Risk management strategy 2.19.2 Authorization boundary of the DM 2.7.2, 2.18.5 system Industry best practices that influence the 2.17.4 DM system security program Policy.2 Policy - The organization develops and documents a DM Organizational system security policy, supporting plans, processes, and procedures that address the organizational aspects of the DM system security program including the following areas: Executive accountability and authority 2.2.3, 2.19.2 for the DM system security program Management and leadership and 2.2.2, 2.2.3, 2.4.1, responsibilities including; 1 approval of 2.6.1, 2.8.1, 2.9.1, security policy, 2 assignments of 2.10.1, 2.11.1, 2.12.1, security roles, 3 coordination, 2.13.1, 2.14.1, 2.15.1, implementation, and accountability of 2.16.1, 2.17.1, 2.18.1 the DM system security program Roles, responsibilities, and identification 2.10.1, 2.11.1, 2.11.3, of the organization’s DM security 2.14.5, 2.15.8, 2.18.1 personnel The organization’s contracts with 2.2.3, 2.5.9 external entities that address the organization’s DM system security policies and procedures with business partners, contractors, and outsourcing partners Coordination organizational entities 2.3.1, 2.4.1, 2.6.1, of the DM system security program to 2.8.1 ensure compliance with the organization’s security policy and other regulatory commitments Roles and responsibilities for all 2.7.4, 2.12.1 personnel involved in the organizations DM system incident response process Initial and refresher training on the DM 2.12.4 incident response process for all personnel involved in the organizations DM system incident response process Coordination efforts with law 2.2.4, 2.12.1 enforcement agencies, regulators, Internet service providers and other
Risk management strategy 2.19.2 Authorization boundary of the DM system 2.7.2, 2.18.5 Industry best practices that influence the DM system security program 2.17.4 Policy.2 Policy - Organizational The organization develops and documents a DM system security policy, supporting plans, processes, and procedures that address the organizational aspects of the DM system security program including the following areas: Executive accountability and authority for the DM system security program 2.2.3, 2.19.2 Management and leadership and responsibilities including; 1 approval of security policy, 2 assignments of security roles, 3 coordination, implementation, and accountability of the DM system security program 2.2.2, 2.2.3, 2.4.1, 2.6.1, 2.8.1, 2.9.1, 2.10.1, 2.11.1, 2.12.1, 2.13.1, 2.14.1, 2.15.1, 2.16.1, 2.17.1, 2.18.1 Roles, responsibilities, and identification of the organization’s DM security personnel 2.10.1, 2.11.1, 2.11.3, 2.14.5, 2.15.8, 2.18.1 The organization’s contracts with external entities that address the organization’s DM system security policies and procedures with business partners, contractors, and outsourcing partners 2.2.3, 2.5.9 Coordination organizational entities of the DM system security program to ensure compliance with the organization’s security policy and other regulatory commitments 2.3.1, 2.4.1, 2.6.1, 2.8.1 Roles and responsibilities for all personnel involved in the organizations DM system incident response process 2.7.4, 2.12.1 Initial and refresher training on the DM incident response process for all personnel involved in the organizations DM system incident response process 2.12.4 Coordination efforts with law enforcement agencies, regulators, Internet service providers and other 2.2.4, 2.12.1