Comply

GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks

GV.OV-03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed

PR.PS-01: Configuration management practices are established and applied

PR.PS-02: Software is maintained, replaced, and removed commensurate with risk

PR.PS-05: Installation and execution of unauthorized software are prevented

RS.CO-02: Internal and external stakeholders are notified of incidents

RS.CO-03: Information is shared with designated internal and external stakeholders

7.10 Storage media - Storage media shall be managed through their life cycle of acquisition, use, transportation, and disposal in accordance with the organization's classification scheme and handling requirements.

7.2 Physical entry - Secure areas shall be protected by appropriate entry controls and access points.

7.3 Securing offices, rooms, and facilities - Physical security for offices, rooms, and facilities shall be designed and implemented.

7.4 Physical security monitoring - Premises shall be continuously monitored for unauthorized physical access.

7.5 Protecting against physical and environmental threats - Protection against physical and environmental threats, such as natural disasters and other intentional or unintentional physical threats to infrastructure shall be designed and implemented.

7.7 Clear desk and clear screen - Clear desk rules for papers and removable storage media and clear screen rules for information processing facilities shall be defined and appropriately enforced.

7.8 Equipment siting and protection - Equipment shall be sited securely and protected.

7.9 Security of assets off premises - Off-site assets shall be protected.

Entities must maintain a complete incident register.

Mandates risk controls for ICT third-party services.

Contracts must include specific operational clauses.

Describes conditions for sub-outsourcing ICT services.

Procedures for terminating contracts safely.

Helps firms prepare compliance frameworks before enforcement; mirrors practices seen in GDPR rollouts.

Address Unauthorized Assets

Address Unauthorized Software

Establish and Maintain a Service Provider Management Policy

Classify Service Providers

Assess Service Providers

Monitor Service Providers

Establish and Maintain Contact Information for Reporting Security Incidents

Establish and Maintain an Enterprise Process for Reporting Incidents

Establish and Maintain an Incident Response Process

Define Mechanisms for Communicating During Incident Response

What measures are in place to protect sensitive employee and customer data from unauthorized access or data breaches? (Data Security and Privacy)

What measures are in place to address the risk of employee misconduct or non-compliance with policies and regulations? (Employee Misconduct)

How does the organization manage the risk of employee turnover and its impact on business operations? (Employee Turnover)