safe, e)6.1(v)7.5(olution)]TJ /F2 1 Tf -39.4052 -2.97 TD -.0097 Tc -.0003 Tw [(Suppor)-22.9(t)-.1( agility)-10.2( )]TJ 0 -1.0329 TD [(and ar)10.1(chitect for)-8.9( )]TJ 0 -1.033 TD 0 Tw (adaptability.)Tj /F3 1 Tf 9.144 2.067 TD -.0093 Tc .0003 Tw [(Not only does the threat landscape change as adversaries)-9( )]TJ 0 -1.0331 TD [(e)6.2(v)7.7(olve, so do technologies and the ways in which individuals)-8.8( )]TJ T* [(and organizations use them. Both agility and adaptability are)-9.8( )]TJ 0 -1.0329 TD [(integr)19.7(al t)9.3(o).2( the risk management str)19.7(a)-.7(tegy in response t)9.4(o).2( the)-9.8( )]TJ 0 -1.033 TD [(risk fr)19.5(aming assumption that unforeseen changes will occur)-9.6( )]TJ T* [(in the threat, technical, and oper)19.7(ational envir)9.6(o).1(nment thr)9.6(o)0(ugh a)-9.9( )]TJ T* [(system)54.5(s).9( lifespan.)]TJ /F2 1 Tf 25.136 6.2001 TD -.0097 Tc 0 Tw (Security:)Tj /F3 1 Tf 3.4916 0 TD -.0093 Tc .0003 Tw [( Secure e)6.1(v)7.5(olv)7.4(a)-.7(bility, minimized sharing, reduced)-9.6( )]TJ -3.4916 -1.033 TD 0 Tw (complexity)Tj /F2 1 Tf T* -.0099 Tc .001 Tw (Resilience Engineering:)Tj /F3 1 Tf 9.192 0 TD -.0094 Tc .0004 Tw ( Reorganization, human backup, inter-)Tj -9.192 -1.0329 TD [(node inter)19.7(a)-.8(ction)]TJ /F2 1 Tf T* -.0096 Tc 0 Tw [(Sur)-7.7(v)-.3(iv)6.7(ability:)]TJ /F3 1 Tf 5.1242 0 TD -.0093 Tc .0003 Tw [( Mobility, e)6.3(v)7.7(olution)]TJ /F2 1 Tf -39.4052 -4.003 TD -.0098 Tc -.0002 Tw [(Reduce attack)-8.8( )]TJ 0 -1.033 TD 0 Tw [(sur)-9.2(f)-.7(aces.)]TJ /F3 1 Tf 9.144 1.033 TD -.0093 Tc .0003 Tw [(A large attack sur)-7.4(f).2(ace is difficult t)9.2(o).1( defend, requiring ongoing)-8.8( )]TJ 0 -1.033 TD [(effor)-23.2(t).3( t)9.3(o).2( monit)9.3(or)60.7(, analyze and respond t)9.3(o).2( anomalies. Reducing)-8.7( )]TJ T* [(attack sur)-7.4(f).2(aces decreases ongoing pr)9.6(otection scope costs)-9( )]TJ T* [(and makes the adversary concentr)19.6(a)-.3(te effor)-23.3(t).2(s on a small set)-9.9( )]TJ 0 -1.0331 TD [(of locations, resour)9.6(ces or envir)9.6(o).1(nments that can be more)-9.9( )]TJ 0 -1.0329 TD [(effectively monit)9(ored and defended.)]TJ /F2 1 Tf 25.1361 5.1669 TD -.0249 Tc 0 Tw (Security:)Tj /F3 1 Tf 3.356 0 TD -.0244 Tc -.0002 Tw [( Least common mechanism, minimized sharing,)-24.2( )]TJ -3.356 -1.0329 TD -.0247 Tc .0001 Tw [(reduced complexity, minimized security elements, least privilege,)-24.7( )]TJ 0 -1.033 TD (predicate permission)Tj /F2 1 Tf T* -.0244 Tc 0 Tw (Resilience Engineering:)Tj /F3 1 Tf 8.8464 0 TD -.0247 Tc .0001 Tw [( Complexity a)7.4(v)7.8(oidance, drift correction)]TJ /F2 1 Tf -8.8464 -1.033 TD -.0245 Tc 0 Tw [(Sur)-8.4(v).3(iv)7.4(ability:)]TJ /F3 1 Tf 4.9141 0 TD -.0247 Tc .0001 Tw [( Pre)6.1(vention, failure mode reduction)]TJ /F2 1 Tf -39.1952 -3.4421 TD -.0096 Tc 0 Tw [(Assume)-8.7( )]TJ 0 -1.0329 TD -.0099 Tc [(compr)17.7(o)1(mised)-9.9( )]TJ 0 -1.033 TD [(resour)9.4(ces.)]TJ /F3 1 Tf 9.144 2.067 TD -.0245 Tc -.0001 Tw [(Systems and system components, r)18.9(a)-.4(nging fr)8.8(om chips t)9.6(o)-24.8( )]TJ 0 -1.033 TD [(software modules t)9.5(o)-.8( running ser)-9.3(v)-.1(ices, can be compr)8.7(o)-.9(mised for)-25.2( )]TJ T* 0 Tw [(extended periods without detection. In fact, some compr)8.7(o)-.9(mises)-23.8( )]TJ 0 -1.0329 TD -.0001 Tw [(may ne)6.4(ver be detected. Systems must remain capable of meeting)-24.7( )]TJ 0 -1.033 TD [(per)-8.2(f).5(ormance and quality requirements, nonetheless.)-25.1( )]TJ /F2 1 Tf 25.1361 4.133 TD -.0097 Tc 0 Tw (Security:)Tj /F3 1 Tf 3.4915 0 TD -.0094 Tc -.0196 Tw [( T)37.4(r).2(usted )-20(components, )-19(self-reliant )-19.1(trustwor)-23.5(thiness,)-9.9( )]TJ -3.4915 -1.033 TD .0005 Tw (trusted communications channels. )Tj /F4 1 Tf 13.533 0 TD -.0097 Tc -.0006 Tw [(Incompatible with security:)-9.9( )]TJ /F3 1 Tf -13.533 -1.033 TD -.0094 Tc .0004 Tw [(hier)19.7(ar)9.7(chical pr)9.7(otection)]TJ /F2 1 Tf T* -.0099 Tc -.0001 Tw (Resilience Engineering:)Tj /F3 1 Tf 9.1918 0 TD -.0094 Tc .0004 Tw [( Human backup, localized capacity,)-9.9( )]TJ -9.1918 -1.033 TD (loose coupling)Tj /F2 1 Tf -34.2811 -1.937 TD -.0098 Tc -.0002 Tw [(Expect adversaries)-10( )]TJ 0 -1.033 TD -.0237 Tc .0137 Tw [(to)-13.5( e)-7.7(v)-7.4(o)-14.6(l)-14.3(v)-14.4(e)-13.7(.)]TJ /F3 1 Tf 9.144 1.033 TD -.0247 Tc .0001 Tw [(Adv)7.6(anced cyber)19.7(a).3(dversaries invest time, effor)-24.4(t).3(, and intelligence-)]TJ 0 -1.033 TD -.0246 Tc 0 Tw [(gathering t)9.6(o)-.9( impr)9.8(o)7.1(v)-.1(e existing and de)6.3(velop new tactics,)-24.5( )]TJ T* -.0248 Tc .0002 Tw [(techniques and pr)9.5(ocedures \(T)-7.8(TPs\). Adversaries e)6(v)7.4(olve in)-24.2( )]TJ T* -.0246 Tc 0 Tw [(response t)9.4(o)-.9( oppor)-24.3(t).3(unities offered by new technologies or uses)-23.8( )]TJ T* [(of technology, as well as t)9.5(o)-.9( the knowledge they gain about)-24.6( )]TJ T* -.0247 Tc .0001 Tw [(defender )19.2(T)-7.4(T).5(Ps. In \(increasingly shor)-24.4(t\) time, the t)9.3(o)-1(ols de)6.2(veloped)-24.5( )]TJ T* -.0246 Tc 0 Tw [(by adv)7.7(a)0(nced adversaries become a)7.4(v)7.8(ailable t)9.4(o)-.9( less sophisticated)-24.4( )]TJ T* -.0248 Tc .0002 Tw [(adversaries. )19.6(Therefore, systems and missions need t)9.2(o)-1.3( be resilient)-25( )]TJ T* -.0246 Tc 0 Tw (in the face of unexpected attacks.)Tj /F2 1 Tf 25.136 8.267 TD -.0097 Tc (Security:)Tj /F3 1 Tf 3.4916 0 TD -.0094 Tc -.0196 Tw [( T)37.7(r).2(usted )-19.9(communications )-20.1(channels)]TJ /F2 1 Tf -3.4916 -1.033 TD -.0099 Tc -.0001 Tw (Resilience Engineering:)Tj /F3 1 Tf 9.192 0 TD -.0094 Tc .0004 Tw ( Reorganization, drift correction)Tj /F2 1 Tf -9.192 -1.033 TD -.0096 Tc 0 Tw [(Sur)-7.8(v)-.2(iv)6.9(ability: )]TJ /F3 1 Tf 5.346 0 TD -.0222 Tc [(Ev)-5.1(o)-12.4(l)-13.2(u)-12.5(t)-12.8(i)-13.2(o)-12.4(n)]TJ 6 0 0 6 35.31 349.1146 Tm -.0093 Tc .0003 Tw [(Sour)9.1(ce: National Institute of Standards and )19.8(Technology \(NIST\), SP 800-160 v)8.3(o)-.6(l. 2, )]TJ /F4 1 Tf 31.6273 0 TD -.0011 Tw [(De)6.3(veloping Cyber Resilient Systems: A Systems Security Engineering Appr)10.5(oach)]TJ /F3 1 Tf 29.6403 0 TD .0002 Tw [(, USA, No)7.2(vember 2019, )]TJ /F4 1 Tf -61.0487 -1 TD 0 Tw [(https:/)109.1(/)-.2(csr)10.5(c).5(.nist.go)7.3(v/publications/detail/sp/800-160/v)8.5(ol-2/final)]TJ ET EMC Q endstream endobj 433 0 obj <>/ExtGState<>>> endobj 447 0 obj <> endobj 465 0 obj <> endobj 470 0 obj <> endobj 475 0 obj <> endobj 476 0 obj <>stream /P <>BDC q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS2 gs BT /TT2 1 Tf 7 0 0 7 490.9954 20.9379 Tm 0 0 0 1 k 0 Tc 0 Tw (ISACA )Tj ET EMC /P <>BDC BT 7 0 0 7 512.4738 20.9379 Tm (JOURNAL)Tj ET EMC /P <>BDC /GS1 gs BT 7 0 0 7 543.321 20.9379 Tm .761 .549 .11 0 k [( V)6.3(OL 3)]TJ ET EMC /Artifact <>BDC 0 0 0 1 k /GS2 gs 572.364 .014984 .51599 31.274 re f EMC /P <>BDC /GS1 gs BT 7 0 0 7 585.4174 20.9379 Tm .761 .549 .11 0 k (13)Tj ET EMC /P <>BDC /GS2 gs BT 7 0 0 7 36.9471 21.3673 Tm 0 0 0 1 k [( 2021 ISACA. All rights reser)-8.8(ved. )]TJ ET EMC /P <>BDC BT /TT4 1 Tf 7 0 0 7 144.579 21.3673 Tm [(www)60.5(.isaca.org)]TJ ET EMC /Figure <>BDC Q q 1 i 36.001 404.5 532.985 -345.948 re W n .76471 .54118 .098039 .007843 k /GS1 gs 35.986 404.5 532.5 -18.479 re 223.386 386.021 52.1 -28.383 re 275.486 386.021 103.6 -28.383 re 379.086 386.021 189.4 -28.383 re f .78824 .85098 .17255 .043137 k 35.986 386.021 48 -28.383 re 83.986 386.021 57.7 -28.383 re 141.686 386.021 81.7 -28.383 re f .1098 .015686 .011765 0 k 35.986 357.638 48 -299.101 re 83.986 357.638 57.7 -299.101 re 141.686 357.638 81.7 -299.101 re f .11765 .082353 .019608 0 k 223.386 357.638 52.1 -149.101 re 275.486 357.638 103.6 -32.383 re 379.086 357.638 189.4 -32.383 re 275.486 325.256 103.6 -92.335 re 379.086 325.256 189.4 -92.335 re 275.486 232.921 103.6 -24.383 re 379.086 232.921 189.4 -24.383 re 223.386 208.538 52.1 -150 re 275.486 208.538 103.6 -150 re 379.086 208.538 189.4 -150 re f Q q 1 i 35.986 404.5 533 -345.963 re W n 0 0 0 1 K 0 J 0 j 1 w 10 M [] 0 d /GS2 gs q 1 0 0 1 568.486 387.021 cm 0 0 m 0 17.479 l S Q Q q 1 i 36.001 404.5 532.985 -345.948 re W n 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d /GS1 gs q 1 0 0 1 35.986 386.021 cm 0 0 m 48 0 l S Q Q 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d /GS1 gs 1 i q 1 0 0 1 83.986 386.021 cm 0 0 m 191.5 0 l S 1 0 0 1 191.5 0 cm 0 0 m 103.6 0 l S Q q 36.001 404.5 532.985 -345.948 re W n q 1 0 0 1 379.086 386.021 cm 0 0 m 189.9 0 l S Q 1 w q 1 0 0 1 35.986 357.638 cm 0 0 m 48 0 l S Q Q 1 w q 1 0 0 1 83.986 357.638 cm 0 0 m 191.5 0 l S 1 0 0 1 191.5 0 cm 0 0 m 103.6 0 l S Q q 36.001 404.5 532.985 -345.948 re W n q 1 0 0 1 379.086 357.638 cm 0 0 m 189.9 0 l S Q Q q 1 0 0 1 83.986 358.138 cm 0 0 m 0 26.883 l S 1 0 0 1 0 -32.883 cm 0 0 m 0 31.883 l S 1 0 0 1 0 -92.335 cm 0 0 m 0 92.335 l S 1 0 0 1 0 -24.382 cm 0 0 m 0 24.382 l S Q q 36.001 404.5 532.985 -345.948 re W n q 1 0 0 1 83.986 58.538 cm 0 0 m 0 150 l S Q Q q 1 0 0 1 141.686 358.138 cm 0 0 m 0 26.883 l S 1 0 0 1 0 -32.883 cm 0 0 m 0 31.883 l S 1 0 0 1 0 -92.335 cm 0 0 m 0 92.335 l S 1 0 0 1 0 -24.382 cm 0 0 m 0 24.382 l S Q q 36.001 404.5 532.985 -345.948 re W n q 1 0 0 1 141.686 58.538 cm 0 0 m 0 150 l S Q Q q 1 0 0 1 275.486 358.138 cm 0 0 m 0 26.883 l S 1 0 0 1 0 -32.383 cm 0 0 m 0 31.383 l S 1 0 0 1 0 -92.335 cm 0 0 m 0 91.335 l S 1 0 0 1 0 -24.382 cm 0 0 m 0 23.382 l S Q q 36.001 404.5 532.985 -345.948 re W n q 1 0 0 1 275.486 58.538 cm 0 0 m 0 149.5 l S Q Q q 1 0 0 1 379.086 358.138 cm 0 0 m 0 26.883 l S 1 0 0 1 0 -32.383 cm 0 0 m 0 31.383 l S 1 0 0 1 0 -92.335 cm 0 0 m 0 91.335 l S 1 0 0 1 0 -24.382 cm 0 0 m 0 23.382 l S Q q 36.001 404.5 532.985 -345.948 re W n q 1 0 0 1 379.086 58.538 cm 0 0 m 0 149.5 l S Q Q q 35.986 404.5 533 -345.963 re W n q 1 0 0 1 568.486 358.138 cm 0 0 m 0 26.883 l S 1 0 0 1 0 -32.383 cm 0 0 m 0 31.383 l S 1 0 0 1 0 -116.717 cm 0 0 m 0 23.382 l S Q Q q 36.001 404.5 532.985 -345.948 re W n q 1 0 0 1 568.486 58.538 cm 0 0 m 0 149.5 l S Q Q q 1 0 0 1 274.986 325.255 cm 0 0 m 104.1 0 l S Q q 36.001 404.5 532.985 -345.948 re W n q 1 0 0 1 379.086 325.255 cm 0 0 m 189.9 0 l S Q Q q 1 0 0 1 274.986 232.92 cm 0 0 m 104.1 0 l S Q q 36.001 404.5 532.985 -345.948 re W n q 1 0 0 1 379.086 232.92 cm 0 0 m 189.9 0 l S Q Q q 1 0 0 1 222.886 208.538 cm 0 0 m 52.6 0 l S 1 0 0 1 52.6 0 cm 0 0 m 103.6 0 l S Q q 36.001 404.5 532.985 -345.948 re W n q 1 0 0 1 379.086 208.538 cm 0 0 m 189.9 0 l S Q Q q 1 0 0 1 223.386 325.255 cm 0 0 m 0 31.883 l S 1 0 0 1 0 -92.335 cm 0 0 m 0 92.335 l S 1 0 0 1 0 -23.882 cm 0 0 m 0 23.882 l S Q q 36.001 404.5 532.985 -345.948 re W n q 1 0 0 1 223.386 58.538 cm 0 0 m 0 149.5 l S Q Q q 35.986 404.5 533 -345.963 re W n q 1 0 0 1 568.486 233.42 cm 0 0 m 0 91.335 l S Q Q q 1 0 0 1 223.386 358.138 cm 0 0 m 0 26.883 l S Q BT /F2 1 Tf 10 0 0 10 204.9126 390.021 Tm 0 0 0 0 k -.015 Tc .023 Tw (Figure 7Cyberresilience Completeness Checklist)Tj 8 0 0 8 43.5632 367.6382 Tm -.0097 Tc 0 Tw [(Technique)-2683.2(Appr)17.5(oach)-4600.7(Description)]TJ 23.6 1 TD -.0002 Tw [(Threat Use)-8.8( )]TJ -.388 -1 TD -.0099 Tc -.0001 Tw [(Case \(MITRE)-9.5( )]TJ .2 -1 TD -.0101 Tc 0 Tw [(F)12.2(r)14(amework\))]TJ 9.485 1 TD -.0098 Tc -.0002 Tw [(Assumptions)-10492.2(Cyber Resilience Appr)17.6(oach)]TJ ET /GS2 gs BT 7.2 0 0 8 47.4744 223.896 Tm 0 0 0 1 k -.01 Tc 0 Tw [(Adaptive)-9.5( )]TJ -.179 -1 TD -.0097 Tc (Response)Tj /F3 1 Tf -.14 -1 TD -.0094 Tc [(Implement)-10.4( )]TJ -.512 -1 TD -.0097 Tc .0001 Tw [(agile courses)-8.8( )]TJ .366 -1 TD -.0092 Tc -.0004 Tw [(of action t)8.9(o)-9.7( )]TJ -.509 -1 TD -.0098 Tc .0002 Tw (manage risks.)Tj /F2 1 Tf 8.3681 3 TD 0 Tw (Dynamic)Tj -1.443 -1 TD -.0095 Tc [(Reconfigur)15.2(a).2(tion)]TJ /F3 1 Tf 9.516 4 TD -.0002 Tw [(Make changes t)8.7(o)-9.9( )]TJ -.3721 -1 TD -.0099 Tc .0003 Tw [(individual systems,)-10( )]TJ .2931 -1 TD [(system elements,)-10( )]TJ -1.065 -1 TD -.0094 Tc -.0002 Tw [(components, or sets of)-10.2( )]TJ -.526 -1 TD -.0096 Tc 0 Tw [(cyberresour)9.2(ces t)8.4(o)-1.2( change)-9.7( )]TJ .3071 -1 TD -.0094 Tc -.0002 Tw [(functionality or beha)7.8(v).5(ior)-9.5( )]TJ .8839 -1 TD -.0003 Tw [(without interrupting)-8.8( )]TJ 2.2611 -1 TD -.0097 Tc 0 Tw [(ser)-9.2(v)-.4(ice.)]TJ 8.8958 13.375 TD [(Privileged)-9.6( )]TJ -.0919 -1 TD -.0093 Tc (escalation)Tj 6.17 8.795 TD -.0003 Tw [(Oper)19.5(ation system logs are)-9.3( )]TJ 0 -1 TD -.0098 Tc .0002 Tw [(a)7.1(v)7.6(ailable t)9.4(o)-.1( enable the enterprise)-10( )]TJ T* .0001 Tw [(t)8.9(o)-.7( be resilient)]TJ 14.389 2 TD (Implement trust-based privileged management.)Tj -14.389 -3.75 TD -.0245 Tc -.0003 Tw [(Change contr)9.6(o)-.3(l pr)9.6(ocess. Ensure)-24.2( )]TJ 0 -1 TD [(that systems undergoing)-23.5( )]TJ T* -.0247 Tc -.0001 Tw [(patching remain capable of)-25.1( )]TJ T* -.0246 Tc -.0002 Tw [(meeting per)-7.4(formance and quality)-24.6( )]TJ T* [(requirements thr)9.3(o)-.8(ugh loose)-24.4( )]TJ T* -.0247 Tc 0 Tw (coupling.)Tj 14.389 4.702 TD -.0097 Tc .0001 Tw [(Implement attribute-based usage restriction t)9.5(o)-1.3( make system,)-9.7( )]TJ 0 -1 TD -.0095 Tc -.0001 Tw [(de)6.5(vice or other application changes.)]TJ -14.389 -10.542 TD -.0002 Tw [(Persistence)-9849.8(E).1(xplore dynamic pr)9.4(o)7.1(v).1(isioning implement multifact)8.6(o)-.9(r)-9.6( )]TJ 14.389 -1 TD -.0096 Tc 0 Tw (authentication where possible.)Tj -19.3679 -10.399 TD -.0095 Tc (APT)Tj 4.9789 8.351 TD -.0096 Tc [(Access t)8.4(o)-1.1( sensitive data is not)-10.6( )]TJ 0 -1 TD -.0095 Tc -.0001 Tw (restricted using a maturity model)Tj 14.389 1.298 TD -.0245 Tc -.0003 Tw [( 1. )204.3(Constant monit)8.8(oring of critical assets.)]TJ 0 -1 TD [( 2. )204.2(Coordinate ar)9.5(chitecture of Firewall, W)21.8(A).4(F and A)42.4(V)108.9(, IPSIDS.)]TJ T* -.0247 Tc -.0001 Tw [( 3. )204(F)9.7(o)-1(r)9.2(c)-.7(e unauthorized users t)8.4(o)-1( a sandbo)10(x.)]TJ T* ( 4. Utilize a VPN.)Tj T* -.0246 Tc -.0002 Tw [( 5. )203.9(Email encryption.)]TJ T* -.0247 Tc -.0001 Tw [( 6. )203.9(Use of MSSO)49.6(.)]TJ T* [( 7. )204.1(Patch regularly.)]TJ T* -.0246 Tc -.0002 Tw [( 8. )204.3(Use multifact)8.8(o)-1(r authentication including for VPNs, RDP)158.4(,).6( SSH)-25( )]TJ 1.319 -1 TD [(and other remote access, and for all users when they per)-7.6(form a)-24.5( )]TJ T* [(privileged action or access a critical \(sensitive high-a)7.7(v)7(a)-.6(ilability\))-24.5( )]TJ T* [(data reposit)8.7(o)-.4(ry. Do daily backups of impor)-24.6(t)-.2(ant newly changed)-24( )]TJ T* [(data, software and configur)19.7(a).2(tion settings, st)8.7(ored disconnected,)-24.1( )]TJ T* -.0003 Tw [(retained for at least three months. )19.6(Test rest)8.9(or)19.7(ation initially,)-24.1( )]TJ T* -.0002 Tw [(annually and when IT)20.5( infr)19.5(astructure changes.)]TJ -1.319 -1 TD [( 9. )204.4(Re)6.6(view system and OS configur)19.6(a).2(tion updates.)]TJ T* [(10. )205.2(A)24.3(v)6.9(oid plan for loss of data.)]TJ T* -.0003 Tw [(11. )205.4(Include priv)7(acy at e)6.7(v)-1(ery stage in de)6.8(velopment of pr)9.7(ocesses or)-24.4( )]TJ 1.3789 -1 TD 0 Tw [(pr)9.6(oducts.)]TJ ET EMC /P <>BDC q 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n BT /TT2 1 Tf 9 0 0 9 37.4129 650.4155 Tm -.005 Tc [(Cyberresilient examples are illustr)19.5(ated in )]TJ ET EMC /P <>BDC BT /TT14 1 Tf 9 0 0 9 199.4343 650.4155 Tm 0 Tc ()Tj /TT6 1 Tf .6034 0 TD -.005 Tc (gure 6)Tj ET EMC /P <>BDC BT /TT2 1 Tf 9 0 0 9 230.3205 650.4155 Tm 0 Tc (.)Tj ET EMC /P <>BDC BT 9 0 0 9 232.6443 650.4155 Tm ( )Tj ET EMC /P <>BDC /GS1 gs BT /TT6 1 Tf 11 0 0 11 37.4129 624.4155 Tm .8 .871 .22 0 k -.005 Tc [(Oper)14.6(ational Checklist)]TJ ET EMC /P <>BDC BT 11 0 0 11 142.4235 624.4155 Tm 0 Tc ( )Tj ET EMC /P <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 37.4129 606.4155 Tm 0 0 0 1 k -.005 Tc [(Using the NIST)19.5( guidance, the checklist illustr)19.5(ated in)]TJ ET EMC /P <>BDC BT 9 0 0 9 238.856 606.4155 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT /TT14 1 Tf 9 0 0 9 37.4129 594.4155 Tm ()Tj /TT6 1 Tf .6034 0 TD -.005 Tc (gure 7)Tj ET EMC /P <>BDC BT /TT2 1 Tf 9 0 0 9 68.2993 594.4155 Tm [( can be oper)19.5(ationalized t)9.8(o)0( re)6.3(view an)]TJ ET EMC /P <>BDC BT 9 0 0 9 209.6208 594.4155 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 37.4129 582.4155 Tm -.005 Tc [(organization)39.1()54.7(s)0( cyberresilience appr)9.8(oach for)]TJ ET EMC /P <>BDC BT 9 0 0 9 206.6106 582.4155 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 37.4129 570.4155 Tm -.005 Tc [(completeness and o)7.3(ver)19.5(all r)9.8(obustness.)]TJ ET EMC /P <>BDC BT 9 0 0 9 187.2643 570.4155 Tm 0 Tc ( )Tj ET EMC /P <>BDC /GS1 gs BT /TT6 1 Tf 11 0 0 11 37.4129 544.4155 Tm .8 .871 .22 0 k -.005 Tc (Applying the Concept of Cyberresilience)Tj ET EMC /P <>BDC BT 11 0 0 11 233.9777 544.4155 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 11 0 0 11 37.4129 530.4155 Tm -.005 Tc [(or the NIST)29.3( Model)]TJ ET EMC /P <>BDC BT 11 0 0 11 125.8802 530.4155 Tm 0 Tc ( )Tj ET EMC /P <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 37.4129 512.4155 Tm 0 0 0 1 k -.005 Tc [(There are four steps organizations can take t)9.8(o)]TJ ET EMC /P <>BDC BT 9 0 0 9 219.0746 512.4155 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 37.4129 500.4155 Tm -.005 Tc [(strengthen their oper)19.5(ational resilience pr)9.8(ogr)19.5(ams:)]TJ ET EMC /P <>BDC BT 9 0 0 9 228.955 500.4155 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 57.1753 482.4395 Tm -.005 Tc [(Re)6.3(view the organization)39.1()54.7(s)0( oper)19.5(ational)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 203.6507 482.4395 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 44.3969 482.4395 Tm .49 .04 0 .05 k (1.)