Showing 62 controls
Access to client data requires a unique ID assigned to each user.
The goal is to ensure that appropriate safeguards are in place and effective.
The virtual firewall is equipped with intrusion detection and prevention system capabilities to identify and block malicious network-based activity or abuse of cloud assets.
The goal is to ensure that appropriate safeguards are in place and effective.
The virtual firewall is configured to log alerts for suspicious activity, including potential security events or incidents.
The goal is to ensure that appropriate safeguards are in place and effective.
Logged alerts are reviewed and investigated as needed to identify, respond to, and mitigate suspicious or malicious activity.
The goal is to ensure that appropriate safeguards are in place and effective.
All access request and modification activities are documented in the Jira ticketing system to maintain an auditable record of approvals and provisioning.
The goal is to ensure that appropriate safeguards are in place and effective.
Access for non-employees, including temporary employees, consultants, and contractors, is provisioned for a maximum of 90 days or until the current work contract expires, whichever is shorter.
The goal is to ensure that appropriate safeguards are in place and effective.
A review of active non-employee accounts is conducted periodically to ensure compliance with access time limits and work contract terms.
The goal is to ensure that appropriate safeguards are in place and effective.
Generic IDs, including test, service, and system accounts, are reviewed quarterly to verify their continued necessity and ensure they are appropriately controlled.
The goal is to ensure that appropriate safeguards are in place and effective.
If the individual conducting the account review possesses administrative access to the system, an additional review and approval of their access is required by an executive who does not have administrative access.
The goal is to ensure that appropriate safeguards are in place and effective.
Access removal is initiated upon notification from the business or HR of employee termination, role changes, or contract expiration.
The goal is to ensure that appropriate safeguards are in place and effective.
All system access for terminated or disabled employees and consultants is removed within 24 hours of receiving a notification from the business or HR.
The goal is to ensure that appropriate safeguards are in place and effective.
MFA is enabled on all production servers or in all environments where changes can be promoted.
The goal is to ensure that appropriate safeguards are in place and effective.
A virtual firewall is implemented to monitor and control incoming and outgoing network traffic based on predetermined security rules.
The goal is to ensure that appropriate safeguards are in place and effective.
AWS is configured for security logging, alerting and monitoring for potential threats.
The goal is to ensure that appropriate safeguards are in place and effective.
All access requests, including those for employees, temporary employees, consultants, and system accounts, are reviewed and approved by the appropriate level of business and IT management before provisioning.
The goal is to ensure that appropriate safeguards are in place and effective.
Requests to remove or disable access for terminated or disabled employees, temporary employees, or consultants are documented in the Jira ticketing system to maintain an auditable record.
The goal is to ensure that appropriate safeguards are in place and effective.
A quarterly review is performed to ensure that all active accounts are associated with active employees and that access remains appropriate for their roles.
The goal is to ensure that appropriate safeguards are in place and effective.
Application, network and supporting infrastructure administrator accounts is limited to only authorized and appropriate personnel.
The goal is to ensure that appropriate safeguards are in place and effective.
Passwords must meet the following configuration requirements: Minimum length of at least 12 characters and must include at least one uppercase letter, one lowercase letter, one number, and one special character.
The goal is to ensure that appropriate safeguards are in place and effective.
A business impact analysis (BIA) is performed annually that includes tabletop testing of the business continuity and disaster recovery plans.
The goal is to ensure that appropriate safeguards are in place and effective.
On an annual basis, each in-scope system will be restored from a backup and validated to test the integrity of the backup and restore process.
The goal is to ensure that appropriate safeguards are in place and effective.
Compliance Scorecard has an established policy that identifies and designates what information is considered confidential information, and details the information handling, retention and destruction requirements.
The goal is to ensure that appropriate safeguards are in place and effective.
Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.
The goal is to ensure that appropriate safeguards are in place and effective.
All system change requests are formally documented, including a description of the change, justification, and affected systems or components.
The goal is to ensure that appropriate safeguards are in place and effective.
