Periodic compliance activities supported by the Software
- Automated generation of compliance status reports
- Ensuring data privacy and protection measures are up to date.
- Maintain compliance and evidence documentation
- Monitor and address customers' compliance failures
- Monitoring and documenting system changes for compliance impact
- Ongoing evaluation and management of security risks.
- Organizing periodic security awareness training for users
- Periodic audits of user permissions and access rights.
- Perform quarterly compliance process review
- Regular updates to the incident response plan
- Routine updates to fix vulnerabilities and maintain security standards
- Testing backup and recovery plans to ensure operational
The Software store, process, or transmit
- Customer account data
- Sensitive information such a as Cardholder Data (CHD), Protected Health Information (PHI), Intellectual Property (IP), Bulk Electric System Critical Information (BCSI)
- Other classified information as per relevant compliance standards
- Not Applicable
The Software requires to be integrated with other systems impacting the cybersecurity or compliance of the customer
- Required integration
- Optional integration
- Not Applicable
Software modules implemented
- Modules that provide cybersecurity services for compliance (e.g., built-in features for PCI DSS, NERC CIP compliance, recurring activities, etc.)
- Modules that securely store, process, or transmit customer account data or other sensitive information
- Modules that facilitate network security controls
- Modules that virtualize (e.g., machines, networks, appliances, applications, and hypervisors)
- Modules purchased, subscribed (e.g., SaaS, bespoke and custom software, etc.)
- Tools, code repositories, and systems that implement software configuration management or to systems that can impact the cybersecurity
- Not Applicable
Software vendor Third-Party Service Providers (TPSPs) used
- TPSPs that store, process, or transmit customer account data or other sensitive information on the entity’s behalf
- TPSPs that impact the cybersecurity of the software vendor account data, sensitive information (e.g. vendors providing remote support)
- TPSPs that manage software vendor modules/components included in the evaluation scope
- Not Applicable
