Evo Security

Firewall and Router Configuration Standards (1.1)

Firewall and Router Configurations For Untrusted Networks (1.2)

GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving

ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded

ID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded

5.1 Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to, and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur

5.18 Access Rights - Access rights to information and other associated assets shall be provisioned, reviewed, modified, and removed in accordance with the organization's topic-specific policy on and rules for access control.

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Access Control 2 P & P - Are there both policies and procedures to ensure that idle computing devices enable lock screen after 10 minutes of non-use?

Training 6 - Is there ongoing training or communication regarding security awareness and requirements for all staff?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

Explains proportional application of DORA based on entity type.

Creates an EU-level oversight structure for critical vendors.

Procedures for formally designating critical providers.

Defines the obligations of designated providers.

53