Showing 48 controls
Have you designated an employee or employees to coordinate your information security program?
The goal is to ensure that appropriate safeguards are in place and effective.
Have you currently Designated a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program? The Qualified Individual may be employed by you, an affiliate, or a service provider.
The goal is to ensure that appropriate safeguards are in place and effective.
Have you designated a senior member of your personnel responsible for direction and oversight of the Qualified Individual?
The goal is to ensure that appropriate safeguards are in place and effective.
Have you identified reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized compromise of such information, and assessed the sufficiency of any safeguards in place to control these risks?
The goal is to ensure that appropriate safeguards are in place and effective.
Does the assessment also include the adequacy of the existing controls in the context of the identified risks or threats you face; and Requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the IS program will address the risks?
The goal is to ensure that appropriate safeguards are in place and effective.
Does this risk assessment include consideration of risks in each relevant area of your operations, including: Employee training and management?
The goal is to ensure that appropriate safeguards are in place and effective.
Do you periodically perform additional risk assessments that re-examine the reasonably foreseeable internal and external risks to customer information that could result in the unauthorized disclosure, or other compromise of such info, and reassess the safeguards in place to control these risks?
The goal is to ensure that appropriate safeguards are in place and effective.
Does this risk assessment include consideration of risks in each relevant area of your operations, including: Information systems, including network and software design, as well as information processing, storage, transmission and disposal?
The goal is to ensure that appropriate safeguards are in place and effective.
Is your risk assessment written and does it include criteria for the evaluation and categorization of identified security risks, criteria for the assessment of the confidentiality, integrity, and availability of your IS and customer information,
The goal is to ensure that appropriate safeguards are in place and effective.
Do you currently base your IS program on a risk assessment that identifies foreseeable internal and external risks to the security, and integrity of customer info that could result in the unauthorized disclosure, or other compromise of such info, and assesses the safeguards to control these risks?
The goal is to ensure that appropriate safeguards are in place and effective.
Does this risk assessment include consideration of risks in each relevant area of your operations, including: detecting, preventing and responding to attacks, intrusions, or other systems failures?
The goal is to ensure that appropriate safeguards are in place and effective.
Have you designed and implemented information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures?
The goal is to ensure that appropriate safeguards are in place and effective.
Have you adopted and implemented procedures for change management, as well as controls designed to minitor and log the activity of authorized users and detect unauthorized access or use of, or tamper with, customer information by such users?
The goal is to ensure that appropriate safeguards are in place and effective.
Do you design and implement safeguards to authenticate and permit access only to authorized users to protect against the unauthorized acquisition of customer information?
The goal is to ensure that appropriate safeguards are in place and effective.
Have you?implemented multi-factor authentication for any individual accessing any information system, unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls?
The goal is to ensure that appropriate safeguards are in place and effective.
Do you currently Identify and manage the data, personnel, devices, systems, and facilities that enable you to achieve business purposes in accordance with their relative importance to business objectives and your risk strategy?
The goal is to ensure that appropriate safeguards are in place and effective.
Have you developed procedures for information necessary for business operations or for other legitimate business purposes, or required to be retained by law or regulation, or where disposal is not feasible due to the manner in which it is maintained to minimize the unnecessary retention of data?
The goal is to ensure that appropriate safeguards are in place and effective.
Do you Design and implement safeguards to Limit authorized users' access only to customer information that they need to perform their duties or, in the case of customers, to access their own information?
The goal is to ensure that appropriate safeguards are in place and effective.
Have you developed, implemented, and currently maintain procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used in connection with the provision of a product or service to the customer to which it relates?
The goal is to ensure that appropriate safeguards are in place and effective.
Do you periodically review your data retention poicy to minimiz the unnecessary retention of data?
The goal is to ensure that appropriate safeguards are in place and effective.
Have you adopted secure dev practices for in-house developed applications utilized for transmitting, accessing, or storing customer info, and procedures for evaluating, assessing, or testing the security of externally developed applications you utilize to transmit, access, or store customer info?
The goal is to ensure that appropriate safeguards are in place and effective.
Do you design and implement safeguards to control the risks you identity through risk assessment, including by Implementing and periodically reviewing access controls, including technical and, as appropriate, physical controls to both?
The goal is to ensure that appropriate safeguards are in place and effective.
Do you Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest?
The goal is to ensure that appropriate safeguards are in place and effective.
Do you regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures, including those to detect actual and attempted attacks on, or intrusions into, information systems?
