Collabrance

GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes

GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties

PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected

PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected

PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected

PR.DS-11: Backups of data are created, protected, maintained, and tested

RC.CO-03: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders

RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging

RS.MI-01: Incidents are contained

RS.MI-02: Incidents are eradicated

Have you designed and implemented information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures?

Have you adopted and implemented procedures for change management, as well as controls designed to minitor and log the activity of authorized users and detect unauthorized access or use of, or tamper with, customer information by such users?

Do you currently Identify and manage the data, personnel, devices, systems, and facilities that enable you to achieve business purposes in accordance with their relative importance to business objectives and your risk strategy?

Have you developed, implemented, and currently maintain procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used in connection with the provision of a product or service to the customer to which it relates?

Do you periodically review your data retention poicy to minimiz the unnecessary retention of data?

Have you adopted secure dev practices for in-house developed applications utilized for transmitting, accessing, or storing customer info, and procedures for evaluating, assessing, or testing the security of externally developed applications you utilize to transmit, access, or store customer info?

Do you regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures, including those to detect actual and attempted attacks on, or intrusions into, information systems?

Requires regular, secure backups and recovery processes.

Helps firms prepare compliance frameworks before enforcement; mirrors practices seen in GDPR rollouts.

Address Unauthorized Assets

Address Unauthorized Software

Centrally Manage Anti-Malware Software

Establish and Maintain a Secure Network Architecture

Designate Personnel to Manage Incident Handling

Assign Key Roles and Responsibilities

Define Mechanisms for Communicating During Incident Response