Agari

RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process

RC.RP-02: Recovery actions are selected, scoped, prioritized, and performed

RC.RP-04: Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms

5.1 Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to, and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur

5.34 Privacy and Protection of PII - The organization shall identify and meet the requirements regarding preservation of privacy and protection of PII according to applicable laws and regulations and contractual requirements.

Do you oversee service providers by taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue?

Do you currently Oversee service providers, by: Requiring your service providers by contract to implement and maintain such safeguards?

Do you oversee service providers by periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards?

Do you oversee service providers by requiring your service providers by contract to implement and maintain such safeguards?

If this is a service provider or affiliate, do you require the service provider or affiliate to maintain an information security program that protects you in accordance with the requirements?

Do you currently Oversee service providers, by: Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue?

Mandates risk controls for ICT third-party services.

Providers must be vetted prior to engagement.

Entities must monitor provider performance regularly.