Barracuda MSP

Policies and Procedures (9.10)

Monitoring Physical Access (9.1.1)

DE.AE-02: Potentially adverse events are analyzed to better understand associated activities

DE.AE-03: Information is correlated from multiple sources

DE.AE-04: The estimated impact and scope of adverse events are understood

GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

Identifying Vulnerabilities - In the past 12 months, has the practice performed (or caused to be performed) recommended tests to identify vulnerabilities?

Remediating Vulnerabilities - In the past 12 months, has the organization implemented remediation steps for identified 'critical' and 'important' vulnerabilities?

Does the assessment also include the adequacy of the existing controls in the context of the identified risks or threats you face; and Requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the IS program will address the risks?

Does this risk assessment include consideration of risks in each relevant area of your operations, including: Employee training and management?

Does this risk assessment include consideration of risks in each relevant area of your operations, including: Information systems, including network and software design, as well as information processing, storage, transmission and disposal?

Do you currently base your IS program on a risk assessment that identifies foreseeable internal and external risks to the security, and integrity of customer info that could result in the unauthorized disclosure, or other compromise of such info, and assesses the safeguards to control these risks?

Does this risk assessment include consideration of risks in each relevant area of your operations, including: detecting, preventing and responding to attacks, intrusions, or other systems failures?

Regular reports to national regulators.

Mandates risk controls for ICT third-party services.

Entities must monitor provider performance regularly.

How likely is the HR department to experience a significant data breach or unauthorized access to employee data?

How likely is the HR department to face risks related to improper handling of employee relations issues or ineffective conflict resolution?

How likely is the HR department to face compliance risks associated with evolving labor laws and regulations?