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 57.4289 470.4395 Tm 0 0 0 1 k -.005 Tc [(resilience pr)9.8(ogr)19.5(am t)9.8(o)0( understand how the)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 221.6684 470.4395 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 57.4289 458.4395 Tm -.005 Tc [(pr)9.8(ogr)19.5(am compares t)9.8(o)0( regulat)9.8(ory requirements)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 239.6476 458.4395 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 57.4289 446.4395 Tm -.005 Tc (\(e.g., Bank of England,)Tj ET EMC /LBody <>BDC BT 5.4 0 0 5.4 144.7772 450.2145 Tm -.0083 Tc (10)Tj ET EMC /LBody <>BDC BT 9 0 0 9 150.7516 446.4395 Tm -.005 Tc [( US Feder)19.5(al Financial)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 233.1626 446.4395 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 57.4289 434.4395 Tm -.005 Tc [(Institutions Examination Council [FFIEC)5.9(])]TJ ET EMC /LBody <>BDC BT 5.4 0 0 5.4 214.971 438.2145 Tm -.0083 Tc (11)Tj ET EMC /LBody <>BDC BT 9 0 0 9 220.9455 434.4395 Tm -.005 Tc (\),)Tj ET EMC /LBody <>BDC BT 9 0 0 9 225.7511 434.4395 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 57.4289 422.4395 Tm -.005 Tc [(industry standards \(Disaster Reco)7.3(very Institute)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 241.8715 422.4395 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 274.9289 650.4155 Tm -.005 Tc (International [DRII],)Tj ET EMC /LBody <>BDC BT 5.4 0 0 5.4 349.4209 654.1904 Tm -.0083 Tc (12)Tj ET EMC /LBody <>BDC BT 9 0 0 9 355.3954 650.4155 Tm -.005 Tc ( International Organization)Tj ET EMC /LBody <>BDC BT 9 0 0 9 459.8737 650.4155 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 274.9289 638.4155 Tm -.005 Tc (for Standardization [ISO] ISO 22301)Tj ET EMC /LBody <>BDC BT 5.4 0 0 5.4 414.5552 642.1904 Tm -.0083 Tc (13)Tj ET EMC /LBody <>BDC BT 9 0 0 9 420.5298 638.4155 Tm -.005 Tc (\) and)Tj ET EMC /LBody <>BDC BT 9 0 0 9 440.5989 638.4155 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 274.9289 626.4155 Tm -.005 Tc [(gener)19.5(ally accepted best pr)19.5(actices. )19.5(The)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 426.4482 626.4155 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 274.9289 614.4155 Tm -.005 Tc [(creation and maintenance of a regulat)9.8(ory book)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 459.0219 614.4155 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 274.9289 602.4155 Tm -.005 Tc (of record, along with periodic assessments)Tj ET EMC /LBody <>BDC BT 9 0 0 9 444.6329 602.4155 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 274.9289 590.4155 Tm -.005 Tc [(against those requirements, suppor)-24.4(ts pr)9.8(oper)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 450.4547 590.4155 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 274.9289 578.4155 Tm -.005 Tc [(o)7.3(versight contr)9.8(ols.)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 348.3463 578.4155 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 274.6753 560.4395 Tm -.005 Tc [(Create a scenario libr)19.5(ary of se)6.3(vere but)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 423.7896 560.4395 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 261.8969 560.4395 Tm .49 .04 0 .05 k (2.)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 274.9289 548.4395 Tm 0 0 0 1 k -.005 Tc [(plausible disruptions, threats and e)6.3(vents. )19.5(This)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 455.3109 548.4395 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 274.9289 536.4395 Tm -.005 Tc [(may include a mix of natur)19.5(al, man-made, third-)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 274.9289 524.4395 Tm [(par)-24.4(ty, human capital and technology threats.)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 450.3833 524.4395 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 274.9289 512.4395 Tm -.005 Tc [(Within technology threats, cyber)19.5(attack threats)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 455.826 512.4395 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 274.9289 500.4395 Tm -.005 Tc (such as malware, phishing, distributed denial)Tj ET EMC /LBody <>BDC BT 9 0 0 9 451.749 500.4395 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 274.9289 488.4395 Tm -.005 Tc [(of ser)-8.8(vice \(DDoS\) and r)19.5(ansomware should be)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 453.2726 488.4395 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 274.9289 476.4395 Tm -.005 Tc (included.)Tj ET EMC /LBody <>BDC BT 9 0 0 9 310.8186 476.4395 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 274.6753 458.4636 Tm -.005 Tc [(V)22.5(alidate the organization)39.1()54.7(s)0( oper)19.5(ational)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 425.2003 458.4636 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 261.8969 458.4636 Tm .49 .04 0 .05 k (3.)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 274.9289 446.4636 Tm 0 0 0 1 k -.005 Tc [(resilience pr)9.8(ogr)19.5(am against the pre)6.3(viously)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 436.8205 446.4636 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 274.9289 434.4636 Tm -.005 Tc (identi)Tj /TT11 1 Tf 2.4275 0 TD 0 Tc ()Tj /TT2 1 Tf .5487 0 TD -.005 Tc [(ed threat scenario libr)19.5(ary. V)22.5(alidation will)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 458.8059 434.4636 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 274.9289 422.4636 Tm -.005 Tc (be considered suf)Tj /TT11 1 Tf 7.8447 0 TD 0 Tc ()Tj /TT2 1 Tf .5487 0 TD -.005 Tc (cient if testing is)Tj ET EMC /LBody <>BDC BT 9 0 0 9 415.4892 422.4636 Tm 0 Tc ( )Tj ET EMC Q endstream endobj 477 0 obj <>/ExtGState<>>> endobj 495 0 obj <> endobj 500 0 obj <> endobj 502 0 obj <>stream /P <>BDC q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS2 gs BT /TT2 1 Tf 7 0 0 7 39.4019 20.9698 Tm 0 0 0 1 k 0 Tc 0 Tw (ISACA )Tj ET EMC /P <>BDC BT 7 0 0 7 60.8804 20.9698 Tm (JOURNAL)Tj ET EMC /P <>BDC /GS1 gs BT 7 0 0 7 91.7275 20.9698 Tm .761 .549 .11 0 k [( V)6.3(OL 3)]TJ ET EMC /Artifact <>BDC 0 0 0 1 k /GS2 gs 30.069 .014984 .51505 31.516 re f EMC /P <>BDC /GS1 gs BT 7 0 0 7 10.8984 20.9698 Tm .761 .549 .11 0 k (14)Tj ET EMC /P <>BDC /GS2 gs BT 7 0 0 7 415.3383 21.3673 Tm 0 0 0 1 k [( 2021 ISACA. All rights reser)-8.8(ved. )]TJ ET EMC /P <>BDC BT /TT4 1 Tf 7 0 0 7 522.9701 21.3673 Tm [(www)60.5(.isaca.org)]TJ ET EMC /LBody <>BDC BT /TT2 1 Tf 9 0 0 9 163.2148 185.2244 Tm -.005 Tc [(successful and pr)9.8(ocesses can be)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 294.711 185.2244 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 163.2148 173.2244 Tm -.005 Tc [(reestablished within prescribed reco)7.3(very time)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 342.153 173.2244 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 163.2148 161.2244 Tm -.005 Tc (objectives.)Tj ET EMC /LBody <>BDC BT 9 0 0 9 205.7908 161.2244 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 162.9612 143.2484 Tm -.005 Tc (Initiate a continuous feedback loop. Once a)Tj ET EMC /LBody <>BDC BT 9 0 0 9 333.5605 143.2484 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 150.1829 143.2484 Tm .49 .04 0 .05 k (4.)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 163.2148 131.2484 Tm 0 0 0 1 k -.005 Tc (test is completed for a given scenario, the)Tj ET EMC /LBody <>BDC BT 9 0 0 9 327.8069 131.2484 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 163.2148 119.2484 Tm -.005 Tc [(necessary pr)9.8(ogr)19.5(am impr)9.8(o)7.3(vements should be)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 339.1085 119.2484 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 163.2148 107.2484 Tm -.005 Tc (made and then testing should begin against a)Tj ET EMC /LBody <>BDC BT 9 0 0 9 342.9495 107.2484 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 163.2148 95.2484 Tm -.005 Tc [(new scenario. )19.5(Testing should e)6.3(v)7.3(olve along a)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 337.1234 95.2484 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 163.2148 83.2484 Tm -.005 Tc (maturity matrix with each subsequent test)Tj ET EMC /LBody <>BDC BT 9 0 0 9 329.3119 83.2484 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 163.2148 71.2484 Tm -.005 Tc [(increasing in complexity and rigor)60.1(. In addition,)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 343.4155 71.2484 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 380.7148 185.2244 Tm -.005 Tc [(testing categories should be re)6.3(visited on a)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 547.4427 185.2244 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 380.7148 173.2244 Tm -.005 Tc [(regular cadence t)9.8(o)0( ensure a state of readiness)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 563.5411 173.2244 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 380.7148 161.2244 Tm -.005 Tc [(against a br)9.8(oad r)19.5(ange of threats.)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 509.3086 161.2244 Tm 0 Tc ( )Tj ET EMC /P <>BDC /GS1 gs BT /TT6 1 Tf 11 0 0 11 360.6988 135.2244 Tm .8 .871 .22 0 k -.005 Tc (Conclusion)Tj ET EMC /P <>BDC BT 11 0 0 11 415.4875 135.2244 Tm 0 Tc ( )Tj ET EMC /P <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 360.6988 117.2244 Tm 0 0 0 1 k -.005 Tc (Cyberresilience is a relatively new term, but it)Tj ET EMC /P <>BDC BT 9 0 0 9 537.6212 117.2244 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 360.6988 105.2244 Tm -.005 Tc [(requires organizations t)9.8(o)0( apply basic common)]TJ ET EMC /P <>BDC BT 9 0 0 9 543.5009 105.2244 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 360.6988 93.2244 Tm -.005 Tc [(sense t)9.8(o)0( their contr)9.8(ols t)9.8(o)0( mitigate threats, whether)]TJ ET EMC /P <>BDC BT 9 0 0 9 559.2689 93.2244 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 360.6988 81.2244 Tm -.005 Tc (external or internal, using a thought-based)Tj ET EMC /P <>BDC BT 9 0 0 9 526.3719 81.2244 Tm 0 Tc ( )Tj ET EMC /Figure <>BDC Q q 1 i 33.584 687 533 -472.249 re W n .76471 .54118 .098039 .007843 k /GS1 gs 34.085 687 532.5 -18.479 re 460.085 668.521 106.5 -26 re f Q .78824 .85098 .17255 .043137 k /GS1 gs 1 i 34.085 668.521 106.5 -26 re 140.585 668.521 106.5 -26 re 247.085 668.521 106.5 -26 re 353.585 668.521 106.5 -26 re f .1098 .015686 .011765 0 k 34.085 642.521 106.5 -56.383 re 140.585 642.521 106.5 -56.383 re 247.085 642.521 106.5 -56.383 re 353.585 642.521 106.5 -56.383 re 34.085 586.138 106.5 -92.335 re 140.585 586.138 106.5 -92.335 re 247.085 586.138 106.5 -92.335 re 353.585 586.138 106.5 -92.335 re 34.085 493.804 106.5 -152.383 re 140.585 493.804 106.5 -152.383 re 247.085 493.804 106.5 -152.383 re 353.585 493.804 106.5 -152.383 re 34.085 341.421 106.5 -112.383 re 140.585 341.421 106.5 -112.383 re 247.085 341.421 106.5 -112.383 re 353.585 341.421 106.5 -112.383 re f .11765 .082353 .019608 0 k 460.084 642.521 106.5 -56.383 re 460.084 586.138 106.5 -92.335 re 460.084 493.804 106.5 -152.383 re 460.084 341.421 106.5 -112.383 re f q 33.599 687 532.985 -472.234 re W n 0 0 0 1 K 0 J 0 j 1 w 10 M [] 0 d /GS2 gs q 1 0 0 1 34.085 669.521 cm 0 0 m 0 17.479 l S Q 0 0 0 0 K 2 w /GS1 gs q 1 0 0 1 33.585 668.521 cm 0 0 m 107 0 l S Q Q 0 0 0 0 K 0 J 0 j 2 w 10 M [] 0 d q 1 0 0 1 140.584 668.521 cm 0 0 m 213 0 l S 1 0 0 1 213 0 cm 0 0 m 106.5 0 l S Q q 33.599 687 532.985 -472.234 re W n q 1 0 0 1 460.084 668.521 cm 0 0 m 106.5 0 l S Q 1 w q 1 0 0 1 33.585 642.521 cm 0 0 m 107 0 l S Q Q 1 w q 1 0 0 1 140.584 642.521 cm 0 0 m 213 0 l S 1 0 0 1 213 0 cm 0 0 m 106.5 0 l S Q q 33.599 687 532.985 -472.234 re W n q 1 0 0 1 460.084 642.521 cm 0 0 m 106.5 0 l S 1 0 0 1 -426 .5001 cm 0 0 m 0 24.5 l S 1 0 0 1 0 -56.383 cm 0 0 m 0 55.383 l S 1 0 0 1 0 -357.6 cm 0 0 m 0 111.883 l S 1 0 0 1 0 -14.287 cm 0 0 m 0 14.287 l S Q Q q 1 0 0 1 140.584 643.021 cm 0 0 m 0 24.5 l S 1 0 0 1 0 -56.383 cm 0 0 m 0 55.383 l S 1 0 0 1 0 -357.6 cm 0 0 m 0 111.883 l S 1 0 0 1 106.5 413.983 cm 0 0 m 0 24.5 l S 1 0 0 1 0 -56.383 cm 0 0 m 0 55.383 l S 1 0 0 1 0 -92.335 cm 0 0 m 0 91.335 l S 1 0 0 1 0 -152.382 cm 0 0 m 0 151.382 l S 1 0 0 1 0 -112.883 cm 0 0 m 0 111.883 l S 1 0 0 1 106.5 413.983 cm 0 0 m 0 24.5 l S 1 0 0 1 0 -56.383 cm 0 0 m 0 55.383 l S 1 0 0 1 0 -92.335 cm 0 0 m 0 91.335 l S 1 0 0 1 0 -152.382 cm 0 0 m 0 151.382 l S 1 0 0 1 0 -112.883 cm 0 0 m 0 111.883 l S 1 0 0 1 106.5 413.983 cm 0 0 m 0 24.5 l S 1 0 0 1 0 -56.383 cm 0 0 m 0 55.383 l S 1 0 0 1 0 -92.335 cm 0 0 m 0 91.335 l S 1 0 0 1 0 -152.382 cm 0 0 m 0 151.382 l S 1 0 0 1 0 -112.883 cm 0 0 m 0 111.883 l S 1 0 0 1 -319.5 357.1 cm 0 0 m 213 0 l S 1 0 0 1 213 0 cm 0 0 m 106.5 0 l S Q q 33.599 687 532.985 -472.234 re W n q 1 0 0 1 460.084 586.138 cm 0 0 m 106.5 0 l S Q Q q 1 0 0 1 140.584 493.803 cm 0 0 m 213 0 l S 1 0 0 1 213 0 cm 0 0 m 106.5 0 l S Q q 33.599 687 532.985 -472.234 re W n q 1 0 0 1 460.084 493.803 cm 0 0 m 106.5 0 l S Q Q q 1 0 0 1 140.584 341.421 cm 0 0 m 213 0 l S 1 0 0 1 213 0 cm 0 0 m 106.5 0 l S Q q 33.599 687 532.985 -472.234 re W n q 1 0 0 1 460.084 341.421 cm 0 0 m 106.5 0 l S 1 0 0 1 -426.5 244.717 cm 0 0 m 107 0 l S 1 0 0 1 .5 -91.835 cm 0 0 m 0 91.335 l S Q Q q 1 0 0 1 140.584 494.303 cm 0 0 m 0 91.335 l S Q q 33.599 687 532.985 -472.234 re W n q 1 0 0 1 33.585 493.803 cm 0 0 m 107 0 l S 1 0 0 1 .5 -151.882 cm 0 0 m 0 151.382 l S Q Q q 1 0 0 1 140.584 341.921 cm 0 0 m 0 151.382 l S Q q 33.599 687 532.985 -472.234 re W n q 1 0 0 1 33.585 341.421 cm 0 0 m 107 0 l S Q Q BT /F2 1 Tf 10 0 0 10 189.1064 672.521 Tm 0 0 0 0 k -.015 Tc .022 Tw (Figure 7Cyberresilience Completeness Checklist )Tj /F6 1 Tf 19.6856 0 TD 0 Tw (\(cont.\))Tj /F2 1 Tf 8 0 0 8 67.3651 660.521 Tm -.0094 Tc -.0006 Tw [(Mitigation t)14.6(o)-9.1( )16.5( )]TJ -.344 -1 TD -.0005 Tw [(Reduce A)8.2(t).2(tack)-9.6( )15.1( )]TJ 1.316 -1 TD -.0098 Tc 0 Tw [(Sur)-9.3(f)-.6(ace)]TJ 8.479 .851 TD -.0095 Tc -.0005 Tw [(F)11.2(o)-.5(cus on Common Critical Asset)]TJ 14.029 .149 TD -.0099 Tc -.0001 Tw [(Expect Adversaries t)13.6(o)0( E)12.4(v)7.4(olve)]TJ 17.838 -.149 TD 0 Tw [(Steps)-9961.6(D)-.7(escription)]TJ ET /GS2 gs BT /F3 1 Tf 7.2 0 0 8 38.0844 630.1382 Tm 0 0 0 1 k -.0095 Tc -.0001 Tw [(Remo)6.8(ve users fr)9.3(om the local)-9.5( )]TJ 0 -1 TD -.0097 Tc .0001 Tw [(administr)19(a)-.1(t)9.5(o)-.8(rs on systems:)]TJ T* [(1. )218.8(Implement privileged users)-8.7( )]TJ .956 -1 TD [(based on least privilege.)82.7()]TJ -.956 -1 TD [(2. )218.8(Predicate permission t)9.5(o)-1.5( these)-10( )]TJ .956 -1 TD -.0091 Tc 0 Tw (accounts.)Tj 13.8359 5 TD -.0096 Tc [(F)9.4(o)-1.3(cus on high-v)8(alue enterprise)-9.7( )10( )]TJ 0 -1 TD .0001 Tw [(assets, risk r)19.1(a).2(nked using an)-10.3( )]TJ T* 0 Tw [(appr)9.3(o)6.7(v)0(ed risk fr)19.1(amework, based)-9.4( )]TJ T* -.0094 Tc -.0002 Tw [(on nonpublic information, ability t)8.6(o)-9.9( )]TJ T* -.0001 Tw [(commit fr)19.2(aud, etc.)]TJ 14.7921 4 TD -.0096 Tc 0 Tw [(E)12.7(v)8.1(olve the pr)9.3(ocess.)-7341.6(Dynamically change r)9.1(o)-1.4(uter rules,)-9.6( )]TJ 14.7919 -1 TD -.0092 Tc -.0004 Tw [(access contr)9.7(o)-.3(l lists, intrusion)-9.5( )]TJ T* -.0094 Tc -.0002 Tw [(detection and pre)6.7(v).4(ention system)-10.3( )]TJ T* -.0097 Tc .0001 Tw [(par)19(a)-.7(meters, and filter rules for)-9.9( )]TJ T* 0 Tw (firewalls and gateways)Tj -44.375 -2.75 TD -.0244 Tc -.0004 Tw [(Check for common U)11.2(A).6(C bypass)-24.3( )]TJ 0 -1 TD [(weaknesses on Windows system)-25.1( )]TJ T* -.0247 Tc -.0001 Tw [(t)8.5(o)-1( be aware of the risk posture and)-24.2( )]TJ T* [(address issues where appr)9.1(opriate:)-25.1( )]TJ T* [(1. )204.3(Implement privileged users based)-24.3( )]TJ .911 -1 TD -.0246 Tc -.0002 Tw [(on least privilege.)81.8()]TJ -.911 -1 TD [(2. )204.1(Predicate permission t)8.6(o)-.9( these)-24.6( )]TJ .911 -1 TD -.0244 Tc 0 Tw (accounts,)Tj -.911 -1 TD -.0246 Tc -.0002 Tw [(3. )204.1(Reduce complexity of change)-24.4( )]TJ .911 -1 TD 0 Tw [(pr)9.4(ocess)]TJ 28.672 8.702 TD -.0096 Tc [(Make system resilient in the face)-9.7( )]TJ 0 -1 TD .0001 Tw [(of unexpected attacks thr)9.3(o)-1.5(ugh)-9.9( )]TJ T* -.0169 Tc 0 Tw [(evo)-8(l)-7.3(u)-7.5(t)-8(i)-7.3(o)-8(n)-7.9(.)]TJ 14.7919 2 TD -.0097 Tc .0001 Tw [(Reassign cyber defense)-9.9( )]TJ 0 -1 TD -.0095 Tc -.0001 Tw [(responsibilities t)8.5(o)-1( personnel or)-9.5( )]TJ T* -.0002 Tw [(oper)19.7(ating center)60.5(.)]TJ -44.375 -9.542 TD -.0098 Tc .0002 Tw [(Implement pr)8.9(ofile t)9.4(o)-.2( cust)9.4(omize)-10.1( )]TJ 0 -1 TD .0003 Tw [(user logons or their envir)8.9(o)-.2(nment.)