CloudBolt

Access Control System Restrictions (7.2)

Default deny-all Setting (7.2.3)

GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

RC.CO-03: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders

RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging

Do you oversee service providers by taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue?

Do you currently Oversee service providers, by: Requiring your service providers by contract to implement and maintain such safeguards?

Do you oversee service providers by requiring your service providers by contract to implement and maintain such safeguards?

If this is a service provider or affiliate, do you require the service provider or affiliate to maintain an information security program that protects you in accordance with the requirements?

Do you currently Oversee service providers, by: Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue?

Facilitates international collaboration on ICT matters.

54

Establish and Maintain a Service Provider Management Policy

Assess Service Providers

Monitor Service Providers

Establish and Maintain Contact Information for Reporting Security Incidents

Establish and Maintain an Enterprise Process for Reporting Incidents