Forum

Share stories, ideas, pictures and more!

Get answers and share knowledge.

Processes should be in place to ensure confidentiality, integrity, and availability of sensitive data. This includes the

This refers to anti-virus/anti-malware configurations, firewalls, intrusion detection systems, software updates, patches

This control domain includes mobile storage (e.g., USB drives, CD-ROMs, DVD-ROMs, backup tapes).

This covers requirements specific to laptops, smart phones and tablets.

This refers to all aspects of corporate and guest wireless networks but does not include protections for devices connect

This includes all aspects of configuration managementas well as environments used for development and testing.

This includes vulnerability scanning and patching, antivirus/anti-malware and network/host-based penetration detection.

This includes all aspects of perimeter and internal network security.

This includes web and network connections, such as those for VPN, email, and chat.

This covers specific issues around the use of traditional passwords.

This control includes all aspects of access control other than the use of traditional passwords.

This refers to controls for audit logging and monitoring.

This domain control is for the awareness campaigns, as well as the initial and continual education and training.

This refers to all aspects of managing risk linked to third parties, such as vendors and business associates.

These controls relate to incident monitoring and detection activities, incident response, and breach reporting.

This covers all aspects of contingency, business continuity, and disaster recovery.

This includes risk assessment, risk analysis, and other operations connected to risk management.

This domain includes physical and environmental security requirements for data centers and other facilities.

The final domain addresses the organization’s compliance and privacy program and related controls.