Checkmk

Protection of Audit Trail Files (10.5.2)

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

Exceptions and Anomalies Are Identified and Addressed (10.6.3)

Daily Log Reviews (10.6.1)

Type of Event is Logged (10.3.2)

Time Settings Are From Industry-accepted Time Sources (10.4.3)

Implementing Audit Trails (10.1)

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

All system change requests are formally documented, including a description of the change, justification, and affected systems or components.

There is a segregation of duties over making source code changes and migrating changes to the production environment. Access to promote changes is limited based on job responsibilities.

All required documentation and testing, as specified in the Change Management Policy, are completed and evidenced for each request before changes are released to production.

All system changes, including their review, approval, and evidence of adherence to the Change Management Policy, are documented in Jira to maintain a centralized and auditable record.

A formal risk management process is established to evaluate risks based on identified threats and specified tolerances. This process includes defining risk assessment methodologies, risk categories, and evaluation criteria.

Risk assessments are performed at least annually during security committee management meetings and include evaluations of the following: -Organizational structure, capability, capacity, reporting lines, authorities, and responsibilities. -Environmental, regulatory, and technological changes that have occurred. -The need for additional tools and resources to achieve business objectives. -Threats and vulnerabilities affecting the achievement of commitments to clients.

Results of the risk assessment, including identified risks and recommended actions, are communicated to the respective owners to ensure accountability for addressing risks.

Identified risks and associated action items are documented and tracked through an ongoing risk register to monitor progress and ensure timely resolution.

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission

RS.MA-02: Incident reports are triaged and validated

RS.MA-03: Incidents are categorized and prioritized

RS.MA-04: Incidents are escalated or elevated as needed

Remediating Vulnerabilities - In the past 12 months, has the organization implemented remediation steps for identified 'critical' and 'important' vulnerabilities?

Defines the scope of digital resilience testing.

Details tools for vulnerability and performance testing.

54