Cybereason

DE.AE-02: Potentially adverse events are analyzed to better understand associated activities

DE.AE-04: The estimated impact and scope of adverse events are understood

DE.AE-06: Information on adverse events is provided to authorized staff and tools

ID.IM-01: Improvements are identified from evaluations

ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities

PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected

PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected

PR.DS-11: Backups of data are created, protected, maintained, and tested

Does the assessment also include the adequacy of the existing controls in the context of the identified risks or threats you face; and Requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the IS program will address the risks?

Does this risk assessment include consideration of risks in each relevant area of your operations, including: Employee training and management?

Do you periodically perform additional risk assessments that re-examine the reasonably foreseeable internal and external risks to customer information that could result in the unauthorized disclosure, or other compromise of such info, and reassess the safeguards in place to control these risks?

Does this risk assessment include consideration of risks in each relevant area of your operations, including: Information systems, including network and software design, as well as information processing, storage, transmission and disposal?

Is your risk assessment written and does it include criteria for the evaluation and categorization of identified security risks, criteria for the assessment of the confidentiality, integrity, and availability of your IS and customer information,

Do you currently base your IS program on a risk assessment that identifies foreseeable internal and external risks to the security, and integrity of customer info that could result in the unauthorized disclosure, or other compromise of such info, and assesses the safeguards to control these risks?

Does this risk assessment include consideration of risks in each relevant area of your operations, including: detecting, preventing and responding to attacks, intrusions, or other systems failures?

Defines ESAs??? supervisory and coordinating roles.

Clarifies ECB involvement in oversight activities.

Centrally Manage Anti-Malware Software

Train Workforce Members on Recognizing and Reporting Security Incidents