Zoho One

ID.IM-01: Improvements are identified from evaluations

ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties

6.3 Information security awareness, education , and training - Personnel of the organization and relevant interested parties shall receive appropriate information security awareness, education and training and regular updates of the organization's information security policy, topic-specific policies, and procedures, as relevant for their job function.

6.7 Remote Working - Security measures shall be implemented when personnel are working remotely to protect information accessed, processed, or stored outside the organization's premises.

6.8 Information security event reporting - The organization shall provide a mechanism for personnel to report observed or suspected information security events through appropriate channels in a timely manner.

Employment Screening - Does the organization screen potential employees during the hiring process, to determine trustworthiness?

Roles - CISO - Is there an employee in the organization that oversees the development and implementation of security policies and procedures?

Responsibilities - Perms - Is/are there personnel responsible for determining and implementing the appropriate access and permissions levels for users?

Responsibilities - CISO - Are the job role and responsibilities of the employee who oversees the development and implementation of security policies and procedures fully documented?

Roles - Authority - If there is not a job role identified for development and implementation of security policies, is there a recognized personnel that staff contact in the case of security events?

Have you Implement policies and procedures to ensure that personnel are able to enact your information security program by providing your personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment?\

Have you Implemented policies and procedures to ensure that personnel are able to enact your IS program by utilizing qualified IS personnel employed by you or an affiliate or service provider sufficient to manage your IS risks and to perform or oversee the IS program?

Have you Implemented policies and procedures to ensure that personnel are able to enact your information security program by verifying that key information security personnel take steps to maintain current knowledge of changing information security threats and countermeasures?

Have you Implemented policies and procedures to ensure that personnel are able to enact your information security program by providing information security personnel with security updates and training sufficient to address relevant security risks?

Amends existing laws to align with DORA.

Ensures fund managers also comply with digital operational resilience obligations.

Establish and Maintain Detailed Enterprise Asset Inventory

Establish and Maintain a Data Inventory

Establish and Maintain a Data Classification Scheme

Document Data Flows

Establish and Maintain an Inventory of Service Providers

Cloud service customers must ensure that public-facing domain ownership, registrar controls, and DNS management are governed with documented accountability.