Cross-cloud security rules

General

• Block storage volumes must be encrypted High
• Cache service security hardening High
• Cache services must enforce TLS encryption in transit High
• Container registry security hardening High
• Database authentication must use managed identities High
• Databases must not be publicly accessible Critical
• IAM password policy must require minimum length of 14 Medium
• Key management service security hardening High
• Kubernetes clusters must restrict public API access High
• Load balancers must have access logging enabled Medium
• NoSQL database security hardening High
• Object storage must have encryption at rest enabled High
• Organization should appoint a Data Protection Officer where required High
• Organization should assess and monitor third-party vendor risks Medium
• Organization should assign PCI DSS security responsibilities High
• Organization should classify data by confidentiality level Medium
• Organization should classify information according to confidentiality requirements High
• Organization should collect and analyze threat intelligence Medium
• Organization should communicate security responsibilities to all personnel Medium
• Organization should conduct annual PCI risk assessments High
• Organization should conduct Data Protection Impact Assessments for high-risk processing High
• Organization should conduct formal risk assessments High
• Organization should conduct HIPAA-compliant risk analysis Critical
• Organization should conduct internal information security audits High
• Organization should conduct penetration testing at least annually Critical
• Organization should conduct risk assessments (RA-3) Critical
• Organization should conduct security assessments (CA-2) High
• Organization should conduct security awareness training for all personnel High
• Organization should define and enforce data retention schedules High
• Organization should define and protect physical security perimeters Medium
• Organization should define governance structure and oversight responsibilities High
• Organization should define information security roles and responsibilities High
• Organization should define risk appetite and tolerance levels Medium
• Organization should define security responsibilities upon termination High
• Organization should designate a HIPAA Security Officer Critical
• Organization should develop a contingency plan (CP-2) High
• Organization should develop a system security plan (PL-2) High
• Organization should develop an incident response plan (IR-1) Critical
• Organization should document lawful basis for all personal data processing Critical
• Organization should enforce separation of duties (AC-5) High
• Organization should establish access control policies (AC-1) High
• Organization should establish configuration management policy (CM-1) High
• Organization should establish incident management procedures Critical
• Organization should have a disciplinary process for security violations Medium
• Organization should have breach notification procedures Critical
• Organization should have breach notification procedures Critical
• Organization should have data processing agreements with all processors Critical
• Organization should have procedures for evidence collection and preservation Medium
• Organization should have procedures to handle data subject access requests High
• Organization should have processes for external security communications Medium
• Organization should have safeguards for international data transfers High
• Organization should have secure data disposal procedures Medium
• Organization should identify applicable legal and regulatory requirements High
• Organization should implement a secure software development lifecycle High
• Organization should implement change detection mechanisms Medium
• Organization should implement clear desk and clear screen policies Low
• Organization should implement data protection by design and by default Medium
• Organization should implement device and media controls High
• Organization should implement facility access controls High
• Organization should implement physical access controls to the CDE High
• Organization should implement right to erasure procedures High
• Organization should implement security incident response procedures Critical
• Organization should implement valid consent mechanisms High
• Organization should implement workforce clearance procedures High
• Organization should implement workforce termination procedures High
• Organization should implement workstation security policies Medium
• Organization should integrate security into business continuity management High
• Organization should integrate security into project management Medium
• Organization should maintain a code of conduct and ethics policy Medium
• Organization should maintain a comprehensive information security policy High
• Organization should maintain a contingency plan for ePHI High
• Organization should maintain a PCI incident response plan Critical
• Organization should maintain a Plan of Action and Milestones (CA-5) High
• Organization should maintain a sanctions policy for violations High
• Organization should maintain an information security policy approved by management High
• Organization should maintain an inventory of information assets High
• Organization should maintain Business Associate Agreements Critical
• Organization should maintain capacity and availability planning Medium
• Organization should maintain cardholder data flow diagrams High
• Organization should maintain contact with relevant authorities Medium
• Organization should maintain current network diagrams High
• Organization should maintain documented information security policies High
• Organization should maintain formal change management procedures High
• Organization should maintain logical access policies and procedures High
• Organization should manage information security in supplier relationships High
• Organization should manage information system accounts (AC-2) High
• Organization should manage removable media securely Medium
• Organization should manage service provider PCI compliance High
• Organization should manage supply chain risks (SA-12) Medium
• Organization should monitor and remediate control deficiencies High
• Organization should monitor system operations and detect anomalies High
• Organization should perform background checks for CDE access personnel High
• Organization should perform background checks for security-relevant roles High
• Organization should perform personnel screening Medium
• Organization should perform quarterly vulnerability scans High
• Organization should perform vulnerability scanning (RA-5) High
• Organization should provide GDPR awareness training to all staff Medium
• Organization should provide HIPAA security awareness training High
• Organization should provide information security awareness and training High
• Organization should provide role-based security training (AT-3) Medium
• Organization should provide security awareness training (AT-2) High
• Organization should provide transparent privacy notices High
• Organization should regularly review information system activity High
• Organization should review and analyze audit records (AU-6) High
• Organization should securely destroy cardholder data media High
• Organization should support data portability requests Medium
• Organization should test contingency plans periodically High
• Organization should test incident response capability (IR-3) High
• Organization should test the contingency plan (CP-4) High
• Organization should test the incident response plan annually High
• Organization should train incident response personnel (IR-2) High
• Relational database security hardening High