CommitCRM

Administering User Accounts (12.5.4)

Usage Policies (12.3)

Managing Service Providers (12.8)

Personnel Education (12.6.1)

Agreements with Vendors and Business Partners include privacy and confidentially clauses. If any of the vendors are SaaS, then their respective SOC1/2 reports are obtained and reviewed periodically.

GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes

GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties

ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded

ID.RA-06: Risk responses are chosen, prioritized, planned, tracked, and communicated

ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked

6.3 Information security awareness, education , and training - Personnel of the organization and relevant interested parties shall receive appropriate information security awareness, education and training and regular updates of the organization's information security policy, topic-specific policies, and procedures, as relevant for their job function.

6.4 Disciplinary process - A disciplinary process shall be formalized and communicated to take actions against personnel and other relevant interested parties who have committed an information security policy violation.

6.5 Responsibilities after termination or change of employment - Information security responsibilities and duties that remain valid after termination or change of employment shall be defined, enforced, and communicated to relevant personnel and other interested parties.

Does the monitoring and testing include continuous monitoring or periodic penetration testing and vulnerability assessments?

Do you conduct Annual penetration testing of your information systems, determined each give year based on relevant identified rusisk in accordance with the risk assessment?

Do you Evaluate and adjust your IS program in light of the results of the testing and monitoring including any material changes to your operations or business arrangements or any other circumstances that you know or have reason to know may have a material impact on your IS program?

Do you conduct vulnerability assessments whenever there are material changes to your operations or business arrangements and whenever there are circumstances you know or have reason to know may have a material impact on your information security program?

53

Establish and Maintain Detailed Enterprise Asset Inventory

Establish and Maintain a Software Inventory

Ensure Authorized Software is Currently Supported

Establish and Maintain a Data Inventory

Establish and Maintain a Data Classification Scheme

Establish and Maintain an Inventory of Service Providers