CyTrack

Agreements with Vendors and Business Partners include privacy and confidentially clauses. If any of the vendors are SaaS, then their respective SOC1/2 reports are obtained and reviewed periodically.

PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization

System Monitoring - Are organization systems monitored for events or issues with an alerting or notification system?

Practice - Asset List - Provide a full asset list for practice owned computing devices and owned or leased network devices.

Rules for reporting major ICT-related incidents.

Mandates risk controls for ICT third-party services.

Providers must be vetted prior to engagement.

Entities must monitor provider performance regularly.

Requires exit and transition strategies for continuity.

Encourages participation in threat intel sharing.

Ensures fund managers also comply with digital operational resilience obligations.

Establish and Maintain Detailed Enterprise Asset Inventory

Ensure Authorized Software is Currently Supported

Establish and Maintain a Data Inventory

Establish and Maintain a Data Classification Scheme

Document Data Flows

Establish and Maintain an Inventory of Service Providers