Emsisoft

Intrusion-detection/intrusion-prevention (11.4)

External Vulnerability Scanning (11.2.2)

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

ID.AM-01: Inventories of hardware managed by the organization are maintained

ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained

ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained

RS.MI-01: Incidents are contained

RS.MI-02: Incidents are eradicated

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Security event reporting - Are there both policies and procedures that define a security event and provide instruction for communicating the event to appropriate personnel?

Facility Access 1 - Is there a procedure or mechanism to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.) and are staff educated about the process?

Equipment Controls 1 - Is there an asset list that contains the computing devices (servers, workstations, laptops, tablets) with identifiers (serial number, MAC address, etc.)?

Entities must maintain a complete incident register.

What measures are in place to mitigate the risk of losing key clients or accounts? (Client Loss)