DealHub

Administering User Accounts (12.5.4)

PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization

PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

Have you designed and implemented information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures?

Do you Design and implement safeguards to Limit authorized users' access only to customer information that they need to perform their duties or, in the case of customers, to access their own information?

Rules for reporting major ICT-related incidents.

Specifies deadlines and required content for incident reports.

Allows voluntary reports of cyber threats.