BlackBerry UEM

MFA for remote access (8.3.2)

User Authentication Management (8.2)

Unique User IDs (8.1.1)

Lockout Duration (8.1.7)

User ID Management (8.1.2)

Policies and Procedures for User Identification Management (8.1)

Restricting Public Internet Access (1.3)

Installing Personal Firewall Software on Mobile Devices (1.4)

Access Control System Restrictions (7.2)

Disclosure of Private IPs and Routing Information (1.3.7)

Default deny-all Setting (7.2.3)

Removing/disabling Inactive User Accounts (8.1.4)

Defining Access Needs (7.1.1)

DE.CM-01: Networks and network services are monitored to find potentially adverse events

DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events

DE.CM-06: External service provider activities and services are monitored to find potentially adverse events

GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving

GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

GV.RR-04: Cybersecurity is included in human resources practices

Training 5 - Does training include explaining security event reporting - who to contact and what to do in case of suspicious activity?

Training 6 - Is there ongoing training or communication regarding security awareness and requirements for all staff?

Training 1 - Are all workforce members (including managers) given cyber, digital, and/or information security training, at least annually?

Training 2 - Are all workforce members given email phishing training regularly (monthly or quarterly)?

Training 4 - Does training include password security, safeguarding passwords, compromised passwords, and how to create and change passwords.

Training 3 - Are training sessions recorded or logged for each employee or staff member?

Do you oversee service providers by taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue?

Do you currently Oversee service providers, by: Requiring your service providers by contract to implement and maintain such safeguards?

Do you oversee service providers by requiring your service providers by contract to implement and maintain such safeguards?

If this is a service provider or affiliate, do you require the service provider or affiliate to maintain an information security program that protects you in accordance with the requirements?

Do you currently Oversee service providers, by: Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue?

Log Sensitive Data Access

Deploy and Maintain Anti-Malware Software

Configure Automatic Anti-Malware Scanning of Removable Media