Ironscales

ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded

PR.IR-01: Networks and environments are protected from unauthorized logical access and usage

Does the report include the overall status of the IS program and compliance, and matters related to the program addressing issues such as risk assessment/mgmt and control decisions,service provider arrangements,testing results,security events/violations and mgmt's responses, and recommended changes?

Periodically assess the risk to organizational operations, organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.

How does the board monitor the organization's compliance with relevant cybersecurity regulations and standards? (Monitoring compliance with regulations)

How frequently does the board receive updates on the organization's current cyber threat landscape and potential vulnerabilities? (Frequency of threat landscape updates)