Endpoint Protector

Protecting Payment Card Devices (9.9)

Media Destruction (9.8)

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

All system change requests are formally documented, including a description of the change, justification, and affected systems or components.

All required documentation and testing, as specified in the Change Management Policy, are completed and evidenced for each request before changes are released to production.

All system changes, including their review, approval, and evidence of adherence to the Change Management Policy, are documented in Jira to maintain a centralized and auditable record.

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

RC.RP-02: Recovery actions are selected, scoped, prioritized, and performed

RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration

RC.RP-05: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed

Does the report include the overall status of the IS program and compliance, and matters related to the program addressing issues such as risk assessment/mgmt and control decisions,service provider arrangements,testing results,security events/violations and mgmt's responses, and recommended changes?

55