Entrust

Change-control processes and procedures are followed for all changes to system components.

Protection of Audit Trail Files (10.5.2)

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

Public-facing Web Applications (6.6)

Exceptions and Anomalies Are Identified and Addressed (10.6.3)

File-integrity Monitoring On Logs (10.5.5)

Reviewing of Log Data to Identify Anomalies or Auspicious Activity (10.6)

Improper Access Control (6.5.8)

Daily Log Reviews (10.6.1)

Logging Audit Trails (10.2.3)

Type of Event is Logged (10.3.2)

Installing Critical Security Patches (6.2)

Success or Failure Indication is Logged (10.3.4)

Implementing Audit Trails (10.1)

Logging User Access to Cardholder Data (10.2.1)

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

System change requests are reviewed and approved by management to ensure alignment with business objectives and security requirements.

All system changes, including their review, approval, and evidence of adherence to the Change Management Policy, are documented in Jira to maintain a centralized and auditable record.

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

ID.IM-01: Improvements are identified from evaluations

ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities

RS.MI-01: Incidents are contained

6.3 Information security awareness, education , and training - Personnel of the organization and relevant interested parties shall receive appropriate information security awareness, education and training and regular updates of the organization's information security policy, topic-specific policies, and procedures, as relevant for their job function.

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Access Control 2 P & P - Are there both policies and procedures to ensure that idle computing devices enable lock screen after 10 minutes of non-use?

Employment Screening - Does the organization screen potential employees during the hiring process, to determine trustworthiness?

Responsibilities - ePHI - Does the organization have personnel classifications or job descriptions for which staff have access to ePHI?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

Mandates risk controls for ICT third-party services.

Describes conditions for sub-outsourcing ICT services.

Requires exit and transition strategies for continuity.