Recommended Solutions to Mitigate Narrative Control Procedure Control Gap Control Gaps System Terminations A supervisor must send in an ITRF to disable a terminated user's access. Additionally, the IT department weekly receives a termination report on Fridays from the company's HR system that is worked by the IT helpdesk. As part of the quarterly access reviews performed by the application owners, all system users are compared to the HR database for any termed employees whose accounts are not yet disabled. This is an in-house developed process that does require some manually entry and has been noted by previous audits to have issues identifying all terminated employees. Since a user must log into the network prior to accessing any system, IT will disable the network login first and then clean up access to each system within 30 days of disabling their network account. Policies exist as to the required timing of disabling network logins and then associated follow-up on each system. Server and Database Virtualization Bob and the CP1 use a standard process to virtualize servers and databases. This process provides a safe and secure method to implement these virtualization processes. PCI Requirements Although Bob adheres to all PCI requirements, the organizations credit card volume is low enough that Bob is required only to complete an annual PCI self-assessment. Customer Data As part of Bob's loyalty program, customer data is collected and stored within the LS. Bob's security configurations and processes covering all of Bob's IT environment adheres to all regulatory considerations. Upon a data breach at CP1, Bob's breach intrusion plan covers this event and is annually tested