CloudDesk

Production Data for Development (6.4.3)

Installing Critical Security Patches (6.2)

Policies and Procedures (6.7)

Documented Change Approval (6.4.5.2)

Change Control Processes and Procedures (6.4)

GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

GV.SC-01: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders

GV.SC-03: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes

GV.SC-04: Suppliers are known and prioritized by criticality

GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle

Requires regular, secure backups and recovery processes.

Steps for handling ICT-related incidents.

Criteria for categorizing incidents by severity.

55

Perform Automated Backups

Establish and Maintain an Isolated Instance of Recovery Data

Test Data Recovery

Conduct Routine Incident Response Exercises

Conduct Post-Incident Reviews