CloudJumper

Maintaining a List of Service Providers (12.8.1)

List of Authorized Usage of Devices (12.3.3)

Managing PCI DSS Requirements by Service Providers (12.8.5)

Usage Policies (12.3)

Acceptable Uses of Technology (12.3.5)

A business impact analysis (BIA) is performed annually that includes tabletop testing of the business continuity and disaster recovery plans.

PR.IR-01: Networks and environments are protected from unauthorized logical access and usage

PR.IR-02: The organization's technology assets are protected from environmental threats

PR.IR-04: Adequate resource capacity to ensure availability is maintained

RS.CO-02: Internal and external stakeholders are notified of incidents

RS.CO-03: Information is shared with designated internal and external stakeholders

5.15 Access Control - Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.

5.16 Identity Management - The full lifecycle of identities shall be managed.

5. 24 Information security incident management planning and preparation - The organization shall plan and prepare for managing information security incidents by defining, establishing, and communicating information security incident management processes, roles, and responsibilities.

5.29 Information security during disruption - The organization shall plan how to maintain information security at an appropriate level during disruption.

Mandates risk controls for ICT third-party services.

Providers must be vetted prior to engagement.

Entities must monitor provider performance regularly.

Requires exit and transition strategies for continuity.

Utilize an Active Discovery Tool

Utilize Automated Software Inventory Tools

Log Sensitive Data Access