-9.4( )9( )]TJ T* [(MITRE indicates )24.9(a).1(n administr)18.9(a)-.9(t)9.4(o)-.2(r)-10.1( )]TJ T* -.0094 Tc -.0002 Tw [(can also configure a pr)9.5(ofile that)-10.4( )]TJ T* -.0098 Tc .0002 Tw [(applies t)9.3(o)-.3( all users and host)-9.7( )]TJ T* -.0095 Tc -.0001 Tw [(pr)9.3(ogr)19.3(a)-.5(ms or the local computer)60.3(.)82.9()]TJ 29.583 5 TD -.0096 Tc 0 Tw [(1. )218.8(Use trusted communications)-8.5( )]TJ .956 -1 TD -.0095 Tc -.0001 Tw [(channels in the enterprise where)-9.6( )]TJ T* -.0097 Tc 0 Tw (possible.)Tj -.956 -1 TD -.0095 Tc -.0001 Tw [(2. )219.4(Reorganize if applicable.)]TJ T* -.0093 Tc -.0003 Tw [(3. )219.5(More attention by monit)8.7(oring t)8.7(o)-9.7( )]TJ .956 -1 TD -.0097 Tc .0001 Tw [(audit tr)19(ails of critical systems)-8.7( )]TJ T* -.0094 Tc -.0002 Tw (and key accounts.)Tj -.956 -1 TD -.0003 Tw [(4. )219.1(Become more aware of)-10.1( )]TJ .956 -1 TD -.0001 Tw [(knowledge others may ha)7.7(ve)-9.6( )]TJ T* -.0097 Tc .0001 Tw [(about enterprise )19(T)-7(T)1.1(Ps within)-10.2( )]TJ T* 0 Tw (cybersecurity.)Tj -.956 -1 TD -.0099 Tc .0003 Tw [(5. )219.3(A)7.4(ttempt t)9.1(o)-.4( disguise t)9.2(o)-.3(ols,)-10.1( )]TJ .956 -1 TD -.0096 Tc 0 Tw [(techniques and access data)-9.4( )]TJ T* -.0095 Tc -.0001 Tw (such as using honeypots.)Tj -.956 -1 TD -.0097 Tc .0001 Tw [(6. )219.3(Le)6.2(ver)19.2(a)-.7(ge t)9.6(ools and their use)]TJ ET /GS1 gs BT /F5 1 Tf 7.2 0 0 8 357.5913 481.418 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 7.2 0 0 8 361.1194 481.418 Tm 0 0 0 1 k -.0097 Tc .0001 Tw [( )219(Disable access dynamically.)]TJ ET /GS1 gs BT /F5 1 Tf 7.2 0 0 8 357.5913 473.4179 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 7.2 0 0 8 361.1194 473.4179 Tm 0 0 0 1 k -.0097 Tc .0001 Tw [( )219.1(Implement adaptive)-9.9( )]TJ .219 -1 TD -.0093 Tc 0 Tw (authentication.)Tj ET /GS1 gs BT /F5 1 Tf 7.2 0 0 8 357.5913 457.418 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 7.2 0 0 8 361.1194 457.418 Tm 0 0 0 1 k -.0095 Tc -.0001 Tw [( )219(Employ dynamic pr)9.6(o)6.9(v).3(isioning.)]TJ ET /GS1 gs BT /F5 1 Tf 7.2 0 0 8 357.5913 449.418 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 7.2 0 0 8 361.1194 449.418 Tm 0 0 0 1 k -.0094 Tc -.0002 Tw [( )219.1(Implement load-balance.)]TJ ET /GS1 gs BT /F5 1 Tf 7.2 0 0 8 357.5913 441.418 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 7.2 0 0 8 361.1194 441.418 Tm 0 0 0 1 k -.0095 Tc -.0001 Tw [( )219(Pr)9.2(o)6.9(v)0(ide emergency shut)9.8(off)-10.4( )]TJ .219 -1 TD -.0097 Tc 0 Tw (capabilities.)Tj ET /GS1 gs BT /F5 1 Tf 7.2 0 0 8 357.5913 425.418 Tm .51765 .078431 .027451 0 k 0 Tc ()Tj ET /GS2 gs BT /F3 1 Tf 7.2 0 0 8 361.1194 425.418 Tm 0 0 0 1 k -.0095 Tc -.0001 Tw [( )219.3(Pr)9.3(o)7(vide for aut)8.5(o)-1(matic disabling)-8.9( )]TJ .219 -1 TD (of the system.)Tj ET /GS1 gs BT /F5 1 Tf 7.2 0 0 8 357.5913 409.418 Tm .51765 .078431 .027451 0 k 0 Tc 0 Tw ()Tj ET /GS2 gs BT /F3 1 Tf 7.2 0 0 8 361.1194 409.418 Tm 0 0 0 1 k -.0095 Tc -.0001 Tw [( )219.3(Pr)9.3(o)7(vide dynamic deployment of)-10.2( )]TJ .219 -1 TD [(new or replacement resour)9.3(ces or)-9.6( )]TJ T* -.0097 Tc 0 Tw (capabilities.)Tj 14.0831 11 TD -.0245 Tc -.0003 Tw [(Adversaries may gain persistence)-24.4( )]TJ 0 -1 TD -.0247 Tc -.0001 Tw [(and ele)6.6(v)6.8(ate privileges in cer)-24.6(t)-.4(ain)-24.7( )]TJ T* -.0246 Tc -.0002 Tw [(situations by abusing P)6.4(o)-1(werShell)-24.5( )]TJ T* -.0247 Tc -.0001 Tw [(pr)9.3(ofiles. A P)6.1(o)-1.2(werShell pr)9.3(ofile)-24.7( )]TJ T* -.0246 Tc -.0002 Tw [(\(pr)9.5(o)-.8(file.ps1\) is a script that runs)-24.7( )]TJ T* -.0247 Tc -.0001 Tw [(when P)6.4(o)-1(werShell star)-24.6(ts and can be)-24.6( )]TJ T* -.0246 Tc -.0002 Tw [(used as a logon script t)8.7(o)-.9( cust)8.6(omize)-24.4( )]TJ T* .0012 Tw [(user envir)9.5(o)-1(nments. P)6.3(o)-.8(werShell)-24.4( )]TJ T* -.0002 Tw [(suppor)-24.7(t)-.4(s se)6.2(ver)19.4(a)-.6(l pr)9.4(ofiles depending)-24( )]TJ T* [(on the user or host pr)9.6(ogr)19.6(a)-.3(m. F)9.9(o)-1(r)-24.5( )]TJ T* -.0247 Tc -.0001 Tw [(example, there can be different)-25.5( )]TJ T* -.0246 Tc -.0002 Tw [(pr)9.4(ofiles for P)6.3(o)-1.1(werShell host)-25.5( )]TJ T* -.0247 Tc -.0001 Tw [(pr)9.5(ogr)19.5(a)-.4(ms such as the P)6.5(o)-1(werShell)-24.4( )]TJ T* [(console, P)6.2(o)-1.1(werShell ISE or Visual)-24.5( )]TJ T* -.0244 Tc .001 Tw [(Studio Code. An administr)19.7(a).4(tion can)-24.6( )]TJ T* -.0247 Tc -.0001 Tw [(also configure a pr)9.5(ofile that applies)-24.6( )]TJ T* -.0246 Tc -.0002 Tw [(t)8.7(o)-.9( all users and host pr)9.4(ogr)19.4(a)-.3(ms on)-24.7( )]TJ T* .0012 Tw [(the local computer)60.5(.)]TJ -59.167 -2.048 TD -.0098 Tc .0002 Tw [(1. )218.8(Use application whitelisting t)9.4(o)-9.1( )]TJ .956 -1 TD [(help pre)6(v)-.3(ent malicious software)-10( )]TJ T* [(and unappr)9(o)7.9(v)-.3(ed pr)9(ogr)19(a)-.8(ms fr)9(om)-9.5( )]TJ T* -.0093 Tc 0 Tw (running.)Tj -.956 -1 TD -.0097 Tc .0001 Tw [(2. )218.9(Patch applications such as)-8.8( )]TJ .956 -1 TD [(Ja)7.3(v)7.8(a).3(, PDF viewers, Flash, web)-9.8( )]TJ T* -.0094 Tc -.0002 Tw [(br)9.5(owsers and Micr)9.5(osoft Office.)]TJ -.956 -1 TD -.0097 Tc .0001 Tw [(3. )218.8(P)5.1(a)-.7(tch oper)19.1(ating system)-10.8( )]TJ .956 -1 TD 0 Tw [(vulner)19(abilities.)]TJ -.956 -1 TD .0002 Tw [(4. )218.8(Restrict administr)18.8(a)0(tive privileges)-8.9( )]TJ .956 -1 TD -.01 Tc .0004 Tw [(t)9.2(o)-.4( oper)18.7(ating systems and)-9.9( )]TJ T* -.0098 Tc .0002 Tw [(application, based on user)-10.2( )]TJ T* 0 Tw (duties.)Tj 5.4 0 0 6 38.0844 218.75 Tm -.0091 Tc [(Sour)9.7(ce: )]TJ /F4 1 Tf 3.111 0 TD -.0093 Tc [(https:/)110.2(/)1.3(encylopedia.kaspersky,com/knowledge/sstr)19.8(a)-.4(tegies-for-mitigating-adv)7.1(a)-.6(nced-persistent-threats-aps)]TJ ET EMC endstream endobj 503 0 obj <>/ExtGState<>>> endobj 525 0 obj <> endobj 530 0 obj <> endobj 535 0 obj <> endobj 540 0 obj <> endobj 545 0 obj <> endobj 550 0 obj <> endobj 555 0 obj <> endobj 560 0 obj <> endobj 565 0 obj <> endobj 570 0 obj <> endobj 575 0 obj <> endobj 580 0 obj <> endobj 585 0 obj <> endobj 590 0 obj <>stream /P <>BDC q 1 i 0 783 603 -783 re 301.5 391.515 m W n 0 783.015 603 -783 re W n /GS2 gs BT /TT2 1 Tf 7 0 0 7 490.9954 20.9379 Tm 0 0 0 1 k 0 Tc 0 Tw (ISACA )Tj ET EMC /P <>BDC BT 7 0 0 7 512.4738 20.9379 Tm (JOURNAL)Tj ET EMC /P <>BDC /GS1 gs BT 7 0 0 7 543.321 20.9379 Tm .761 .549 .11 0 k [( V)6.3(OL 3)]TJ ET EMC /Artifact <>BDC 0 0 0 1 k /GS2 gs 572.364 .014984 .51599 31.274 re f EMC /P <>BDC /GS1 gs BT 7 0 0 7 585.4174 20.9379 Tm .761 .549 .11 0 k (15)Tj ET EMC /P <>BDC /GS2 gs BT 7 0 0 7 36.9471 21.3673 Tm 0 0 0 1 k [( 2021 ISACA. All rights reser)-8.8(ved. )]TJ ET EMC /P <>BDC BT /TT4 1 Tf 7 0 0 7 144.579 21.3673 Tm [(www)60.5(.isaca.org)]TJ ET EMC /P <>BDC BT /TT2 1 Tf 9 0 0 9 35.1459 490.5692 Tm -.005 Tc [(appr)9.8(oach. NIST)19.5( guidance pr)9.8(o)7.3(vides risk-based)]TJ ET EMC /P <>BDC BT 9 0 0 9 213.5941 490.5692 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 35.1459 478.5692 Tm -.005 Tc [(appr)9.8(oaches and a fr)19.5(amework that can be an)]TJ ET EMC /P <>BDC BT 9 0 0 9 208.8193 478.5692 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 35.1459 466.5692 Tm -.005 Tc [(impor)-24.4(tant t)9.8(ool for organizations t)9.8(o)0( impr)9.8(o)7.3(ve )]TJ ET EMC /P <>BDC BT 9 0 0 9 207.1506 466.5692 Tm 0 Tc ( )Tj ET EMC /P <>BDC BT 9 0 0 9 35.1459 454.5692 Tm -.005 Tc (their cyberresiliency.)Tj ET EMC /P <>BDC BT 9 0 0 9 116.1891 454.5692 Tm 0 Tc ( )Tj ET EMC /P <>BDC /GS1 gs BT /TT6 1 Tf 11 0 0 11 35.1459 428.5692 Tm .8 .871 .22 0 k -.005 Tc (Endnotes)Tj ET EMC /P <>BDC BT 11 0 0 11 80.9512 428.5692 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 52.5095 410.5692 Tm 0 0 0 1 k -.005 Tc (US Chamber of Congress, )Tj ET EMC /LBody <>BDC BT /TT4 1 Tf 9 0 0 9 156.1032 410.5692 Tm (Internet )Tj ET EMC /LBody <>BDC BT 9 0 0 9 188.1653 410.5692 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 40.146 410.5692 Tm .49 .04 0 .05 k (1)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT4 1 Tf 9 0 0 9 52.146 398.5692 Tm 0 0 0 1 k -.005 Tc (Security Essentials for Business 2.0)Tj ET EMC /LBody <>BDC BT /TT2 1 Tf 9 0 0 9 190.1144 398.5692 Tm (, USA, )Tj ET EMC /LBody <>BDC BT 9 0 0 9 214.8351 398.5692 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 52.146 386.5692 Tm -.005 Tc [(Oct)9.8(ober 2012, )]TJ ET EMC /LBody <>BDC BT /TT4 1 Tf 9 0 0 9 109.6998 386.5692 Tm [(https:/)109.4(/www)60.5(.uschamber)60.1(.com/)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 225.4731 386.5692 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 52.146 374.5692 Tm -.005 Tc (CybersecurityEssentials)Tj ET EMC /LBody <>BDC BT 9 0 0 9 144.7104 374.5692 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT /TT2 1 Tf 9 0 0 9 52.5095 362.5692 Tm -.02 Tc [(Ross, R.; V)109.9(.)0( Pillitteri; R. Gr)19.5(aubar)-24.4(t; D. Bodeau; R.)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 225.3304 362.5692 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 40.146 362.5692 Tm .49 .04 0 .05 k (2)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 52.146 350.5692 Tm 0 0 0 1 k -.02 Tc [(McQuaid; Special Publication \(SP\) 800-160 v)7.3(ol. 2,)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 239.3145 350.5692 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT /TT4 1 Tf 9 0 0 9 52.146 338.5692 Tm -.02 Tc [(De)6.3(veloping Cyber Resilient Systems: A Systems)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 229.9269 338.5692 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 52.146 326.5692 Tm -.02 Tc [(Security Engineering Appr)9.8(oach)]TJ ET EMC /LBody <>BDC BT /TT2 1 Tf 9 0 0 9 166.8798 326.5692 Tm (, National Institute)Tj ET EMC /LBody <>BDC BT 9 0 0 9 235.9043 326.5692 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 52.146 314.5692 Tm -.02 Tc [(of Standards and )19.5(Technology \(NIST\), USA,)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 212.8663 314.5692 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 52.146 302.5692 Tm -.02 Tc [(No)7.3(vember 2019, )]TJ ET EMC /LBody <>BDC BT /TT4 1 Tf 9 0 0 9 117.2451 302.5692 Tm [(https:/)109.4(/csr)9.3(c.nist.go)7.3(v/)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 195.525 302.5692 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 270.6459 677.5693 Tm -.005 Tc [(publications/detail/sp/800-160/v)7.3(ol-2/)]TJ /TT15 1 Tf 16.2868 0 TD 0 Tc ()Tj /TT4 1 Tf .537 0 TD -.005 Tc (nal)Tj ET EMC /LBody <>BDC BT 9 0 0 9 433.7416 677.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT /TT2 1 Tf 9 0 0 9 271.0095 665.5693 Tm -.005 Tc [(F)10.2(o)0(r)9.3(cepoint, What Is Defense in Depth?)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 427.1024 665.5693 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 258.6459 665.5693 Tm .49 .04 0 .05 k (3)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT4 1 Tf 9 0 0 9 270.6459 653.5693 Tm 0 0 0 1 k -.005 Tc [(https:/)109.4(/www)60.5(.for)9.3(cepoint.com/cyber-edu/)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 424.6623 653.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 270.6459 641.5693 Tm -.005 Tc (defense-depth)Tj ET EMC /LBody <>BDC BT 9 0 0 9 326.2849 641.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 271.0095 629.5693 Tm -.005 Tc (Ibid.)Tj ET EMC /LBody <>BDC BT 9 0 0 9 287.6158 629.5693 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 258.6459 629.5693 Tm .49 .04 0 .05 k (4)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 271.0095 617.5693 Tm 0 0 0 1 k -.005 Tc [(ManageEngine Ser)-8.8(viceDesk Plus, What Is)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 437.0516 617.5693 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 258.6459 617.5693 Tm .49 .04 0 .05 k (5)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 270.6459 605.5693 Tm 0 0 0 1 k -.005 Tc (ITIL Incident Management? 25 June 2020,)Tj ET EMC /LBody <>BDC BT 9 0 0 9 439.3589 605.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT /TT4 1 Tf 9 0 0 9 270.6459 593.5693 Tm -.02 Tc [(https:/)109.4(/www)60.5(.manageengine.com/pr)9.8(oducts/)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 433.6379 593.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 270.6459 581.5693 Tm -.02 Tc [(ser)-8.8(vice-desk/itil-incident-management-guide.html)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 456.0915 581.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT /TT2 1 Tf 9 0 0 9 271.0095 569.5693 Tm -.005 Tc (ISACA)Tj ET EMC /LBody <>BDC BT 5.4 0 0 5.4 296.1718 572.5394 Tm 0 Tc ()Tj ET EMC /LBody <>BDC BT 9 0 0 9 300.3721 569.5693 Tm -.005 Tc (, )Tj ET EMC /LBody <>BDC BT /TT4 1 Tf 9 0 0 9 304.2768 569.5693 Tm [(IT)19.5( Contingency Planning A)5.4(udit Pr)9.8(ogr)19.5(am)]TJ ET EMC /LBody <>BDC BT /TT2 1 Tf 9 0 0 9 456.2189 569.5693 Tm 0 Tc (,)Tj ET EMC /LBody <>BDC BT 9 0 0 9 457.9404 569.5693 Tm ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 258.6459 569.5693 Tm .49 .04 0 .05 k (6)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 270.6459 557.5693 Tm 0 0 0 1 k -.005 Tc (USA, 2009, )Tj ET EMC /LBody <>BDC BT /TT4 1 Tf 9 0 0 9 315.4016 557.5693 Tm [(https:/)109.4(/www)60.5(.isaca.org/bookst)9.8(ore/)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 447.1649 557.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 270.6459 545.5693 Tm -.025 Tc [(it-go)7.3(vernance-and-business-management/wapcp)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 452.632 545.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 271.0095 533.5693 Tm -.005 Tc (Op cit )Tj ET EMC /LBody <>BDC BT /TT2 1 Tf 9 0 0 9 295.7699 533.5693 Tm (Ross)Tj ET EMC /LBody <>BDC BT 9 0 0 9 315.5455 533.5693 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 258.6459 533.5693 Tm .49 .04 0 .05 k (7)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 271.0095 521.5693 Tm 0 0 0 1 k -.005 Tc [(\(ISC)12.7(\))]TJ ET EMC /LBody <>BDC BT 5.4 0 0 5.4 290.5205 524.5394 Tm 0 Tc (2)Tj ET EMC /LBody <>BDC BT 9 0 0 9 293.5078 521.5693 Tm -.005 Tc (, )Tj ET EMC /LBody <>BDC BT /TT4 1 Tf 9 0 0 9 297.4125 521.5693 Tm [(\(ISC)12.7(\))]TJ ET EMC /LBody <>BDC BT 5.4 0 0 5.4 316.5498 524.5394 Tm 0 Tc (2)Tj ET EMC /LBody <>BDC BT 9 0 0 9 319.4739 521.5693 Tm -.005 Tc [( Cybersecurity W)15.1(orkfor)9.3(ce Study,)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 442.427 521.5693 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 258.6459 521.5693 Tm .49 .04 0 .05 k (8)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT4 1 Tf 9 0 0 9 270.6459 509.5693 Tm 0 0 0 1 k -.005 Tc [(2019: Str)19.5(ategies for Building and Gr)9.8(owing )]TJ ET EMC /LBody <>BDC BT 9 0 0 9 433.3627 509.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 270.6459 497.5693 Tm -.005 Tc [(Str)9.8(ong Cybersecurity )19.5(Teams)]TJ ET EMC /LBody <>BDC BT /TT2 1 Tf 9 0 0 9 379.9418 497.5693 Tm (, USA, 2019,)Tj ET EMC /LBody <>BDC BT 9 0 0 9 426.4191 497.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT /TT4 1 Tf 9 0 0 9 270.6459 485.5693 Tm -.005 Tc [(https:/)109.4(/www)60.5(.isc2.org/-/media/ISC2/)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 410.5194 485.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 270.6459 473.5693 Tm -.005 Tc [(Resear)9.3(ch/2019-Cybersecurity-W)15.1(orkfor)9.3(ce-)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 270.6459 461.5693 Tm [(Study/ISC2-Cybersecurity-W)15.1(orkfor)9.3(ce-Study-2019)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 458.2722 461.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 271.0095 449.5693 Tm -.005 Tc (Ibid.)Tj ET EMC /LBody <>BDC BT 9 0 0 9 287.6158 449.5693 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 258.6459 449.5693 Tm .49 .04 0 .05 k (9)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 271.173 437.5693 Tm 0 0 0 1 k -.02 Tc (Bank of England, )Tj ET EMC /LBody <>BDC BT /TT4 1 Tf 9 0 0 9 337.0989 437.5693 Tm [(Oper)19.5(ational Resilience: Impact)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 450.7254 437.5693 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 253.646 437.5693 Tm .49 .04 0 .05 k (10)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT4 1 Tf 9 0 0 9 270.6459 425.5693 Tm 0 0 0 1 k -.02 Tc [(T)48.3(oler)19.5(ances for Impor)-24.4(tant Business Ser)-8.8(vices)]TJ ET EMC /LBody <>BDC BT /TT2 1 Tf 9 0 0 9 433.6035 425.5693 Tm 0 Tc (,)Tj ET EMC /LBody <>BDC BT 9 0 0 9 435.1902 425.5693 Tm ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 270.6459 413.5693 Tm -.02 Tc (United Kingdom, 5 December 2019, )Tj ET EMC /LBody <>BDC BT /TT4 1 Tf 9 0 0 9 407.2566 413.5693 Tm [(https:/)109.4(/www)60.5(.)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 455.2999 413.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 270.6459 401.5693 Tm -.02 Tc (bankofengland.co.uk/prudential-regulation/)Tj ET EMC /LBody <>BDC BT 9 0 0 9 433.5595 401.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 270.6459 389.5693 Tm -.02 Tc (publication/2018/building-the-uk-)Tj /TT15 1 Tf 13.8567 0 TD 0 Tc ()Tj /TT4 1 Tf .522 0 TD -.02 Tc (nancial-)Tj ET EMC /LBody <>BDC BT 9 0 0 9 270.6459 377.5693 Tm [(sect)9.8(ors-oper)19.5(ational-resilience-discussion-paper)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 447.465 377.