Az Policy Advertizer

EU_GDPR_2016_679_Art._24

EU General Data Protection Regulation (GDPR) 2016/679 Art. 24

Chapter 4 - Controller and processor

Responsibility of the controller

Shared

n/a

306

EU_GDPR_2016_679_Art._25

EU General Data Protection Regulation (GDPR) 2016/679 Art. 25

Chapter 4 - Controller and processor

Data protection by design and by default

Shared

n/a

306

EU_GDPR_2016_679_Art._28

EU General Data Protection Regulation (GDPR) 2016/679 Art. 28

Chapter 4 - Controller and processor

Processor

Shared

n/a

306

EU_GDPR_2016_679_Art._32

EU General Data Protection Regulation (GDPR) 2016/679 Art. 32

Chapter 4 - Controller and processor

Security of processing

Shared

n/a

306

FedRAMP_High_R4

SC-12

FedRAMP_High_R4_SC-12

FedRAMP High SC-12

System And Communications Protection

Cryptographic Key Establishment And Management

Shared

n/a

The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction]. Supplemental Guidance: Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. Organizations define key management requirements in accordance with applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance, specifying appropriate options, levels, and parameters. Organizations manage trust stores to ensure that only approved trust anchors are in such trust stores. This includes certificates with visibility external to organizational information systems and certificates related to the internal operations of systems. Related controls: SC-13, SC-17. References: NIST Special Publications 800-56, 800-57.

FedRAMP_Moderate_R4_SC-12

FedRAMP_Moderate_R4

SC-12

FedRAMP Moderate SC-12

System And Communications Protection

Cryptographic Key Establishment And Management

Shared

n/a

NIST_SP_800-171_R2_3.13.10

NIST_SP_800-171_R2_3

.13.10

NIST SP 800-171 R2 3.13.10

System and Communications Protection

Establish and manage cryptographic keys for cryptography employed in organizational systems.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Cryptographic key management and establishment can be performed using manual procedures or mechanisms supported by manual procedures. Organizations define key management requirements in accordance with applicable federal laws, Executive Orders, policies, directives, regulations, and standards specifying appropriate options, levels, and parameters. [SP 800-56A] and [SP 800-57-1] provide guidance on cryptographic key management and key establishment.

NIST_SP_800-53_R4

SC-12

NIST_SP_800-53_R4_SC-12

NIST SP 800-53 Rev. 4 SC-12

System And Communications Protection

Cryptographic Key Establishment And Management

Shared

n/a

NIST_SP_800-53_R5

SC-12

NIST_SP_800-53_R5_SC-12

NIST SP 800-53 Rev. 5 SC-12

System and Communications Protection

Cryptographic Key Establishment and Management

Shared

n/a

Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction].

op.cont.3 Periodic tests

404 not found

n/a

op.cont.4 Alternative means

404 not found

n/a

RBI_ITF_NBFC_v2017_6

RBI IT Framework 6

Business Continuity Planning

Business Continuity Planning (BCP) and Disaster Recovery-6

n/a

BCP forms a significant part of an organisation's overall Business Continuity Management plan, which includes policies, standards and procedures to ensure continuity, resumption and recovery of critical business processes. BCP shall be designed to minimise the operational, financial, legal, reputational and other material consequences arising from a disaster. NBFC should adopt a Board approved BCP Policy. The functioning of BCP shall be monitored by the Board by way of periodic reports. The CIO shall be responsible for formulation, review and monitoring of BCP to ensure continued effectiveness. The BCP may have the following salient features

6.2

RBI_ITF_NBFC_v2017_6.2

RBI IT Framework 6.2

Business Continuity Planning

Recovery strategy / Contingency Plan-6.2

n/a

NBFCs shall try to fully understand the vulnerabilities associated with interrelationships between various systems, departments and business processes. The BCP should come up with the probabilities of various failure scenarios. Evaluation of various options should be done for recovery and the most cost-effective, practical strategy should be selected to minimize losses in case of a disaster.

6.3

RBI_ITF_NBFC_v2017_6.3

RBI IT Framework 6.3

Business Continuity Planning

Recovery strategy / Contingency Plan-6.3

n/a

NBFCs shall consider the need to put in place necessary backup sites for their critical business systems and Data centers.

6.4

RBI_ITF_NBFC_v2017_6.4

RBI IT Framework 6.4

Business Continuity Planning

Recovery strategy / Contingency Plan-6.4

n/a

NBFCs shall test the BCP either annually or when significant IT or business changes take place to determine if the entity could be recovered to an acceptable level of business within the timeframe stated in the contingency plan. The test should be based on ???worst case scenarios???. The results along with the gap analysis may be placed before the CIO and the Board. The GAP Analysis along with Board???s insight should form the basis for construction of the updated BCP.