Cortex XSOAR

Maintaining a List of Service Providers (12.8.1)

Staff Training for Breach Response (12.10.4)

Managing PCI DSS Requirements by Service Providers (12.8.5)

Establish, Publish, Maintain, and Disseminate a Security Policy (12.1)

Security Awareness Program (12.6)

Formal organizational structures, including governance frameworks and reporting lines, are established and documented to ensure clear accountability and operational efficiency.

Defined roles and responsibilities are established within the organization, including specific assignments for critical functions, and are documented to ensure clarity of accountability.

Organizational structures and defined roles are maintained in the platform and made available to employees upon request to ensure accessibility and transparency.

Approved security policies are published to the Compliance Scorecard platform, ensuring all employees have access to the latest versions of company policies.

GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected

PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected

PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected

PR.DS-11: Backups of data are created, protected, maintained, and tested

RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident

RS.AN-08: An incident's magnitude is estimated and validated

3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?

3rd Party Access Controls 1 - Are unique credentials used for 3rd party, partner, contractor, and/or vendor access to systems that connect to the organization's domain?

Business Agreements 4 - Does each BAA give assurance(s) that the partner or vendor will follow best practices and/or compliance to protect ePHI/PCI/PII?

Do you conduct Annual penetration testing of your information systems, determined each give year based on relevant identified rusisk in accordance with the risk assessment?

Do you Evaluate and adjust your IS program in light of the results of the testing and monitoring including any material changes to your operations or business arrangements or any other circumstances that you know or have reason to know may have a material impact on your IS program?

Do you conduct vulnerability assessments whenever there are material changes to your operations or business arrangements and whenever there are circumstances you know or have reason to know may have a material impact on your information security program?

Creates an EU-level oversight structure for critical vendors.

Criteria used to designate providers as critical.

Outlines how and when designations are reviewed.