Reflexion

Protection of Audit Trail Files (10.5.2)

Verifying User Identities (8.2.2)

Exceptions and Anomalies Are Identified and Addressed (10.6.3)

Changing Vendor-supplied Defaults (2.1)

Daily Log Reviews (10.6.1)

Logging Audit Trails (10.2.3)

User Identification is Logged (10.3.1)

Revoking Access for Terminated Users (8.1.3)

Logging User Access to Cardholder Data (10.2.1)

GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving

RC.CO-03: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders

3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?

3rd Party Access Controls 1 - Are unique credentials used for 3rd party, partner, contractor, and/or vendor access to systems that connect to the organization's domain?

Do you oversee service providers by taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue?

Do you oversee service providers by requiring your service providers by contract to implement and maintain such safeguards?

Do you currently Oversee service providers, by: Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue?

Requires regular, secure backups and recovery processes.

Address Unauthorized Assets

Address Unauthorized Software