Zoho CRM

Policies and Procedures for Encrypting Transmissions of Cardholder Data (4.3)

Public-facing Web Applications (6.6)

Transmission of Unprotected PANs By End-user Messaging Technologies (4.2)

Broken Authentication and Session Management (6.5.10)

Improper Error Handling (6.5.5)

Installing Critical Security Patches (6.2)

Security of Custom Application Accounts (6.3.1)

Wireless Networks Transmitting Cardholder Data (4.1.1)

Cross-site Scripting (XSS) (6.5.7)

GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving

GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

GV.RR-04: Cybersecurity is included in human resources practices

5.1 Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to, and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur

5.18 Access Rights - Access rights to information and other associated assets shall be provisioned, reviewed, modified, and removed in accordance with the organization's topic-specific policy on and rules for access control.

5. 24 Information security incident management planning and preparation - The organization shall plan and prepare for managing information security incidents by defining, establishing, and communicating information security incident management processes, roles, and responsibilities.

5.34 Privacy and Protection of PII - The organization shall identify and meet the requirements regarding preservation of privacy and protection of PII according to applicable laws and regulations and contractual requirements.

Outlines ICT governance roles for senior management.

Details structural organization to manage ICT risk.

Defines requirements for detecting ICT anomalies.

58