Security and privacy, built in

Policy outlining the processes for provisioning, modifying and revoking user access rights. It defines how often and how user access reviews are performed.

User access rights are provisioned and deprovisioned according to the procedure defined in the access control policy.

A central identity provider (IdP) deploys role-based access control across all organizational systems.

User access reviews are performed periodically on all in-scope systems, with system owners formally approving access control lists.

Physical and virtual assets are inventoried. The inventory defines each asset's owner, classification (for example secure, confidential or public) and location.

Policy setting out data classification levels, which define the appropriate use of each data type, including whether labeling is required.

Multifactor authentication is required for all sensitive access, including privileged access and access to the production environment.

Policy defining the password strength criteria used across all organizational systems.

Passwords are required to authenticate to all systems and applications, and password complexity requirements are enforced technically.

Data at rest, such as databases and storage, is encrypted using industry-accepted standards.

Data in transit, such as data sent over a public network, is encrypted using industry-accepted standards. Deprecated protocols are avoided.

Policy defining encryption requirements, such as cipher strength, for data at rest and in transit, and the procedures for key management, storage and rotation.

Keys are rotated periodically and redistributed securely.

An annual training plan covers all employees and addresses the professional development requirements of each department.

A security awareness curriculum is built from topic-specific training materials. All employees complete awareness training at least once a year.

Software engineers complete annual training in secure coding techniques based on industry best practices.

Policy defining training requirements for employees, covering both training content and frequency.

An endpoint detection and response (EDR) solution is installed on organizational devices.

Organizational devices are managed centrally through a mobile device management system that enforces defined policies.

Disk encryption is enforced on all organizational devices.

Policy governing information security across the organization. It explicitly covers the use of cloud technologies and their risks, and the risks of sensitive personal data (PII) the organization stores or processes.

Employees are informed of possible disciplinary action, as set out in the employee handbook, and a record is kept of any action taken.

An employee handbook is available to all employees and must be signed during onboarding. It contains the code of conduct, the acceptable use policy and confidentiality commitments.

Policy outlining HR processes across the employment lifecycle: before employment, onboarding, the employment period and offboarding.

Background screening and professional reference checks are completed for new employees and contractors before hire.

Documented policy setting out organizational responsibilities in the event of an incident, with basic protocols to follow for all incidents.

A formal procedure defines the response plan once an information security event is classified as an incident.

Logging records key events at the application and infrastructure layers, such as:

• Logon attempts
• Data deletions
• Application and system errors
• Changes to software and configuration settings
• Changes to system, configuration or content files

Automated alerts notify IT of predefined potential issues. For example, repeated failed sign-in attempts or highly privileged access, even when authorized, can trigger an alert. Non-security alerts include resource availability thresholds and backup failures.

The application is scanned against known vulnerabilities (CVEs), and findings are remediated within the timeframes set in the vulnerability management policy.

Firewalls at the application gateway and production network limit access to unnecessary ports, protocols and services. The rules are reviewed and approved periodically.

Organizational infrastructure is scanned against known vulnerabilities (CVEs), and findings are remediated within the timeframes set in the vulnerability management policy.

Intrusion detection and prevention systems continuously monitor the network and block potentially malicious activity.

Policy defining guidelines for network access and giving an overview of the network architecture.

Physical security measures such as CCTV, intruder alarms and guards allow activity to be monitored.

Policy setting out the approach to physical access control and the technical mechanisms that prevent unauthorized access to premises. It also covers the use and management of safety devices such as fire extinguishers and smoke detectors.

Backup restoration is tested periodically to confirm the integrity and completeness of backed-up information.

A business continuity plan covers critical processes and assets, and is tested and reviewed every year.

A business impact analysis identifies business-critical processes and assets and forms an integral part of the business continuity plan. Recovery time objectives (RTOs) and recovery point objectives (RPOs) are defined for business-critical systems.

A clearly defined schedule covers both incremental and full-system backups.

Multiple availability zones provide redundancy for critical resources in case of system downtime.

A risk register is maintained, with an owner and mitigating controls defined for each risk.

Each risk in the register has a defined strategy (accept, transfer, avoid or mitigate) and a course of action in line with that strategy.

The source code management system is integrated with static analysis (SAST) and software composition analysis (SCA) tools.

Policy setting out the security aspects of the software development process.

Development, testing and production environments are separated to reduce the risk of unauthorized access or changes to production.

All new code undergoes functional testing as part of the deployment process.

Vendor audit reports and compliance attestations are reviewed every year. For SOC 2 reports, the impact of control exceptions and applicable complementary user entity controls (CUECs) are considered. Vendor agreements are also reviewed every year.

Policy defining how vendors are evaluated before onboarding, along with security requirements and termination procedures.