ServiceNow ITOM

Policies and Procedures (9.10)

Monitoring Physical Access (9.1.1)

GV.SC-01: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders

GV.SC-04: Suppliers are known and prioritized by criticality

GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships

Facility Access 6 - Is there a mechanism(s) in place to restrict physical access to electronic devices, including mobile devices that contain or can access ePHI?

Facility Access 1 - Is there a procedure or mechanism to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.) and are staff educated about the process?

Facility Changes - Are physical changes to the facility documented and updated appropriately?

Equipment Changes - Are network changes and equipment changes documented and updated appropriately?

58

Ensures fund managers also comply with digital operational resilience obligations.

How likely is the HR department to face operational disruptions due to HR system failures or inadequate HR technology infrastructure

How likely is the HR department to face risks related to improper handling of employee relations issues or ineffective conflict resolution?

How likely is the HR department to face compliance risks associated with evolving labor laws and regulations?

How likely is the HR department to encounter risks related to talent shortages or difficulty in attracting skilled candidates?