Zoho Desk

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

User Identification is Logged (10.3.1)

Success or Failure Indication is Logged (10.3.4)

A formal risk management process is established to evaluate risks based on identified threats and specified tolerances. This process includes defining risk assessment methodologies, risk categories, and evaluation criteria.

GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties

GV.RM-06: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated

PR.AT-01: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind

PR.AT-02: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind

PR.IR-01: Networks and environments are protected from unauthorized logical access and usage

PR.IR-04: Adequate resource capacity to ensure availability is maintained

8.1 User end point devices - Information stored on, processed by or accessible via user endpoint devices shall be protected.

8.3 Information access restriction - Access to information and other associated assets shall be restricted in accordance with the established topic-specific policy on access control.

8.32 Change Management - Changes to information processing facilities and information systems shall be subject to change management procedures.

Information exchange between competent authorities.