Chocolatey

Scanning Due to Significant Change (11.2.3)

Responding to Change-detection Alerts (11.5.1)

Correcting Exploitable Vulnerabilities (11.3.3)

Vulnerability Scanning (11.2)

5.15 Access Control - Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.

5.19 Information Security in Supplier relationships - Processes and procedures shall be defined and implemented to manage the information security risks associated with the use of suppliers' products or services.

5.21 Managing information security in the ICT supply chain - Processes and procedures shall be defined and implemented to manage the information security risks associated with ICT products and services supply chain.

Does your incident response plan address the following areas: Documentation and reporting regarding security events and related incident response activities, and the evaluation and revision as necessary of the incident response plan following a security event?

Does your incident response plan address the following areas:The goals of the incident response plan, The internal processes for responding to a security event, The definition of clear roles, responsibilities, and levels of decision-making authority?

Have you established a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information in your control?

Does your incident response plan address the following areas: External and internal communications and information sharing, and Identification of requirements for the remediation of any identified weaknesses in information systems and associated controls?

Facilitates international collaboration on ICT matters.

Establish and maintain a configuration management database (CMDB) to contain relevant information about configuration items.

Address Unauthorized Software