Baramundi

Access and Authentication with Disk Encryption (3.4.1)

Security Policies and Operational Procedures (3.7)

Managing PAN Data Storage (3.4)

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

Separate application environments are maintained and utilized when making changes to the platform, and changes are made to development and test environments prior to being promoted to production.

There is a segregation of duties over making source code changes and migrating changes to the production environment. Access to promote changes is limited based on job responsibilities.

System change requests are reviewed and approved by management to ensure alignment with business objectives and security requirements.

All required documentation and testing, as specified in the Change Management Policy, are completed and evidenced for each request before changes are released to production.

All system changes, including their review, approval, and evidence of adherence to the Change Management Policy, are documented in Jira to maintain a centralized and auditable record.

Emergency changes follow the same Change Management procedures as standard changes. However, if full change management testing and documentation cannot be performed prior to release, these requirements must be met within one week post-implementation.

7.10 Storage media - Storage media shall be managed through their life cycle of acquisition, use, transportation, and disposal in accordance with the organization's classification scheme and handling requirements.

7.2 Physical entry - Secure areas shall be protected by appropriate entry controls and access points.

7.3 Securing offices, rooms, and facilities - Physical security for offices, rooms, and facilities shall be designed and implemented.

7.5 Protecting against physical and environmental threats - Protection against physical and environmental threats, such as natural disasters and other intentional or unintentional physical threats to infrastructure shall be designed and implemented.

7.9 Security of assets off premises - Off-site assets shall be protected.

Does the assessment also include the adequacy of the existing controls in the context of the identified risks or threats you face; and Requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the IS program will address the risks?

Does this risk assessment include consideration of risks in each relevant area of your operations, including: Employee training and management?

Does this risk assessment include consideration of risks in each relevant area of your operations, including: Information systems, including network and software design, as well as information processing, storage, transmission and disposal?

Do you currently base your IS program on a risk assessment that identifies foreseeable internal and external risks to the security, and integrity of customer info that could result in the unauthorized disclosure, or other compromise of such info, and assesses the safeguards to control these risks?

Does this risk assessment include consideration of risks in each relevant area of your operations, including: detecting, preventing and responding to attacks, intrusions, or other systems failures?

Defines ESAs??? supervisory and coordinating roles.

Clarifies ECB involvement in oversight activities.

Configure Automatic Anti-Malware Signature Updates

Establish and Maintain a Secure Network Architecture

Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise???s AAA Infrastructure

Train Workforce Members to Recognize Social Engineering Attacks

Train Workforce Members on Authentication Best Practices

Train Workforce on Data Handling Best Practices