Cisco Meraki SM

Firewall and Router Configuration Standards (1.1)

Segregate Cardholder Data Environment on Internal Network Zone (1.3.6)

Firewall Network Requirements (1.1.4)

Restricting Public Internet Access (1.3)

Firewall and Router Configurations For Untrusted Networks (1.2)

Implementing a DMZ to Limit Inbound Traffic (1.3.1)

Current Network Diagram (1.1.2)

Compliance Scorecard has an established policy that identifies and designates what information is considered confidential information, and details the information handling, retention and destruction requirements.

GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks

GV.OV-03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed

5.1 Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to, and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur

5.12 Classification of Assets - Information shall be classified according to the information security needs of the organization based on confidentiality, integrity, availability, and relevant interested party requirements.

5.15 Access Control - Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.

5.23 Information security for use of cloud services - Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organization's information security requirements.

5. 24 Information security incident management planning and preparation - The organization shall plan and prepare for managing information security incidents by defining, establishing, and communicating information security incident management processes, roles, and responsibilities.

How likely is the HR department to experience a significant data breach or unauthorized access to employee data?

How likely is the HR department to face risks related to improper handling of employee relations issues or ineffective conflict resolution?

How likely is the HR department to face compliance risks associated with evolving labor laws and regulations?