DokuWiki

Documentation of All Services, Protocols, and Ports Allowed (1.1.6)

Least Privilege Access (7.1.2)

Documenting Security Policies and Firewall Management (1.5)

Current Network Diagram (1.1.2)

Reported client incidents are resolved through documented communication via the client portal and Jira ticketing system to ensure timely and accurate resolution.

Objective descriptions of Compliance Scorecard's system and its boundaries are made available to authorized client users through ongoing communications and the client portal.

ID.IM-01: Improvements are identified from evaluations

ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities

Training 6 - Is there ongoing training or communication regarding security awareness and requirements for all staff?

Training 3 - Are training sessions recorded or logged for each employee or staff member?

Regular reports to national regulators.

Mandates risk controls for ICT third-party services.

Providers must be vetted prior to engagement.

Contracts must include specific operational clauses.

Entities must monitor provider performance regularly.

Describes conditions for sub-outsourcing ICT services.

Procedures for terminating contracts safely.

Requires exit and transition strategies for continuity.

Creates an EU-level oversight structure for critical vendors.

Criteria used to designate providers as critical.

Procedures for formally designating critical providers.

Grants oversight authorities various supervisory rights.

Defines the obligations of designated providers.

Outlines how and when designations are reviewed.