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT /TT2 1 Tf 9 0 0 9 271.173 365.5693 Tm -.005 Tc [(Feder)19.5(al Financial Institutions Examination)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 436.0344 365.5693 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 253.646 365.5693 Tm .49 .04 0 .05 k (11)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 270.6459 353.5693 Tm 0 0 0 1 k -.005 Tc [(Council \(FFIEC)12.7(\) IT)19.5( Examination Handbook)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 435.7609 353.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 270.6459 341.5693 Tm -.005 Tc (Infobase, )Tj ET EMC /LBody <>BDC BT /TT4 1 Tf 9 0 0 9 309.2151 341.5693 Tm (Business Continuity Managemen)Tj ET EMC /LBody <>BDC BT /TT2 1 Tf 9 0 0 9 436.5429 341.5693 Tm (t,)Tj ET EMC /LBody <>BDC BT /TT4 1 Tf 9 0 0 9 441.1596 341.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT /TT2 1 Tf 9 0 0 9 270.6459 329.5693 Tm -.005 Tc (USA,)Tj ET EMC /LBody <>BDC BT /TT4 1 Tf 9 0 0 9 289.279 329.5693 Tm [( https:/)109.4(/ithandbook.f)]TJ /TT15 1 Tf 8.8067 0 TD 0 Tc ()Tj /TT4 1 Tf .537 0 TD -.005 Tc [(ec.go)7.3(v/it-booklets/)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 446.8376 329.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 270.6459 317.5693 Tm -.005 Tc (business-continuity-management.aspx)Tj ET EMC /LBody <>BDC BT 9 0 0 9 420.4719 317.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT /TT2 1 Tf 9 0 0 9 271.173 305.5693 Tm -.005 Tc [(Disaster Reco)7.3(very Institute International \(DRII\),)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 454.8444 305.5693 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 253.646 305.5693 Tm .49 .04 0 .05 k (12)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT4 1 Tf 9 0 0 9 270.6459 293.5693 Tm 0 0 0 1 k -.005 Tc [(https:/)109.4(/drii.org/)]TJ ET EMC /LBody <>BDC BT 9 0 0 9 329.7084 293.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT /TT2 1 Tf 9 0 0 9 271.173 281.5693 Tm -.005 Tc (International Organization for Standardization)Tj ET EMC /LBody <>BDC BT 9 0 0 9 451.3231 281.5693 Tm 0 Tc ( )Tj ET EMC /Lbl <>BDC /GS1 gs BT /TT6 1 Tf 9 0 0 9 253.646 281.5693 Tm .49 .04 0 .05 k (13)Tj ET EMC /LBody <>BDC /GS2 gs BT /TT2 1 Tf 9 0 0 9 270.6459 269.5693 Tm 0 0 0 1 k -.005 Tc (\(ISO\), ISO 22301:2019 )Tj ET EMC /LBody <>BDC BT /TT4 1 Tf 9 0 0 9 359.9244 269.5693 Tm (Security and Resilience)Tj ET EMC /LBody <>BDC BT 9 0 0 9 270.6459 257.5693 Tm (Business Continuity Management)Tj ET EMC /LBody <>BDC BT 9 0 0 9 400.8248 257.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT 9 0 0 9 270.6459 245.5693 Tm -.005 Tc (SystemsRequirements)Tj ET EMC /LBody <>BDC BT /TT2 1 Tf 9 0 0 9 364.7869 245.5693 Tm (, Switzerland, 2019,)Tj ET EMC /LBody <>BDC BT 9 0 0 9 440.4795 245.5693 Tm 0 Tc ( )Tj ET EMC /LBody <>BDC BT /TT4 1 Tf 9 0 0 9 270.6459 233.5693 Tm -.005 Tc [(https:/)109.4(/www)60.5(.iso.org/standard/75106.html)]TJ ET EMC /Artifact <>BDC .761 .549 .11 0 k /GS1 gs 35.146 514.044 203.988 172.956 re f EMC /P <>BDC BT /TT13 1 Tf 47 0 0 47 45 646.9285 Tm .49 .04 0 .05 k 0 Tc ()Tj ET EMC /P <>BDC BT /TT2 1 Tf 14 0 0 14 58.9072 666.9287 Tm 0 0 0 0 k [( )19.5(THE CREA)63(TION AND)]TJ ET EMC /P <>BDC BT 14 0 0 14 189.3232 666.9287 Tm ( )Tj ET EMC /P <>BDC BT 14 0 0 14 45 648.9287 Tm (MAINTENANCE OF A)Tj ET EMC /P <>BDC BT 14 0 0 14 176.0449 648.9287 Tm ( )Tj ET EMC /P <>BDC BT 14 0 0 14 45 630.9286 Tm [(REGUL)-9.3(A)63(T)13.7(OR)23.4(Y BOOK OF)]TJ ET EMC /P <>BDC BT 14 0 0 14 191.6309 630.9286 Tm ( )Tj ET EMC /P <>BDC BT 14 0 0 14 45 612.9286 Tm [(RECORD, AL)31.7(ONG WITH)]TJ ET EMC /P <>BDC BT 14 0 0 14 187.7207 612.9286 Tm ( )Tj ET EMC /P <>BDC BT 14 0 0 14 45 594.9286 Tm [(PERIODIC ASSESSMENT)7.8(S)]TJ ET EMC /P <>BDC BT 14 0 0 14 206.4307 594.9286 Tm ( )Tj ET EMC /P <>BDC BT 14 0 0 14 45 576.9286 Tm -.0195 Tw [(AGAINST)19.5( THOSE)]TJ ET EMC /P <>BDC BT 14 0 0 14 150.3896 576.9286 Tm 0 Tw ( )Tj ET EMC /P <>BDC BT 14 0 0 14 45 558.9287 Tm [(REQUIREMENT)7.8(S, SUPPOR)39.1(T)7.8(S)]TJ ET EMC /P <>BDC BT 14 0 0 14 222.8848 558.9287 Tm ( )Tj ET EMC /P <>BDC BT 14 0 0 14 45 540.9287 Tm [(PROPER O)10.7(VERSIGH)14.2(T)]TJ ET EMC /P <>BDC BT 14 0 0 14 175.4229 540.9287 Tm ( )Tj ET EMC /P <>BDC BT 14 0 0 14 45 522.9286 Tm (CONTROLS. )Tj ET EMC /P <>BDC BT /TT13 1 Tf 47 0 0 47 123.3056 502.9285 Tm .49 .04 0 .05 k ()Tj ET EMC Q endstream endobj 591 0 obj <>/ExtGState<>>> endobj 6 0 obj <> endobj 5 0 obj <> endobj 70 0 obj <>stream Adobed         #"""#''''''''''     !! !!''''''''''""  s!1AQa"q2B#R3b$r%C4Scs5D'6Tdt& EFVU(eufv7GWgw8HXhx)9IYiy*:JZjzm!1AQa"q2#BRbr3$4CS%cs5DT &6E'dtU7()󄔤euFVfvGWgw8HXhx9IYiy*:JZjz?X;egh(FyY,B=]6Q!Af49Yi-"|H4İ2)d.$HwmjN]E4Y2ywl]7(NjaI4lvb+w"IlP.wM^9mcNN.|mG.ǏP6#tZ2{%c,БZuSm TW|5/!a/Mcv:?N- J,&k;;]E(9@'Q_z_hx[F1iuP\d1'ȲO^9C[PV.Vb^UeR:gW+4iX󭗡tn^g6_8Om:0I_:{}wF0RYU=WV[91i[}#6j Q2Co{{CZ yrFP41$LOhޟ&e)!C`Ӭ;nnE7òPy>N;38F6E߫Qp1j 00pz?}y2/:y'xQkA.?M?؛ykEʏ͒JNͽqqg\@{Em9dB>,C'xO@=ԗ1eؒ6,xu~JֵM]i/o/~'f b3y3!5ˈYBho ?vsSO8Ra.|suc-2,O0@rq޴>,# $):]ѯ':JF:|pm9҅W0K-fGl:׭m4ecyGڽH(r(#A~a~6fgKakCN e(O@|io[.~N֡+>2A3f̌OaSI}T|`@oץ$5A-ˑ#O|W͈ 7qlÐ_vU!45jJ9]r}+)\aPz, ) Wcϯ^1:6*nY|Z Oz55?VmWw 7~>Ϧ>,ܜOI> dYusNmJC^):[Xb4=]˒ZPO?7Aٚ.\\@\#i^I Oʷ2eD8I (;.Ai_TcrAc S]2M}Ū^ DH"(U`cXOYIZՊT}mj+.3 >o\Gl(#jgP6YթEoQ)'XWE_¸6Ub>y#Z*nA7 $8csR⇑'}sYxߍ?'hv'gK&AςGiڜ߽,z~-̥1% !MX'$Qlo䶒b38#UA,5_$~Y·}y3V!GZYdA$_}qiǡC^Sv:=$LY;,+l{3Zb'_J=1Ǐ.O\T@סHڟ})MyiQ;/C |.(l,%V?د$l#(cࠜCiij+Gv@Pl3{ ))#~sNXGޟ&s`/8oNG$ߓj%׵ !S^~cC Gn5˙I,.Ĝ-YO4w4hpWQ[)L-1(jL$qg&FPqi,u/z*iz'^1q_E74VQ4-: (8?%dr=Zg ƩCu3qz$cW|sWA֍>. 8@?t8)5>R"aɪ^EX㠕]M8}yR1W4ZE'NIfa]CCrc\LXHˡY#I=yYL}'^Fw\T umnQjGs!}4++Jj25im{1cq7ϪǸ/9~M?u'e#zjƷ-˦<ǫjM=#_‚I͕0HvlkmAb,Nwg$=C፶s5ZF~hf7WEݳ#gnnB Jg `>GaGEeJ76N/(w\EC_u8'΋=Mfi8 ; 2Nu֨= ;'38tw7X+;pI׏E6ץdʺu$L}imeGQNW] U%)'ۯpC(aCҠ1tK[:~i|9#g2j0vBWHp:{KEiLZGyG/!X=+W0fHCPHgj7oe\Q'O#c$1ċ4"MUm9334 Éz_^8F˽(ia[@jI )A xc M$u"@F k˓@;ǹuݳGшۈ}) JhAoĵ}oJQ_}E8Ϋ_j/s{3M+ٍ~l!'w=~ 6eF9<|ڝ^C<2'lk|- ;zJ~'#989+]iK01ڽNlٳelnX\$o$8--O/aklX׊\*rXOlٳf,cwsKi[& t}BK;FP_녎%-`\,Jװ=\ٳ: J4rJZs\K0au@>Ӱ ʪ+PH4>5?{͛6eF"#e(b&܎g *Ǧө 64F`1r4o#eb޹f͔ T_4Y]1t#Ӷ $aQa5aWJHCǮ0o\nhs~\ځ8ͣɗ4eKg& Z,AjbZTBi\ٳgA@w|&;}'v=om%_ + {ct. "r_6զePHr;f͛+0u|pu: au9Pr;(ԄrͮHI$ 7^l؜VWH&E6qŰ]4a8[aSa╮ldA]q.̔IyK+zs^)҃*8ߦ+o#QVc@|r&36lٝ.>/>/=hT>ףzg߮_SҹWehHrRN6T4+_"?sKtI{v`pje}M0G0l?Do'\?zݸ1_qJLCZ0{Oݶi,lOא82%Q#w"91& Ko& NٛJ^EyrSX5{GJL -dh0Ԝ1`XۛQA\,N+C/Nz Wc؍ysӌHOUó^IMX0&[-,3Z6IH*!ϳvɽRT^#/rmx%mTo-6rRFIu -8ԗL;u=Hޗt)av[]>0N1ٰmFFQ𪎘jw#_QǴ$VC[r~s~ьj`9&bC.ZIBH #;MlWo&y^e =QDqyy)#˪Sژ\XcV;.MniJThhwcӃ e88cm:%9Ce${JtyC2FTQ@eB6 (},َrH9TW ZS&zeڇv㝏`\c!Q2;9wU(cԱ12}3>GFMSK1& uO3p,g,Ɵ~sibbWF&68o:G\~8>sZܺ\.XG%߼w2kMmd~LUb^<>;巕.$D8__(kZ$i}se,vR"f]+xcƩcR2R*ݩȅebȌg߶u2#1L>O7>N<7gGq, 5K=6l8wL()=:g³R*I4"֚ 8$܁l݆ۘt~eXfQ I2>#3jB9!)<=W O%$SK>dy,ф0M:{zzqWMKˍ6's2zq[TU;ztcn֤Hf+D)t5yIO LoR%>51{gۙF}>bc?{}S>< rzxǘynj q?e[/2c{;oVsym xޥLX+ |WqWdn-AMM2Yuny8@@lioC`8+6vgNS##dQ9{KU,Qh޹{Aͮ{ /Dut4P*xg^׵9?osE!67™f #_f͛"qK!ܺbCdPvf1ܒkH'Z 0wX|NfħyissҦ|CKx_7R2#I#}fpN E#Ɣ#4M:ym_cTTNw:U>'OriWC.\c~A8Hms.PEi&&_vG}d'!1uS9XaQRrs]\egw毕tw4)v7li~[% 7/[oծ*ޒN]qnn0"! -{X(U[0#ˬownq=G#2|"iAZ8}i_z a^kAƙ1.E`Unȝz߹'s\ D>̨ 1 ; +Ꭻl=Vo37.c 'Ë[Y Iؤrhi帒vI<$}{{*LKTF|MDj:D7o)eHP=Oc$.bC_=&i6%czl) cSP\|;3 #@9~זZ^L RiOįp5c\9TvOtiO9g%R6lٲh{ydPVs;sao4P/5lwdJ&z͛6W F^\q]ʫͩrznpUk{r@6zjD~6lmq&;3 dρ([!Pq-r[L}6lٳ_LuFS$,콆! 4|DzU5{fƻLqΐ'&aDR/_50ӟ>`}wixg;ˠzgqv"_N3V|0IԓV88MNG2GN/3;yr{#S#̞;G wf5)"q+3:% I('ٳfͶl.Q~(hm7GcOlRZ8 nS,QEAٹ1=f͛12P!BDnQäk|jn8G?<$ ٳfq=}9&QrڹR8^k CaڝAQe@6lL R\v92#c >oJ/ULH~/>3R|=r}s8ĉ QfO?O ~{'O ,Z_=pT _a}uUuž4;eӐ9duz?>nß=e8{_}9~!=H?ʣ|>#ZmGQARTTL3%ԁntv^Q N"Td_rYuKQP䌧 3=ΐ]rapm_-rF_hj>C+ʡPM<*Au]0 6d#w^MqEƘ2P102W ,zTJWjF+6#цuHM1A߉!]1v=6BU=4X56Vĺ[͚ ApQG*dᆘy"0 dOqmbۗˤb]{g }kUJk=?؆% 9 I-qY'zuƝiww34$GUb*F O*Z6IM:cSv瀧b2v> 102 WZ!vi@ׄ7hԮx_1HdBS5%,\m\" ]p>YRWЎώc_Z0De\7d7evciBub2^_,k50Zc˺V: uu+ VXfmxPsޙ%$+b#UEj6uJf!-OGb4!Tx}G?687oݟ: t4wI] TkYd?Sg=?c:GO$yjjd28Md:{#K=IcF>ajiG #!;[Wl)š-0}?;?0~ 6j8doW~^q*b@aQ=6:]0HH#i~˧)Wc.Bvll>c dbN+y,J _cE?8r9#\FS?'&svFVNOӍK HNh0M$~51#b+ g=FI2$.S,?E^g]TO-]Hs{#7ie3,Ҙbx3(Oe`38b둈1$YO|_@On(á;IաљX*Ð5jt(kbBG;R l=[Jٞ[[U}j|J.(| ~Tz$w<%_Uvxų*(;gO@܄GJD2QyrX&#;NJz4Fh$"lbN[_#~mysSa>,Sz?8;s޾8jWIۂ1J)MJ ׫XˋnC: tUTǶ@(<Q`%98>sM?es4;< M0O8d# =o,8zGr2Y{RbR8'~\(Ϋef[ɒ!~i=2#u +puLU߂gӉuʷ8(u* fz9a!;k,51tqvПFET@pAT9N}D ?[h{3WD%D#QH1haoi#FnJQ0C|_G'eyB [ڑ=~Wra< y0R?frHQSQaL dcS[ !(f㈘}36|阕0Q_+Wu܉'|oi-$=6E,xS*l3ҟ-0 N̅u~ (ݍ<\2:M'2O1CN(*|5/KK{= %5}vOxԅiRAû[8V?9quUE * ǃOzT:k#_cʵ}cMu GERH.{,u1-AaC͏sNfVG5gsS%Xf͒`O דh eXԼp[a..*6++aƦٳfaɺ8y|8ᦟ:b[zeAPK`~]nvQx6la""dHBj]bF7"y N7$:6mOlٳf&\>3X1zV(R" ۲Iq!$Irұf81h7Hj݆iC">],3`{懴uٱ@&gcSd71CljZe`IeV .CEX`(2GE˨-F˂s;+sk DyII.8F αw#΢V0Se2B8 :wZObZOqPt㏄B z`?KeGQr)-_RRhcw/5{MN:!6cͱh\0"$?#휒S.6lٲ7'[ c$jw;8S,qĝ[C%ċƔ:ab iw\ٳf&jp"isZ#QP191Џ:l#7O,;EWxٳf#$F:Traa[Э0COLk͛6B;hF,h&_Rfm{j741mý}ʒp6cԷrJ{u(7 S+k{Oƒ_f͔̫<}[Ţhs]^򧵑/w;c{x34 N_p{ $w#Jf0e,'.tWs/}Ϫ^N51⽈͏1n*F]OV=VDCl]1rhUE m*9ѕzbk3lӦ7b(q) m6Tw*Nvf&*sV@2 [+-'/|G]N0|;c]`0B-yƑM#0b w,.3\qy8{lx@w :*D$׶W@q v*ͧ1˴k>@e?Sjdž|ZyBxzobs\I쟸VcڟxOGe몏0WEzQ#WeQՇ3#̄yzuOzqm@8v ͼmOϯZڍ~98~;Q_lOjk%tyo/ԣE?@usaqX|TOb{]6$a!Yz7'3x 6kƑSKV؜ivtaJ~UY{LD'!(V{\u:?i{ @0TSˆ@b6̰,OPQ ׋sj>EVO״+A#2p?&L]k|׹d%7 Ma]; Jȩh${ ai*{?Axty+e#]cP69*KCI^$iNu?7yKt7Oyt(vvU^Dq#S]Z|rP~>;J"FwQTPNihN#Z+e=>iFXfc=Q{|IHϤ͒xˊ0?@0onnnI s tKM;tȩ~FTЯ=ܟng#OՒ [rԨmɧXEvijUvPrFY A #)Sɴ]UD\Id^<:Ǧ@|Rq?-_NӡӬYf, /5|{QCf?Ew;'ǧ^a`v^I[TpC\(O8{X Yth I3e3+`e\ɗvt Hf88P?s^~d~^1=4j}OAL^v_ţYK|d7R1 d0^(:̀%IB*Ш&\DB&FuC4<9H䉐R36G[oKP@% 8j,}}=-UnDd\)ʞˢy2jK#\#(uV2g3bPs+ghQLg%IIg)e$WWɽv*\0'  )'1OF:P->Yf^L%[ܡj7 ImL%Ln Alxf[HA/uon+4ܡ#H5:ܧ'lSPoQp7;0!_r;֧R }^ٸ;|+*Px )Yߌ\*P!O<ǰ'!ô-^cŔCQX뗸cĜTc\w嵢N}C舎_{L_>hÓMm p/C>&'ŒC%_ORkO2;p˯Z݀rGIUňݽ̗_!ِD!3i?ޠyM9\& ޑg/eg#;W?+_lHdP\˷2HƬI$|ڕ7,GYq2O1x5Do݄&w!{-C\5:Q11ypc=vQ?ygVԟ^~.%Њ DPO̠+VI'TS*M\yPF2(1E5-PڷZUμ 'mgwYy6~Ǽ#aO#V 5?q Dg`W;mjϘ*Ir@m:TwRHח,X0rmM,^cHwC^nW d =64=GSf %>$zvie {ultML]&% BMؑw߲[n v08#Q힤{xܑ( "ևF;N'̌u#gbsK"YE|;LPUDXGxPah^WRn-_(-zl z.㉔} ޼縐MK1'[-"_;ב52ՕT=68^Ǜ12w2,̞wu)#6OEUݚ 'ԙ~ ٳa014*)I.|,)"3/ *;Sk)m5TflZgs׹!܉8 C~Ɓq8%q,v&7 ;u2(SbsCo:9Vp'|l(r d( @2 pфG-6MGxrp/3ͼ=* .F-䤶} j˺w %e+on}'*n ' #j3:֫w%˗w?@͛6O%\Ge\GpŝNIƥ!{f4dD~=N=\ϰ͛66eJQN.lqb$R3IE!r<ða!ZJv?dG͚:xkC[j͍W iEE2>\ڌB>LٳW"F$5 fGs"8%ؒjO|}2Rz vlٳg ϫ5# nJbX48ԒM=aAhbCK )ހR댗)HBjGS&ϧ&v!2|Yl{ȉ~9W6pׇӬFiV514NL?،zado)㒙kRO=5sOo#$C+LvjcH(a-2fVŗ,OK'Ӛ}/fq?oL_t?i2H'cS,OKg\3+s49u3SKCI_݋E='?gbPI?jq^W?fG7Ӕe8#~tؓr'*qF:W1lb2NV}[\YO/n$ryv:?KSXWi?4',x֝T\|'@k>b_ ^ 4egO_G})JF t0WC?5ʹ$D!Ei!ڇ 5RExFN kT}~v8~^:}TX #I 3-ޘG5#9iA9 `W,&[Z8ّ `<+z<+XjS*h S"$5͓c}dfA?KC{,#UlEUq>v@D4"Q;T90Ae`9|ocFIJ6cwlȿ[jvJR,wRїbnof,=+h^Rv:j{gU&q/8=E,twsM҅ ly*3 &'dgßӨf:|1nCSE@T̈WX_ůgRI/TA2b\I"fkS+7hc4*ћ7b̾؟nN˔K=8[6AQWpgŒ;F)߅(1DL>ImasS:ly#ŪǦ8#,,;R8Së%~_R\^ZJDxn#w}mCDQ $Ӗ]8^|mfc&@mA fJ ;|#.O!(NĚZؼbeEVJ,qb?&߇\[6\R.z3o m%?$̱)f! NI@Hyvg| G$4TY;5ٙKHB# :O'5#`{ td$t\EPF@j( {1WZ[l咭"䅏qҘ}Igm4p( P{b"+>I@lV$>P&LgŦhK3 moCȍFHf~x XЁ(Pe͌#,ړ Է7g>gCp;+rBF [|$k5 ٳfidCQy G>0wUbz{9XRA­DHdڴŴԑTt=0q(F:s.vcRIt$QhF-y]RPO͛6nچ;=0b#':.l<26-;a)HdkPͱV_5ݤmfaR闔M3 Wǎ&16{KY\^Q~zm5h=*hcolhpi6\tv_VrƤԞ (6/Bw?v;5pu3b. f5+F%if՝IT,rKkfan|1LE,LPؑͯVeńUJ(oc.nyP xz"}⤜d\sGrq ɇE NBX?e{ wga/6@v}5zT"Lcp5>?ޱ4:z(W̚pL%Mߊ5ΝkZvjAejCܓPq$V;6lO(w6i|xNVlGƼţ-ӥƀ.:$KI-suT^|$Pf?yƣ1fUf͛6b,ɬ^IYޭ}/'jc^ʣ[<EY)U`UAUn|3f͌*M":2Ą HD9x6G2y6qڒxQ+VFdZHTbrX受ԮYd)i U{cY-{ ~P4ڐ#&˥kf!g#ֺ,ѐnR!S?9q+K+w%RN-W:ܷoYMXa3\+|ic x飋0x?#}ƣsC@os,t,Y%]c0ɺ喑іl`[gyb検%H;QN[ƅTT~[ԢksFGa:Ȼ~j)w?.nY*Ƥ?}kѶ@Z+hV9&NҎ$R:"2E+ ~e(CYr@/JM7Ztz8 { ;ϓ-b{ x`{9$i&ɇ<^HDeEA|t.QՐk 2T~ MixX"\RU˥?zI.:қZ0"@+ox}?͓;V~d>O#: SAoCnݿoZ,UO'7Nte c,sU/*JmdmG|h'Œ5>e^J?4׮ ?M֫Zd'z!oY,edwe˱?~Z!zB_X춞rJ9Ad̿GONK4_6̸ֈGp_!ƙn]30}6o^G+>g=~cl:iسL/E/1$:~UEY/l,zx\?a~cSӼa~bգB }c ~dXYOT}.zt4'}+ m4r2YO1[`ѻa)x_6<>XG(v?mqt U/c%.zvfHż_ʰuΪ|lWӉ7|?按&0(D&B{cqޔ~ʏb\-!I\[C*s2q[ 16`?FB S@d_W=4듐;ed1z .`! yn,z 9X|Qb-yU S=4lځbG?z5݇X??L017rHK67ý$̍|i:6F8hR>드 ~F_ q cb>pzD'/??O2\ "~ڟ_Ր5>d\U|zzģ%cخ̏?ޣ+?.x\|}^qm?Ȳr1d샯>fǖ)~Hv^|g7/qOf_>GvXAcrFF8iuOiۨ> JKo %X#utY3ЃVT&>XC'ajnG` 'O$]N/7aiDy>\R|B5țX'sLTBBwkiC$j ,mc h W6lV?N(óP)X}=mk Ÿ~5 "T?cQ>ptƴ/u2hPLl Ǥc{ЈG"#j#%ǧI2Mo1\~ gSd Y+t)8ٱ\)(n 1l$!@ky!E>T2GJ'"}FvY4)p^]\G42j@XU.rPƨè58 vq3zQ$zPӻؚɁ#"'ژ& "xLQEVÔfDpھi%>*G6^|ZO{X"e,wSo{Wv' jkFܴX8]졔k)KM*^Uvj7HL_?Lrf<*)}e` %0X]8FR5,O2GaWkQ8#o\2"0=䇑ߺw+kASӳ#IeJϋNE8)1ܽWb`$"  6tMSUKLа3_uu ȻV Vo:}B (#vġ.L5QqH :u{PF8⦟<=B#qe"7L.YLf1.S SA#G0"vZu֡:ZDN)bIg_*k7F̉Co:6Ej:E~#ՊCYq)b5Z~]u$=58e8v. r#ҿ&uͫO&R_9Ӵ{} -*x[E߻1NJZw·ҚYLlpw8ODRv+}, 5A9P'#8R.^t,w"k.㤙a3ivqy:AYX(eoh9v?U}rQN3I䟀pF*cVxݸî$_7(G#w9yI];BR㯥>ާWlg' ~~a{af_֡rYi&͛7]ic3< f>$J%Ù%bےMN"E7AFE *ĄD5k+Ө2Ht'91%>:pM}"ѴyE*6b@;Y uGDŽ?so'9qCz;X#njs|杂O}*/#l|_Kd`U;8'V^H }F3w[0 p~Wȣ1Rvn$j* ϪQtGiG:s?9rNnF;96he|^hmߘ Hsio|*յ^KFvy Y cb{ x!G,˿Apqi3rbqcG $w8yi ݔ_f͛6gXǰ6|v11>l˂<1Ǽl<2%i9D\0bHTRI4΁_۝G5sXה y7:>c ^fR!WvGOƦ[K Jwool2K*B Sz#ڞѱ@`;ɥ1bwkQq/^Gf3@F0*"=/1yKD/CN”r#.KqBI5=rcrq\:G6HYvc-DFCȋN.oQ|`1(p '`Gh*Ǡe,`5 Flٳf1C```hfa1kylw=pO(ZvVbrH{٩49W^,'a.(l k C`zvQgYb_:*zMbXᨷKam )ߩY4aaT d~5(tZjdQgqNabr/Q q)[X gsF83#Αz8!zhX~ocʨOl. =/%?E}b)s2oϹ1E*8ٳ1@#ǚpKаfcs=z\LgcCƻ _Fcut(a ch/o&)P6G0V{4i\e=|rc`!9p@׽얎/IOJo&j >½'ξT7dɔ{/սy! dj8q־d;?PmW|=|񿃈q.OGወxb&}8oڒ[ v?6?ƟgcfQcU;z;d'ws`Cz~nK> 6E6xs4Ug{HLK1='8O,v΂k'ٝk?68HP# ֮tNE5]q~c^-[c5G(W&-Gz/5q#˷{L;rUCT1MD?2V3EݩEa-Y?z~i=`sz^g|Z}p _Z0[;"JiڲV\!%v>eYje)@nLCR0fMW dǨ1Ln!1evA1hOk өUy6`v(M -bOc:Ašʑ=GX3qa (gVS<7겷I9;g?v?.:-5 XM[_2~pW$A& I%Ɂ6-Wpґwm|ORalGXo^Wm}|⹕r18o+"< pDalBLX9{"$ؓUpJѭdTǼ@#X\]ڸp0OM8<=D:,$5L]V'IV~ /NvH@›i dR1cl?j>jb +"՘WLkyEWHOTb˶'ɦvN=dey$?\Ed?6#KLJm @~|Յ~.%Mb' AO8X׭52\iͧՏYCAϞeJu|X{.KiBqˆc&.#.wGUnRITU? x'q2E.$g>⼲FhA,V6܎I"VK($SFtb qCE }C+$1&)Snj?OA.O?(-S5hNgO 򦱮Za kK]-6e[Q͉X֭ߋ17J2O=C,H>Lz„ k/{SGn.Oj摑ؿ-|! 86?ʟ1ux ˸]]6T`6ԯ[ex1FyOׁUaW C4;.y8ОO~(_jq ]2lC*N:\LGv߬SVW㙵b֐#Z=\4k$v+^}?V"Jv?2pZʧX?^k26ɫ䠗 e/h+`4ktx#Tx*ro.CWW$x"?m0E=yG­HXATKQ-21i?c2㽷UCMvM$F2&vߵMf&ģ(ƇvwmE3phzMR$yP#aـ\""~=~`ySFVG2JXՔQfLdXeu_6Xu|L82DzM6;ᶝUU}?NV:Fx5L6T+PEN ,ٝ?Tp,t_&LSɔc=>BLc_֞CwrU{&L<B)?9^PoNG$_QՑu2r.=2=A߯i(Q 2#1cC2O1G!$q%F!kuØq3e1?~9{ ʄ[T?n{[ԚOW%j䋁a\kP$C W/Myr8ze:fYD-;>3* $>df>#` Z 0$A۾A d ,Ϯ)D2'z^IӍDsd CYizbPFq{KoRӰJ\~YP Tblw1zZzV1ec/<+Ŵ!uqXA%M6@*dnF$g"4YeXrG( CiGw:^ū×O,5!0e=V y?Z7bX>>?FtxEF x(ZɃ+Ќ*;pOXU fT]<+P\ .B˚9AItk6Q<1؃#ޞ ŕ̶ X.mKY,ٖuJAγ5Û[7Q =)iTKfPNR7l,}Igw#᝝vqf`MO#.KHGj .lD!XaәK"F-?S{S]ÑhW Mw_=֛Y`G -iܜv[FgHL*^$RyKY[yvi X6gW7̪*;;6y&{ &cY]kRiopQV| 82lcSQV>*I/Cem$z,j[g˟,XѤ7rڜWU=b+HcEB\ͫYCQa7za|ʹQ1g/?7sDd:7Ǔ?2{Kj9;?'eMFI/W3b]\\#?;}lG6lƔ#r$lX10 rP 'LңiZVnf͛6l|qI3K10I,$,62Y nIe݊ |GGV'GzhYˎ(;p=C6x#_ oOq:F ?yMm~0Ԡ 0(Dok8iC' |He_fx1ˌ]][Y@7$ #Q^fӬv/*>%V|Uzrw:3jo>Ua4qEpB04) 3F>pIxc+r'3dlޚeuƩt4ET $$koO8OF Oe .qrUGlv\7 tN20TD"7Q7" єl$!L;^j0gѕki Vޘٱ8G'p:u1.@u/M(o|D^nm񥶦ERۘڃi"$QMԪ(Ā*MPn[$MPҷ&' c@M'1BCcDW$fJ"A|^dtHZ U v휷[ ֧)3>KFlٳf&O)`uYreԓ+Ӹ'~` za0и٘{SLRMIZMKG6l,ZH~}~ zm .9iJjpm a% CvcĶzlV_͛$fNm9 xdB+4P%U>~'Fܘǖ.z<y)#oq!wb/GnSh5Uڿ9 8FZktنIdD`j3'=h7vgOO l#"~T-!H=I;Z8\tc+GtEwI[l7:ҧ_I֘l_.<3tL28 w25>g| ~ YX՘o]a%bƧD.줖BX`;Lzֵۑ⢃8}dT; :eDi* 5S1ĖqQYs)"^)(,ƀgwEpz}7 qb€7yH=éӶȌwV˖'ӍnGl#z4 B X@^YQvf=g"+idlhWQqDk wFi}t&‖5*vdVTs#;bWT^5=>s7]0a8;x!4 ݗ1t~-r߂^*:bܔaaf8%=Avy08J#8$n.s&hdAU$0̫?2E% cefw-+F_S^4ބITj'0Ts3Y bbw$,_=nÜ12;mq<-rؐrA.#Nv ⻀?d"*kbUszOǶ-qd 7gӜvxUw=j|^/U|f|0l/bǼ 0#)N&|On{)${`/bst8?dҴ_I-,LyN_% 0궿ekq$%:\|鉟?y|tiʲ{Mx.gA!R~%Q&MpBn}_LT' Qqm)&:"E XlpFnݍ>|?^?ob3ᖛQ|*Xg䑏uʞaC4ʊ#PLڨؕ ?M2fbm;kbDq+sV3 \Wu7_?Z 9f/m=bj"-.qr=tM8b@ xYv mkbq*wyȚ-I+[dN9Q '"G+P4]G#[?<>R4 c'ȿ̏ց X2Myƌ?V2߲cGAPPf#1g۸e4!=hٷ?D ?zԮdso'XL_GcOocԳ >D>͌1-zO|#xvWmRf8dHdJwQIAKc98)˽>9m_a!]?M.K`y֣0UiDJHUAM%mW鄿Rn40e$|~\Z=f:zxJ?Ք#3Qښcc;6I~)+!ovѯQT;">Hspq#|v*0nWvoՙ|f>čb=-~H~lˣc,9>1HiuZHIJ},O.~\癥k@~WRdR@dA-%%'šsug;co SF[ʑש#_#XҎܦ/Xs ;BI9pwX#cf[- xcD Ѕ_e'09J /̓wܟsDze_ㄇZضp?#(k@sbY/Bf;w =8!=4~>^x_wrWvxU^C n?5q$*1cߔ`r=q ^=|^<6JGrvkarGi#0!@knSW.bG'z9{geF`0Gr*(Ms$q7ӫu`KE~[a5 ZQU”y=`rLB3$}7ڇ" Eqp%*qH7J7[Bj^I6%رsRJa HL >oiE-JUzn<3[I)֡ q1#8A@@<0孴ɀHʥ&!=adq!SV?L v~S@}1p3YSk̤fM܌OyֻyP}Feb(aǓ(c=CRh#v A `=;o^\t΁ggmamb8cDޡqx0jzWf͘3xI?adž(B<A(ה4o*@b)$Nߨf͘uߦlff͒cA8S A2*5%oNݜ3tT'|Rk ,LGVj?M+\j4pj#iÖzKᄈ;̋z5IV7.D]،y<\1MȨu]XQM$qP;]:Rӵ;yg,*IPi_͛5N:͕6 .(8!Yz[֧B_%.97.\#:.l81K 'Vb=s-k^ߖ+W]ڽvq7G@UEefvm w\2Js?E qd#!̶o@فz>+d{^󷖼F=q/J}O9W;5;py~lb; i${k=q x@>g$VidBevÏS/X&G/{KڽN:L~Lz|Ѫk:^nnu[b#PW3yr קg- Ru .gnJŏO!O9'e,Jb +&×kuLD/_'f g{zz1#U0 jqim* 64 lJW^otZ}8!qNE grDQ#援kȰT{-m#NRxiR+#lu2chNnz16leQɈw9GveDNiqNq8 USKP; c\H"π͈Z_E> MOcwlɤ1$#/$m,þMCTCun~N|@KH% SUr9 ʎ4xơ@f9}#qj'2xI̠4QoRe Spv|=doe=#s}!}נ-@|ٳf.;86Iܥw4fmbjGruo閈[VZR>DaʿQw4S ٳf0e>8dl[FWms_Ձ QY-A: =ܳ#f͌%)+XȆ [b~xg.TfpS0G"0Ü*7L̑3/l$_Jц!{*Hˎ4F8W 9x`kpNv2wo|Km A Z։TU~6~^+·zaӭ<2 ŵ,v'xc-ⶌGOr|Isf×$qBWHd-;̗OrAQ.ʫJ!+N\1Gt!TwēS6l٬yfo{˒DzyLp5w/s2͛6l`"#6L3`eƎjM݉ǨG>[;szbu8t *I0+Qq0;Oo|Zy U5;;»yvGmvi%|qv,:YCI~<3|TG/{Ȭb2K+$>h׭k' +՟QОɪi ̥L3v5f5$Ŗj`eKHFM>ыz(Ǿ4aSҾ1; Gb8]˰4˓8nqbzL^F&6܆}6E-e!K3';Um JY%m|NC4jF5|aUTP(Aጢ1}[=<˵MW糎DQo:j?6ֽGp9mkzNY;;(`KKInHbg4@S*J4fr+La#w6<c&PE, llZ>nEBͼEˣZrwOۏp!s'JsDARq#ڽ'?D~fkXt'ꜶaK&_R ·.Iqq sJi(#6:~43>KzdFuJG/TrTË=RBh $r$E7ݦ f@7åɨD/=mˁq{taIl$(syQHZ1,}e9ۮna'`'94-.4%Yo.OQ!٘S:al $Śv,XPcǓ9#@D'kwp}^f<_;byؒk^,f2O۵9Oѕƻ a`ҠhǍ9KKA<arJuؚ Qsￒ0qNf '6\<eӔ(<:x9#Hn*2N/b1S :Cl(-$=nž~0vz?b;?)W/ck!^lON kIXS%*F!qsL-i󎒠F?_q-4"㾰cWQN/_~i4< Fo4pv8?2\rX rͪ !G-rU Vãu |8m 5|JPQXB_ڹ(s!0M} i4&,;}Dsɓ/h桋'myH|iiicoz2cnr~OK_vfzhG/5OX[ZcQIœIvj-?ΉL:F>N_kfX@/zWöY&=Dz.G8)n{d. kNQJ0iCBE|c+aT}_XP0}:|_"Ɠ LJiqś&,x8減$2ddgПJ򟖢[`:.݅OM(x$=\jzH9Aeʏ.Kkh5U~|8e2c?xwٿ^ ^TߣdV7;q2}!xb%ltJ2@"vӗ2FILX:t2;+h‡t(h~p&QyWV}#ےY8 nlٲ ͛+ [$:xnV1&$J&38F@ 7m&\5[ite=kjLǗNè]@*/>2/~.F`$~rC1X/4s-jUVsio:R;'M2WK,S#)27-{(F01 rP5am]xB. Fu|q7EO닦w)B@o!z +ޘ:h.