RPort

Policies and Procedures for Encrypting Transmissions of Cardholder Data (4.3)

Security Policies and Operational Procedures (3.7)

Access Control System Restrictions (7.2)

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

5.15 Access Control - Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.

5.18 Access Rights - Access rights to information and other associated assets shall be provisioned, reviewed, modified, and removed in accordance with the organization's topic-specific policy on and rules for access control.

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Access Control 2 P & P - Are there both policies and procedures to ensure that idle computing devices enable lock screen after 10 minutes of non-use?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?