GreenCloud

Firewall and Router Configuration Standards (1.1)

Least Privilege Access (7.1.2)

ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Access Control 2 P & P - Are there both policies and procedures to ensure that idle computing devices enable lock screen after 10 minutes of non-use?

Access Control 3 P & P - Are there both policies and procedures to ensure that user accounts are unique, not shared amongst users?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

Access Control 5 P & P - Are there both policies and procedures to ensure that users are permitted only those permissions necessary to perform their role (Principle of Least Privilege)?

Have you designed and implemented information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures?

Do you currently Identify and manage the data, personnel, devices, systems, and facilities that enable you to achieve business purposes in accordance with their relative importance to business objectives and your risk strategy?

Do you design and implement safeguards to control the risks you identity through risk assessment, including by Implementing and periodically reviewing access controls, including technical and, as appropriate, physical controls to both?

Defines the scope of digital resilience testing.

58

Perform Automated Backups