$蝷̜zHr,DPq6ݿ6K1N\\&6@7$ 9y_H Zudo^Y(HЬH˅6$.A=;P7@(*a}լ :H-}Zwy"BU2hc,6 1dav?/{PC#bjB]@{ο,A0 V159;5?tZ'8%ڌ(ê!Ȅ}bX^AJDTƗN^GQ{}9#i6,Zu4$wo8'elBY.eկ?AEvãG+l 6V8iM[apLvksyŰQ|c[Wl'Hzye`Γ-7_g*槚P-oB֨H*OrquiSKc ^g`)qg˭r;?@䔲H ,#bYb^o18km y_UgRдP C5Vh JI֦6kv;8CNn|X~nr6R 0 ГKF3<#qXm$b%RAAp9H\ҽ=&8}zWN(:NZff}emmQW};8B[ѦO\ :b]ԅ =;6RҞ//;$H$Hwzc$ Y&rMy LQaO5m]QH6'4I w4)5ͧJzhO$]|Ghfχ!gG,NN{CAړUw"^g3'ykznQLFŏ..%Y.gk,hc$$m 2I%[ïbT(GKQY}7v 8t)%Zov]jMR$["$?<~aj3N $uv8v~͛6l>Q4#8*ǠɆd14i|MփFib'~žь۟͛6K8 tE99Hb,'#'$qFG__zz(x#=go#=J֤HٵAPQ|>gjW7?ʿۑ|<45faV|ZjroChC9]̷>\kTӎ!# Jv&aލe$<$^ RČ~!G#ohzG@u{0[7+jt?<rI=]xebk_2P# jv_늁AAȥڝaL0D2cb̊ 1h19ђcei`ޟGf~R77?,rQ؁6G`8'OxRHUGRItU1mʦo{f`YHeC# Ə]q=:؃3A'WPw(P!(H,g>$4hT~>+{EcĄQ0-XneI+p%[n{HfWKǏ@ l`1զl:ucMIrnza§7c̒N:~eIߡ w{Ţuj T(d jɟ!hMhkM |5p4Օi͐2Nzwcޮr9{ybHZ1V+39Itn?aY3--ozb#Fۥ|ph Ū:3Scw?lW)ezIbˋ)Ö3Y Cw<xex8?1uQMiۢ$R4Jd Oy@3,-# k@f{)MӞDG'w z 2OYk1\oWfX`ɯ=>1=Q\k$vK^*IR0?+m^^"?5M' OM9+zN `%扏xL{p8Oe:3Jhj6*c 5tyKjV9Y%xsON%־Gr+r=kw I ulU[m-I9M ->0g^ ߆=6cq.'yg̶eO cR;W{ar%/yn[;J74f"!ۦ#W(GQwPlx}\plD022tlTH )`@q(¾=1zcD;A5*֧00bNliC6{で?a!N^G)hs= #-|wXX!{먭u2H/|-TT+yo:' ܷ 0BiQ%'(Ǜ8ԦCH61},dǏKQ{O4;/u?3 v-1⿎EuViEu%#Z~oK4M6*69AN OGjWOтG&"ގcAd #>ԙ {Kb9܉*?q-gm)ɲ:?NkR'@iPӨcӒW92l3?eD\]iKzt=Z ޏ[K|^\OkhfI5F=¹u2c)B"ŒݚRt  O,җ[5Oپ>F$nDG 73M0";[QdH6;+!}R`|^RFeԯbQ` /?vsO4~myNo_Jzq݇ݜZIno&+9ĻЯal;ndgĽX'OwUL6߯ZWۦNzL~ ?=~ȼYHKGtܝjhc6܍>ˢXx+ɜݺ'iw?ݏ=S`D›F Hcә4$pat UL칰äia,0?Pvutzs KLvX-o) z$ }V4W}e:^)w/ŷ^s 05ơkmQ$..5+~ '=tF{JGEKY3/yR $!I'ɆkmoWjݝDgSا?QH7O[#_;cPFv  Ŗg:|.e]V%GFŦܰÇwmSrrw5͙gM\_|<`FR GnzԚҊA)H?~G{صCWB( 'Sc["6(I 9 OQkZV査CWXCkOA]~9f͐3\L!rem,'ihL.M{w8>QexxjCk3@ ]͛6lĖi>(z j2^bjVs /G E\UBɤjSۛx[>7Lm< q`,nw%F}N_Uʉk!,թ lxpCŘSt'dv^S1q˗u>KlmKkd2K! I9+e佾"{0&~XyFq2V-9:.-D2 t%=H(O7$D-{8eQD^GZ#z!0@ei&+b"(cEŔ2rE~aZl~ ꦀ(f\/²LH;6l}Nz4y\L)w2֧Ż?6GK-~0'8\q+K+w'#I" {1,cy2J7W iJ̻ >v3sNV;T#};XIn1ƥ@4kڼ)nqLٳfNN\'\&5s+K;ǩ'(G"XJWLh3(U*ksiq|IrՎ0@)fjjr.kiWvY\GVXM7|[TEaO&>9#WO>?迕~]I}jj!<-cw_Ym46 5W#ǾH/%9KD~70(ymy?*e;PZG"~M;zXN|>4VJw>(rJZ\,VVzpRk$~ŌX6T8aOխl1G_jh?Ԅ ÿbks#QjҫţPWnKr* Ie/6fmWvqp 2 I粵䷶Ols崽TuK*Gq M"KZهB?϶U3S/6< 3ߘxaJݒH-B:㾵C^]}򩗛6<:zC[~s͛6l<,CFH섹7õW'L}wNxrI_cLcGd-6m⾢o?QT,LCێr9 xaVff+>ك/l;6z^Y82M vibJn 1ApSFr 1uه%qNjX\҂v' [I+P@IiR07+ [ aԝ]sI6)NjsFyƣ>R?bpdyD->"{ORjyZ`ki'k-O\2e'40@ַX~M 1]Y|N;uYig>=r9[Yar.[+W |K3mYOUR6E]۶zq_E_7ZGI>[k*r'j$U^$Yf" ~7E鲱j7I"*QbvAg4ΧWQ!,pd:Â/ٜډè*>]R|xcSWiȴDlʘ|>xmڡPH)ː |uo/ywU.r PŷI \uR@'k_|0[CN,EvY@x.W.|#غ-FL.<Ⱦlzir R/ ƪrS(:vLGچufbWHbrJ ErcK+OaWcŏPۼ>n>Oȶ +vd?[/;oCQL-mcF.F#k[pSqv-)c8䔫ۗCy8j%H7C2u˿3jzB"HWV&;Mt܏ςP~9|le'ʑǓ?oUx̨LqnO͎[As&x_S69584eY~KQ;6:P9gL%y4,4ߪD07x9Ng}[O)$M+ᵊXݒJ 7,-="ӡ;p@Tҫ_aVWq΂@Fw Z bO=_jOQ24Z-h3j٣1,Gl^RԂ M{ c}^a?ǔmMb~0G5d4_&ZG/xvDPJ@N?"x5+DJ7/ +ygb9  s#Q<轚 I?pF;ccyTŦCږG#`[r4~tΫc/47R 0 VӴ?ImhP)4npNµK0oV ݏR.|YKzU`;#|6@rC<.8x2DqIttrzBE(-wzE1*eXOyӸDWpE=ԜR?Yw+N>C<P@8gqA[t:s; c{"521\O,g\p^~vf qX|5KEաeh (? ;窬7V\2_EiO-Tz3sv{rG{t6`^Ar8>r)g\7?Mxk(vUIooּ7Ry~zߚ~B:(%a5#QE' ൂx|Os8l+Gy|SjOY5\0?L>]~/]殏rI_ O?>Z󞵯97'sUza * {vf;տw8Qu\UI>߃Q;6UGΞ:FjK7OcVխ]%z4 Eˡ0~.7o .{~3 Zz>HbCG[=N|CÏZ;vwfd<}DL'!/$޻EkCPTS`4//*ȱjuP +dto2/-+/(-~`GP؞s+K9ArǴuiH!y*;G<_A4%W_>_wq20*HBrsyBK_,Ư!g >fjZEğGspHѵ=rlwex.+wo"- P1m,8cRHq}A3`2]CSYN_oWWXiB?fÙ4.0ڛ&ҫd7Z߶GCuoQ.F6D^ʊ6P2=XIK2BsTnIğ;&W\1חϥj=8~c< [m;EiֳM+䍲.y3x@), oĿV:)dzOnjezeb(ǮePrRQse 9 6,cD{5ޙ[Rm >c/3U.VN1ƃ0D#EEI%It۝X-ܟWG^(讼]C)-Y̤?d'U0<4y4NБ]꺍r\;##QL\&y13Nv=|y[_hEa(f/E%8~͛ڼS81c7=i31=uY5 Ou&佖U"FMsI#6à'a*ӮfCGYBYD@bjym#CW~q/7!#.ܼ'K-QViGgcRƹPdoa( }/=y9T? +{ˑLO"G Izg221غ;;喑nG3W_EI8 {(Ժu;}T~lXDM~gYchC>IlV % }lj6 _i,H)6e`W*M)$8ĤVY1[g K>p+WJTO {5WN#۹fçco Zdr6r"5TEU3)N)P㵞Otov I&+&#W k5@' _1&G|)JƝ.NH'%2?mvޯ,qˋC>qɖ>@LD#$̏l#i9ӡPO$Ű8@ׄi:ӏXx _bp%Ca{P~+jĄڃg̗2S-tX;f:fFqp>;^nGdv`n|Z\1>,Y%2YH9_ɵ{ƫs͗XvS}>m2!%*Ҥޒ@2?~XڏRIO1+&?ӯH+o GLZd!ؓ~g)L/Y}~ُ|sj|A8|36Y˽{r{-1h6bC+3cXw$?4?1?ٸpc,1|㻿wBom[B1?ɧ"FX@>*Sf@#瀡4,JxFX1QPQ(yoGӊ`ŀwbc 㦌~!HF?ky4Yb?gDR@viBdW16 [V3ai,9 f bygg1r;zX~XOk[PӶsGB-.H$ֱjYXv JV0)0Zw&nz,ٯai "(O OFm{)UI_%YDW0[i#8}qz`1~jxp;EO\H‚Djjo\lkAqs+ncfb7o`*A.߆G'|!k{hm̒Fg?(,dt48a8e鈡dF`iq`(9o_h.x[SCMAL-#^yb2#. R!0xo[h~x+n~O> ăኬWJak-v.B/lr?y@ӭV8˷UŏA_*D;aU_c=h pÂ{Q p5bYl꣓4j>n֕Qyu37ܕ'xqKL"y=4P0irN:aƟI.*c.|[3[WQrDeP;g oiτt:|ݵLr<zWL&FinԈi`[4nrO{Ua.}[Y$[u ZPOl`K7qe]n#.`yR +^~MLXlhO)bozi;?}jj]NA xrj7f*]iMpKJ1[I_`nO)g'l+ִ]RkѫL~t{d jz$VWs\pY!zFsڹu]lxkٝs͑lDt4A+D,>=%d`HUn;/ΝmrٮJQ[Q^sN'إzW CniLQYw̱; 4z?ipi!) '?Uݏ=!Y2; @IéZ0˦&c^ / cvkkmC P>Jo>*Au?.4n]]?1#H+>ccd Z ( :'Sv- fB:C̺OP?9%ˊ|ҎoVN@BڝFDy} 淙5h lam_ݑ[ WY^)nc>.G7pz"FQBfͦ)q˦5z]%WaEΡ5*?ڿNmJ2:5?^, (4*=W4|2)&^콗-F<_^1Ҽ^MNA#:N}+GE1$uJ1; Mt]l$ ?3Y#htԬmlHܤC0UEG\ A^~vQtG}/O,%`(3E[˃{J]=힓Mxt@jsrWPo-[^aqW>s_&N0yF[} R5 դq!05"KH~KWѸZJ}zZ|MK07n= 7iv3xec>sYRߢ?jCf{e?/6 ;r.^Reǂ8f$G%vV)/Iwϓ s[qq9܁3N./$ۋ qKڼbfYLCdQ<}y{ZǙ%V~;*}=ρ n Y&/&# y^.zlsdd?GHfNMWw;uϘٖjAl§&nL#u<N!?~ &{d'/O94tqVFx#>MRt:Ӵx iz.kWKme K#u@kkwKޤq12vrȒN/}ejqy~{jR7(j#SϏ cL]rK3zq)1оŷfh3xeJ۳vQP C(d^\%>9:SN$@^i˞DC>u an27"()'3*)f4U'`hB ;N4mݽY(ag}c:oguGV"(bww -xeRFJ# |ŕ-,Ҫ*9,ZzM@>äZ x2oxmƱwu8&Vĵ܂ K{Wn\x}yr4E$Ga3?y.@km _Q{}9 8x1q3#KMDD}0ޭnDJEB{d7_tkg_ђӼlSl۳?g吖w${6lٲzCs?sd.~;fP*iL ̋ _wL9ybgiv2"X;z͛6QŽr(XaTz4 OÝݦHb@QN.= so'#Hq0Q uOai6dYNb qE'$qK/UwYw ϋ3-,E~g ?O:|@r4p\9…omiP)/6dx8>?Y2\Ml~= شD؄XV@qHn(՚ntN|G25"tS^V""qoXVKywI,si@%*8#|hE[NT&k%Oc^S RJ}M7E~8M)LWSr3Y{UرENg1O%2qJAM x1HK9crA6Aj-nݚ%YwNK8/-j\5vi&VEK^{df_ DHdqhW6k '0LkujeZtiT< Sf_O'h6n?di7WwXx*}?QSь ry6&-o|o-+ͅAg!T(IćՓPWsi:Zq<ÊrUSE7bc_\R-VQ "SW@(=ovЕb1x%$b~nF=?hSxqjΦ'Z`|ȅeƅ]M{oOՇv[TB:49p+{xvx"XݤF30YfG/Y dho-Dl 8FV{΀<7-5/Ӳ_ٵ/>h۪z& lY7_LîlٳfE_ [.!%mh(A0S͛6l"`: 3>mU6Ejx^{T͛6&rb50:`VaS7% NHHUݎa%ǚ R#-?h>5 xI4:;.6V9]>>HhL҈at3ŧ#K HUwsjW 1,z(/?֫32$v0UC5=݇7jg]An974䰋PSWqpMߘFaCPQw)ZtyQ{xOFo8_',9_(? Ohuj?9De<t7}OݫrCQ /O˭BbvȟMH#qPвV꿖Vr cP,eY|MweL3Nƌ D.|ilXA^[ Ϫy1\OۍTOlRlB4}BvnGٸzq럾?u=18Wy7ךJ]c?Ov}S͚V 쾽)Tƣ벏r[X%1hmE=z=q@녳j2JY-V54I8䙥<w4 ImUd~Qڽ?!J> {3O"ph,Zy2L`k/pBH$se5c1jjW-$q65" 6ji\#I?3>y8"h|0х$G1Yjzb ׎^F4s`1 |Dn7>p,Yf{סˤgq cYD'u2iV"I.?su~WKmЏCݓCN}V8-Д @Q3Ϟn拶ij {-%p?R{|h!F=#:U*B˵s;A.w`}O{ɟ8@H1"ʼJEc"<D`+Hzu#@Y(ܓ/E>X۬Ww4x5Pد#vJ ,=+zӟVsՎ|f#qu C裩̢QDHiڵZhsy7NQo%^ZAoda 3M}L"@>?ʋ).$y'G6?|[khSn1qr{@0$N}eDGY̴BaSA{wiڵ̉ok NUP;3y:Z4N^^M_l!ouJ{-жE+bOan!7= %cTiX3/e TFQ-w 2!\ƻĘ6]6O0ޤDtxr4:8CoV傠`>gj| 8͛6n58B=!aގcH_+s,YIl}@E v¹ V 6lٲx"kga̸!-89C;\;av,+kUDN 'kOTJl'AFfC4 bnq kr.uY@5NFwRp!Asp(Caq"LVsoox̣jE6b1?ii2֞&CwrC}i˸_(FgwI>=#[WҠStM\,:/^smt ܺ|~JaޓgA߳Җ <1;:yǂ$;@Tb@;s&]WR52i;l_Oo8FfB>FE2-5HanpFa4KGEқO]?q9قOҺ•?@9X"8IsiwvܑH} lN&rכ!7=ۦeM"zqlIKd-"FvJyLhW$e t5+=׃t&QI\z~φLc&H[u:|]oj{EM:m (JDqqK"ZTm<ފZ ()ȟ淘ZTMzORFS'9\R VbKoLuF 7=Y n.ZHe ~F @~/7jNM,up29>fU'*t GGaJy-gHYA-Vm8#iւTx X(4헔@47BňF;Fk3Y9>d@]nu MO9E{¨U8wp$ȦI,zuGߧ^lٳ[;ɐ\|~̐h?w„Rı'QOS q@ִfNsFZ ;.]"'Zjk7UG?`2q:ET{oКENmb73g=Y?,($)޸<3Yn|Io]l.|] e iuP8R]Rr'w>hmOo,;FLp_@S#SmFI"_v?Zw+z9%;41kzϒ42´Tw?u H 6*ANX.<4:d3Rv&_Qnwۛˣ)\ddIǴO57Y?vo'h~^9q*c9i;@REAt-OrP7a&Њ+P|kWthÅ j?4>Ԇ.^ۉb⁣C8Fq9╙G2襖Bmk{ 3L"ۑᵶi<'K״ GCCQ+i[NmN3@W 2-6X  BQў6P`O$iu,R^N v^}>3krԇkK\ٍ+"iY8XA1ߡ2׹>}`-WxKG~> ݙO&??Wp"h^dڳa͏v]>0] ԁ`WKj%&&QㆉF#P6bm,Ͷz.n.S ǏHx:yG(YI5mOJ{/R$QXt1ɥmX#Yn-܊?ieCA 8L6CXKrBK0ㅔxE?|ѨNZ+eiΧLxAa^0ľ_sI?`h1`czWP`ȿۏ޵|?Jb"@Tl|̠}l&ռC(tC>`4PI>;ŽS_ `WTTcgxI0cC|b{wH#EgbIU~oO34 3l\|MF~8M&6R}Mշ tބ@߫Ge3`r9.ݸ}X#Ƨ.0Lj^Y?YZXϨ'/T$~k?Zy"Noo~hyUco U7< \~(шH}j qK0y~8lj?3a^ꑒA ٕEX=}ߠMvElMNfŔTQuC-d 0駐K\ êOxK4Y : nc[Qr_hvfcf}dJ_Oivw b3g(-eow6/ּv-9|K |w_kj pj4H~Cq%vOwx^Nw; 'Jz}5-L,66a~(=ڀdzCLvC?tOk;? &S2MCPK.o?WRu0XAҠF‹KOYlCRc^t-LK̷l~nCH}NW73wsE fo#ᯰR)`EQF+PIg4r5xQ_~n|{&ab//.V .d;$j]=3snyy[D>#g IW]OocPNfaіc nSĒ䇻z/ho1ymm∕P\\ rf߅K$(Oቌc29KSQŧ`*?шzznt/ZƴٝĎsiޡ5$a"Pӣ%Ԓ^Hw 7O ?Nwc8w h*lyR6imc/vPzqG.HAQq;d:"lʥ({%uZG_Z㽭P#4E(wuCUcpjUchLpinx 8/?8%@`#tc4U@xYz&:~R1⭹ge⎾^04oC^$t$Y|'];/| jzdz{'7wJK3By_LtW]e`U-f&z1Zzw' u?yS+i:vg&"a9ީK*Uؐ`NkdFH"GohOg!Tr/6܎~y`=B,V?y #)`9rIH6i=HR i]as\^Iw)s : ڶ6te`#G _2Wy䉼y)۰]IjzOJ#YmHZ\~}aOz.RLdby1=,0D`c,΍D8yG,@P?O-u7]cSXƣtpEwn qhQVon(PQa6ykZyvԎ1SOeIEDGA_HX$G ťɦqoO|mipdErFTu{/E?oڿgԦpi ^g:wyXܒN-$*OlB~R0}iڛp`w]]e ;zFQ I;r)έ{I6' RTp ֣c;"XxԖIQ=^fXb? &f+iF7OTucˎD1rv}7fk2vS N&q7|.{[B3%ՒNO newU'V;ťH>>?QY/&4Z(a5"=´߯|*n8źװNq Kf-N*7/+"}RgOTe=i>I6^0ƝY$+6s7sCU""P: 渓(Xπ-2Pz0}9')&26~'tq*'}[)vwfbz^Xfa&4japqJÛk!( 8O[&k&8'fl4dלz?)w!)Yx•i8;]]9_li/踈>׈u>LHf͐1@s 7P*MWsv2> eiro V x(&)ˑsn[0#0;: -x`;Og_>9b8Hr;fX$˒8d"q5f??-y{s~qiYP2$نu*U~7=G[6jroƧ~.2HfҽʡEig޸v^hTO=]>59ZPK zFRP)^8+O~ٳgWU|^NfKŝ?=^8qfƟF-u cKqHDj?M3f͛&Fjbsf͛UZzшlٳaڵAޟvQ;}L{eռsfZ/Kŕy(,|x'K<;DdzF80rvq,P>&Xh /ƞO $x#/lft­CZN+As)3ĊXaK[KWsֲ:D?pnlo5qp*2%epf]`N"F'1yQ4bGq ,x]GB&TNs~fPz4,H>zmݬ YtFNMN6v#ʍGh3;ȎkIS#iWOK[mR(xȂ)8Ǿp;:)"Y(B=/2yVZCq!QO)o,DkySowŢv6;*=d qIG;\M{B V{VRHwד^h"r}Nb"_Lj,ywrտlk-r}1[nGJKU28?ظa'a{ %CW8Bn˙LE}~J@?HZ]٥ ܒ>姕t :~ܵel%.8go9 oeɜ0Lʇܳ,3jĞ~s<]Rď4r."Tڨo?*_:8(m; q(H" vw]JiCSQڙt2 %2baŢ V,bk[[.\2Ol4 O|ٳfQ("؊$6֘_km ٳfoA4ww8+qYU%  p֔|\qʣō3Q!NB1dh|˱=> L7&>mX:U $8ơ@좟">>_u-40cŔ#i=~*2X=~O#,pY*ȵϷqKjɔ~_~j1˺c;Uτ{} -K맆 *cuFxتYVb~[ TO??J@9]MASxK2|G.6^՘j3oa=/T4j2#?ܕr~nI+4-88/&_C"o1F}S^OESt޻o[Cӗra802ݩl/U(yƷ'0As/֛]ab8p+:PiOL(D}f3̓۽n}V`E*׵fnTR5NG5nTe熓/> wւ?/D`y_#~q?'0X`Oz}2jIJ7(?u~C?~Mt*!mtX-~dn~rč䍲2 <7#8kn3x˓t4j.5W[}٧nr9>?,|6n;_ho%QRiܜkU"I>1ڱݾ]=s*:iT#Xw#tKab}@f;ak+V?:? }"̌aGT%?l #JC{Ҥw8.B!rDh:!0H"O?ƿ>qj#zyyqV0qz/o2[:>_^q銇MjCkCl#{\3~\_W̺ǔn>d[SKoH#jf5>$XSh‹v$% rR_F3S֞0t6ր XqS ϴ;s/fgo%sY.$%|ZGΕ}&ύǘn ܋fM`mgԹJŶ*+kK:z1$. h^܂5ՎK?PE^84|]D5'$z63=cOy/,50ݕk5MsݶIΙ؇2=~lva3(@x^ *㢁!J@ xb#=ޏO,tX`,X.4gǘ8H:,% >_S/,dISɭטt Uz9T^ĵ6j`f,Q3aO,SvztIy3#Wa遠[J8goCM w >DL.n vLxp[toN\G'0nJ7R.%7yڀ|nܤ*E}-ܭh-*KXyLxçOeɯ1 8d1?{ϟG QGޥrѫFDUa5GLkƥ %NB=ߙ1GmdK{%^ͽ8t'íH/R9}v죹$x ~7_qDŽleB>NG/ph/]NNO!QGV';_S 'ЌSw= 3'mCM1Ot38A}8L7)UǠ9e\q\ O=DrtcUbԣl_sNkXD!h?Y'A.6t@Gjf΃sqq;qI2G¿h-ӊ=NUvo&nI>:p#!|:O䣨cV _n 5ϫ۹P#ۻ0|%ԯcn-?e{' v!YX*"I&Kx:(O`1+I%uğv8|D>P=|-eFR_U?scK eǐqdt|]kڌvljiODiv7/" FC5|d-ImFjZm8Wwt *7:̥"#(>*|]bco}$?aП 3MKFČv=~E>it|\<"C:s4?(jzV l$t@h\VKu-], s. U?$AQe'_­:#iH}>le&6Sr{o[}S?(|]8k5q@&FHQ4$z¾,{ʤfgv,jO sEQ\O3J?V5 1o=Y~#?oµ*4Ĝ5^._ ϯɿ4~b}=eY}zG"*}Gm AJ]?8SߒeEgrTz7$D,h? ,k4m(py gͦ㦄2DD5(hrfq GA}_5KxXl" MO,z]R %:H|j)b&ۋtͣlLz AW͘EFLP"6s)|y$'aO0I-J[1* Y.쏿X(\6-4x4 >?a $JZzjv?f\)<3tGQ$=0F344ԱΓ_%J?sY.c!I"M3ҞSc4-( |\/Ic-LƸ4|MìyZIfNWFԃmR u#yQ+_>g=[J@jHߞzl u #Bs6afYөy =G,GH+S_$jN7C`"AVrG΅%&PxV88GWPA}^W6u BBhvh=/><1 2y)~gINd(;nho؊ N?/^IGWKC< w"N>cFDGƯwlR `=GO mm9 ?Ft8&b *{:f͛6t.]`Nb~]e4~ 5R%ڳEpSCBTPF\h߇['RM#t-T}9#͚^s"3H`D&9J: ?g>2e 7!BG{BɌ:Ejm\Cj (x;Stts~)4Htw"u[p:|R36f͙ݟNGI0$@]-Cr0`dž0@ܙn}WBtr\ ċː?ɺ}'(q_U͛6l!<* Rч̵ہ6UyPW{/6S<10 L[ z`EjKf͛6##|1EH g06l1&Kv)hl5 )**e3)g`:h0jr`Rg5&6f3Ljv.{#!GT#q]Gs⢋D^`_m ɯ9d8,O}ѐntޛM=n_IQן|^i:b"[o+0(y7AQ5s~QG󎫨#f;qB-W5/,[+#cyK E~'r"im\764[BS+ytmmvϱ4F?)9EYsc@!:ޛyZW%l&J$c#7wUgUmJAS}3@,rqTYqzz}V~w'+|MX`C'7y#1[lו'uK4٩1@g~i;K]d>n? |"l{@x:3=1On[Ŕm鸵?|_%TAEXgCҹ,+,|#95u{QQ-}I%~a2>ۑ:}UQO'ԏ>Uۀ낍lPʗ xDے=yu+ibO(216\}Ħ i}`;=/P2)ACn]]8~?HvWξc@/8yswaO;瘥vzɏ-$ +)l 4v Q64}V6[>h .YO$GlwtZghf)Ldzt/W}B(xKhƾ ~- YդػiIAnIvZWyQ"MEŜGrΙ;,T;]]8.0 RHU>to J41zeHbM4jm0e oqobi=k4zz*Y2 ٥3e@E.VcNn\_/=% 7u>G/nI?iP=d6@2VQm||GTj+T;O-LLLǎQ{'4P_/O5kocW~ǷOrK2M˿Ԡ;|OèuR`ѭ 3|%U /ĝسq0\7 @(/%8Q@ű3& @T~9plah"cOg#c.> j7vv]j>r5̍/@ifE* hw~Q7j w40x{"QSȍ_kLVߪrlqmYsrWV;}c=\cSKR;1A x7BDt ̿r$h C]?QkgbbƤROΕ~VY<ZCT<izx :Uz7iv#4eEa4proN9oE-EzJ`3&(l$cmGf=xdieHeHRbwn3̺>#f<_+Jf Zk\jsjiI5& #rTqZ*; fZz=:#E߰qhתLHXɦ+{Ox G97;k,`Za?W6r9C xB#Eٳa&s$Px{JfpUd{ӾIL(6ƻ/&Bv/dŢxT:|$Czvw-Wd_e'(_a=7wmuw=J@#WҊ?#,򞿲:sE%;ꚡGg3Rv*n cF¨8V mn%QԜZ7IPH#2;;D1e!,%!j4x8eYdc;0`.d8M+K|u|W7l{,|}j3YvRUVq]\C/Oc0.b-"?>~=%܍̭IG5 d1;8x,{,'`7'"ٻ.?_1Dt~`D:{#O[mA2)t7nu~\ BV@ۇIαr Ӣ98aF {|Ep o=~ I&rw'/@_0HkeNG%޾ ]it8'=r^QhHqL~P O7\5o[I98wgg̗GRUaZ8e6lFNN v^;# V#|$. ;QG՘O!ëboO%-b>}'2e"1N7'q#DqdK=a jGԴџԯg.ܜ{|?ʰ.ԈSgy('r@NC ޅ;d+MWs7-_@ܐ0f`(e9Z e9&8I_ʽj-̕ւ:27O;hayCD˚3ƞČBQMI酞cf*=S1OaۭJ8; kW%y8;+sϞlg!f?A{g gy ^F,ܚڛ0Ls2On ^8`?3I$@{dkePoA:_'I{{z "B`i58l!eP}^aO/ _73}o򦸷?L7Ս䖓/>G^o?pzL5R:*f4 ~KC\xr!q,(KeGg  f'ž#ϸ͛6lډ&2Mb( <-'8D#K|ٳf =INqpt3hNlٳd xŔԁ[ F&͛6lRJ'ŀ͛6lb.DM r =|I:oH0rLf)[oǪ#-a`mӑw_饷M哊~C$+rYa[F1o9"UmHSӄEe~aS͔%7L:|b|O\cHD?͈s~G||3$j1࿷%x5mw'wTPa0 4~nܳR.xb&Eo葨Q`DWe2/}n4ݼ G@)o0hI-ȎX=g1힗='Qq#.,sHr{w.18:_:lsy̚ƩqG#CelBc#P{׈>"La*\nCG/$v ğՃwLZAel~١on-uY#{t :ݝɰ@=ŧg} ɆVuP<꾷^o+P3!?C25D&$PBmʸyħM>aΗm[COѺ LrM i1x Xƶhj"/>Wrg1I-G!ّSZ!,UF!Ӽ- ꛱m;[QĻBzpk kc&I 'wXyGӀe7ڗ쏒 bIlcTI* R(Ք-u7Rt5GE"/m[Nƈ{a'J4s6ݑ>:˧gn^?YA1˨#?x=L(M#g@ݔncmR?o~֯/*HBe|poH r7=yW[H`G${[LN~Ss mv;CeL 0璇ā/d{yg:,-HAlڴTGA˩Ƒx a_$zye܎#^]:'4-6ޘnx 4 M hG1m03^GWQ |1LhGAovANr4f;=/?àGkڋJKɘCHT{ >Y>:B !!_ǒ#6<= ?ƾR+53>7Z{DsVndԳ ԧ'~k8ך0u?0vTr`c\FҎt¤|Ky{JeWzv]nm&qo'⎾-Md{Ixuϣɟ}}Q>,F{jꪫ\\x( Ѵ-G_+<=̛"ᦣ>YN?Q @(:h |\\MO1/uf} Q/Pw-U$˺odkhCQcD.oR!} wn8WP\q-<@=dG`!} AMM:H^iג.januR*O+ׄ_WZ.jαw`14AE4ڊN-; Z5xn!<逊o%'gn1.ǿ$3RMHq߿.!dϔ_d\d ̏.~!aUR\ (c(+h*w8xK꾦R|77K_y=G:zni߲ ")jvA0@6[H%vnVҌAYGKSnGՐ2YZi±Cӌ "9̆ctLd=NJ?,==8 *(XI(n٥H"id4U9Nѓ+BMZRLCq37BTUG\iUTUo "iyX7 /F隕rG"WGj|FhݿsgU,bpC,Pa+o'8D0/%C4cƀ;[]!sodsjZCy WwSag_nvg ,qJx0?/LOQf|h| qzö/M>x|ilE3_yM)76>-':]7pGsnF=+_l; R8QN~V&x$8eAd^ 8.+MW\+6lvv;2&(OLʢ~#5U(r͈Myk*݁KE!kyOkvUKL;JyM4Y'<߹ش oNG~}y}n uۋ. zv! I8 L\yX 'e[hFYK%<5mw1.wUUP^d }̱?W)q p\1_i?s0vmP5مIMaLsY,kWŬ"$Ca^M[^A&C Gs?X ♲h19Jr$YInry;͟}s]ہ`VBN Yy[Q4=^f2Iɪ@GEQA c A)TTU =2fD0へrLwo(Gx_9|yv/eE~p1) ٍB (lٳeA MI8 6l!Ej`1@"ٳf͑s0FAL)J`땔s$ԜEvr!Faju}8>H<8ܤ|eY׍DQ9Vr2y:[#EzNդ.Bg3!=9Rz'Ub}C=eo&0Σ3iƞ<>PqN] ?5(! kt9n>pzs_o>Iy̪[Xuo8mz?`7/Y.h#+G݀5khBcX-+ׄJw"|p6cgzv=?O#"?q6ؚywΣ{võ { Mђ;j\@c^2k\SdatT*llcdt 0D^ƀ}QJ#((? ~U0@6i4V?{.iZH`U͍N 1jYw&`)Ր0!7<~ßNi o$WiVcErN ۅhdpT"AF'^\~[!H/~g1'-fba<(|8U A1V-,z56skVr)𵂅G~\&uM'Osb">򖕥aM(wK7}'\_RmWQҭQDƍ%*kk;NFo&iݣbOiS(f:DfŎw/Q(pǾ(}=nˎ b291ʤHv3Б : רȍg{2m?H{8wS?vMm%.m[ ['E ?6lD*M;,XGnO/lQap!`('JbWzm zTN~(IF' l/'/#8PQF>?iQ_MK)<:\gY?EۙrJZ~S?T|F=_师պR" n>y{k?/+C|?YaYZׁt?WW^25y7?y+z|3\Oڙf8/7J`DP(D]< 1 *Xi""|S Xb_Lߚ=Gl8zߚ+e "znN#劣ϙXae?RG4V&#R7wͪZM]3+"'8R򐏆GaFBmNjmyrT뚓FǑ7ߜjk>]-eQI|\G ِEqLNɽvV6i8P>6~ci`k=, صkg>u X=kKPIl:a{kKVt.hħ<8>~eŎH-XkMq! mll"[ E|O-ac?=jzXp(SŠz&o?=UuNWkyn*b]"z6G|m xjwp6ik5k`SY5*07'Bݳ͓q9xc=ޞaҘEj520GxǻM=-l)4T]ُ:I]6J-W[Zm?7År/uwr#߮A5McXUf40x=YMUskN[T~NQ+QnSAiKJt/OՋw u>9?ɯAW4-ڍc̎2UV)mds^e%;E4z{VK/7cc+$נODgpkGw>/N#n`l,jtGXs#~b'As=ŪxHbGTأt5k$խ '0M `M1M&lӑ=MqJҘǥ٧##d ԮHO 9/2PZϾ'C0Oigfhx#>B%9d6}:=,1U"rC#yg_|ãyKɶ)3Wc>77W4@/``c]*kpHrq_:{1s!\Fs[fys$jj{/yN=[LI?3X2TF EX}9FV{Gms:15^18^qS#i$XU,!G}#,z|C ?yOPy~֓"bCqs W#%/,hl~( QU D#]VokA>돈la MGS!㵹vξ:\@=+K%^lEo!jG#/Sjկf;f8y_4]*V*izvriSqp]R:Aq#{{]1+n\"Տ+JZffo' M>NI (6çLeđw]4:>r1 r#_ 5Hy)#SF>>8柚<[O'~o>Yѥb ;HHG_9饺/ZW-5ÒORNt=E'%i5f5귿Zӌ3A{IsY&1D"w= bw4.Hlit 2jXRyM'd}9->L8AEw>#CycHQ2@=w_{ub4F lYn}aV9t|MT8TgzV6>lR]WAydS:N1[[_VSzdNo6G@B8S@[#=*EB%g rMw8A0 ٧ZՏbfB$ c댢)LaG򑂏iFcӚVON9qK51Y{):vq x.&yܱ5$wBs^E۵X? P5JդTWGyCp_DNJ.!mkѢGhWVD#yM<Ƭ CXj[vAsjZ/="׆,h(cfΗu]ÊfS䞽:6y3VIܻ}'/˹2 n%ߑwə%$_h0ukRO>id|Dr%7 sʭA}^S;?s3m<rq P]̵Ғ-!?a=拓Fͳw o!\l'3L8`眙f5$ԓr+tfn)P+R2Go4q_-.9JvrO[&b>8uǖ:lqoAv>f~wUa) <|ϩ}FAdFBvWCI.@IcUymMv&2SoݓB掹'on{Wǀ C]fn bO\إ BoV@p],a)r4c6hG,bgM_4׮V =W.IoZS[nm 6ޡ,vaw}9md#_i5m6Obc9Myqp;.^ ebOtB;Am|Q0E79.ү&n3_zxy'LTx󻝯gv\e[J#=(hAQΩ:InܡU{odCR@[l2͛6vnn߫720NF'Jo G7<ӈw$ k޿Fگ]Ty]x1RApj2?Wy$?P'HQSޗ2ws|̺֮,$M6t:>G1fc,{T.WSe>NHz c1+DQ1&4F~O8_ G6f5<~b;OWcAclqC )柀$V^Ju+J>K/Lٳf̀l6r@RLVڧPb͛6lR 9Lnٳf͊Lԡ{6lٱKDf܎cd.֕\5[F}ADc&Y`DzΙ3&i`Dz~3; z& 녚ڕϥDN7{>{o5kHg'6vc+`gY\/N6p块g)O}pr)^ ~95y7%:vn!'p9YzGk3Zy)=ВE#j|?NGΫm|vS+EG\-4p,]]_ک)%6&s}tmq$Hc b~ʝkFɶo4<~#Վ83Lc7_!ciqǓQ(?8'j^=BH)񹽎TG  h? W-Q>pf! JcɒC6xɞ}VdBR2B'F;y*o-x`{SO! sB^>h~Td^{`@7;S|JYae0};}"RCpz? C䃯*ప(@6*nnU]GPgCβf??$EM*[cb/NC/m\mmz[d>%}veE&8(#5" R%j i_a&Mc8T$HGe0d"\)Dm݃E/1yQu2yPiEEqKд>uDziCv:;e͛3g'ʋF4v+)#0\0; =߾lٳd8 s@r]1>4=W`dS6lNi^RQw?!Ia0u] q9aꟾg#"fb/ 9XἿ<=d$նj@7$(|ɥhEԜR=|%Ϛ| _X)ԇ+s} ἒnp7ծ+a u?oiG9ݏCPgR?fY MyKHт2nw Sp絷/k~Amӄ(})HC$U~"lD2~=6ϴؚhD㦍V/pňrgfGhx<@iHS{}?I\KI.鴲QcB\j~կ+VBnܜO-u1<.(^qSjvg?m յ=""ӰiH"s 50#ZlNȻ/t+ZFbǑRjNLbbHQzmV]7Fyuy%^7e-}]L։K;w)ߛ޽ѾEEs{wzsŨ<q%R8k.ZKzh#R@1­6zz4ja;.I /f` g]DL 5{W^ԣk]m"SD`^ Т%O߁ _[X(yZF:F]6P$Igr{v?ʧ~^hA G>K~_Y>~p>yDP. "k6}=GEvɨ;"|)k,`BFkq{7bBYLLy_uvyKJk=̄ZO#X_8g> WVZ !T(:W9εi]-Ƭ1Z;iORg'#~d8'>7qyFIg  S^G9tzjYDz|9e Y1H2I6K9238~(4&>W!FįcвAk6%- ?v u*~tَ;׍Z,+C(yjUu+$#w94ΓZ^ٙ5]8f>$!SnwfaO$g ԉ}F30d.<ǥ&"P\qm2듅@SNt'NT/#]( lλ{KY?g}?0'+}f^ꗷzgj5}BɁ<өlZ|ciF.2ʎqۈ`J7hn'0 '!s7OfKc1|6VcӐe#`+yR̗;VHOh3]z}WlҖ  fV .x LpGSM>ёW*Ϩ!~g'G(d3j2FN`J8=RǕ3 kQ ܰ#_ǰΥyo^] Mq" ':o(R?*.5}zܝ>=[l%iX`:Lw-dpf`vm 1ÌYy~6ymOhxm&:̤څBĢa1vrrjO'1B>i]%cixq{J?S6]?-#m}Sf<k7/,$5;GO#dMB%Œ]>/~6\zQ "uHm2OH?xn72d OüKω[?82#GAߏVcrPG|poNQ:%/=y<~Rvccu֮Kz͌ccz|#"G;\'% i3'[qoqҿ_Nckq&q3)>)<#_C\?v磭ZYQFѣSHUQՏ8k1OhPy^9){r['tC=N+ej,Cv;xOQh[E/xd0#@W |ĻC\LsJLOϞk3k0V+D$܏'oR[ޥV3K4#?4kԯ6 k+{gAռ/t$&װ4NّGTAVcE5{"\B!YGC^KJvfZ)QL#!˃=wΘ|B,iq{hz$pJ#K; {oK0=ޫƞr҆ЫS7|:k:5[[e!kzwJ0XnI&YuO- _JlxZѥGٻ,{x86ldNSF蘱8
