Cohesity

Verifying User Identities (8.2.2)

Unique User IDs (8.1.1)

MFA for non-console access to CDE (8.3.1)

Least Privilege Access (7.1.2)

Policies and Procedures for User Identification Management (8.1)

Limiting Access to Cardholder Data (7.1)

Access Control System Restrictions (7.2)

Removing/disabling Inactive User Accounts (8.1.4)

Policies & Procedures (7.3)

A formal risk management process is established to evaluate risks based on identified threats and specified tolerances. This process includes defining risk assessment methodologies, risk categories, and evaluation criteria.

Risk assessments are performed at least annually during security committee management meetings and include evaluations of the following: -Organizational structure, capability, capacity, reporting lines, authorities, and responsibilities. -Environmental, regulatory, and technological changes that have occurred. -The need for additional tools and resources to achieve business objectives. -Threats and vulnerabilities affecting the achievement of commitments to clients.

Results of the risk assessment, including identified risks and recommended actions, are communicated to the respective owners to ensure accountability for addressing risks.

Identified risks and associated action items are documented and tracked through an ongoing risk register to monitor progress and ensure timely resolution.

DE.CM-01: Networks and network services are monitored to find potentially adverse events

DE.CM-06: External service provider activities and services are monitored to find potentially adverse events

GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes

GV.RM-06: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated

Have you Evaluated and adjusted your information security program in light of the results of the testing and monitoring required, or any material changes to your operations or business arrangements due to the results of risk assessments performed?

Amends existing laws to align with DORA.