Boomi

Policies and Procedures for Encrypting Transmissions of Cardholder Data (4.3)

Transmission of Unprotected PANs By End-user Messaging Technologies (4.2)

Wireless Networks Transmitting Cardholder Data (4.1.1)

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

All system change requests are formally documented, including a description of the change, justification, and affected systems or components.

There is a segregation of duties over making source code changes and migrating changes to the production environment. Access to promote changes is limited based on job responsibilities.

System change requests are reviewed and approved by management to ensure alignment with business objectives and security requirements.

All required documentation and testing, as specified in the Change Management Policy, are completed and evidenced for each request before changes are released to production.

All system changes, including their review, approval, and evidence of adherence to the Change Management Policy, are documented in Jira to maintain a centralized and auditable record.

Emergency changes follow the same Change Management procedures as standard changes. However, if full change management testing and documentation cannot be performed prior to release, these requirements must be met within one week post-implementation.

Processing capacity is monitored monthly by management to ensure that current system performance meets operational requirements.

Compliance Scorecard's clients are provided onboarding materials that details security, availability, and regulatory related requirements, platform access information, and incident escalation information.

DE.AE-02: Potentially adverse events are analyzed to better understand associated activities

DE.AE-04: The estimated impact and scope of adverse events are understood

DE.AE-08: Incidents are declared when adverse events meet the defined incident criteria

GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

GV.SC-02: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally

GV.SC-04: Suppliers are known and prioritized by criticality

GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships

RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared

RS.MA-02: Incident reports are triaged and validated

RS.MA-03: Incidents are categorized and prioritized

RS.MA-04: Incidents are escalated or elevated as needed

RS.MA-05: The criteria for initiating incident recovery are applied

Utilize Automated Software Inventory Tools

Log Sensitive Data Access