Archer

Maintaining a List of Service Providers (12.8.1)

Staff Training for Breach Response (12.10.4)

Information Security Responsibilities (12.4)

Administering User Accounts (12.5.4)

Verifying Personnel Understands Security Policies and Procedures (12.6.2)

Managing PCI DSS Requirements by Service Providers (12.8.5)

Personnel Education (12.6.1)

Risk-assessment Process (12.2)

Security Awareness Program (12.6)

GV.OC-01: The organizational mission is understood and informs cybersecurity risk management

GV.OC-04: Critical objectives, capabilities, and services that stakeholders depend on or expect from the organization are understood and communicated

GV.OC-05: Outcomes, capabilities, and services that the organization depends on are understood and communicated

RS.CO-02: Internal and external stakeholders are notified of incidents

RS.CO-03: Information is shared with designated internal and external stakeholders

Does the monitoring and testing include continuous monitoring or periodic penetration testing and vulnerability assessments?

Do you conduct Annual penetration testing of your information systems, determined each give year based on relevant identified rusisk in accordance with the risk assessment?

Do you Evaluate and adjust your IS program in light of the results of the testing and monitoring including any material changes to your operations or business arrangements or any other circumstances that you know or have reason to know may have a material impact on your IS program?

Do you conduct vulnerability assessments whenever there are material changes to your operations or business arrangements and whenever there are circumstances you know or have reason to know may have a material impact on your information security program?