EciFMAudit

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

All required documentation and testing, as specified in the Change Management Policy, are completed and evidenced for each request before changes are released to production.

All system changes, including their review, approval, and evidence of adherence to the Change Management Policy, are documented in Jira to maintain a centralized and auditable record.

DE.CM-01: Networks and network services are monitored to find potentially adverse events

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission

RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident

RS.AN-07: Incident data and metadata are collected, and their integrity and provenance are preserved

Outlines ICT governance roles for senior management.

Details structural organization to manage ICT risk.

Creates an EU-level oversight structure for critical vendors.

Criteria used to designate providers as critical.

Procedures for formally designating critical providers.

Defines the obligations of designated providers.

Outlines how and when designations are reviewed.

Facilitates international collaboration on ICT matters.

Establish and Maintain a Data Management Process

Establish and Maintain a Service Provider Management Policy

Assess Service Providers

Monitor Service Providers

Establish and Maintain an Enterprise Process for Reporting Incidents