Azure Cost Management

Maintaining a List of Service Providers (12.8.1)

Managing PCI DSS Requirements by Service Providers (12.8.5)

Personnel Education (12.6.1)

DE.AE-02: Potentially adverse events are analyzed to better understand associated activities

DE.AE-03: Information is correlated from multiple sources

DE.AE-04: The estimated impact and scope of adverse events are understood

Does the monitoring and testing include continuous monitoring or periodic penetration testing and vulnerability assessments?

Do you conduct Annual penetration testing of your information systems, determined each give year based on relevant identified rusisk in accordance with the risk assessment?

Do you conduct vulnerability assessments including any system scans or reviews of systems resonably designed to identify publicly known security vulnerabilities in your information system based on the risk assessment at lease every six months?

Do you Evaluate and adjust your IS program in light of the results of the testing and monitoring including any material changes to your operations or business arrangements or any other circumstances that you know or have reason to know may have a material impact on your IS program?

Do you conduct vulnerability assessments whenever there are material changes to your operations or business arrangements and whenever there are circumstances you know or have reason to know may have a material impact on your information security program?

Brings market infrastructures under DORA???s incident management and ICT governance frameworks.