Autotask Endpoint Management

Maintaining Up-to-date Device Lists (9.9.1)

Securing Cryptographic Key Storage (3.6.3)

Segregate Cardholder Data Environment on Internal Network Zone (1.3.6)

Access and Authentication with Disk Encryption (3.4.1)

Restricting Inbound and Outbound Traffic (1.2.1)

Minimizing Cardholder Data Storage (3.1)

Physically Securing Media (9.5)

Policies and Procedures for Protecting Against Malware (5.4)

Anti-virus Maintenance (5.2)

Current Network Diagram (1.1.2)

Monitoring Physical Access (9.1.1)

Managing PAN Data Storage (3.4)

GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving

GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

GV.RR-04: Cybersecurity is included in human resources practices

RC.CO-03: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders

RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging

RS.MI-01: Incidents are contained

RS.MI-02: Incidents are eradicated

5.15 Access Control - Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.

5.16 Identity Management - The full lifecycle of identities shall be managed.

5.19 Information Security in Supplier relationships - Processes and procedures shall be defined and implemented to manage the information security risks associated with the use of suppliers' products or services.

5. 24 Information security incident management planning and preparation - The organization shall plan and prepare for managing information security incidents by defining, establishing, and communicating information security incident management processes, roles, and responsibilities.

5.34 Privacy and Protection of PII - The organization shall identify and meet the requirements regarding preservation of privacy and protection of PII according to applicable laws and regulations and contractual requirements.

Have you designed and implemented information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures?

Have you?implemented multi-factor authentication for any individual accessing any information system, unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls?

Do you Design and implement safeguards to Limit authorized users' access only to customer information that they need to perform their duties or, in the case of customers, to access their own information?

Have you developed, implemented, and currently maintain procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used in connection with the provision of a product or service to the customer to which it relates?

Do you Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest?

Do you regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures, including those to detect actual and attempted attacks on, or intrusions into, information systems?

54

Utilize an Active Discovery Tool

Utilize Automated Software Inventory Tools

Use Behavior-Based Anti-Malware Software

How does the board monitor the organization's compliance with relevant cybersecurity regulations and standards? (Monitoring compliance with regulations)

Are regular internal or external cybersecurity audits or assessments conducted, and how are the findings communicated and addressed? (Frequency and follow-up on cybersecurity audits)

What measures are in place to assess and manage cybersecurity risks at the organizational level? (Existence and effectiveness of risk assessment measures)

How does the organization monitor and ensure compliance with relevant regulations? (Regulatory Compliance Failure)

Authorize, design, develop, implement, operate, approve, and document changes to infrastructure, data, software, and procedures.