Nagios

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

A formal risk management process is established to evaluate risks based on identified threats and specified tolerances. This process includes defining risk assessment methodologies, risk categories, and evaluation criteria.

ID.IM-01: Improvements are identified from evaluations

ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities

Does your incident response plan address the following areas: Documentation and reporting regarding security events and related incident response activities, and the evaluation and revision as necessary of the incident response plan following a security event?

Does the assessment also include the adequacy of the existing controls in the context of the identified risks or threats you face; and Requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the IS program will address the risks?

Do you currently base your IS program on a risk assessment that identifies foreseeable internal and external risks to the security, and integrity of customer info that could result in the unauthorized disclosure, or other compromise of such info, and assesses the safeguards to control these risks?

Requires regular, secure backups and recovery processes.

Address Unauthorized Assets

Maintain a configuration management system (CMS) that includes all relevant configuration items.