Naverisk

Security Policies and Procedures for Managing Vendor Defaults (2.5)

Enabling Only Necessary Services (2.2.2)

Access Control System Restrictions (7.2)

GV.SC-01: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders

GV.SC-03: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes

GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle

ID.AM-01: Inventories of hardware managed by the organization are maintained

ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained

ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles

ID.IM-01: Improvements are identified from evaluations

ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities

Have you Evaluated and adjusted your information security program in light of the results of the testing and monitoring required, or any material changes to your operations or business arrangements due to the results of risk assessments performed?

DORA entered into force on Jan 16, 2023, and applies fromxa0Jan 17, 2025, giving entities 2 years to prepare.

Address Unauthorized Assets

Define Mechanisms for Communicating During Incident Response