WatchGuard Cloud

Public-facing Web Applications (6.6)

Installing Critical Security Patches (6.2)

Security of Custom Application Accounts (6.3.1)

Cross-site Scripting (XSS) (6.5.7)

A business impact analysis (BIA) is performed annually that includes tabletop testing of the business continuity and disaster recovery plans.

5.15 Access Control - Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.

5.23 Information security for use of cloud services - Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organization's information security requirements.

5. 24 Information security incident management planning and preparation - The organization shall plan and prepare for managing information security incidents by defining, establishing, and communicating information security incident management processes, roles, and responsibilities.

3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?

3rd Party Access Controls 1 - Are unique credentials used for 3rd party, partner, contractor, and/or vendor access to systems that connect to the organization's domain?

Regular reports to national regulators.