Hudu Knowledge Base

GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties

GV.RM-06: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated

ID.IM-01: Improvements are identified from evaluations

ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties

ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities

ID.IM-04: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved

RS.AN-06: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved

RS.AN-07: Incident data and metadata are collected, and their integrity and provenance are preserved

8.1 User end point devices - Information stored on, processed by or accessible via user endpoint devices shall be protected.

8.11 Data Masking - Data masking shall be used in accordance with the organization's topic-specific policy on access control and other related topic-specific policies, and business requirements, taking applicable legislation into consideration.

8.12 Data leakage prevention - Data leakage prevention measures shall be applied to systems, networks and any other devices that process, store, or transmit sensitive information.

8.13 Information backup - Backup copies of information, software and systems shall be maintained and regularly tested in accordance with the agreed topic-specific policy on backup.

8.15 Logging - Logs that record activities, exceptions, faults, and other relevant events shall be produced, stored, protected, and analyzed.

8.3 Information access restriction - Access to information and other associated assets shall be restricted in accordance with the established topic-specific policy on access control.

8.32 Change Management - Changes to information processing facilities and information systems shall be subject to change management procedures.

Establish and Maintain Architecture Diagram(s)

Establish and Maintain a Service Provider Management Policy

Classify Service Providers

Ensure Service Provider Contracts Include Security Requirements

Assess Service Providers

Monitor Service Providers

Establish and Maintain Contact Information for Reporting Security Incidents

Establish and Maintain an Enterprise Process for Reporting Incidents

Establish and Maintain an Incident Response Process