Laika

GV.OC-01: The organizational mission is understood and informs cybersecurity risk management

GV.OC-04: Critical objectives, capabilities, and services that stakeholders depend on or expect from the organization are understood and communicated

RC.CO-03: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders

Training 5 - Does training include explaining security event reporting - who to contact and what to do in case of suspicious activity?

Training 1 - Are all workforce members (including managers) given cyber, digital, and/or information security training, at least annually?

Training 3 - Are training sessions recorded or logged for each employee or staff member?

Have you designed and implemented information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures?

Have you?implemented multi-factor authentication for any individual accessing any information system, unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls?

Do you Design and implement safeguards to Limit authorized users' access only to customer information that they need to perform their duties or, in the case of customers, to access their own information?

Do you design and implement safeguards to control the risks you identity through risk assessment, including by Implementing and periodically reviewing access controls, including technical and, as appropriate, physical controls to both?

Creates an EU-level oversight structure for critical vendors.

Grants oversight authorities various supervisory rights.

Perform Automated Backups

Conduct Post-Incident Reviews

Adversaries may acquire domains to mimic legitimate services or impersonate organizations.