Pentest-Tools.com

Changing Vendor-supplied Defaults (2.1)

GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks

GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes

ID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded

RS.CO-02: Internal and external stakeholders are notified of incidents

8.16 Monitoring activities - Networks, systems, and applications shall be monitored for anomalous behavior and appropriate actions taken to evaluate potential information security incidents.

Events and Incidents 1 - Does the organization or its IT MSP have procedures documented and implemented to detect, prevent, and respond to security incidents?

Events and Incidents 2 - Are the procedures to detect, prevent, and respond to security and IT events documented and available for analysis for a reasonable amount of time?

Do you oversee service providers by taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue?

If this is a service provider or affiliate, do you require the service provider or affiliate to maintain an information security program that protects you in accordance with the requirements?

Rules for reporting major ICT-related incidents.

Establish and Maintain Detailed Enterprise Asset Inventory

Utilize an Active Discovery Tool

Establish and Maintain a Data Inventory

What measures are in place to protect sensitive employee and customer data from unauthorized access or data breaches? (Data Security and Privacy)