Action1 RMM

Administering User Accounts (12.5.4)

Managing PCI DSS Requirements by Service Providers (12.8.5)

Removing Unnecessary Functionality (2.2.5)

Monitoring and Controlling All Access to Data (12.5.5)

Developing Configuration Standards for All System Components (2.2)

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

GV.OC-04: Critical objectives, capabilities, and services that stakeholders depend on or expect from the organization are understood and communicated

GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks

GV.OV-03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed

ID.AM-01: Inventories of hardware managed by the organization are maintained

ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained

ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles

RC.RP-02: Recovery actions are selected, scoped, prioritized, and performed

RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration

RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident

RS.AN-06: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved

RS.AN-07: Incident data and metadata are collected, and their integrity and provenance are preserved

5.15 Access Control - Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.

5.18 Access Rights - Access rights to information and other associated assets shall be provisioned, reviewed, modified, and removed in accordance with the organization's topic-specific policy on and rules for access control.

5.23 Information security for use of cloud services - Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organization's information security requirements.

5. 24 Information security incident management planning and preparation - The organization shall plan and prepare for managing information security incidents by defining, establishing, and communicating information security incident management processes, roles, and responsibilities.

6.3 Information security awareness, education , and training - Personnel of the organization and relevant interested parties shall receive appropriate information security awareness, education and training and regular updates of the organization's information security policy, topic-specific policies, and procedures, as relevant for their job function.

6.7 Remote Working - Security measures shall be implemented when personnel are working remotely to protect information accessed, processed, or stored outside the organization's premises.

Creates an EU-level oversight structure for critical vendors.

Criteria used to designate providers as critical.

Grants oversight authorities various supervisory rights.

Configure Automatic Anti-Malware Signature Updates

Centrally Manage Anti-Malware Software

Ensure Network Infrastructure is Up-to-Date

Establish and Maintain a Secure Network Architecture

Centralize Network Authentication, Authorization, and Auditing (AAA)

Use of Secure Network Management and Communication Protocols

Manage Access Control for Remote Assets