The goal is to ensure that appropriate safeguards are in place and effective.
Does the monitoring and testing include continuous monitoring or periodic penetration testing and vulnerability assessments?
The goal is to ensure that appropriate safeguards are in place and effective.
Do you conduct Annual penetration testing of your information systems, determined each give year based on relevant identified rusisk in accordance with the risk assessment?
The goal is to ensure that appropriate safeguards are in place and effective.
Do you conduct vulnerability assessments including any system scans or reviews of systems resonably designed to identify publicly known security vulnerabilities in your information system based on the risk assessment at lease every six months?
The goal is to ensure that appropriate safeguards are in place and effective.
Do you Evaluate and adjust your IS program in light of the results of the testing and monitoring including any material changes to your operations or business arrangements or any other circumstances that you know or have reason to know may have a material impact on your IS program?
The goal is to ensure that appropriate safeguards are in place and effective.
Do you conduct vulnerability assessments whenever there are material changes to your operations or business arrangements and whenever there are circumstances you know or have reason to know may have a material impact on your information security program?
The goal is to ensure that appropriate safeguards are in place and effective.
Have you Implement policies and procedures to ensure that personnel are able to enact your information security program by providing your personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment?\
The goal is to ensure that appropriate safeguards are in place and effective.
Have you Implemented policies and procedures to ensure that personnel are able to enact your IS program by utilizing qualified IS personnel employed by you or an affiliate or service provider sufficient to manage your IS risks and to perform or oversee the IS program?
The goal is to ensure that appropriate safeguards are in place and effective.
Have you Implemented policies and procedures to ensure that personnel are able to enact your information security program by verifying that key information security personnel take steps to maintain current knowledge of changing information security threats and countermeasures?
The goal is to ensure that appropriate safeguards are in place and effective.
Have you Implemented policies and procedures to ensure that personnel are able to enact your information security program by providing information security personnel with security updates and training sufficient to address relevant security risks?
The goal is to ensure that appropriate safeguards are in place and effective.
Do you oversee service providers by taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue?
The goal is to ensure that appropriate safeguards are in place and effective.
Do you currently Oversee service providers, by: Requiring your service providers by contract to implement and maintain such safeguards?
The goal is to ensure that appropriate safeguards are in place and effective.
Do you oversee service providers by periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards?
The goal is to ensure that appropriate safeguards are in place and effective.
Do you oversee service providers by requiring your service providers by contract to implement and maintain such safeguards?
The goal is to ensure that appropriate safeguards are in place and effective.
If this is a service provider or affiliate, do you require the service provider or affiliate to maintain an information security program that protects you in accordance with the requirements?
The goal is to ensure that appropriate safeguards are in place and effective.
Do you currently Oversee service providers, by: Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue?
The goal is to ensure that appropriate safeguards are in place and effective.
Have you Evaluated and adjusted your information security program in light of the results of the testing and monitoring required, or any material changes to your operations or business arrangements due to the results of risk assessments performed?
The goal is to ensure that appropriate safeguards are in place and effective.
Does your incident response plan address the following areas: Documentation and reporting regarding security events and related incident response activities, and the evaluation and revision as necessary of the incident response plan following a security event?
The goal is to ensure that appropriate safeguards are in place and effective.
Does your incident response plan address the following areas:The goals of the incident response plan, The internal processes for responding to a security event, The definition of clear roles, responsibilities, and levels of decision-making authority?
The goal is to ensure that appropriate safeguards are in place and effective.
Have you established a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information in your control?
The goal is to ensure that appropriate safeguards are in place and effective.
Does your incident response plan address the following areas: External and internal communications and information sharing, and Identification of requirements for the remediation of any identified weaknesses in information systems and associated controls?
The goal is to ensure that appropriate safeguards are in place and effective.
Does the report include the overall status of the IS program and compliance, and matters related to the program addressing issues such as risk assessment/mgmt and control decisions,service provider arrangements,testing results,security events/violations and mgmt's responses, and recommended changes?
The goal is to ensure that appropriate safeguards are in place and effective.
Do you require your Qualified Individual to report in writing, regularly and at least annually, to your board of directors or equivalent governing body.
The goal is to ensure that appropriate safeguards are in place and effective.
Design and implement safeguards to control the risks you identify through your risk assessment.
Desired outcome.
Periodically assess the risk to organizational operations, organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
Registrar and WHOIS data are regularly audited during risk assessments and updated accordingly.