Anecdotes

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission

ID.IM-01: Improvements are identified from evaluations

ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties

ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities

ID.IM-04: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved

7.10 Storage media - Storage media shall be managed through their life cycle of acquisition, use, transportation, and disposal in accordance with the organization's classification scheme and handling requirements.

7.2 Physical entry - Secure areas shall be protected by appropriate entry controls and access points.

7.3 Securing offices, rooms, and facilities - Physical security for offices, rooms, and facilities shall be designed and implemented.

7.4 Physical security monitoring - Premises shall be continuously monitored for unauthorized physical access.

7.5 Protecting against physical and environmental threats - Protection against physical and environmental threats, such as natural disasters and other intentional or unintentional physical threats to infrastructure shall be designed and implemented.

7.6 Working in secure areas - Procedures for working in secure areas shall be designed and implemented.

7.7 Clear desk and clear screen - Clear desk rules for papers and removable storage media and clear screen rules for information processing facilities shall be defined and appropriately enforced.

7.9 Security of assets off premises - Off-site assets shall be protected.

Establish and Maintain Detailed Enterprise Asset Inventory

Establish and Maintain a Data Inventory

Establish and Maintain a Data Classification Scheme

Document Data Flows

Establish and Maintain an Inventory of Service Providers