Controls

Unique account authentication enforced

Authentication to systems and applications uses unique credentials or authorized keys per user.

Access control procedures established

Access control policies define how users are added, modified, and removed from systems.

Remote access encrypted enforced

Remote access to production systems is restricted to authorized users via encrypted connections.

Information security for use of cloud services

Processes for acquisition, use, management and exit from cloud services are established in accordance with the organization’s information security requirements.

Information transfer

Information transfer rules, procedures, or agreements are in place for all types of transfer facilities within the organization and between the organization and other parties.

Authentication information

Allocation and management of authentication information is controlled by a management process, including advising personnel on the appropriate handling of authentication information.

Secure authentication

Secure authentication technologies and procedures are implemented based on information access restrictions and the topic-specific policy on access control.

Use of privileged utility programs

The use of utility programs that can be capable of overriding system and application controls is restricted and tightly controlled.

Monitoring activities

Networks, systems and applications are monitored for anomalous behaviour and appropriate actions taken to evaluate potential information security incidents.

Remote working

Security measures are implemented when personnel are working remotely to protect information accessed, processed or stored outside the organization’s premises.

Segregation of networks

Groups of information services, users and information systems are segregated in the organization’s networks.

Web filtering

Access to external websites is managed to reduce exposure to malicious content.

Clock synchronization

The clocks of information processing systems used by the organization are synchronized to approved time sources.

Application security requirements

Information security requirements are identified, specified and approved when developing or acquiring applications.

Employee background checks performed

Background checks are performed on employees in accordance with local laws and regulations.

Code of Conduct acknowledged

Employees acknowledge a Code of Conduct covering security and privacy expectations.

Control self-assessments conducted

Security and compliance controls are periodically reviewed and self-assessed.

Vulnerability and system monitoring established

Processes exist for vulnerability management and security monitoring of production systems.

Continuity and Disaster Recovery plans established

Business continuity and disaster recovery plans are defined for critical services.

Development lifecycle established

A secure development lifecycle governs changes to the platform.

Data retention procedures established

Retention and disposal procedures guide how customer and company data is stored and deleted.

Data classification policy established

Data classification guidelines help ensure that confidential data is secured and access controlled.