Druva inSync

Change-control processes and procedures are followed for all changes to system components.

Maintaining Up-to-date Device Lists (9.9.1)

Media Storage and Accessibility (9.7)

Physically Securing Media (9.5)

Electronic Media Protection (9.8.2)

PR.AT-01: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind

PR.AT-02: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind

Does the report include the overall status of the IS program and compliance, and matters related to the program addressing issues such as risk assessment/mgmt and control decisions,service provider arrangements,testing results,security events/violations and mgmt's responses, and recommended changes?

Do you require your Qualified Individual to report in writing, regularly and at least annually, to your board of directors or equivalent governing body.

Address Unauthorized Assets

Address Unauthorized Software

Deploy and Maintain Anti-Malware Software

Tune Security Event Alerting Thresholds

Designate Personnel to Manage Incident Handling

Assign Key Roles and Responsibilities

Define Mechanisms for Communicating During Incident Response

What measures are in place to protect sensitive employee and customer data from unauthorized access or data breaches? (Data Security and Privacy)

What measures are in place to address the risk of employee misconduct or non-compliance with policies and regulations? (Employee Misconduct)

How does the organization manage the risk of employee turnover and its impact on business operations? (Employee Turnover)

How does the organization ensure that employees are adequately trained and aware of security best practices to mitigate the risk of security incidents? (Security Awareness and Training)