VMware Workspace ONE

Firewall and Router Configuration Standards (1.1)

Segregate Cardholder Data Environment on Internal Network Zone (1.3.6)

Documentation of All Services, Protocols, and Ports Allowed (1.1.6)

Restricting Inbound and Outbound Traffic (1.2.1)

Restricting Public Internet Access (1.3)

Physically Securing Media (9.5)

Facility Entry Controls (9.1)

Current Network Diagram (1.1.2)

Monitoring Physical Access (9.1.1)

A business impact analysis (BIA) is performed annually that includes tabletop testing of the business continuity and disaster recovery plans.

On an annual basis, each in-scope system will be restored from a backup and validated to test the integrity of the backup and restore process.

GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving

GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

GV.RR-04: Cybersecurity is included in human resources practices

5.17 Authentication information - Allocation and management of authentication information shall be controlled by a management process, including advising personnel on the appropriate handling of authentication information.

5.2 Information security roles and responsibilities shall be defined and allocated according to the organization needs.

Employment Screening - Does the organization screen potential employees during the hiring process, to determine trustworthiness?

Roles - CISO - Is there an employee in the organization that oversees the development and implementation of security policies and procedures?

Responsibilities - Perms - Is/are there personnel responsible for determining and implementing the appropriate access and permissions levels for users?

Responsibilities - CISO - Are the job role and responsibilities of the employee who oversees the development and implementation of security policies and procedures fully documented?

Roles - Authority - If there is not a job role identified for development and implementation of security policies, is there a recognized personnel that staff contact in the case of security events?

Have you designated an employee or employees to coordinate your information security program?

Have you currently Designated a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program? The Qualified Individual may be employed by you, an affiliate, or a service provider.

Have you designated a senior member of your personnel responsible for direction and oversight of the Qualified Individual?

Have you identified reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized compromise of such information, and assessed the sufficiency of any safeguards in place to control these risks?