zW8dr㼄n>s6mEg/aCgwl/+Li!CbK%qК6Q9qh~^R"g=8 H8+?[=8~g3ڍ̗3wrI$;wacGU?85 iMϒ]jwX|*Go]-inEOa#HV!GN[,p? DMtg FLwy5bc@kոk'܎ ԍν:OWovYm>sxiO xD;}ꎘ9d>ʀ1q@ʀ>X XҶKe?sOj o 4~:vn|g??5+]vK\lyJ\,^UB|}ֵ9VS5Vr;gSqy9}Zԟ}a]%FGӒY#II~Ak ¿.ԱD$(혺&)HGw綽M&.!Sdt/{-6VY[mbG3n51M_Cnړ;}H^PvQ.g[۔;I#Ǒ :*$<_xal{+[&<4MXn9͈HVc,d+.lEH4 ܜk-ow"v9?½[O(dQVqm;jh8N穏aϋpE[(t%|[RdDjV4H{_!DP{aL-TҞ0]* )g˻C.no Mƾm?}ڱmFrQn-f gaErPE8H|Z_ZUSji_G$J$kT8+{}WFFFy " ;sXz~OMJG1X86@w8l6 Bzݟu˺3B CSO:P1l5.zF(? f9T_S-`,&(-!#9"aOB9q8i;'{?L}Y.D40/W\Y-~x=-`퇇ߔPe͝V<" xvM;kzSlZ+aߛ6lِK8W#`P 6lٲL`ģJblٳaHrx~M{썳f͛(M5(vf͐9" gnXp^ 隔 o<ɥYq,ֹmzqMf͛#Ő>rcŒ\dȠO <ť1zC|8 ǭjL:!< mt98ۤGoO`w3/&avM:kJxO]j3ݏcb^*N֜f̨͔QbhZd$O@`N Uc_!$ۭp mO}mku2BͅVV1F6-уT3\GZ{u/",fU!Cg@~R"xxGf8"G-|k"Y\/|A %/ch_Ә#ē>*-|yq 7rm+}Z#gM0SӔ5E]XD^7;[FnOB=M~ a2q?j[ц=6>ԉON=$%\},9ԑ|Ie?}_d}6^N'b(ri(K5%%PsWt&W>8ԗq_2Y K%ftSȏGE ͛3ia(F47#Gp!X#{Oy=O/ >y񌆿Gݒ@ LQ8rytƈ[$sf͛ 19 o>؉a;ezk6n cO]J%u:piQЀy&GHB>|MV[!$i/7eچen/XbOR~Yn^ /iq%G$!\ԎTE4OBFH?idH+dqJ5ě᳎&\f=e}3b7WvQ4R,QVcL~Rޟ.S.g̗$ >=缞/OojOy1;ͲDlld)鑽kZhhbo^E;QŰX6, n{@_23Qgcez{xdn[_]$Z;?k?ŋ1Zܑ' P##01 zo>~yDAΑ8 $Ҋz9:i joA8w#kjAhO m^=52D3L-wi}z iihC.8d 1?M_ Q͖`Ofg5cS /ԬaY$:?@4W: 4߹h{jW:G~mHb f6#nK|M&+q|}ɭ=/a؀&!=bLOs ??W#>=6<"ᧉt|:5ݩ11copR[+h>k-^kw*xIȠ>}mt1tyNJ.&0ڍmQ?H!ƻQ|}˴ Gʗ+k5G8G 69;[UaN`|Mm8{,9xgM #G$24RGCFV oe&eILڵe{/VVW־X`no>)oiM@h GOv:P?)x`=R z߶J:mC-e^C" ǘ.!ޱءWO#ymZOF2cCGݏ6!nͼ0/Q_׋ywFN7ڊ'#ݽc@`6 FcP0vPpM4S~?i?13=;/z #h#?I#P9fcc A';V}[[F"!Eϩ&HT#T6(@$:5 d[1~Md rp[u(E#>^'K {Z@q-F:j“;33}ǫ &q~Ԧ6 y}rvh\"0D,75"=|0ܟ2c,sTt`gX/}Haey#s]ƟMAԟzf-K(DtMB& 듹Xݏ9_QڲںpO. cЎljde#!^SDNHԏKE{oolI;o4{8WX_XҔ~*~/ՀeېԚw6艘IF 9QLI5|x "?C:ʷpDo{.Qg4-zO4i5}mmXBCo_|]&5Xp&Or:wExa)2\ݾ.d paݽcdd|㣲fgQh:nʬX9-{.R\Lx[-Xfl,휛 'Xdb*:I ؿt"(4W_)?R G?l6j>}nNG#Fru /jkLP9K'SyX@Yn7gYϔ,Ԋr# .|! 1g{(S0ךب IxuO."i1+ @u QUQB(eg#'`_WW[CsV>]zxb}vOaR51@*ۋHMe^?ۂm4_ךm^r1G?n]?ok1ћǦ2?~rEM"T&8\Mv+18kΩvܦrT{'͂yaœ()-G96 Jz> J\uL!4*+O &}T'2f!O@Gwf-V=La?$=#zmV}*щ6H?> >tC<]G]].HaP~4]:ov?'yZ)f9=YeoRy-J>X 76 aF`ぜDB(~L6lNmel Ӓ ZSw8U[9=OQSL4O+ȌҴ_Ҡ;hcR8*ay.ei5faB ]7H¬k;;o;156b rW*qQ96GN4(tV/Arͯ~zTMI7яo3{g5^lHەӥSퟥDIpSI/d2)^? :Z];Ll>a^KRx~^!ܘe,b@X>JNrh3՞Jl,ivR$ш4d2Hj=(C\ߑizrm#?Fa~c4(9K% 37ZzSҸU3oVc2lZa^rh<5_I.%\w>%ͭon A9Crm@ܛʷQ; b[žXB% =68 <2i$b q[LL+NO.:n CeCWރ#ʳʨ1GIޅWɲqJprm\!MrA yI  ~(mV<6! `_>o)9MW9<Υ:yczRxD#}vm;&4IS+o;Y8g(q=:q#~$\=ɭ=:f:m^㒻ͻ_0Yi: Cq69͛6n0"!"[olYm`ՀlٳdYr H H"8ٳf͓EF( { `|*1D16lٰj8}qћfHלv 6lٲ',"j T@=r ›3q1 tI<Ѫ߿ZqF66lٰqd.$q. ̹*)g!Tubh?*6fJ޳؈rzayw[ԈU(~~Û/-VToK֐~ܛ͛6l|;ee#/|^|ìjMI(7tkR5z1`aKpzw͛6l( Hሡ@y!-4]+Og=`'i6lkF`:{RaTԣb5n^U9zHTͫǏiH7"fpWz.d~Zg$D ;aƥmuwhܛIٙ@'BּyI㿁, !tֵm?ёTeL7ޟ#n^bZCǯߞ?۾?cvǒX&\P=S1˘OOGG/eM5A"GP 9 Qs4cSk]%rfjBڦ&I 1}p>]/Fe%3]OHjEv<@az7ݏYdq1qia xf R.nJr\W{fn Pzm3Yeuݖ7}.y!߉$'M3H, 22U*6 ͛;P; &0[mmN|LO<1lٳalWZSnqdlf͋gW b3sf͈MuM1 =W.,P!Ԟ@wl'0S񲿩/]ZذUodr׻ޢ3:t_쿯rޔy6?BātUg϶!lC~8ɟ':C|s&_y16Ӈ?d>%PNl-[vK0OQ,(?eݏSoq_5oDcnU*6l^lgN_VY<9`0ߎ~OUu-ђ0y.lJĿ/OEӤ7*g-XAo|63;幊0]7$)QK1 rN u_1R7IG)9 u0lOP9h})i4`rr\-_kqFI ˩ g$wƱ8Idf?`|!w7Wdi$?dY󝝉6C7GeUW#aj]AY ?*[L/.1{O|{AVH=t;ǤtsuzmfC.YxNBC>|y :۝mduUp 7$5<d_JqY?t ;HNP)IBGNrO0 mi}iNI(eHD/H"%|R3u;D[}ߏL5򵍀8~(/C4 QPzslz^^XBr^FUD+0mth򝋏;g e军O{KP?s?<}F\8#qƣz׫½!}8qmhOp7y5 |cu}jG?{Zm5&55XWh_hܶP* v'Gz2tM./N>#?igOoQ($)+n,{W)j#A9|YYu9Ma}scپvQ;] Լ(ةFJ?,YM aĵ-G_v  $t@Cڸ =)b4` 1b~'PE^u4\2FGaGC SF)-Χi_Z3sM$ezR I)<0U:T1 1c 喥O%lR7p9LrZc4dqX\s}&'["SГ>mnI(iq03Y3Ǘ!#?u+;NrnTjW$3N~bz S6PHcx'xFU%zw~V0'AU~r.x ̨܅U,v ظ0kcHDb0ɆG>K=fφ,BCc"<މm3Jްabk^|m~(^GC=ȊW*)\ą@7$̾iCcIWļkZ fF<^E{aK'OaGkh[S8c(a>Md >]?G=nH"8U\ڬ~3bZ>/UOo|3t.%//Gt} A:\UĞ7kskWv+h:2aX'MCxt)ދ]B ҡv9/i;T;K14Q)fuHd˓"9Quڬ|9 'o(dvKen_S;s# FV7#yFp(`5qsr-B^@upVE#A uoLz(zaVcge 95}idvWo9.B>▌i42=601 /)o'22+k&i&K"WY]dFj#=w~ȌIؑË i,B4䀆{`3cy'YĒV@@v'z=>% 轞m_F:-~Yc#X@A?K]l{<;zG 翶76L?F ?6?*<ˆ6gOA<0tD }R:690b5?IFg*{t#q ]⟨[d'ۨ%<бy\Ҟ;Ɨ0k(E+ݛĘI&8s[e3[)6E>a kE袃. rg2ሉSD0䈔xPTPg,- IooԯvNAnI3gVq ZR!at!D~<=.]~pS;s'mG 9zϼ1(!mB|km&+6+Jv ᧛K@\X7o#<Z[rʇW&I8's("!X szT&iM~xc-ЎQ\>zoK855q$R˹ﮥbLcԖ5ZT^w/ҼR(ާ́$7*VV5 {b8{yʋJoYgg}eot8u>+r'F"I`v⢟A5è卒*:l a+K; ExsEfDA32b/y]74I4̇O.7{cK+P=~r@$gU',Z!l#l᮷sN~oU3j?3Ct?(yԍd% w¡CTЌs.oϨkF>zA?fuhqk~78:<>Y,`xeOwH߻{_&_0 dyX]ƍM{ &wbOrMNv oѲbov73?Ms{F͞u B U<.]Tgܒiws-ǔ;Hf/w^b[H͌)ĎD~8iy2ihВ:]v=ZF_bv0r26 O'@O\}?S x%63a q}Q=\Zʊ&JvJҴY@pI*ʽ ZAE^&W Sol…!usu_qy n+Ey}!iY֧9jW'`69d p<OD5w7bQ0#STq1PwK,ǛU{cg<қӸFg@Wz=>9> 98c$/(q8Ibv?g_\W6l}T${V5 *G^S:?4͛6lB< z,,ݱdp̺}D\omp Aq?y͛6lI}ce/YyJ |ˤ#r7j?I/&ZGȟ sf͛O2&_Lm6jWMB#ƒG oh~ɍcp$[6lٲ1 1 oF5ˏFp(Hcw˭3f͌hB: !&y$!2dr#)̓Ag50aeipݣ_?"pյ2Hv O/{aי>5̝Erk?X܏\jcjsvW`juyux<11=jN]Ŝ S,ā#<$wJ[l\bXP{tڗN;K6QpkMH;|(>_وhyێލ MKESL0Qn-i/f^}_Rp+FyOj=?^>Hu9I}q .4bIDŽO 5KM~h+!_/&}%{'(q-e5ɡ#/O3Iz!=s~^;.h?PL~lv?8AHEQAcp5]ںnfr1繜396=Ȏ.g߲L̜s!x~+!0ॱ&-,scf͞& pi0c<"shXT6OU-6^{f͛6f9([Z a: I@* ͛6P8ٳbs\CVvU*G&XcɒqcR<1Q,LD@IOAwj0ij 9+H%%50P9؍G'oV42Wš o՛f;\#&-}M^,u>c6'_nl/,tw-3wm+|)Ymult\1Ӭ4-~{s!+s%ퟫEAvGߋCP/(;ܟ'r~xl"rd2o*m:fn] 7*G:s# amU^@#MSV+*Ɲ?h2Q}Y)?e!W=1PaB[jZĢKuYN*I 'ʑeD1u+3^喗qOi7:}&MV_3 }=cP̝}cVoRc;>MC]MWI9!=,я>dkMΡ0aA޻A?ruv\dӎ_d^ b8cX@*1ɒ#UFr˾1'$wm婇ě6leY$h*ƀ 8&y$#I&9K$e"RF|F)2D W/6 {D+6j|Yemc "=ςיlG|%nj0Z;iYCä(' O-Zi?f5&3hvY轖## 7G$ͨţHl?h7=E58kLi|& K]:z2B,uyF ^7:OccZ 2>bsNY 2Ui,q(DQEUcf=D&p fgꜷm'z7)8iy$P'v6t kg1NPPcZK/3f̈́&).vА(te[?:N-0d!,8Hq3j1b$#u~\eK2$nGQ!oNZ־jKȴ٥"1 ૛ԅ 'a2"FF*v oMK;4޽%kY%R>'~pĂ{3# P?a+Fc<q]{Y;a} DzZe6 D'0DMNf5'F-eVXbthmW йV'orps!eOxZx3||QMn=5!o 4#v nNq7zkXҳz&,)?O è⿖P/58}ݤxqC|p&lemݮ3d~voNla`Rp?[,1p13=ji]FJ%Y.Hd5$~g:NjzDgᵈ(._gfżN Ѣ0 u,f6v]mLVL96>ᖟIsd<\>>mYhy ?Vv/J+{p7X7Ͽ_]-bF'?\ԣmIRCG3v^'ۨY&ͅdfD-v'W xB+$O5zzx[; :,}?3%3|# 9·p6lП0K/vv 9cI5kƐOjU) 8Y3.z@%Fhsc%u5zdCSZ 8|#v6>Hjq!N!%cIly2D!d_ C'#ɗWE`C$\HdEI?adXՆtM!M 2oQ{6co97o2>;lvlٳR$t0J[>AQ%=P ?Uڨ%zVyɽ:0qRot@( N6lٲybyѯ&Sсy8`85-hF=sf͛&MPeXӡE:uhS#EY}'6lq{kj+8 jrl!~;ȶVh3~'oikOyCAoƲ|\1ݔi;٦۽cvZgW|qkmp?2};;42^L'? {m15Ӎ?smumjrcIn'sR͛a}7Li&=S ;}sTcnT9v輻utmV"d#H$jG@cHjd3v7iL8>XV94mIo|Ϯj,4}6}-'OWiW?7;T`[M:R%SN ͛:m>O0C88Gui4͛6lmHHAKzF3>fͅ+xCQצ`vu͛6b@8%(H̓AB D9р^Zjr!w?%͍y1ڃL#_fXQO3?3˓m46Ub<l6 '?͏9}60iZr+uX~J2;S]M*/ڝԟho_o\VO6> 8kz)*佾tVBK-!R8la&2ϐrzcX‐I.Lj~?. O 4O[E3ݝc鍓T1:en919fW^ӴtԵw?Go4 puV6Cwct+_ʚunvuݣoY䔏 qb&Da~'뛫=K.ݫ| Ӵ[@QVwý7qEkH7?>(Qc={˺B!ʅ|Nѭ,hS+}XA g;k=ܝ|:?UDe!^Aԁw'6lB@P*I2%[Ε嘍lV4"x;w rk2< c2tCyucQnO(NK.l&a+Tԇm(QRv$H#Ubv"n.`ooPíg_H?)X~7v;stk-֮e+Eٜxa(%I""j>'~=ھ9ıvN)q4~Tvwqڒ%cCjd ?=9oe\]9H+OQP<#\yl.5!?ٞ.5TE)Z-KKTu>'f͝8c80G!s"1 l)zM(Oې8j6M1+lɦ6wƂh2?Zd>0FiX `NqMHnccᆡ\%#/ivfykM^WDvl;`{r919Aݟ X4\\yrf &"#Q'nI~]k)#Nj"sc{qF*/oO;_CNSS3J=ֵM_ 77#{{M7ǶpO>iv)Fyb<]Fy#{{ڽH߰)e@21?pfqNώ3S켹j&A"w^Մw\Ku5J-_;$5ax@@'HQ~U,h2'@1Gld'gLRS⧁3cj|HDrOU5:x-`[~bJ`=dZ7M]RNC-wbC0Hcƍ#$4|in9#߇۴L~kF<t8?;޳ϤH# {; ;\=Y-Dƞ7/a PI=BV1jQzh/ ۡs|ӭ'{LN˹$L[ZL>"jd{3JdoGAC-=i Xjzs3,L}FmgOc/D}S GE[hҟy킵]t6KVr -`h*z k ]:5|'pII#J۩D/O ?K!Wsy3-KꏩUkXߜ;P (0=VۯğQr`U<=,#JR7ӭ?Xteۧ3Wٺ ܟ\(fRG㣠ο'H̶] xǠp/0^ cOgO8mΏe(7N}pf7nxҹ1ǰQ)~6E(--j4.of駃mvw>|۽sv~T8gq5 _P 7N#G=~C=Cz5kB"NJ~۟}?/7/1+FA_m,ucL=HmM>K6!|MN/>iGE~Sm8cCyyoO}t C$|<~0:F)Gѝ30f9i=Eu~h&inYvv2Y sjcB$'HoXU-AkM{30}EF-#k6l (ܳ5GP! Ly^liA?kŤH9LH߇@CCwսܺ]MF`buRLp&$VoswYne5/^EўX x8Qhr7Ri;X͛6^lٳf͎HF @'aRksfK4PF8wc@nI>E\08uQLΨ@Հ",H(:LJ6rbLw;Ddä :жV$Mc~ry>+ ܬ-۩Ozgֻ5>qGJ >Zݕ[V^ kF{8ժ QNcXmАG \+u 4;=géa Ku:~CQvvD 2HᴹYMM/YxEرa\2yyLVMlXWT`u_ VQ.# 8C Kױ$ :&i0Z'x)5QZEmkt$\. 3oiҲ=\?c ssVyqT#91K'_^OTߜ~^ f ?NJq!\ T;O羫EҴTn_&, |0~}YlW0fo(: !X{]K[K/)#;|?5]1ߥp0,P@ N[}c.˭ZQF9ƙ7qtKO̜WڜeחfԴ_.%;ٹ?~(`#f:al,\ܹXq@6'~xg+^(`Dک|*ѯKŏZS8d.,GJ.'ll&#=6^18<@zq//iO=O7#%Ir=f'սD%?F~a}c:_oXQcl(ҸƳ ;Yx0zxy >ؕyR"Ӽ%4$tf.C1=N^;6QeQV n5{8*9z;/ΛWZ-xYȟQGz]FM|c+js I5 gG7(?`EDZk_ f"\X^RAM29q]JJۯ{!j BBsA~dhj Ft{xHz,#Dn$ kM:EaP(Hx KKVp<{ '[0CU[VlT44iɕ: 5(^(ET;#^v8eG]LJhSW1%l+ I: jZ$E'oF)ӿ//eMJe_'쌕im62?z}RZWrsVeCff/: ,.QW7'}4G_Ο9S5-}^~Ɇm.ҏy[G^_ #ӒVՖ~}f͛eT8TEz*}4L)Ĝalٳ`bcmtƓ6l|wo3#pa0C sf͛VF1DkBw^Rzt͛6lyuAW,21!-0olٳdI'LLvw!u٧)/#r~C ^_M:=~teoVy:ߛ53c 7<؈9eH0\L7^$_N]WWIM7 gz~~GӕyُN#H6d|L^W?{cNw(?`GMGdak;KId:7;n~5YUm,ǥ]G|L"Xxu8L?r#'k6 rT~g$Pӡ3L c?0 LZBz(rj'gV=MH,=gv?-I^2Dz{C͆^a96vPo_c[Gլ4ӤIy֮f=hi$Rz}oϳ %L1Gl 5=j_PI'%P&֐ZHP-+i}C}ņDLjz`>ۇW.1b'Nu~c{QS-Vz}R%wQm?FJ:çGto(Zت߶גhġvo"ܞ7'_zdv/e614xH}[ɓo.ᏋM>'$Qu2Siemd"P>>7Zy[@,DZ^j$IBߪFzVS߲2i< p @:HhFzˈp%#ՒVF1URyݠLBOahs=g5CĂ4Q@(1 0UIe WYѠ _*YF1v9"j}Ս|$$\m y"rg%>Q>[5xsgC,B>n[9ПGh!@ma}Q%i1*!NΣ#iy19;3ȍHQw^WՒkV".^dY{'_,}#l G#N3 zv5*JeҌT c.vH1%@u_2iq~y?ƒłM+MD<FBYVV2+UI9{ISDCG)2xp'/yc"e*!TTfSXAan *='eOC>ip`Mq"":\R:"Tհ~]p8TBy kJmtrPl^lٓT(l㈌D19F-D9ܜN./}j7v ypA:/cLt?lt )#l5~nE㏧3h/+L~c%n2yk `"M?eqM)yjLQs5djbM/8TP u#Mk+2[UWjc\2ы} paf"GnXku_fo8t)nTw-+)9j{tl~6ؑW<H;Ov?Ni樇#{aSo9kvVeÏ=e#}=-C3r??cͼw$rKxY~ 7?Ep7/جgﯥ ;5]@JJ74ST!uIb>oqfv,ƬMICUh|ŝͦvF<MFc)yG#vhóuRxqǿ!!PDB8PU`m_Tt˭VX̌?v;`f%KG?ꏈ#HU6Aa K^p]HGL=aNq9nOi.,LNgD_w:Υsݷ)d27z(l.|YzzW["ELmDcjP|.YqCM 3079}fm4v(.nb'NRK;hō3oGmcM<Ѫ>NV- e:f>Y^W.ƤOD+MNj-'rǠQ<!ӡ~3jrzfF?O#:^py$IUڏ,X(|kL!..(2KԵ~s^]㑿,XogBb ֧16[ >罃f8OW0Q;w彟3͋xF.'⪭$rf N_| ;5i0Kq2JJ Bo]'U.BNأ2ʑ~|_{ X qyF!|i`QL?8sl';xg>ȥL= >a;mBGl7;Z(jAao]a]\4$!LD!^ųavi꧂&rIHdv_榩Oκ[H?t(/{ˋMdc[^EbK'DxG&l688;uVԌ 5`i~]z0Wmi[hUaWr 8wÌW^-oWd^E=;WWFv ORppedpIfN@Cy5.8Dםsoqy$cyZjX7Ιad"U!Cπ_CkR#7s`{k)GӶ?Fk7]c^jC&4cmIсx#$aKo'+x_>8S(:~r3GLRMb%'봟Nϑ+˿.Mp^ŽwdO݀g!ҡw^g3gow?|V{m/3?<|~8tῧK<|WsT5QHf<"a dj~="]Bj7WF;(ly{{Tx8[6;6lEpE?ql5kM>hfjn͞?#J_׹Gx_z_Ὅ11Z};>l&ZG͞s4ߜߝc+zuq߃b{~+o.$z*+#wo^H>H p6{˶>_ä iDB=A퇹 v/_~_|?+î:{|>W {*K1A?EpX ͞_TL+\GnԳ@{AB=<u-<3}_r-䕏 |͞ӵE{[Y%/q?~f??|{ڿ.uѕ>[J}0 e4|l(Gr|90vZ|.͜\_Z/ĸxˆ{=~6^<ֽB I_R4,IX{$orbGVNf}[ۉl q\l1~<ppW<:ʺUtgKe hbѐ#i**vkzƛlZkˆ!VGW7q[g3(tV}+I㸛Ĩķ llLM$~S.>W^w{<x[~>OR HCrd8Q ٹ|y=B#e ` Qk6{6x6H=r/ E sf~4'>7>OO]+TUsk;(#RԯV<|3Z$a^ΊJ`Pz=͞`wV^O^aO&DyМ~x6i;z_}NGo^7_?S*4&[ymZ,Ycf Bۮwlh$Q*14c'o+h'P}qF{?G_7__X\2A*D$e?Kȳv+=kS^땞3͛rCJ~tft<}H\6 xx?6o &G<;7<~CiKF,;FCPW#zߕ7ER ?/+o6{[H6B/J{kD"v=ٳ~Wt8x}pxz/"- @IZvZhPi6&&QiĈRC!em ?;!W}<'p98ku}8nop חik$11ݔEx̊M͞ԙ &HZ}Vћnxx;6dirgƶZ>$y10զNZ8qJ (0g-6*†d/#P5|p6{B!/*,@ {P(͔Fo;< 2p/`F)̫o%j)%XGRcfhA.o 5!#O-^/i-"ӯNف~S__~~zwK;~g'".cuᚭ";y6{@ >X ɹ^3 ?P<;ߍ_>_hq_ ?2]Rk[nQv`KA :ykAq-rCu'8ln;' x#<!){˄~p7MbuZ? bͶî8̄n[w͞vx+6"<ς_sgcWq\|"ePH:j"rB (>sfnZ\_A[|Ks-iѓ1sS \7ˑz'> endobj 72 0 obj <> endobj 593 0 obj <> endobj 594 0 obj <>stream HTOOHQvTijԷl,/[]̌NƈҶXSBRD$F=(&)B1{&.?¯Bl)-tPXYQ},RPKKr8cHb!JPlitPФoiP/MׂY%W/!F-@loa7,E(8|-y=g{rA8DP^ SƩH1g;'B_4U.¶x-frΡ3wG)te!~l>!Hx zBLF LRgWny]M }Yͻ|~e@[Zj_{+ endstream endobj 595 0 obj <> endobj 596 0 obj <>stream HTkPS>xP;8c]w{ۮtFD$&@NI'.! ]fnNNl;_i?;o}y (kQpٷϷԷ[ζxWy>*p|/8oWH@PCa-:BE0TCUt,M: AɌg|1TLMf(xȺ&팡'Pik[v]n99/sSwuQmH"A@޹:bjNk'QϱSWal}/ pFì?C:t1L63:rA FU0@hw v*-Vm$]2dZ-v҉zkUiQ+^:&yyg?Dhv6=~1ޤ0n2n7 )]#<~TN.?oz[:)^)Wa/Ơe"ѽ`AܫIlR & :fOl]T/O҄Ro?.ܭϣw6,yA%TdU/.9~-:ёѰ=N n]eWˌm+=WTF>_émUc?.+}DF0 { u%ݿ-U9aΜl@׉e)QÊ}of75 8J& Ս$*Q 8: ;aC6ǝa HV;u%"6J>)"V6 o u:l6U(2dL6~:>P_o3gP :lzS%q- :KuVO]kl&EC Oq2m_#3sޫxq>iDtCzc)U卧Ud>ALHɚ!<"kɅD>\Y-\]=p|}i}*glN " EN/Zhշ*t͙2ͩRoUL*u ,P{&2?H)o200mD~ABhWV39Fh^ 1/m5M5O3JW `/RL$tjPnj3FbPD%8k6k$.jN'G8+V,Ml+T">dYLZ5+4 jX90PsP$F.[_F";9WlBbx/i!c Ͳ(*Lo(7Hh{%_>XuY,4uFj1 ,k@Hku*ȴXP'0P,]Fi~!ud #-Zzd _nJ$&R|z?ɐ흮:u  {G)#4@:q+q҈m56) ¢%N-o?:|ޤ6YGK+ɛW[R0JFtV5+k-ɯOݫ i3T! 2`ml;ͪ s9zV^-W<΋tqs:"8Zg7ÀcZE]8KG8^[D}&u(f (MeJXSݮd{0ͦA*eULGXq5O\й|fT!Tø!Gt짃YyF^ @>OE U絾\uꍘWx  zBQ?.nTb.(Lgn%>}]d?V5.Euܦ 0O^k -`:Jp'DJb :g> endobj 598 0 obj <>stream HST"{ xP0p='6Ɉ1&ĉ(.rY.{F #C#r۳Wv]`#HL Tqi3tޥ=L:>Η@>yhwNJUUUYV^,/ۓS.TJ_ҢDBk<bۆo]Lo]mJހqОX.tCi4t >aA ( *UΏ89%k|j.w 3d!r,#E\F\ug9ngşw_gBbŽM雂(wÛ7|xk-Y[lIO:t!i0qGmL*xǘ5>D1 qx:菌En!w^7qG >\6W`0G~^SHV<-JGfBe:^1E:Z6noi;v-o4)k"{l`泵v~.}kXM"Sr~'Q~M׼EΆ&{ |=W5H_j׀Z`'u#a: "۩ W zQ][QLmP]&~pM&BqF Ԟ4 Gd~Z"U'sRh4eYݝ 3m.ӕpƕ>CDRJ"2dBduJNeQ~> +XkNvΩ/!K.Dꂊ.#z:G5o&q>TԴuam}NVh.[/.ʭI"թH3;,^m&խ^=eZz[m&^hU.ą rDHäM |c"/ :&֩~lx,!gl"缺PBI ٙΜPYUOޫԥ9R!$ Y)3DVx(w/*h,L(h? ~peopnt9>_7.#GqV`J)PҔ,=.I6k;Z*4eEyQZۙXelIAm-6+e5I{EO :-Ky3> Yp ~3 ceLzP" Ghm,mk{OMsn'dHrq` 0%q8]`iTZSm l0 p$`єSo,Ŗ*m-YUeÃѱaP5f*D"אRg >$)b4dTQ .DዋGKL1ܯ1}F^P 2`%# >qӺyqG903Sn.j!6GEig>Lg1#?97wl2Ȝ#g]@`Cs\^p>f Mki{YжfMp#(>Bd|p #IWx }>"_W af|tj>OFT]YK4܃#]a`g4.U؝v&p Sb4`[xHS/ Cg bAoIhXQ#Vmlgb^|qo%e Mҏ4 @9Ieogo1 vo_՗(}#הJ]nqI $t;K*q9?[+b-?#YC'EA(./=q8ky]9&6f]b't^S/%2s,w(ܪAUP}[s[WՄCYYDd*A[$L K~`(TV kT%ȋJUj0:MͱV=#3~.ڃA&/l+N7;`r/1(GS~8# n> |3_~j t6bmН4|% E[1s tZeo<Ozr(g"6!7xay]bAIy)ԵrV~Y^Io`EkuvA@^SJ}iΪ-(# K5 9RX9πPߔilS_'ϩF"uM,3juDZ٨2e!48I=t", W #F$cK 3^ d9e½kOMYXke:)L+؆&AhH_콪CH?(0F?M]6{!0oP#PuVH?bVQ#ebk:8-f%T5i$W뿭fǭ>Đ>Dm\jj X*nD [PO-B<<\Is=MՖq?7eRg&836js6(Xz@Rpv\,UAǣaULcR%RsIekT+T2[(]e,Hв1"T~bHM>RRBSeB M*: [:NwQݣ@҂8H ScX}Gٞ¶uuU .W1U:#N|d PK7EJ,3aN A/dR,Z~PQmdsh_Iܒ%ѝ9D?_byWEGZ\-#63v5c=VGxF-ޚ\<cY?2bL1FC^cB0CG+z=={n [ lR7 /_]{,Wmqho&3nv N˯ t*`m|n#*p %wA?¸J6nT|jA3_A7zy&P1}_ÝnpX]n7eqXu- bUf 3WN6+ ^xi|NSekfwlʊ)۝7?VL+DEzD-v!sY`t F I:sbc0`̃45!D%FPBDEQvCwk;ݵ7*VӽlM/--MC<Kq 9S3g$?|;i%r_C Κ4J7N:6NZX#'E`lcpz88l^fγ|U9b4&Jp  v(,L]x{ Ԧ)~ YHFL~~_'cc8Skݘvr wb@JnzXl:Ulƈ؞ F yƆڂ]gy|ƴ0 ~oWc\3[3cC$G~w*V(-b TvV 0]-Nn(8j0ZYwPnxgici>`/U:GUQXE3gjF_yB ێ,lE %BĝFԹ 4p5~A/AzC6YAp~ĺ^r 3ݷ_6&q cMK 2-B<(Gm.Y'ֶUt" c P5 ?sA6r/h*٪D|j 5Ih>l&9h]i#{m݂ܳl7`g}_9YFKRHM OQ jVڂT-jLfco{ЛYiL:4'"@Y$-&[ Q&`EG3/Kn_R2/Rhdڍ @;^ ӿ$LW endstream endobj 599 0 obj <> endobj 600 0 obj <>stream H{Pdz ⌙\*Ę/P/J@O屰@8VbaY@V9#"U).\iJrU=䟤U5_IP$ `cT\|\Tӊ4FqD/WgHwG+}F,?/5k-׭_"RJ 6Ip$,PHd HvDoTI$?KKHj%  6 _նj,赠SAR̉ AO#x58F ~m! Dj 9,&,)l(%KY5Oà /vWkײb2 @4(?Ėqm)b?qHP_Q kAP$'MeqĴL#UIdFodQ8WKڋ&Z>ӳ3,޽5/1A4HgGIm׻Htï)TpXHd2ZY©of : V XҚ:jdIqȌcK}I! U?cS1gK_H7c}Y'̲.Xe/3Ґ&jr\keZlfkkUrZ]*U%J>O΢p`#;W68țLb7q&GF,ugQф[f[VU=V!4'Ltg2uy\ ]9'sZmN^oW t^D%YRس6%1X@ @]P٦WF(K#氶XOKYʜBФ+0ņzW@5SmSuge{9,=;/N1 /n j%B_c$iTY}yB,EOK:@'o8Jbo+gknu%|L]v>w`g'oga08jV3 Iͪ|I!S78c[}YFU;(Q7s.R4Ps ~@bx3*l Ʊ~wYLzT;LۅcT O|rzF{[z!}Šd45R՚{ίИT\dO ^Wk2irSl K#OhJs#-h8}{S2x̓aGm #!xQ|7Q"1 { L?# D=Mܲdľp`4;:-&8K 002%@2AbV!̥LlgLOU|r{!ֳyd.核$^5z$H~ 0>1 OνѶ_Pqe)|>+49mydk#Nasԡ;81'hGj^K?72~Rt/m(~NEgW( < f ]aUB="Bl&kv% ?,X`z/(O963 I4Y90 kvoH7ȝC?N5BxĿ&3Z]uhJ@ ;73L4d ?ʄ`c0?_m/YZdKq eY/Ȳ-by6$ih#3ܥי镙iog޳;ssx Qͤn?f?3\rٚ69FЗ/jBRJ?ڼQ34G&Q2_P Đ]\wsp6[]3/i:S:~&2bG16IcqNSm#vйΐjkH S7nj*Re'Ci%7ZQk5[BImk)'u:fokCkFvb3IL;@CF\]9VV旱ZfFǟ,iYaOhgb|2}tnΩ ՚P(0kP6֜\$w;NbZTMzQq-%Y`!N%ඞh`dh\ߥveZ"Z?mYr #PUoo(o;6ƽJUOdE𻜐L`&0PB.f<(`<00,for$9';c2/ %ሗK< ]mJ#*"EzE=T2zbލ\Uf -FiDnXNm5F{IL# X8T%k`1#p^z։_: ^ ?a<+[c B v1Zkf.tgVY>˦hxZsP{#$34q{hٸ 5 _*UPUi8sR؇sk=0!'ea_p)`a9;38#գ6O rrlt>rʣϙ*s6-}IKgpJ鯃\*npީg Vh{4j>-OOՍlDWboa˩6e ~N'< ⁘opg!`xh-=2+= u6ʼn/`̟ˆCzܱ]֦V&ѧ4(_Eٻ /2k B&x `XiBiYc ZX_cf^yzσّ)Y }!#8G]V#|>t_ޡt)\@1j)513F-d[JX.q+3Ftچխob#2 SSHBo^'|~àmgnH ^+GKZ !׮=H8ABuozOm=S~mPZW]h V'zh^w0M11T.qu%q]e0C:ID ?sTd=ښ pB{s}iy^2ߢAP/Qx۷-Tg)<Ov:N0l}q=h@OA??:J*L*8…pj ^jU)T# * 12~A"10 u[@w>o bRvZ@mR{(,'dC/B`,K=5d4CevZmi­q~"Lf`2 3EvΞjOpxP;{%oqLDDB+z"#h Luʧm_͚6Cw OFS釾?>{Uw|SO3]>+0C.=Xd?3ȑ8\njh[AD#טȚlJwIWzF;E%} n"__rn61}t>A!F/7l0.7Foq nOEt!MI_Ao׿F7'|.G;KCO|B_#MHp}fPS{u뇖9~6n~+ `FԉA endstream endobj 601 0 obj <> endobj 602 0 obj <>stream AOPOBE+Arial-Black V5 Arial-BlacktQhhgke^^e{lklk{e^^elk{{l endstream endobj 603 0 obj <> endobj 604 0 obj <>stream "AOPOCF+RobotoCondensed-BoldItalic  RobotoCondensed-BoldItalic DOPU ?@ u2}[[g'g"?Z-bRiDr7q8|30)5DCWibuψʒݚީ̩ͱvVq]abR? ~rqg\m@uohhc_L:|(|)u9mHmIdS]_>ŧѧўחݏ }|}xutx||||xtvz}13اvcm~oobV> endobj 606 0 obj <>stream endstream endobj 607 0 obj <>stream HVklU;c;qJ$MG"$$& )m4vHve# &?*?+^[&PH[- <*+.v&sǦ X_;{wf  Pݽ t }#C.&OGL^vlП!=8ճ|W(aRYD*L s?3 ?vA;8&D *G YԡHS[Zż,o ㍤o`f-1[7&(׾2D*WDd䌉tоlgٽg=/~~Bqu6$b⏸G<; 8FCF6N <Ǝa5K=j)b7D:?ŎVb GhwPbQ\܏Nu8*.SOLSC ju^2Я*1HW0i&3xTbZ α Sh4Qpj:yiM^CCX8~V5i$aAy %ē. OT~1)-~-^K}wbW ڷ-.ӻ Ka>f?#<\]ivOno*wzۦDǝJu+ 3ؽmCP1vm)~?~sbuNɦՊ?Ӝ~Iu[Qz bnXW~Sj'ߚ @}o2ul4өW JXE# ~`YR62UƸQ Qv u*8] P* ԓӉ)N&(,>yW՘*knbgefqe1<7Y}4?c~YYZb]zU ז_\t!~ಟ\5|eO5g0JsCȉ%J|id^8a}0(nAL,x v/#B@7oGܝ"y%߱ҝ}Y7*ޅ/~xη˭-u`O endstream endobj 608 0 obj <> endobj 609 0 obj <>stream HlV}PT? .dX"#DŏD"*Xgt[ cg5jEmzwG#b$jNG1436Zu=ff޹{>~.HHPbCԋ.Yձ}㝦c߳n^՚t}*uesB3.}i+*egʙ]dGek׭hv3@1ړM_jǏVvfwZjb_34]?E{sǟ?1/<ܾ2V0&Xمu3S+ &Z`>NhPB,Da7N JX p]`98JC$:("2o-")VUrTZj5>'^lz6nCMĶB o2I"kngC6ZxDr=#~bfBߎ-C>D擨 =Q岃9N=9=E5s NZc' N.'% Ny%8꺲4YTfQ64ՖNu[z4\pN͢.(gCp%yS _{8*XMX@J#D_.d / AH#z^x& _A$# WdV:ħ:$bRe@{J›6H6ÑRmvWU j1hU\DHy"e3*S|1K$v+jkS{$vp94AHMʍ 3*:V6ŶҍtS6vF] l `8813">qB@="Zdj eikL}~+vo_#<̙9(1<@0'iLd#!eI5w16Y/@*aAPv>A1ʌY^2G&fD:*bf'5ɦ,Τ9"c75:SԔec3ak%X Ǔפk=}_Y[)}샶'Lꟑ^2*!0A&pã{=q8PsNYMM[d+Xb '268 /vx,dy%tf-zK$o;ii+C m%? b֫Qb5&ڰBũb9LҎ36s1Srq< ]~5G(#+t}} TTN` l?*(sC HCTŤW+U*eC٧VT, ׄhx+:0@wތM|N֝2ҫ?3R'eC ̄GK%S*Z!8z̩ocmרUnI}'mwӆ_u =' 'oӆHuv}>Gfұî;)3eKhͰxlESRR=%999ťl-RKBd['\Oy;:qCԇ~Mv}-rd淄AR~x~t\pq?FoWCZmg4۞yB93|b8SZFB |61%zEheSY֨4zι77@nIHdl-oXךuZDBQpUŷiG.㈔Ž.G]Pv*qhHN;$HϽ9Yyo{þ ]x#]$H簧2`JcI/__uGeV(Z22\'WLgjU[O"t9&@"@4_0[ 7`fIC"9ȂB~@XB?rHD0D9$MpT( AWU!pa΢M K>2矈? ֲ*7|,PԱDεy^LZNg)G{n7<7^SVfv=97bǂa-%daBNYۂ79ŘdkHq'"(dB䭈s10gRR//J,nu3D#Q8 2JAϱ9$ׅ?>^{2gL3l'޳xu9sgO?>Z.kC=h3\ ^S OZڤFAOHOs23Uf<ϧǂt*94c|^)=L@HVdy.XqFP'qVXUj( L/+( OY=7.b"Y{a2ҐHp[o[7s:{[wF[r֭mZO˩JNlq}\}ڵCKz^0wÆM Nڍ Kc)40tM8 %#X5< ^N0SgHcUÎo/⾮+F#(=gGm*iNx>17 m%FFPJ!э+> n1A%'򅬡t%rfOdqoQd~緟Hdke 6NSR8*lf)K ezIgp@GOTv(fpԑ @l !B5h[]&eq{ 73-@Eҍ oz+q}WZ_ST'l%_As֍kH)Bt]+.UɅ=,. g7Yi:St QrR<:Aǭ Tt jЋlM$H!j;$->m:g| =M5b_ rfJ$q$@/+ Q[Stłz $a=e\`/اL A0e"sO..ƮV#FiW hZXpqIAi-͢;VoW^¥<6,8r3=,Ui:qSD>o 8"T 铨3817vR^ݩݽݭYx2:ͥ&.zĝUxb@2V(\iԾ[IǧvA/wvmD׮ňmˣ_$uFA4Axu` Xll"-s>ТFnlb#ԅS <&ɰt}PÊh0 I\ yލwK_kj(i]zZ183)`hkW-"}xW#ɄیbG$w@H((X'۱<ȼ|[2E5M%|}ԜQHH,A,ŴA>卭kB^Hw(F\&̒"X AQ+$^+|A.U\b .W@S> gw}Ua!7A'-x]8OT" '=Dp!Mq<ӅKMŦ4 U{dfz~цEҚ;֖s7P7e(E܂z&nE蓘m bB6cXXყʓ)iU%xd3e%ylw-8zKzҵox("TC:&ΐJ"?_3A.=TJwE4_3:B܆ߓE[ 2@Ā9 YӖMX;RO׸Qov N-EX=n~!wa(-Qiko4XsNǒ[?@6͢6xhu>Ӛ{u )5Bm~w{p47{*x7Up5f)1KwU`XqPUP25"X9΄DG<,Kl~pt7ܼ)mH/?j̜E eh HxЇ%OUz3[\뮷~6:͙Owp0c //N[|a7!]pϐ:n HWܗu˜1R9``3d)ig*oGL+) !u //TkV*34u{PzQ oScioe`9"cNtE_Ӧ={Smo՞жֵO>VH(\׎~\\n* )\OXxPhefT+17#Wf$ٌ 5v 7˙7~tO /~ ?^a=]<Dz©ȣ*pT*n]h rr*'O{۩z#+Z|`Թ;Ep< \]U4&u얺 1 53{RC~84mZligma 1ZK7Pj4c˶j866_ w8=Fqeb?P7pwɬ.BD~ޕIᠫA@')O[ :Ll\ C}1:Q~ ]DhX32 pe{Ds 1)ј9N"S 6b YNYcG  96ȳaq+A5iSAgB1Xob șq"w9U"fL_"pD~Od42R 7|*8%L&D ؄'@z?NN&_`H1)8Ī2Gf̘0.)vzbC)NuXhD|/*Ec,W:7[$L8Q{zHI$JTBi4tJ ʤ,ʦzriͤBEiͥ|Z@ i-bZB%JQ9 XAP%UQ5P-z1>FDNL HMmQ;v}=>1[=|'=XnG%vdY/cav~v/d_?߱:;~{YvaoV?N{றOvuSwNvYՍB`xT\Z3W7y d_l)ޗyVlj|WᒒY &:kMul< h2ωPs"AVY u* Y~E"*7V ^4HCZFd0UU*2KV{0~uxo~xW0u endstream endobj 610 0 obj <> endobj 611 0 obj <>stream H|V}pT?㽷$M ɆD65 DfH3B ݵ%&@L ǠRtQSG 2vJmkG.MQZcNPXo N;׽=d(0h_?2OW -vƁ)3q ? }J;j! >4d@/^70Yr0W6 Tb<1Ddj?uЖޡ?Y7޼#TmIJ1~\?=Xz |8 $_>4u8}wB而 ,;J.K`qW2x#(P o O@MXۣ BM>\: z;4(ZE-k7Ľ-޾z㱐W@Gkhy{cjen0@fOU %]7"ڣb٣bB#(ʠՂB]P-,Q3O'7ѧ'|4׀Lvseԧ{tDk`[G4uh @ZdE%2{0 cxGTpX?aS`bޱ |a /MTBTͱj,9ܞz>?g;arУ谘g!KVhEvZ Qo P`;%x??G:=|^Flc){6+%c(OM'a"!TQ?*nP{9 MN~h7i KuW7 qKEyFvcg@9}n7A=A燈W $ɥU$ HO:k{`dœ4⫕t|xK_)Εz纖:'%ۯ/um$7FeR۳2v2~ v*%uRro`3KCؙjNb5y$H*F*I%$iIʋ6Mzlےe6X&U)},IynMqI^$-2/T.=X%N3 vȅ;vәw;LKji*!O- Υ$I%ô ,a_N3l H/.uΜ8 "|OaJ)G-uHu1ډ]@a16(H2s?l"lUQ-DR8.Wx?8Ev% rۂFJSH AƋgZ3>%X.LyQg@1@&:<+59и#΅tv2%&SlSiMݥ9 7|וe)KT~vF)zcǍ\څ,nhTkpiI86~{Glb;*v 5(ULJ]J>>.٨1YF!E]HtNnynx򀿂6̣nWE^*xTUs5|e4pr߈}yW~|=/}8q^GkyVETS+zc?Hz^Y^6gIgwG~n[Ìa4`gKcWM79W/=F-e>[BK&&W+Rͭ$*39Uhk}@}1!]{rokmr JC|m~#xRm4ݸaH›FH/ڈ9>U}K3h  aJވ&Ԝ*n{;K/:XgOl6[g/N&"r'3Zi9u_[G0vd־C?kbdńSE,U@ǂy++'/Ly2!