CloudAlly

Access to client data requires a unique ID assigned to each user.

All system access for terminated or disabled employees and consultants is removed within 24 hours of receiving a notification from the business or HR.

All access requests, including those for employees, temporary employees, consultants, and system accounts, are reviewed and approved by the appropriate level of business and IT management before provisioning.

RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared

RS.MA-02: Incident reports are triaged and validated

RS.MA-05: The criteria for initiating incident recovery are applied

8.12 Data leakage prevention - Data leakage prevention measures shall be applied to systems, networks and any other devices that process, store, or transmit sensitive information.

8.14 Redundancies of information processing facilities - Information processing facilities shall be implemented with redundancy sufficient to meet availability requirements.

Creates an EU-level oversight structure for critical vendors.

Criteria used to designate providers as critical.

Defines the obligations of designated providers.

What measures are in place to protect sensitive employee and customer data from unauthorized access or data breaches? (Data Security and Privacy)

What measures are in place to address the risk of employee misconduct or non-compliance with policies and regulations? (Employee Misconduct)

How does the organization manage the risk of employee turnover and its impact on business operations? (Employee Turnover)

How does the organization ensure that employees are adequately trained and aware of security best practices to mitigate the risk of security incidents? (Security Awareness and Training)