Zendesk Support

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

User Identification is Logged (10.3.1)

Success or Failure Indication is Logged (10.3.4)

Employment Screening - Does the organization screen potential employees during the hiring process, to determine trustworthiness?

Roles - CISO - Is there an employee in the organization that oversees the development and implementation of security policies and procedures?

Responsibilities - Perms - Is/are there personnel responsible for determining and implementing the appropriate access and permissions levels for users?

Responsibilities - CISO - Are the job role and responsibilities of the employee who oversees the development and implementation of security policies and procedures fully documented?

Roles - Authority - If there is not a job role identified for development and implementation of security policies, is there a recognized personnel that staff contact in the case of security events?

Requires regular, secure backups and recovery processes.

Mandates risk controls for ICT third-party services.

Providers must be vetted prior to engagement.

Entities must monitor provider performance regularly.

Requires exit and transition strategies for continuity.

Creates an EU-level oversight structure for critical vendors.

Criteria used to designate providers as critical.

Procedures for formally designating critical providers.

Defines the obligations of designated providers.

Outlines how and when designations are reviewed.

Establish and Maintain Detailed Enterprise Asset Inventory

Establish and Maintain a Software Inventory

Establish and Maintain a Data Inventory

Document Data Flows

Establish and Maintain an Inventory of Service Providers