Nuso

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

System change requests are reviewed and approved by management to ensure alignment with business objectives and security requirements.

Emergency changes follow the same Change Management procedures as standard changes. However, if full change management testing and documentation cannot be performed prior to release, these requirements must be met within one week post-implementation.

GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

8.1 User end point devices - Information stored on, processed by or accessible via user endpoint devices shall be protected.

8.16 Monitoring activities - Networks, systems, and applications shall be monitored for anomalous behavior and appropriate actions taken to evaluate potential information security incidents.

8.3 Information access restriction - Access to information and other associated assets shall be restricted in accordance with the established topic-specific policy on access control.

Does the monitoring and testing include continuous monitoring or periodic penetration testing and vulnerability assessments?

Do you Evaluate and adjust your IS program in light of the results of the testing and monitoring including any material changes to your operations or business arrangements or any other circumstances that you know or have reason to know may have a material impact on your IS program?

Utilize an Active Discovery Tool

Utilize Automated Software Inventory Tools

Configure Automatic Anti-Malware Scanning of Removable Media