Bitwarden Secrets Manager

Policies and Procedures (11.6)

Vulnerability Scanning (11.2)

ID.IM-01: Improvements are identified from evaluations

ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties

ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities

ID.IM-04: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Disaster Recovery Plan 2 - Is critical data (backed up at least weekly) to a network or cloud repository available for data recovery?

Defines ESAs??? supervisory and coordinating roles.

Clarifies ECB involvement in oversight activities.

Expands the Solvency II framework to address digital resilience in insurance.

Ensures fund managers also comply with digital operational resilience obligations.

What measures are in place to protect sensitive employee and customer data from unauthorized access or data breaches? (Data Security and Privacy)

What measures are in place to address the risk of employee misconduct or non-compliance with policies and regulations? (Employee Misconduct)

How does the organization manage the risk of employee turnover and its impact on business operations? (Employee Turnover)

How does the organization ensure that employees are adequately trained and aware of security best practices to mitigate the risk of security incidents? (Security Awareness and Training)