NordPass

MFA for remote access (8.3.2)

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

Use of Strong Cryptography and Security Protocols (4.1)

Administering User Accounts (12.5.4)

Securing Cryptographic Key Storage (3.6.3)

MFA for non-console access to CDE (8.3.1)

Changing Vendor-supplied Defaults (2.1)

Improper Access Control (6.5.8)

Broken Authentication and Session Management (6.5.10)

Incorporating Multi-factor Authentication (8.3)

Limiting Access to Cardholder Data (7.1)

Passwords Issued / Reset Requirements (8.2.6)

Removing/disabling Inactive User Accounts (8.1.4)

Defining Access Needs (7.1.1)

Monitoring and alerts are configured by the security team to identify and notify management of incidents when thresholds are crossed on security and operational metrics. Issues, if any, are routed through incident management for resolution.

DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events

GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes

GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained

8.1 User end point devices - Information stored on, processed by or accessible via user endpoint devices shall be protected.

Mandates risk controls for ICT third-party services.

Facilitates international collaboration on ICT matters.

Expands the Solvency II framework to address digital resilience in insurance.

Establish and Maintain a Security Awareness Program