Compliance Scorecard

Change-control processes and procedures are followed for all changes to system components.

Security Policies and Procedures for Managing Vendor Defaults (2.5)

Developing Configuration Standards for All System Components (2.2)

Enabling Only Necessary Services (2.2.2)

PR.AT-01: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind

PR.AT-02: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind

PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected

PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected

RC.RP-02: Recovery actions are selected, scoped, prioritized, and performed

RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration

RC.RP-05: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed

Employment Screening - Does the organization screen potential employees during the hiring process, to determine trustworthiness?

Responsibilities - Perms - Is/are there personnel responsible for determining and implementing the appropriate access and permissions levels for users?

Roles - Authority - If there is not a job role identified for development and implementation of security policies, is there a recognized personnel that staff contact in the case of security events?

Does the assessment also include the adequacy of the existing controls in the context of the identified risks or threats you face; and Requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the IS program will address the risks?

Does this risk assessment include consideration of risks in each relevant area of your operations, including: Employee training and management?

Does this risk assessment include consideration of risks in each relevant area of your operations, including: Information systems, including network and software design, as well as information processing, storage, transmission and disposal?

Is your risk assessment written and does it include criteria for the evaluation and categorization of identified security risks, criteria for the assessment of the confidentiality, integrity, and availability of your IS and customer information,

Does this risk assessment include consideration of risks in each relevant area of your operations, including: detecting, preventing and responding to attacks, intrusions, or other systems failures?

55