Showing 14 controls
Cloud Security
Understanding of the shared responsibility model, applying the same principles of IAM, network, and data protection, threat detection, and response
Data Protection and Privacy
Encryption (in transit and at rest), audit trails, privacy by design (data minimization at least), GDPR compliance
Disaster Recovery & Backup
Offline or immutable backups, performed and tested, protocols and playbooks for disaster recovery documented and tested, cyber resiliency strategy documented and known
Endpoint Protection
Antivirus/Antimalware, EDR, MDM, Application Control, quarantaine management, email and browsing security
IAM/PAM
Identity federation, SSO and MFA, group-based access management, secrets management, AD hardening, IAM aligned with onboarding and offboarding processes
Inventory
Hardware and software components listed, regular controls and audits, lifecycle management, categorization, visibility, and continuous improvement
Network Protection
Network segmentation, Firewall, IDS, Remote Access Control (VPN and/or ZTNA), WAF, NAC, and Wireless Security
Physical Security
Facility access control, surveillance, security personnel, visitor management, locks and safes, emergency response, secure disposal
Risk, Governance and Regulation
Risk analysis, assigned personnel, management involvement, regulatory framework identification, independent audit
Security Detection and Response
Aggregation of events for inspection and correlation, logs protection, tooling and processes for timely incident response involving relevant stakeholders
Software Security
Application security and DevSecOps principles, threat modelling, use standard libraries, software factory security through gates (SAST, SCA, secret leaks, DAST)
Third-Party Risk Management
Vendor management, exit strategy, privileged communication channels, decoupling, incident management, contract management
Training
General cybersecurity awareness, specialized training, campaigns to check for efficiency
Vulnerability Management
Identification on all workloads and assets, monitoring and communication, triage and prioritization processes, continuous patching, periodic checkpoints