Panda Adaptive Defense

Prevention of Unauthorized Substitution of Cryptographic Keys (3.6.7)

Securing Cryptographic Key Distribution (3.6.2)

List of Authorized Usage of Devices (12.3.3)

Protecting Keys Used in Storing Cardholder Data (3.5)

Access to client data requires a unique ID assigned to each user.

Logged alerts are reviewed and investigated as needed to identify, respond to, and mitigate suspicious or malicious activity.

All system access for terminated or disabled employees and consultants is removed within 24 hours of receiving a notification from the business or HR.

DE.AE-02: Potentially adverse events are analyzed to better understand associated activities

DE.AE-04: The estimated impact and scope of adverse events are understood

PR.PS-01: Configuration management practices are established and applied

Have you designed and implemented information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures?

Do you currently Identify and manage the data, personnel, devices, systems, and facilities that enable you to achieve business purposes in accordance with their relative importance to business objectives and your risk strategy?

Have you developed, implemented, and currently maintain procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used in connection with the provision of a product or service to the customer to which it relates?

Do you design and implement safeguards to control the risks you identity through risk assessment, including by Implementing and periodically reviewing access controls, including technical and, as appropriate, physical controls to both?

How likely is the HR department to experience a significant data breach or unauthorized access to employee data?