42Gears

Scanning Due to Significant Change (11.2.3)

Intrusion-detection/intrusion-prevention (11.4)

Correcting Exploitable Vulnerabilities (11.3.3)

Vulnerability Scanning (11.2)

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

All system change requests are formally documented, including a description of the change, justification, and affected systems or components.

System change requests are reviewed and approved by management to ensure alignment with business objectives and security requirements.

All required documentation and testing, as specified in the Change Management Policy, are completed and evidenced for each request before changes are released to production.

All system changes, including their review, approval, and evidence of adherence to the Change Management Policy, are documented in Jira to maintain a centralized and auditable record.

Emergency changes follow the same Change Management procedures as standard changes. However, if full change management testing and documentation cannot be performed prior to release, these requirements must be met within one week post-implementation.

DE.CM-01: Networks and network services are monitored to find potentially adverse events

DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events

DE.CM-06: External service provider activities and services are monitored to find potentially adverse events

ID.IM-01: Improvements are identified from evaluations

ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties

ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities

ID.IM-04: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved

RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared

RS.MA-03: Incidents are categorized and prioritized

RS.MA-04: Incidents are escalated or elevated as needed

RS.MA-05: The criteria for initiating incident recovery are applied

8.15 Logging - Logs that record activities, exceptions, faults, and other relevant events shall be produced, stored, protected, and analyzed.

8.16 Monitoring activities - Networks, systems, and applications shall be monitored for anomalous behavior and appropriate actions taken to evaluate potential information security incidents.

8.22 Segregation of networks - Groups of information services, users, and information systems shall be segregated in the organization's networks.

8.24 Use of cryptography - Rules for the effective use of cryptography, including cryptographic key management, shall be defined, and implemented.

3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?

3rd Party Access Controls 1 - Are unique credentials used for 3rd party, partner, contractor, and/or vendor access to systems that connect to the organization's domain?

Creates an EU-level oversight structure for critical vendors.

Criteria used to designate providers as critical.

Defines the obligations of designated providers.

Defines ESAs??? supervisory and coordinating roles.

Clarifies ECB involvement in oversight activities.

Establish and Maintain a Data Recovery Process

Establish and Maintain a Service Provider Management Policy

Classify Service Providers

Ensure Service Provider Contracts Include Security Requirements

Assess Service Providers

Monitor Service Providers

Establish and Maintain Contact Information for Reporting Security Incidents

Establish and Maintain an Enterprise Process for Reporting Incidents

Establish and Maintain an Incident Response Process