8x8

MFA for remote access (8.3.2)

Verifying User Identities (8.2.2)

User Authentication Management (8.2)

Lockout Duration (8.1.7)

User ID Management (8.1.2)

Policies and Procedures for User Identification Management (8.1)

Revoking Access for Terminated Users (8.1.3)

Removing/disabling Inactive User Accounts (8.1.4)

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

GV.OC-04: Critical objectives, capabilities, and services that stakeholders depend on or expect from the organization are understood and communicated

RS.MI-01: Incidents are contained

RS.MI-02: Incidents are eradicated

System Monitoring - Are organization systems monitored for events or issues with an alerting or notification system?

Practice - Vendor and Business Associate List - Provide a full and detailed list of the practice's vendors and business associates with: representative contact informationwhether the vendor provides cloud or other servicesscope of the service provided (application, supplies, equipment, etc)systems (

Practice - Asset List - Provide a full asset list for practice owned computing devices and owned or leased network devices.

Practice point of contact information - What is the title or role, the phone number, and the email contact for the point of contact of the practice?

Practice Name, address, and primary phone - Practice name, primary address, and primary phone number.

Information Technology Responsibilities - Is the party responsible for Information Technology (IT) internal to the organization, or a contracted IT support firm (MSP)?

Remediation Documentation - Provide documentation of planned or on-going remediation from recent assessments. This may include Corrective Action Plans, remediation plans, or checklists that address identified vulnerabilities found in recent SRAs.

Practice Point of Contact - Who is the primary point of contact for the Practice?

Expands the Solvency II framework to address digital resilience in insurance.