(CI"v'YنU[Ku$q~3l\$< Pspp9#E/Ԥ,19¥@y{Ds nIhn2Y){ճy#$\Qpvʫ?>eT{R&UFtձKgnw=zI8RB?=,6 kP 6f+L HHmv<@#x \dCg}D9mvNڃxJkjі,uxF۵3e8SnY%ܬ:䏼cվ*1)ٞ$>¥]#Ȅ{/yau 1R92Y*MP FvpȯVqfNŢ4gkJgx9eH찱(SaP1UMBry-cܝIҥ^[ޝyRGt%"_ͭl%&&y}2e1𻱟E<_^Iq":xf|sKX}ZDļ42O.vŅ7"wX:>eV|~Q6r&kf-aX㑡;!GmAbČ&D,])]1Ϙ5cGptR6Y`&xQE om48@"<8*zh5~cQ o%J~ gD0zɐDP$-Cia>PI+'IL'_೚fTk aQ{Rt>?lZkhD'jzCE|* ֕EZ7ZhAiwLXG+0g:@#Uw1 4^sBuլK&V!ȯ@#Y*;l|:oݣPۄËw5o ]QLWm%^ݹ"]ͯf pl$#4ƽ RMolx];^(A"@{Idߒ#@^)oJ0Dh ?_e760f<eT;& sk@m[a$yZeC~asYvz'8*t/k3cHܰȬȢϛ㯑CC۸Hm Z 5_ָ4 `ck"6RBX~ eykY&;pI ! HwT4Y*ً2o* EDp jUlhՑOltrζv)ێz6;j%~O9y{EGqԽCpNr[ v汞ps!@HU;.(jч1RqjƸqwиPxQ!zA:re ~?(DD]l3A/R8B&2`&5urٍ!!pFPXػ!]7(i`hZ[bZ\JZq?QI&|u{Fu羠Cxf6e|%, ּy_XWM2l*yhmUڍMJEcŌ ŷλQCە =+ZX,E'-vAћ)<2@`容wL',^'og[W,p'rgIcڶ)ץ Jr95ezAJOSZܧu)E^ 3;?6|\ʂ[ܧJa@+|70c̀6cJB03ZJT+QIUYa_E?m}NWG|w!5׷*UOۯ#Y@kQZբh4 ?WW&?2( P<^DCͽv4f= KmcK)I%N-*2|wmjl=}C~Sn':499iw1CK޾5 _[im}=TIЄv##ZnA8Ԛ ak@⭌V0(ukmwN$:rBs %Q[h,pU= M[,h6DwĄ.D+D̹C;4+\ΝHj-a42 $` LZ̥֭zmFIY)f`s=RZ$l(bVz^Jv}> s`Dz=Zb{m7I}mmE" `V' 1@Ź(ӁQ]q3CzusՂ';w=V|%i%_pD`3{0T2hA߻E} PRۦJjkD*(uNn&aP,}!?Sɠ(x;FɌAEA2IG1rPz/[^aKolFۭΌM7W]OZϘtE4ϒeH9\vJg_~ċfC"J\MSZU'3 GZaxj,|(4R-ZV 77MU qabgۯnp(ⵉKΓwP°!ӈ}5c ܓ ~xdmUj;^'z=E{^^]> eKF.슽[ʍn8W (t/z]ͳCڊ{ey|S"n,9h .CK)Aɟ.EN)ag/4HȐ!gAٮ{0G9! fF3#Zp Лnm檜S/J$gѤ/IL30I2dTq guы*7sp>pqnɥyjyX`o*/kE欲+:Wjr+T\OXFH9o+䛳>O?=嶇+Bf%@0g hxE;_](f,sCж}T-tyUKU{x ݦVBD 2z}mբ *;lk]~1Qzӵ{{;[Hx/W +S.u!PAZבN.T"a}{o&|K? NbTp@)?a򭠐on[!&n,wVˀDkUE"lcHE%H>ϦiSxs z`Y_z)ϛvSl'hfZӧi^sݛbYSV,|-п&dŒ>~Pdn`bhjyLR?LCtg h*5aܢ| x-ڈgϟ8^\0!2ڏRdžhִb\-x z]g39hg3]p * vDcaYI,FgcQ%NBн.̘B p4DmXE<%4^/Utݵ^Z2K״4["5-Z˵Q`=PEE`ٕ D=dDMYRZ83?sg?q Y~N<o1M 27sb 2dƖ1&}.h;fKglӟ~@ E= En+MI)<,;r_QW{cuo 5xAy_UM/t02c"0f!ф&^ў58~A7+D;q䜑N2oc4qp?61&HC%86Hh\.gO,,|`gDI„L]Z-QiP9,r@GBtaD-1Cf%HJ)9Yn5;/7#>Ӝ2!n6-DOa7x.odp#'0<{Ȣ~ 1E(B,b,E)ʰ ˱P Tb=P ؈Mb3l6:l.ۄV]a{qa,>ODw#XhW ⊸#n2۞KOoK{z[Dh̝ϋzQ'V#r /j2uun"KNtn+t.SR yMmK KR|>Ͻпλo/a\0;(>~QPͽ2* fe g> endobj 613 0 obj <>stream H|V{P?~e.,,uݏ塰+(Z(b[#+C:-iLcKMm;z+huf&mdž$qZiN:s{=s{  - Ai&O^v%qR}ſ'8Ɲ/ަʚ|Vȧ75$ ՕFZ/EӸ1k{ |rfT%xVW6ڂwTY_[so1mlڄ~(A|RXK}=0x$,5H"Gn8qk@5%T z M r?'>x]'k8R\yq)}wސӾݳSWYY>Fm{(á,A\#Pϙ0t3!4ԏ[RFipyxaQȥ(b~4P #q޳.%,?Z( BP{{*Վ `IKU\BU " ɷ,Xhb?'/In4eASeÈ-=xuYYyFLGBMڡeO })-SUIm VjBBFVIwt]su5jQnYbj '%[xm OqyShf̄<s*T1ɑ7cVtv"IgD\eǫ?}.]Wod/oiW7K Ʒa*>°czRcaJI G/P?Iu8H5.8U_"N;1vλNknVNEr]N7 p[=p(.5&) -lRb O >ϮxX`LNNr0#+333fxD#&WCBPڿuw|a/3&KvԆ>Xz聤b@*U4h кLKU8g Ǹgk5I̝NfΣ3E6(@ތd̀ΤfE'LjW޾V,´կ(D;pHcK߻t+:^xnq\U.XRύ۬sUfO}ɆA&& ǎ 9;@IL[v֣}E>^a2]&-'f鏢 ~+FS\߂ɪmA"̀HzGNf}B 6:wJbbwdkށW;G߿NfTˣ2|Wboml/QY4ۙ;zG1la׸`9h{XBRњ̒8uR69L\d#qz:$?>dao''wn?}@xMdױZ{7vz$rϣ9-jL$% -6G=>#lZm% l#3:T2Ķٝ_EuǞ %!7_y/7m}ܻew&ʢMԟȚ&lq=>a|0<;]^QM]YsMHɅ!X է%l j[]@RpHz1lXs ɇhx{h翞Oc|c<#LL,&F . q,2wQe0ѣDQzm"WYj%"ׅIh {d1 )̂JN͍}DMpJEOx I#"FOwӈ'rbuSp9eWa#B"GC6cz KπyTlatC0w]/wy/DOrWd&]͝.ӄz I?09nҏW_*Jlh4((M&Y7%n*/2PVWow ,֠$*jtb{gGxkʢ*Bw hlʢfe9"|Q2?@RҎl##IjArK1{x'#=i2amj#ˌy[BrE1~ޡ%py, ?P/X,Fn#AAK E 6FP%Mg5:}e:@ZNxO|%:Ƌc.3GЛ'۾8Wxsn}zuT}hl -I81!UI(& 2Zɶβ(ҋl{"%_K7b=%_Tpϖ/}qߎ 2uс%iʳntsFQ`;q^2٘CLopIOǟ@AFP")-w\l ,J @/oR1-N} y=˞ 3+!uFc11ݗ4>){k|qc U;x;# -xůvp&dGh#4^*3W˦E+l4UMS[ +b81R"*eNIJMSl2ژebKs3{?]OZ/Xu3n]#o(|):hث7QZqiM‚g~lׇ-sܯnKK}ICTaK.9YTXyI)g6|`˽?+8h򀸇mFT*࿖@ddFIC6z?l30c NIBAdhe:U-|:3;H[S%D5^R Q/$WPmaڃ0->+3R- #ȩ7X/ʶVMom[wmިF|OP zf.[ڍX<;b:jaʜ62KaD>,[BL3\qAoEe}Uۭ7ѷq&^O;EpJdM] J)POCR+-m;X# j.[T?_wBnշ//w̢Uksb9/``0mA2HLa2ȀA2oe]" mO+6ױi24&o $WJ5mIGJ &\,s ֒$T[VPvWyTT{ EBPĨ De #8DmOU_] GD=]ZyyUnRpĦEKc݋뮮!IoHqM3gח=QI#'%B951mL'BuR†0vK+6y` HGZN:Cq !Jg'_:_>Djdب_;twOH]tr+ߩ:sQ.b hb[}[QЫL**vq( Jծ *(*J< ezpVHN1;2kXuĄa9SD\D?I,h"l3yv%{X{AJaJυ$$JDžs=)l] Q>si ޝ 1\jj49/h=G,&F)7]_\Wf I at[zvaNKUF>HKS;9<5ׇ*u״I- srt [nvk`6YQeds!kUu.Q?%?GgqJ_XSTf肢eX# t7$;=Dl٢mp9`ΐ2~]>/xW 5v:IpMC,ݿ}}7Go~L ({0vi-aߍo>Ƒ"Y1eZ^ExWXbᾸDwQVثƶF:7q]T*y]NEC`g3 )h9=ėK1RN2bD/FòLKeyUiUpq/eat<ݒWY/=Zi;y $lൃku" jd=a;)!H>8l DI xjI"6**>?({TY|+p6֔.W^X{hV,X"\pW,Zv윆9UM{^8\ݖҾͫ\\ɗ9qd>Ut:W6-#֖fc6RϳFQ)A)A:."LF#J s@Ūk.RoA;+e_lUg$j3IǀR.5-o-bk'G $ L_b\U>1lR^ٺ fM-.Nv5= DE6 ،"1 .t ;XUIݭ࿶D hKh9Th__ЌGZsB&n% 7a 407"&vXq &bRpѾwX7.lGf4ĢDڳY=hWfτ!Y%?98Iz:b6 YU 6-F?q@KvKE%0Ԑ"! žq88a`$q 94<04(0 a6TB,jx"X5걂5XMܰ B)8ʌVgzBz`@=wzяyzt=CCӃ|Svi~ چv#Eb"ʾ נ fJOl3@+>#*_O_rg\nWjyNC̳!1v!.υ2D1R̸pmp "ah ý1p5 =2]z0/̻8h` < mq}/ɑ漢۾_Vl`՚ endstream endobj 614 0 obj <> endobj 615 0 obj <>stream HWmp~Ne[egq'd>\Bka0N`dKF6I Sb Ȥ dmNK;R+ixBi ҙtI'-$V;M(?={wV( }#OM Q29ehٟ=:a]PO6Nn>. kgP~M!eNresvb$װ?`H5~S( K1omhF&s{l_ _P`Zֱ}j-ʫrI\ڭ3M*R=F>E{ƛ8T>w*C"[Kc(9riter.^*w{h=xarIDDΑusO!%/E2 EVb{lC+($}}F%&!%>%?{-ʾ1Aœvnk@'\E n\/V]Tb\s!l߭T>ˏﯟ'm cRD /Yr{;T`r޲~vؒh&SY&;t;php[Gܞ1wn53nN-ٷg|3_n~1E g3ӈi q"j_B(x?(ׇ{ CyďWN23ӈJ#?8(+Lw9)1uŒ$0"wB(;.DN DhV;odz\ux,!Oi z`ݶRjXm# ZmK!`[7p-~6Z.fwX,Km]TccHmmvf^ryF3~C =EM;ܜ~zhmDsqRTsp`ޣIj֞!鳜㒟١М?N7?|~RB^, c3QM*ј_p49o10 SGCƪCV]b[=7j8ր#`v`SU2n5W071ގ ;kVI\|!/b ̯N_v~V [Ƒfo % Jedoݺk.caTg 0 w܄lZ`hm:gcH{so69*m><̶wg# l^n2DAB0AE?a?<,Ojnc>=T `p}A؀gW(ny (%ma2Ë7+lnW?̗QG-.d endstream endobj 616 0 obj <> endobj 617 0 obj <>stream H|V PT>" ]Wh@v~)+`4ՎCh15ѱ&ƘFG4TMc*iDc:hM}ܷ,tg޹ss> `CYv{aǻ:ƿ/Mϙ5 [V_IUW[Y3x{m^M} j|;%޵(zgVk}"7A5CCU?䦢ke^FK|6^JʼT kl5.*e6la(;lmAwE'GN ve&J4Ƶ`):bfEqл޶Y Twhu;:ѸsKvء̆['dwJ|n|V0bg=>f~V~5.N̅Kǽ VhB#9 J.80mբo4(l =MdAyP493 l8EҜq~l+fas[NI/5//r2M3WxvD+by&$;n؞?_34H,25&L6;&yf2έbb;d\XD#xA&'wlb;6T֘ 01>_^>&21Lv01siȈPa&zFYo4ӨHII14`z)>p,MxЪ Cx3ҸS7b"?)4.P&( D 5Jne+3_&e%5{TV<Ⓡ(jhↀ^ØƠloRP3jrӝi\Llffs3;T]zi!dvΉݐe~\ʇ#R12zc`clIpsyf$$X#3%Z̹9¹w>j%1۾Wﶒxxd;{^ $M5_P>DX91:* Hr]N+zo \$.R yʽU}?WD4s<_<`2-HXZT'nT.ʢ^b,3_fZ8gZ„i6e (7r@ӑϙCgK:T+_^WBC r"><@ (oOzÇMް*F{:Fiӗnxu#o_- _m}mъ11Ij9ɖh$)HOOZHLTgU/x:v!i yggdb~4t󽯶;pcŊs$-nUu&}2}ƽɮ"Jeaq4gD&-먐h XƞkDϔZ>xˏ9w{n㾱[/£GWCPsAYH[翏ɮ,)~[DzoG?Ndgj$hfF "L;=󕺝'qSW--Yz i<a`a/4E}%%*Ft"1ytij:ى}2oPoJE4k17&_I:R0cZc2ڸ<mbX1iyw@P R@4,5vwRijiL*EMښ&J 2=sg`Kכ33w 'a"˼LĠԴ!aLq:=nU@ؒIYn#d¤(>4C@kSO3DP1e՛K yKʞ6y?>k{㻂YOXHI% /ZE(0"gZh&MaЩ uG[|?qzdhݮ3/ROAs6Jtn&D|]M Z}cqn$nYHt#b`䈅8E\FLeIXT Im9litxN:Zoɝ}96owg/[KCˠ >׆84<]<gEߌzN^5¼mZmZo>[P"xh~Rj#BZps4\߾^:R;ߩE>]qS*T/g.`a {hd>/I.6،> endobj 619 0 obj <>stream HV_P\s?.vp+ B 0ncDaԽGp7v&ҕZt_GNQeq= CaAG"b W݉"@e#\@}Xdf ƞ3Q] f2BB)o {M=V}42(򴦁Y tHv dzi UQi&%8Mp0Stl  fhj6= 1L3 ,s$}dlcfVT-+,<f6Ye_4/NTsfmRWhp㣛s^G "^x@/IvE}G% gIlf TA~*ox?b駩G&=q'q҈Mʽ S}M^r6`EX~E689\G֘a ڎEғiʙSqj:۵zX7&YW&[T;(!oU:yiWGէh5QOQu0A)Z]nq|H2'+ed9lz+t&* ` *Iō,ȇ ydJ,垎P{k3z : tLG؃\+|DOQ=v?j=+(A7ٵ˗I䢲t ˼0/t_Q#54+(~kTox}PjK{_\q%G+|o 0i} endstream endobj 620 0 obj <> endobj 621 0 obj <>stream HTKHTak^8c!LR1Dk"q1j&BgF'q.> Q$d&Dn-ڴAR;W@ս}kF 99?^HJqa-UNeK 8ƽt?d Lk"~MIǧv\S5jy*rϿ;2po>}MI{{6\9n~[깑h:1a\ ({8(u"];sڂ7$"&BXG%jQ)dxxC2ncVߣb[#~ÖFmŃ!猂 *q]DDT/#:Z,Ï+dqe[wO$$&:T=ymF"$Ё,bH;Cq۲ю yܠ/.vDZ{u #"-H![GBa\<Xat郁ғC'QҜvy;ow(D; endstream endobj 622 0 obj <> endobj 623 0 obj <>stream HV]lUviw.3]~jk EOK6h@vԴmD4y0$pJ(L`X!Hsw*<>||s͙0PQvK^ %=뺛9Y$zǖwtM,/^#p'\e:{S*'cWlm |%`hw˶[@^zϦ- %4$׮nq:UolnKzb{iԴ32 cX#| ؁yHe7 x>d#O#=M X#!4nrM!^>"ؚP!jήnL=ǟizgK೓= b]1peRm7Ͳ2 O`C*d [FsQ񋊈7 Ja!a#;:^1**fA=X`q V,d;kc f^'{)"f;Bݵ_PoG'7h|1VTJP]|?~` zf6$T*)_Ho5Ix#V( W@,])I6 oZJ,gIM[_, HͶeMM8Wjy>OǒZYq/Sjp0PSV8Cjw|SiHt&J2pԻYo_B%ʽdkb/ II'Ḅ y^+OFɈDb>IvSB% ү8GFH( ͰjQv8B&TERR|K$ tfuӒHpY)AqK% cΔ11SzףlkR&9GT;y=٘ -/kn15Uf夦Q)!G|D|V$ӈLDu1H+o 'en1/W ,(]Ο3']ȅ8tH}e煭]K^ajDž[t3qR9l]a;;B'iU& c9$vϛ.ܟё 3&+:R*Y*s,N,;ɒpJWAＥє9)NeuuuE Xo,Tj;,C%܀ZIzIЎuCZ!~!TvaܑEiX Gj2UZ8UGMu4V%6ޮɲ!A:(& endstream endobj 624 0 obj <> endobj 625 0 obj <>stream HVoL[mb`<{u(CRRZ`ش-8@[v ,N0 itڴ?mi|ȵ7%Ra*HnSTmٚI֮\ɺ~Ȧi_k=  4mBoȆ'Sgfڰ d|"U`>55O8l(BmS(uuj&=9*47ώ&PЩ?L|>ŏi4oO^ ;Xx`eρws4|&Ҝ|G3yj p#Tr6Fp֪~؉2[H`?;'FY՛cLl& MZ6v"*w0$e{Zae>FGB #2l,$yPfHjAWj;zc~D5 )vӲBRFMWkJ}gH:b'ae2E7B&\Y0|1@d-D 3 ~ӧ~o pH:C-Ѥ%eS$$e39W0PBWX]@aI?57WܸSOY]+e]@a ёt>[e`?GC$l&dx=_oE\{?51> 8e݋gH%<Nӯgb?:.] L|TGluħO`Wp;=}H(i4e\8~1wˮ8K^ԡ D_cD>zDZEvD9V,fwppw.yo_si={w(&F*fk TL?vwO1N|ݯ[w)5=:Vؖ$\2W]N]=M_(V.9;-xsm,ܨo+hRl@AR lNU̩9U1d}G,)xSA^AkiPMn '\ılS : XNJ$&y/ $ ي^t˖\HyIV4=a4LymqUkol^7'>>GW;FguFqyNZ*Uޒ^5$j<%QKV*wɲ@%:EXNwݷV;ymkjV_3U|{7?{{ǒ/}ViK,q>1ʹV.>xp./S{FoN# VG|l)(jroi+p`׉5NI:t8G )r2%.*qOў`P2 G1(}z0$1ØQq&y!S4n?+X'ާ[fҞUCLݨB*zL.㋯WuP7vdrheǟu׮zv)~|imwc N endstream endobj 63 0 obj <> endobj 236 0 obj <> endobj 237 0 obj <> endobj 238 0 obj <> endobj 278 0 obj <> endobj 302 0 obj <> endobj 239 0 obj <> endobj 626 0 obj <>/DW 1000/W[1[568]]/CIDToGIDMap/Identity>> endobj 64 0 obj <> endobj 65 0 obj <> endobj 66 0 obj <> endobj 67 0 obj <> endobj 68 0 obj <> endobj 69 0 obj <> endobj 121 0 obj <> endobj 240 0 obj <> endobj 592 0 obj <> endobj 627 0 obj <>stream HTPn0 :$&BURu%E*Nd7WX~hlN`dFd gADq-Fu]X\o4 |qblikuLz3R MBՌ 6Pe\v;WYфPK)fOH汾.>|8h"j4&}nKqCYiyOrn. endstream endobj 7 0 obj <> endobj 74 0 obj <> endobj 122 0 obj <> endobj 241 0 obj <> endobj 279 0 obj <> endobj 303 0 obj <> endobj 322 0 obj <> endobj 339 0 obj <> endobj 356 0 obj <> endobj 373 0 obj <> endobj 390 0 obj <> endobj 415 0 obj <> endobj 434 0 obj <> endobj 478 0 obj <> endobj 504 0 obj <> endobj 628 0 obj <> endobj 629 0 obj <> endobj 73 0 obj <> endobj 414 0 obj <> endobj 413 0 obj <> endobj 588 0 obj <> endobj 586 0 obj <> endobj 583 0 obj <> endobj 581 0 obj <> endobj 578 0 obj <> endobj 576 0 obj <> endobj 573 0 obj <> endobj 571 0 obj <> endobj 568 0 obj <> endobj 566 0 obj <> endobj 563 0 obj <> endobj 561 0 obj <> endobj 558 0 obj <> endobj 556 0 obj <> endobj 553 0 obj <> endobj 551 0 obj <> endobj 548 0 obj <> endobj 546 0 obj <> endobj 543 0 obj <> endobj 541 0 obj <> endobj 538 0 obj <> endobj 536 0 obj <> endobj 533 0 obj <> endobj 531 0 obj <> endobj 528 0 obj <> endobj 526 0 obj <> endobj 523 0 obj <> endobj 521 0 obj <> endobj 519 0 obj <> endobj 517 0 obj <> endobj 515 0 obj <> endobj 513 0 obj <> endobj 511 0 obj <> endobj 509 0 obj <> endobj 507 0 obj <> endobj 505 0 obj <> endobj 498 0 obj <><><><><><><><>]/Pg 478 0 R>> endobj 496 0 obj <> endobj 493 0 obj <> endobj 491 0 obj <> endobj 489 0 obj <> endobj 487 0 obj <> endobj 485 0 obj <> endobj 483 0 obj <> endobj 481 0 obj <> endobj 479 0 obj <> endobj 473 0 obj <><><><><><>]/Pg 434 0 R>> endobj 471 0 obj <> endobj 468 0 obj <> endobj 466 0 obj <> endobj 463 0 obj <> endobj 461 0 obj <> endobj 459 0 obj <> endobj 457 0 obj <> endobj 455 0 obj <> endobj 453 0 obj <> endobj 451 0 obj <> endobj 449 0 obj <> endobj 445 0 obj <> endobj 443 0 obj <> endobj 441 0 obj <> endobj 439 0 obj <> endobj 437 0 obj <> endobj 435 0 obj <> endobj 426 0 obj <> endobj 424 0 obj <> endobj 422 0 obj <> endobj 420 0 obj <> endobj 418 0 obj <> endobj 416 0 obj <> endobj 409 0 obj <> endobj 407 0 obj <> endobj 405 0 obj <> endobj 401 0 obj <> endobj 399 0 obj <> endobj 397 0 obj <> endobj 395 0 obj <> endobj 393 0 obj <> endobj 391 0 obj <> endobj 384 0 obj <> endobj 382 0 obj <> endobj 380 0 obj <> endobj 378 0 obj <> endobj 376 0 obj <> endobj 374 0 obj <> endobj 367 0 obj <> endobj 365 0 obj <> endobj 363 0 obj <> endobj 361 0 obj <> endobj 359 0 obj <> endobj 357 0 obj <> endobj 350 0 obj <> endobj 348 0 obj <> endobj 346 0 obj <> endobj 344 0 obj <> endobj 342 0 obj <> endobj 340 0 obj <> endobj 333 0 obj <> endobj 331 0 obj <> endobj 329 0 obj <> endobj 327 0 obj <> endobj 325 0 obj <> endobj 323 0 obj <> endobj 314 0 obj <> endobj 312 0 obj <> endobj 310 0 obj <> endobj 308 0 obj <> endobj 306 0 obj <> endobj 304 0 obj <> endobj 296 0 obj <> endobj 294 0 obj <> endobj 292 0 obj <> endobj 290 0 obj <> endobj 288 0 obj <> endobj 286 0 obj <> endobj 284 0 obj <> endobj 282 0 obj <> endobj 280 0 obj <> endobj 274 0 obj <> endobj 272 0 obj <> endobj 268 0 obj <><><><><><><><><>]/Pg 241 0 R>> endobj 266 0 obj <> endobj 264 0 obj <> endobj 261 0 obj <> endobj 259 0 obj <> endobj 256 0 obj <> endobj 254 0 obj <> endobj 252 0 obj <> endobj 250 0 obj <> endobj 248 0 obj <> endobj 246 0 obj <> endobj 244 0 obj <> endobj 242 0 obj <> endobj 229 0 obj <> endobj 227 0 obj <> endobj 224 0 obj <> endobj 222 0 obj <> endobj 219 0 obj <> endobj 217 0 obj <> endobj 214 0 obj <> endobj 212 0 obj <> endobj 209 0 obj <> endobj 207 0 obj <> endobj 204 0 obj <> endobj 202 0 obj <> endobj 199 0 obj <> endobj 197 0 obj <> endobj 194 0 obj <> endobj 192 0 obj <> endobj 189 0 obj <> endobj 187 0 obj <> endobj 184 0 obj <> endobj 182 0 obj <> endobj 179 0 obj <> endobj 177 0 obj <> endobj 175 0 obj <> endobj 173 0 obj <> endobj 171 0 obj <> endobj 169 0 obj <> endobj 166 0 obj <> endobj 164 0 obj <> endobj 161 0 obj <> endobj 159 0 obj <> endobj 156 0 obj <> endobj 154 0 obj <> endobj 152 0 obj <> endobj 150 0 obj <> endobj 147 0 obj <> endobj 145 0 obj <> endobj 142 0 obj <> endobj 140 0 obj <> endobj 137 0 obj <> endobj 135 0 obj <> endobj 133 0 obj <> endobj 131 0 obj <> endobj 129 0 obj <> endobj 127 0 obj <> endobj 125 0 obj <> endobj 123 0 obj <> endobj 117 0 obj <> endobj 115 0 obj <> endobj 112 0 obj <><><><>]/Pg 74 0 R>> endobj 110 0 obj <> endobj 107 0 obj <> endobj 105 0 obj <> endobj 103 0 obj <> endobj 101 0 obj <> endobj 99 0 obj <> endobj 97 0 obj <> endobj 95 0 obj <> endobj 93 0 obj <> endobj 91 0 obj <> endobj 89 0 obj <> endobj 87 0 obj <> endobj 85 0 obj <> endobj 83 0 obj <> endobj 81 0 obj <> endobj 79 0 obj <> endobj 77 0 obj <> endobj 75 0 obj <> endobj 59 0 obj <> endobj 57 0 obj <> endobj 55 0 obj <> endobj 53 0 obj <> endobj 51 0 obj <> endobj 49 0 obj <> endobj 43 0 obj <> endobj 41 0 obj <> endobj 39 0 obj <> endobj 37 0 obj <> endobj 35 0 obj <> endobj 33 0 obj <> endobj 31 0 obj <> endobj 29 0 obj <> endobj 26 0 obj <> endobj 24 0 obj <> endobj 21 0 obj <> endobj 19 0 obj <> endobj 16 0 obj <> endobj 14 0 obj <> endobj 12 0 obj <> endobj 10 0 obj <> endobj 8 0 obj <> endobj 630 0 obj [10 0 R 10 0 R 10 0 R 10 0 R 10 0 R 10 0 R 10 0 R 10 0 R 10 0 R 10 0 R 10 0 R 10 0 R 10 0 R 10 0 R 10 0 R 10 0 R 10 0 R 10 0 R 10 0 R 10 0 R 10 0 R 16 0 R 16 0 R 18 0 R 16 0 R 16 0 R 16 0 R 16 0 R 21 0 R 21 0 R 23 0 R 21 0 R 21 0 R 26 0 R 26 0 R 28 0 R 26 0 R 26 0 R 26 0 R 26 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 29 0 R 31 0 R 31 0 R 31 0 R 31 0 R 31 0 R 31 0 R 31 0 R 31 0 R 31 0 R 31 0 R 31 0 R 31 0 R 31 0 R 31 0 R 31 0 R 31 0 R 31 0 R 31 0 R 31 0 R 31 0 R 31 0 R 33 0 R 33 0 R 33 0 R 33 0 R 33 0 R 33 0 R 33 0 R 33 0 R 33 0 R 33 0 R 33 0 R 33 0 R 33 0 R 33 0 R 33 0 R 33 0 R 33 0 R 33 0 R 33 0 R 33 0 R 37 0 R 37 0 R 37 0 R 41 0 R 41 0 R 41 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 43 0 R 45 0 R 47 0 R 51 0 R 51 0 R 51 0 R 55 0 R 59 0 R 59 0 R] endobj 631 0 obj [77 0 R 77 0 R 77 0 R 81 0 R 85 0 R 85 0 R 87 0 R 87 0 R 87 0 R 87 0 R 87 0 R 87 0 R 87 0 R 87 0 R 87 0 R 87 0 R 87 0 R 87 0 R 87 0 R 87 0 R 87 0 R 87 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 89 0 R 91 0 R 91 0 R 91 0 R 91 0 R 93 0 R 93 0 R 93 0 R 93 0 R 93 0 R 93 0 R 93 0 R 93 0 R 93 0 R 93 0 R 93 0 R 93 0 R 93 0 R 93 0 R 93 0 R 93 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 95 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 97 0 R 99 0 R 99 0 R 99 0 R 99 0 R 99 0 R 99 0 R 99 0 R 99 0 R 99 0 R 99 0 R 99 0 R 99 0 R 99 0 R 99 0 R 99 0 R 99 0 R 99 0 R 99 0 R 101 0 R 101 0 R 101 0 R 101 0 R 107 0 R 107 0 R 109 0 R 107 0 R 107 0 R 107 0 R 107 0 R 112 0 R 112 0 R 114 0 R 117 0 R 117 0 R 117 0 R 117 0 R 117 0 R 117 0 R 117 0 R 117 0 R 117 0 R 117 0 R 117 0 R 117 0 R 117 0 R 117 0 R 117 0 R 117 0 R 117 0 R] endobj 632 0 obj [125 0 R 125 0 R 125 0 R 129 0 R 133 0 R 133 0 R 112 0 R 112 0 R 112 0 R 112 0 R 137 0 R 137 0 R 139 0 R 137 0 R 137 0 R 137 0 R 137 0 R 142 0 R 142 0 R 144 0 R 142 0 R 142 0 R 142 0 R 142 0 R 147 0 R 147 0 R 149 0 R 150 0 R 150 0 R 150 0 R 150 0 R 150 0 R 150 0 R 156 0 R 156 0 R 158 0 R 156 0 R 156 0 R 156 0 R 156 0 R 156 0 R 156 0 R 156 0 R 156 0 R 156 0 R 156 0 R 156 0 R 156 0 R 161 0 R 161 0 R 163 0 R 161 0 R 161 0 R 161 0 R 161 0 R 161 0 R 161 0 R 161 0 R 161 0 R 161 0 R 161 0 R 161 0 R 161 0 R 166 0 R 166 0 R 168 0 R 166 0 R 166 0 R 166 0 R 166 0 R 166 0 R 169 0 R 169 0 R 171 0 R 171 0 R 171 0 R 171 0 R 171 0 R 171 0 R 171 0 R 171 0 R 171 0 R 171 0 R 171 0 R 171 0 R 171 0 R 171 0 R 171 0 R 173 0 R 173 0 R 179 0 R 179 0 R 179 0 R 181 0 R 179 0 R 179 0 R 179 0 R 179 0 R 184 0 R 184 0 R 184 0 R 186 0 R 184 0 R 184 0 R 184 0 R 184 0 R 184 0 R 184 0 R 189 0 R 189 0 R 189 0 R 191 0 R 189 0 R 189 0 R 189 0 R 189 0 R 194 0 R 194 0 R 194 0 R 196 0 R 194 0 R 194 0 R 194 0 R 194 0 R 199 0 R 199 0 R 199 0 R 201 0 R 199 0 R 199 0 R 199 0 R 199 0 R 204 0 R 204 0 R 204 0 R 206 0 R 204 0 R 204 0 R 209 0 R 209 0 R 209 0 R 211 0 R 209 0 R 209 0 R 214 0 R 214 0 R 214 0 R 216 0 R 214 0 R 214 0 R 214 0 R 214 0 R 219 0 R 219 0 R 219 0 R 221 0 R 219 0 R 219 0 R 219 0 R 219 0 R 224 0 R 224 0 R 224 0 R 226 0 R 224 0 R 224 0 R 229 0 R 229 0 R 229 0 R 231 0 R 229 0 R 229 0 R 232 0 R] endobj 633 0 obj [244 0 R 244 0 R 244 0 R 248 0 R 252 0 R 252 0 R 256 0 R 256 0 R 256 0 R 258 0 R 256 0 R 256 0 R 261 0 R 261 0 R 261 0 R 263 0 R 264 0 R 264 0 R 264 0 R 264 0 R 264 0 R 264 0 R 264 0 R 264 0 R 264 0 R 264 0 R 264 0 R 264 0 R 264 0 R 264 0 R 264 0 R 264 0 R 264 0 R 264 0 R 266 0 R 266 0 R 266 0 R 266 0 R 266 0 R 266 0 R 266 0 R 266 0 R 266 0 R 266 0 R 266 0 R 266 0 R 266 0 R 266 0 R 266 0 R 268 0 R 268 0 R 268 0 R 268 0 R 268 0 R 268 0 R 268 0 R 268 0 R 268 0 R 268 0 R 270 0 R 274 0 R 274 0 R 274 0 R 274 0 R 274 0 R 274 0 R 274 0 R 274 0 R 274 0 R 274 0 R 274 0 R 274 0 R 274 0 R] endobj 634 0 obj [282 0 R 282 0 R 282 0 R 286 0 R 290 0 R 290 0 R 268 0 R 268 0 R 268 0 R 268 0 R 268 0 R 268 0 R 268 0 R 268 0 R 268 0 R 292 0 R 