BetterCloud

MFA for remote access (8.3.2)

Verifying User Identities (8.2.2)

User Authentication Management (8.2)

Lockout Duration (8.1.7)

User ID Management (8.1.2)

Policies and Procedures for User Identification Management (8.1)

Revoking Access for Terminated Users (8.1.3)

Removing/disabling Inactive User Accounts (8.1.4)

DE.CM-01: Networks and network services are monitored to find potentially adverse events

DE.CM-06: External service provider activities and services are monitored to find potentially adverse events

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission

RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared

RS.MA-03: Incidents are categorized and prioritized

RS.MA-04: Incidents are escalated or elevated as needed

5.16 Identity Management - The full lifecycle of identities shall be managed.

5.23 Information security for use of cloud services - Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organization's information security requirements.

55