I1 (3 points)
https://knobit.org/id/task/dsec-regulatory-requirements/I1
Also as Turtle · JSON-LD · RDF/XML
| dcterms:license | https://creativecommons.org/licenses/by/4.0/ |
|---|---|
| rdfs:label | I1 (3 points) en |
| schema:hasPart | dsec-regulatory-requirements I1: RQ-002 has no control |
| schema:hasPart | dsec-regulatory-requirements I1: RQ-006 has no data scope |
| schema:hasPart | dsec-regulatory-requirements I1: RQ-005 cites a requirement PCI DSS does not have |
| schema:hasPart | dsec-regulatory-requirements I1: CT-006 has no owner |
| schema:hasPart | dsec-regulatory-requirements I1: CT-007 has no evidence |
| schema:hasPart | dsec-regulatory-requirements I1: DORA produced no requirements |
| schema:identifier | I1 |
| schema:position | 3 |
| schema:text | 0.5 each. (a) RQ-002 (records of processing, GDPR Art. 30) has no control: one proposed, owned by the DPO, or raised. (b) RQ-006 'All data shall be encrypted' has no data scope: categories and data sets proposed or asked for. (c) RQ-005 cites 'PCI DSS v4.0.1 Req. 13.2', which does not exist (PCI DSS has twelve principal requirements); MFA into the cardholder data environment is Req. 8.4.2. (d) CT-006 has no owner. (e) CT-007, the erasure workflow, has no evidence and was never tested. (f) DORA and the EBA guidelines are in force and produced no requirements: requirements proposed (e.g. ICT access control and logging) or the gap raised. en |