AlienVault OTX

Logged alerts are reviewed and investigated as needed to identify, respond to, and mitigate suspicious or malicious activity.

AWS is configured for security logging, alerting and monitoring for potential threats.

A formal risk management process is established to evaluate risks based on identified threats and specified tolerances. This process includes defining risk assessment methodologies, risk categories, and evaluation criteria.

Risk assessments are performed at least annually during security committee management meetings and include evaluations of the following: -Organizational structure, capability, capacity, reporting lines, authorities, and responsibilities. -Environmental, regulatory, and technological changes that have occurred. -The need for additional tools and resources to achieve business objectives. -Threats and vulnerabilities affecting the achievement of commitments to clients.

Results of the risk assessment, including identified risks and recommended actions, are communicated to the respective owners to ensure accountability for addressing risks.

Identified risks and associated action items are documented and tracked through an ongoing risk register to monitor progress and ensure timely resolution.

ID.AM-01: Inventories of hardware managed by the organization are maintained

ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained

ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained

ID.AM-05: Assets are prioritized based on classification, criticality, resources, and impact on the mission

ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained

ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles

5.26 Response to information security incidents - Information security incidents shall be responded to in accordance with the documented procedures.

5.27 Learning from information security incidents - Knowledge gained from information security incidents shall be used to strengthen and improve the information security controls.

Training 5 - Does training include explaining security event reporting - who to contact and what to do in case of suspicious activity?

Training 6 - Is there ongoing training or communication regarding security awareness and requirements for all staff?

Training 1 - Are all workforce members (including managers) given cyber, digital, and/or information security training, at least annually?

Training 2 - Are all workforce members given email phishing training regularly (monthly or quarterly)?

Training 4 - Does training include password security, safeguarding passwords, compromised passwords, and how to create and change passwords.

Training 3 - Are training sessions recorded or logged for each employee or staff member?

Outlines ICT governance roles for senior management.

Details structural organization to manage ICT risk.