Exabeam

Administering User Accounts (12.5.4)

Usage Policies (12.3)

External Vulnerability Scanning (11.2.2)

Vulnerability Scanning (11.2)

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

5. 24 Information security incident management planning and preparation - The organization shall plan and prepare for managing information security incidents by defining, establishing, and communicating information security incident management processes, roles, and responsibilities.

5.25 Assessment and decision on information security events - The organization shall assess information security events and decide if they are to be categorized as information security incidents.

5.26 Response to information security incidents - Information security incidents shall be responded to in accordance with the documented procedures.

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Training 5 - Does training include explaining security event reporting - who to contact and what to do in case of suspicious activity?

Training 1 - Are all workforce members (including managers) given cyber, digital, and/or information security training, at least annually?

Access Control 3 P & P - Are there both policies and procedures to ensure that user accounts are unique, not shared amongst users?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

How likely is the HR department to experience a significant data breach or unauthorized access to employee data?