Demisto

Maintaining a List of Service Providers (12.8.1)

Security Policies and Procedures for Managing Vendor Defaults (2.5)

Encrypting Non-console Administrative Access (2.3)

Maintaining an Inventory of System Components (2.4)

Changing Vendor-supplied Defaults (2.1)

Establish, Publish, Maintain, and Disseminate a Security Policy (12.1)

Removing Unnecessary Functionality (2.2.5)

Implementing One Primary Function Per Server (2.2.1)

Developing Configuration Standards for All System Components (2.2)

Enabling Only Necessary Services (2.2.2)

DE.CM-01: Networks and network services are monitored to find potentially adverse events

DE.CM-06: External service provider activities and services are monitored to find potentially adverse events

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission

5.1 Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to, and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur

5.16 Identity Management - The full lifecycle of identities shall be managed.

5.27 Learning from information security incidents - Knowledge gained from information security incidents shall be used to strengthen and improve the information security controls.

Address Unauthorized Assets

Address Unauthorized Software

Perform Automated Backups

Establish and Maintain an Isolated Instance of Recovery Data

Define Mechanisms for Communicating During Incident Response

Establish and Maintain Security Incident Thresholds