Alloy Navigator

Documentation of All Services, Protocols, and Ports Allowed (1.1.6)

Documenting Security Policies and Firewall Management (1.5)

Current Network Diagram (1.1.2)

GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes

GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties

GV.SC-04: Suppliers are known and prioritized by criticality

GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships

5.1 Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to, and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur

5.11 Return of Assets - Personnel and other interested parties as appropriate shall return all the organization's assets in their possession upon change or termination of their employment, contract, or agreement.

5.12 Classification of Assets - Information shall be classified according to the information security needs of the organization based on confidentiality, integrity, availability, and relevant interested party requirements.

5.18 Access Rights - Access rights to information and other associated assets shall be provisioned, reviewed, modified, and removed in accordance with the organization's topic-specific policy on and rules for access control.

5. 24 Information security incident management planning and preparation - The organization shall plan and prepare for managing information security incidents by defining, establishing, and communicating information security incident management processes, roles, and responsibilities.

5.26 Response to information security incidents - Information security incidents shall be responded to in accordance with the documented procedures.

5.28 Collection of evidence - The organization shall establish and implement procedures for the identification, collection, acquisition, and preservation of evidence related to information security events

5.34 Privacy and Protection of PII - The organization shall identify and meet the requirements regarding preservation of privacy and protection of PII according to applicable laws and regulations and contractual requirements.

Rules for reporting major ICT-related incidents.

Specifies deadlines and required content for incident reports.

Creates an EU-level oversight structure for critical vendors.

Criteria used to designate providers as critical.

Defines the obligations of designated providers.

Establish and maintain a configuration management database (CMDB) to contain relevant information about configuration items.

Utilize an Active Discovery Tool

Use a Passive Asset Discovery Tool

Log Sensitive Data Access

How does the board monitor the organization's compliance with relevant cybersecurity regulations and standards? (Monitoring compliance with regulations)

Are regular internal or external cybersecurity audits or assessments conducted, and how are the findings communicated and addressed? (Frequency and follow-up on cybersecurity audits)

How frequently does the board receive updates on the organization's current cyber threat landscape and potential vulnerabilities? (Frequency of threat landscape updates)

What measures are in place to assess and manage cybersecurity risks at the organizational level? (Existence and effectiveness of risk assessment measures)

How does the organization ensure that employees receive adequate training on cybersecurity risks and best practices? (Employee training on cybersecurity)

How does the organization monitor and ensure compliance with relevant regulations? (Regulatory Compliance Failure)