292 0 R 292 0 R 292 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 294 0 R 296 0 R 296 0 R 296 0 R 296 0 R 296 0 R 296 0 R 296 0 R 298 0 R] endobj 635 0 obj [306 0 R 306 0 R 306 0 R 310 0 R 314 0 R 314 0 R 316 0 R 318 0 R] endobj 636 0 obj [325 0 R 325 0 R 325 0 R 329 0 R 333 0 R 333 0 R 335 0 R] endobj 637 0 obj [342 0 R 342 0 R 342 0 R 346 0 R 350 0 R 350 0 R 352 0 R] endobj 638 0 obj [359 0 R 359 0 R 359 0 R 363 0 R 367 0 R 367 0 R 369 0 R] endobj 639 0 obj [376 0 R 376 0 R 376 0 R 380 0 R 384 0 R 384 0 R 386 0 R] endobj 640 0 obj [393 0 R 393 0 R 393 0 R 397 0 R 401 0 R 401 0 R 403 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 405 0 R 407 0 R 407 0 R 407 0 R 407 0 R 409 0 R 409 0 R 409 0 R 409 0 R 409 0 R 409 0 R 409 0 R 409 0 R 409 0 R 409 0 R 409 0 R 409 0 R 409 0 R 409 0 R 409 0 R 409 0 R 409 0 R 409 0 R 409 0 R 409 0 R 409 0 R 409 0 R] endobj 641 0 obj [418 0 R 418 0 R 418 0 R 422 0 R 426 0 R 426 0 R 428 0 R 430 0 R] endobj 642 0 obj [437 0 R 437 0 R 437 0 R 441 0 R 445 0 R 445 0 R 447 0 R 449 0 R 449 0 R 449 0 R 449 0 R 451 0 R 451 0 R 453 0 R 453 0 R 453 0 R 453 0 R 453 0 R 453 0 R 453 0 R 453 0 R 453 0 R 455 0 R 455 0 R 455 0 R 455 0 R 457 0 R 457 0 R 457 0 R 457 0 R 463 0 R 463 0 R 465 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 463 0 R 468 0 R 468 0 R 470 0 R 468 0 R 468 0 R 468 0 R 468 0 R 468 0 R 468 0 R 468 0 R 468 0 R 468 0 R 468 0 R 468 0 R 468 0 R 468 0 R 473 0 R 473 0 R 475 0 R 473 0 R 473 0 R 473 0 R 473 0 R 473 0 R 473 0 R] endobj 643 0 obj [481 0 R 481 0 R 481 0 R 485 0 R 489 0 R 489 0 R 473 0 R 473 0 R 473 0 R 473 0 R 473 0 R 473 0 R 493 0 R 493 0 R 495 0 R 493 0 R 493 0 R 493 0 R 493 0 R 493 0 R 493 0 R 493 0 R 493 0 R 493 0 R 493 0 R 493 0 R 493 0 R 493 0 R 493 0 R 493 0 R 493 0 R 493 0 R 493 0 R 496 0 R 496 0 R 498 0 R 498 0 R 498 0 R 498 0 R 498 0 R 498 0 R 498 0 R 498 0 R 500 0 R] endobj 644 0 obj [507 0 R 507 0 R 507 0 R 511 0 R 515 0 R 515 0 R 498 0 R 498 0 R 498 0 R 498 0 R 498 0 R 498 0 R 498 0 R 498 0 R 517 0 R 517 0 R 523 0 R 523 0 R 523 0 R 525 0 R 523 0 R 523 0 R 523 0 R 523 0 R 523 0 R 523 0 R 523 0 R 523 0 R 528 0 R 528 0 R 530 0 R 528 0 R 528 0 R 528 0 R 528 0 R 528 0 R 528 0 R 528 0 R 528 0 R 528 0 R 528 0 R 528 0 R 528 0 R 528 0 R 528 0 R 533 0 R 533 0 R 535 0 R 533 0 R 533 0 R 533 0 R 533 0 R 538 0 R 538 0 R 540 0 R 543 0 R 543 0 R 545 0 R 543 0 R 543 0 R 543 0 R 543 0 R 543 0 R 543 0 R 548 0 R 548 0 R 548 0 R 548 0 R 548 0 R 548 0 R 550 0 R 548 0 R 548 0 R 548 0 R 548 0 R 548 0 R 553 0 R 553 0 R 553 0 R 555 0 R 558 0 R 558 0 R 558 0 R 558 0 R 558 0 R 558 0 R 558 0 R 560 0 R 558 0 R 558 0 R 558 0 R 558 0 R 558 0 R 558 0 R 558 0 R 558 0 R 558 0 R 558 0 R 563 0 R 563 0 R 565 0 R 568 0 R 568 0 R 568 0 R 570 0 R 568 0 R 568 0 R 568 0 R 568 0 R 568 0 R 568 0 R 568 0 R 568 0 R 568 0 R 568 0 R 568 0 R 573 0 R 573 0 R 575 0 R 573 0 R 573 0 R 573 0 R 573 0 R 573 0 R 573 0 R 573 0 R 573 0 R 573 0 R 573 0 R 573 0 R 578 0 R 578 0 R 580 0 R 578 0 R 578 0 R 583 0 R 583 0 R 585 0 R 583 0 R 583 0 R 583 0 R 583 0 R 583 0 R 583 0 R 583 0 R 583 0 R 588 0 R 588 0 R 588 0 R 588 0 R 588 0 R 588 0 R 588 0 R 588 0 R 588 0 R 588 0 R 588 0 R 588 0 R 588 0 R 588 0 R 588 0 R 588 0 R 588 0 R 588 0 R 588 0 R] endobj 645 0 obj <> endobj 4 0 obj <>/K 5 0 R>> endobj 646 0 obj << /Dt (D:20210602210925) /JTM (Distiller) >> endobj 647 0 obj /This endobj 648 0 obj << /CP (Distiller) /Fi 647 0 R >> endobj 649 0 obj << /R [ 2400.000 2400.000 ]>> endobj 650 0 obj << /JTF 0 /MB [ 0.000 0.000 603.000 783.000 ]/R 649 0 R /W [ 0 14 ]>> endobj 651 0 obj << /Fi [ 648 0 R ]/P [ 650 0 R ]>> endobj 652 0 obj << /Dm [ 603.000 783.000 603.000 783.000 ]>> endobj 653 0 obj << /Me 652 0 R >> endobj 654 0 obj << /D [ 651 0 R ]/MS 653 0 R /Type /JobTicketContents >> endobj 655 0 obj << /A [ 646 0 R ]/Cn [ 654 0 R ]/V 1.100 >> endobj 3 0 obj <> endobj 656 0 obj <>stream 2021-06-02T21:09:22-06:00 QuarkXPress(R) 16.32 2021-06-02T21:09:22-06:00 Layout 1 Sally Kennedy QuarkXPress(R) 16.32 %%DocumentProcessColors: Cyan Magenta Yellow Black %%EndComments endstream endobj 1 0 obj <>/MarkInfo<>>> endobj 317 0 obj <> endobj 370 0 obj <> endobj 336 0 obj <> endobj 271 0 obj <> endobj 46 0 obj <> endobj 319 0 obj <> endobj 431 0 obj <> endobj 233 0 obj <> endobj 353 0 obj <> endobj 48 0 obj <> endobj 501 0 obj <> endobj 404 0 obj <> endobj 299 0 obj <> endobj 429 0 obj <> endobj 448 0 obj <> endobj 2 0 obj <<>> endobj 387 0 obj <> endobj xref 0 657 0000000000 65535 f 0000520943 00000 n 0000522373 00000 n 0000517365 00000 n 0000516658 00000 n 0000295925 00000 n 0000295360 00000 n 0000488343 00000 n 0000507602 00000 n 0000000000 00000 f 0000507504 00000 n 0000000000 00000 f 0000507447 00000 n 0000000000 00000 f 0000507395 00000 n 0000000000 00000 f 0000507327 00000 n 0000000000 00000 f 0000000016 00000 n 0000507275 00000 n 0000000000 00000 f 0000507213 00000 n 0000000000 00000 f 0000000066 00000 n 0000507161 00000 n 0000000000 00000 f 0000507093 00000 n 0000000000 00000 f 0000000116 00000 n 0000506970 00000 n 0000000000 00000 f 0000506862 00000 n 0000000000 00000 f 0000506750 00000 n 0000000000 00000 f 0000506704 00000 n 0000000000 00000 f 0000506646 00000 n 0000000000 00000 f 0000506592 00000 n 0000000000 00000 f 0000506534 00000 n 0000000000 00000 f 0000506236 00000 n 0000000000 00000 f 0000000166 00000 n 0000521498 00000 n 0000000238 00000 n 0000521893 00000 n 0000506190 00000 n 0000000000 00000 f 0000506132 00000 n 0000000000 00000 f 0000506086 00000 n 0000000000 00000 f 0000506037 00000 n 0000000000 00000 f 0000505991 00000 n 0000000000 00000 f 0000505937 00000 n 0000000000 00000 f 0000000310 00000 n 0000019569 00000 n 0000482324 00000 n 0000485215 00000 n 0000485820 00000 n 0000486384 00000 n 0000486836 00000 n 0000486999 00000 n 0000487382 00000 n 0000295984 00000 n 0000426098 00000 n 0000426248 00000 n 0000491803 00000 n 0000488565 00000 n 0000505891 00000 n 0000000000 00000 f 0000505838 00000 n 0000000000 00000 f 0000505792 00000 n 0000000000 00000 f 0000505744 00000 n 0000000000 00000 f 0000505698 00000 n 0000000000 00000 f 0000505647 00000 n 0000000000 00000 f 0000505557 00000 n 0000000000 00000 f 0000505439 00000 n 0000000000 00000 f 0000505381 00000 n 0000000000 00000 f 0000505287 00000 n 0000000000 00000 f 0000505151 00000 n 0000000000 00000 f 0000504957 00000 n 0000000000 00000 f 0000504839 00000 n 0000000000 00000 f 0000504776 00000 n 0000000000 00000 f 0000504699 00000 n 0000000000 00000 f 0000504643 00000 n 0000000000 00000 f 0000504566 00000 n 0000000000 00000 f 0000019762 00000 n 0000504510 00000 n 0000000000 00000 f 0000504325 00000 n 0000000000 00000 f 0000019816 00000 n 0000504277 00000 n 0000000000 00000 f 0000504160 00000 n 0000000000 00000 f 0000019870 00000 n 0000037880 00000 n 0000487549 00000 n 0000488790 00000 n 0000504112 00000 n 0000000000 00000 f 0000504056 00000 n 0000000000 00000 f 0000504008 00000 n 0000000000 00000 f 0000503957 00000 n 0000000000 00000 f 0000503909 00000 n 0000000000 00000 f 0000503855 00000 n 0000000000 00000 f 0000503799 00000 n 0000000000 00000 f 0000503727 00000 n 0000000000 00000 f 0000038035 00000 n 0000503671 00000 n 0000000000 00000 f 0000503599 00000 n 0000000000 00000 f 0000038089 00000 n 0000503543 00000 n 0000000000 00000 f 0000503483 00000 n 0000000000 00000 f 0000038143 00000 n 0000503417 00000 n 0000000000 00000 f 0000503356 00000 n 0000000000 00000 f 0000503300 00000 n 0000000000 00000 f 0000503204 00000 n 0000000000 00000 f 0000038197 00000 n 0000503148 00000 n 0000000000 00000 f 0000503052 00000 n 0000000000 00000 f 0000038251 00000 n 0000502996 00000 n 0000000000 00000 f 0000502921 00000 n 0000000000 00000 f 0000038305 00000 n 0000502867 00000 n 0000000000 00000 f 0000502774 00000 n 0000000000 00000 f 0000502720 00000 n 0000000000 00000 f 0000502579 00000 n 0000000000 00000 f 0000502523 00000 n 0000000000 00000 f 0000502448 00000 n 0000000000 00000 f 0000038359 00000 n 0000502392 00000 n 0000000000 00000 f 0000502304 00000 n 0000000000 00000 f 0000038413 00000 n 0000502248 00000 n 0000000000 00000 f 0000502166 00000 n 0000000000 00000 f 0000038468 00000 n 0000502110 00000 n 0000000000 00000 f 0000502028 00000 n 0000000000 00000 f 0000038523 00000 n 0000501972 00000 n 0000000000 00000 f 0000501890 00000 n 0000000000 00000 f 0000038578 00000 n 0000501834 00000 n 0000000000 00000 f 0000501760 00000 n 0000000000 00000 f 0000038633 00000 n 0000501704 00000 n 0000000000 00000 f 0000501630 00000 n 0000000000 00000 f 0000038688 00000 n 0000501574 00000 n 0000000000 00000 f 0000501492 00000 n 0000000000 00000 f 0000038743 00000 n 0000501436 00000 n 0000000000 00000 f 0000501354 00000 n 0000000000 00000 f 0000038798 00000 n 0000501298 00000 n 0000000000 00000 f 0000501224 00000 n 0000000000 00000 f 0000038853 00000 n 0000501168 00000 n 0000000000 00000 f 0000501094 00000 n 0000000000 00000 f 0000038908 00000 n 0000038963 00000 n 0000521743 00000 n 0000039039 00000 n 0000059565 00000 n 0000482534 00000 n 0000483206 00000 n 0000483917 00000 n 0000484863 00000 n 0000487720 00000 n 0000489016 00000 n 0000501046 00000 n 0000000000 00000 f 0000500990 00000 n 0000000000 00000 f 0000500942 00000 n 0000000000 00000 f 0000500891 00000 n 0000000000 00000 f 0000500843 00000 n 0000000000 00000 f 0000500789 00000 n 0000000000 00000 f 0000500733 00000 n 0000000000 00000 f 0000500667 00000 n 0000000000 00000 f 0000059765 00000 n 0000500611 00000 n 0000000000 00000 f 0000500548 00000 n 0000000000 00000 f 0000059818 00000 n 0000500446 00000 n 0000000000 00000 f 0000500353 00000 n 0000000000 00000 f 0000499991 00000 n 0000000000 00000 f 0000059872 00000 n 0000521415 00000 n 0000499943 00000 n 0000000000 00000 f 0000499854 00000 n 0000000000 00000 f 0000059947 00000 n 0000081031 00000 n 0000484344 00000 n 0000489242 00000 n 0000499806 00000 n 0000000000 00000 f 0000499750 00000 n 0000000000 00000 f 0000499702 00000 n 0000000000 00000 f 0000499651 00000 n 0000000000 00000 f 0000499603 00000 n 0000000000 00000 f 0000499549 00000 n 0000000000 00000 f 0000499489 00000 n 0000000000 00000 f 0000499366 00000 n 0000000000 00000 f 0000499297 00000 n 0000000000 00000 f 0000081219 00000 n 0000522129 00000 n 0000081294 00000 n 0000103995 00000 n 0000484506 00000 n 0000489468 00000 n 0000499249 00000 n 0000000000 00000 f 0000499193 00000 n 0000000000 00000 f 0000499145 00000 n 0000000000 00000 f 0000499094 00000 n 0000000000 00000 f 0000499046 00000 n 0000000000 00000 f 0000498992 00000 n 0000000000 00000 f 0000104194 00000 n 0000521166 00000 n 0000104268 00000 n 0000521580 00000 n 0000104342 00000 n 0000121765 00000 n 0000489694 00000 n 0000498944 00000 n 0000000000 00000 f 0000498888 00000 n 0000000000 00000 f 0000498840 00000 n 0000000000 00000 f 0000498789 00000 n 0000000000 00000 f 0000498741 00000 n 0000000000 00000 f 0000498687 00000 n 0000000000 00000 f 0000121917 00000 n 0000521332 00000 n 0000121991 00000 n 0000139134 00000 n 0000489920 00000 n 0000498639 00000 n 0000000000 00000 f 0000498583 00000 n 0000000000 00000 f 0000498535 00000 n 0000000000 00000 f 0000498484 00000 n 0000000000 00000 f 0000498436 00000 n 0000000000 00000 f 0000498382 00000 n 0000000000 00000 f 0000139286 00000 n 0000521816 00000 n 0000139360 00000 n 0000159685 00000 n 0000490146 00000 n 0000498334 00000 n 0000000000 00000 f 0000498278 00000 n 0000000000 00000 f 0000498230 00000 n 0000000000 00000 f 0000498179 00000 n 0000000000 00000 f 0000498131 00000 n 0000000000 00000 f 0000498077 00000 n 0000000000 00000 f 0000159837 00000 n 0000521251 00000 n 0000159911 00000 n 0000176147 00000 n 0000490372 00000 n 0000498029 00000 n 0000000000 00000 f 0000497973 00000 n 0000000000 00000 f 0000497925 00000 n 0000000000 00000 f 0000497874 00000 n 0000000000 00000 f 0000497826 00000 n 0000000000 00000 f 0000497772 00000 n 0000000000 00000 f 0000176299 00000 n 0000522393 00000 n 0000176373 00000 n 0000195172 00000 n 0000490599 00000 n 0000497724 00000 n 0000000000 00000 f 0000497668 00000 n 0000000000 00000 f 0000497620 00000 n 0000000000 00000 f 0000497569 00000 n 0000000000 00000 f 0000497521 00000 n 0000000000 00000 f 0000497467 00000 n 0000000000 00000 f 0000195324 00000 n 0000522049 00000 n 0000497326 00000 n 0000000000 00000 f 0000497266 00000 n 0000000000 00000 f 0000497152 00000 n 0000000000 00000 f 0000195398 00000 n 0000212182 00000 n 0000492044 00000 n 0000491942 00000 n 0000490827 00000 n 0000497104 00000 n 0000000000 00000 f 0000497048 00000 n 0000000000 00000 f 0000497000 00000 n 0000000000 00000 f 0000496949 00000 n 0000000000 00000 f 0000496901 00000 n 0000000000 00000 f 0000496847 00000 n 0000000000 00000 f 0000212381 00000 n 0000522213 00000 n 0000212455 00000 n 0000521664 00000 n 0000212529 00000 n 0000243239 00000 n 0000491055 00000 n 0000496799 00000 n 0000000000 00000 f 0000496743 00000 n 0000000000 00000 f 0000496695 00000 n 0000000000 00000 f 0000496644 00000 n 0000000000 00000 f 0000496596 00000 n 0000000000 00000 f 0000496542 00000 n 0000000000 00000 f 0000243391 00000 n 0000522292 00000 n 0000496485 00000 n 0000000000 00000 f 0000496431 00000 n 0000000000 00000 f 0000496356 00000 n 0000000000 00000 f 0000496296 00000 n 0000000000 00000 f 0000496236 00000 n 0000000000 00000 f 0000496167 00000 n 0000000000 00000 f 0000496111 00000 n 0000000000 00000 f 0000495955 00000 n 0000000000 00000 f 0000243465 00000 n 0000495899 00000 n 0000000000 00000 f 0000495800 00000 n 0000000000 00000 f 0000243519 00000 n 0000495744 00000 n 0000000000 00000 f 0000495478 00000 n 0000000000 00000 f 0000243573 00000 n 0000243627 00000 n 0000260825 00000 n 0000491283 00000 n 0000495430 00000 n 0000000000 00000 f 0000495374 00000 n 0000000000 00000 f 0000495326 00000 n 0000000000 00000 f 0000495275 00000 n 0000000000 00000 f 0000495227 00000 n 0000000000 00000 f 0000495173 00000 n 0000000000 00000 f 0000495117 00000 n 0000000000 00000 f 0000495003 00000 n 0000000000 00000 f 0000260991 00000 n 0000494949 00000 n 0000000000 00000 f 0000494625 00000 n 0000000000 00000 f 0000261045 00000 n 0000521969 00000 n 0000261120 00000 n 0000277851 00000 n 0000491511 00000 n 0000494577 00000 n 0000000000 00000 f 0000494521 00000 n 0000000000 00000 f 0000494473 00000 n 0000000000 00000 f 0000494422 00000 n 0000000000 00000 f 0000494374 00000 n 0000000000 00000 f 0000494320 00000 n 0000000000 00000 f 0000494266 00000 n 0000000000 00000 f 0000494125 00000 n 0000000000 00000 f 0000494069 00000 n 0000000000 00000 f 0000493982 00000 n 0000000000 00000 f 0000278025 00000 n 0000493926 00000 n 0000000000 00000 f 0000493824 00000 n 0000000000 00000 f 0000278079 00000 n 0000493768 00000 n 0000000000 00000 f 0000493696 00000 n 0000000000 00000 f 0000278133 00000 n 0000493640 00000 n 0000000000 00000 f 0000493580 00000 n 0000000000 00000 f 0000278187 00000 n 0000493524 00000 n 0000000000 00000 f 0000493446 00000 n 0000000000 00000 f 0000278241 00000 n 0000493390 00000 n 0000000000 00000 f 0000493303 00000 n 0000000000 00000 f 0000278295 00000 n 0000493247 00000 n 0000000000 00000 f 0000493184 00000 n 0000000000 00000 f 0000278349 00000 n 0000493128 00000 n 0000000000 00000 f 0000493023 00000 n 0000000000 00000 f 0000278403 00000 n 0000492967 00000 n 0000000000 00000 f 0000492907 00000 n 0000000000 00000 f 0000278457 00000 n 0000492851 00000 n 0000000000 00000 f 0000492741 00000 n 0000000000 00000 f 0000278512 00000 n 0000492685 00000 n 0000000000 00000 f 0000492579 00000 n 0000000000 00000 f 0000278567 00000 n 0000492523 00000 n 0000000000 00000 f 0000492453 00000 n 0000000000 00000 f 0000278622 00000 n 0000492397 00000 n 0000000000 00000 f 0000492303 00000 n 0000000000 00000 f 0000278677 00000 n 0000492255 00000 n 0000000000 00000 f 0000492129 00000 n 0000000000 00000 f 0000278732 00000 n 0000295215 00000 n 0000487885 00000 n 0000426396 00000 n 0000426602 00000 n 0000427128 00000 n 0000427455 00000 n 0000430900 00000 n 0000431417 00000 n 0000436489 00000 n 0000436891 00000 n 0000441154 00000 n 0000441351 00000 n 0000441581 00000 n 0000441830 00000 n 0000442684 00000 n 0000442906 00000 n 0000442967 00000 n 0000444630 00000 n 0000444838 00000 n 0000454043 00000 n 0000454252 00000 n 0000462248 00000 n 0000462454 00000 n 0000469599 00000 n 0000469785 00000 n 0000471970 00000 n 0000472164 00000 n 0000475751 00000 n 0000475959 00000 n 0000477710 00000 n 0000477901 00000 n 0000478635 00000 n 0000478841 00000 n 0000480428 00000 n 0000480637 00000 n 0000485003 00000 n 0000488052 00000 n 0000491739 00000 n 0000491765 00000 n 0000507941 00000 n 0000509248 00000 n 0000510579 00000 n 0000511982 00000 n 0000512585 00000 n 0000513020 00000 n 0000513103 00000 n 0000513178 00000 n 0000513253 00000 n 0000513328 00000 n 0000513403 00000 n 0000513942 00000 n 0000514025 00000 n 0000514764 00000 n 0000515135 00000 n 0000516474 00000 n 0000516808 00000 n 0000516871 00000 n 0000516895 00000 n 0000516946 00000 n 0000516993 00000 n 0000517080 00000 n 0000517132 00000 n 0000517194 00000 n 0000517229 00000 n 0000517304 00000 n 0000517652 00000 n trailer << /Size 657 /Root 1 0 R /Info 3 0 R /ID[] >> startxref 522472 %%EOF