Databarracks

Changing Vendor-supplied Defaults (2.1)

Developing Configuration Standards for All System Components (2.2)

Enabling Only Necessary Services (2.2.2)

DE.CM-01: Networks and network services are monitored to find potentially adverse events

5.1 Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to, and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur

5.12 Classification of Assets - Information shall be classified according to the information security needs of the organization based on confidentiality, integrity, availability, and relevant interested party requirements.

5.18 Access Rights - Access rights to information and other associated assets shall be provisioned, reviewed, modified, and removed in accordance with the organization's topic-specific policy on and rules for access control.

5.19 Information Security in Supplier relationships - Processes and procedures shall be defined and implemented to manage the information security risks associated with the use of suppliers' products or services.

5. 24 Information security incident management planning and preparation - The organization shall plan and prepare for managing information security incidents by defining, establishing, and communicating information security incident management processes, roles, and responsibilities.

5.29 Information security during disruption - The organization shall plan how to maintain information security at an appropriate level during disruption.

Facility Access 6 - Is there a mechanism(s) in place to restrict physical access to electronic devices, including mobile devices that contain or can access ePHI?

Facility Changes - Are physical changes to the facility documented and updated appropriately?

Have you Implement policies and procedures to ensure that personnel are able to enact your information security program by providing your personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment?\

Mandates risk controls for ICT third-party services.

Providers must be vetted prior to engagement.

Entities must monitor provider performance regularly.

Requires exit and transition strategies for continuity.

Ensures fund managers also comply with digital operational resilience obligations.

Cloud service customers must ensure that public-facing domain ownership, registrar controls, and DNS management are governed with documented accountability.