Map your controls to Israel's ICDM with less manual work

The ICDM is the Israel National Cyber Directorate's framework for protecting organisations against cyber threats. Version 1.0, titled Cyber Defense Methodology for an Organization, was published in June 2017. It adopts the NIST Cybersecurity Framework, groups its controls into 25 families such as access control, network security and business continuity, and grades each control from level 1 to level 4 so protection matches the potential for damage.

Not for most businesses. The document presents itself as a recommendation for all Israeli organisations. However, the Israeli government adopted it in 2018 as the required cyber risk methodology for its offices, the environmental protection sector built it into requirements for companies handling hazardous materials, and organisations can require their suppliers to meet its category B controls. Check whether your regulator or customer contracts reference it.

Category A organisations have low damage potential: a cyber incident would cost no more than NIS 500,000 to handle. They follow a short, simplified set of protection categories. Category B organisations would face costs above NIS 500,000 and must carry out a fuller process of asset mapping, risk assessment and control selection across the 25 families. Regulatory obligations can move an organisation from category A to B.

The ICDM is built on the NIST Cybersecurity Framework: its 25 families sit under the Identify, Protect, Detect, Respond and Recover functions, and most controls derive from NIST SP 800-53. Version 1.0 also includes an appendix showing compatibility with ISO 27001. An organisation with a mature ISO 27001 or NIST CSF programme will already meet a large share of the ICDM's controls.

Yes. The Israel National Cyber Directorate published ICDM 2.0 in 2021, which updates the control set and draws on more recent NIST guidance. Version 1.0 remains useful where a customer, contract or internal programme still references it, but organisations starting fresh should confirm which version their regulator or customer expects before scoping work.

Start by deciding whether you are a category A or category B organisation. Category B organisations then map their information assets, assess the damage potential of each, and implement the controls at the matching level, from level 1 basics through to level 4. Controls cover governance, risk, technical protection, monitoring, incident handling and business continuity, with periodic review of the programme.

Version 1.0 does not define a formal certification. The 2017 document is a self-assessment methodology for building a multi-year protection plan, and INCD has described plans for a national certification scheme separately. Organisations typically demonstrate alignment through internal assessment, independent review or customer audits. OneClickComply does not issue certifications.

The ICDM is mapped in OneClickComply's control library and available on request; it is not yet a self-serve framework in the platform. Because the mapping links ICDM families to the same controls used for ISO 27001, NIST CSF and SOC 2, evidence you already collect can count towards it. Contact us to enable it and talk to our audit team about scoping.