JumpCloud

Changing Vendor-supplied Defaults (2.1)

Enabling Only Necessary Services (2.2.2)

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission

5.15 Access Control - Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.

5.18 Access Rights - Access rights to information and other associated assets shall be provisioned, reviewed, modified, and removed in accordance with the organization's topic-specific policy on and rules for access control.

5.2 Information security roles and responsibilities shall be defined and allocated according to the organization needs.

7.2 Physical entry - Secure areas shall be protected by appropriate entry controls and access points.

7.3 Securing offices, rooms, and facilities - Physical security for offices, rooms, and facilities shall be designed and implemented.

7.4 Physical security monitoring - Premises shall be continuously monitored for unauthorized physical access.