Adaptive Shield

Prevention of Unauthorized Substitution of Cryptographic Keys (3.6.7)

Security Policies and Procedures for Managing Vendor Defaults (2.5)

Securing Cryptographic Key Distribution (3.6.2)

Clear-text Cryptographic Key Management (3.6.6)

Information Security Responsibilities (12.4)

Securing Cryptographic Key Storage (3.6.3)

Establish, Publish, Maintain, and Disseminate a Security Policy (12.1)

Removing Unnecessary Functionality (2.2.5)

Risk-assessment Process (12.2)

Document and Implement Key Management Processes and Procedures (3.6)

Enabling Only Necessary Services (2.2.2)

Protecting Keys Used in Storing Cardholder Data (3.5)

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission

Rules for reporting major ICT-related incidents.

Specifies deadlines and required content for incident reports.

Address Unauthorized Assets

Utilize an Active Discovery Tool

Log Sensitive Data Access

Establish and Maintain a Service Provider Management Policy

Designate Personnel to Manage Incident Handling

Establish and Maintain an Enterprise Process for Reporting Incidents

Assign Key Roles and Responsibilities

Define Mechanisms for Communicating During Incident Response

Cloud service customers must ensure that public-facing domain ownership, registrar controls, and DNS management are governed with documented accountability.