PCI (Payment Card Industry Security Standard)
Track and monitor all access to network resources and cardholder data
Req 10.8.1
10.8.1 Additional requirement for service providers only: respond to failures of any critical security controls in a timely manner. Processes for responding to failures in security controls must include: – restoring security functions – Identifying and documenting the duration (date and time start to end) of the security failure – Identifying and documenting cause(s) of failure including root cause and documenting remediation required to address root cause – Identifying and addressing any security issues that arose during the failure – Performing a risk assessment to determine whether further actions are required as a result of the security failure – Implementing controls to prevent cause of failure from reoccurring – Resuming monitoring of security controls. Note: This requirement is a best practice until January 31 2018 after which it becomes a requirement.
If critical security control failures alerts are not quickly and effectively responded to attackers may use this time to insert malicious software gain control of a system or steal data from the entity’s environment. Documented evidence (e.g. records within a problem management system) should support that processes and procedures are in place to respond to security failures. In addition personnel should be aware of their responsibilities in the event of a failure. Actions and responses to the failure should be captured in the documented evidence.
Click here to Start your FREE trial today!
What is a Cybersecurity Compliance Framework?
You don’t need to clutter your security and privacy programs with an ever-increasing number of tools as they become more sophisticated. The Lionfish platform offers a one-stop solution to track progress and monitor any framework, from custom-built ones to highly-specialized and in-demand top security and privacy frameworks and certifications.
With the Lionfish platform, every framework is supported with guided scoping, policies, controls, automated evidence collection, and continuous monitoring, ensuring efficient preparation for audits or attestation in minimal time.
The Lionfish platform is compatible with a wide range of security and privacy frameworks, including:
- CMMC v2
- HIPAA
- NERC CIP-002 through CIP-014 Revision 6
- NIST 800-171
- NIST 800-172
- PCI (Payment Card Industry Security Standard)
- SOC 2
- NIST 800-53
- NIST SP800-161 Supply Chain Risk Management
- NIST-CSF
- CIS Framework Controls V8
Click here to Start your FREE trial today!