Separate application environments are maintained and utilized when making changes to the platform, and changes are made to development and test environments prior to being promoted to production.
The goal is to ensure that appropriate safeguards are in place and effective.
There is a segregation of duties over making source code changes and migrating changes to the production environment. Access to promote changes is limited based on job responsibilities.
The goal is to ensure that appropriate safeguards are in place and effective.
System change requests are reviewed and approved by management to ensure alignment with business objectives and security requirements.
The goal is to ensure that appropriate safeguards are in place and effective.
All required documentation and testing, as specified in the Change Management Policy, are completed and evidenced for each request before changes are released to production.
The goal is to ensure that appropriate safeguards are in place and effective.
All system changes, including their review, approval, and evidence of adherence to the Change Management Policy, are documented in Jira to maintain a centralized and auditable record.
The goal is to ensure that appropriate safeguards are in place and effective.
Emergency changes follow the same Change Management procedures as standard changes. However, if full change management testing and documentation cannot be performed prior to release, these requirements must be met within one week post-implementation.
The goal is to ensure that appropriate safeguards are in place and effective.
Formal organizational structures, including governance frameworks and reporting lines, are established and documented to ensure clear accountability and operational efficiency.
The goal is to ensure that appropriate safeguards are in place and effective.
New employees are required to read and formally acknowledge understanding of the company???s security policies during the onboarding process.
The goal is to ensure that appropriate safeguards are in place and effective.
All employees are required to reaffirm their understanding of and compliance with company security policies on an annual basis.
The goal is to ensure that appropriate safeguards are in place and effective.
Compliance Scorecard has established HR policies and procedures, including Code of Conduct, and, employees are required to acknowledge them either upon hire and annually.
The goal is to ensure that appropriate safeguards are in place and effective.
Security policies are reviewed and approved by the security committee at least annually to ensure they remain current, relevant, and aligned with organizational and regulatory requirements.
The goal is to ensure that appropriate safeguards are in place and effective.
All personnel including those responsible for system security, availability, and confidentiality commitments complete security awareness training on an annual basis.
The goal is to ensure that appropriate safeguards are in place and effective.
Management evaluates employees performance against expectations and standards.
The goal is to ensure that appropriate safeguards are in place and effective.
Defined roles and responsibilities are established within the organization, including specific assignments for critical functions, and are documented to ensure clarity of accountability.
The goal is to ensure that appropriate safeguards are in place and effective.
Organizational structures and defined roles are maintained in the platform and made available to employees upon request to ensure accessibility and transparency.
The goal is to ensure that appropriate safeguards are in place and effective.
An information security committee is established with a defined structure, reporting lines, and responsibilities. The committee is aligned with the organization???s governance framework to oversee and guide information security strategy and initiatives.
The goal is to ensure that appropriate safeguards are in place and effective.
Approved security policies are published to the Compliance Scorecard platform, ensuring all employees have access to the latest versions of company policies.
The goal is to ensure that appropriate safeguards are in place and effective.
Job descriptions are defined for all personnel responsible for designing, developing, implementing, operating, monitoring, and maintaining the system. These descriptions outline roles, responsibilities, and required skills to ensure alignment with organizational objectives.
The goal is to ensure that appropriate safeguards are in place and effective.
Background checks are performed on new hires as permitted by local laws.
The goal is to ensure that appropriate safeguards are in place and effective.
During the recruitment process, candidates are evaluated against defined job requirements to ensure they possess the necessary qualifications, skills, and experience for their roles.
The goal is to ensure that appropriate safeguards are in place and effective.
Monitoring and alerts are configured by the security team to identify and notify management of incidents when thresholds are crossed on security and operational metrics. Issues, if any, are routed through incident management for resolution.
The goal is to ensure that appropriate safeguards are in place and effective.
Reported client incidents are resolved through documented communication via the client portal and Jira ticketing system to ensure timely and accurate resolution.
The goal is to ensure that appropriate safeguards are in place and effective.
Processing capacity is monitored monthly by management to ensure that current system performance meets operational requirements.
The goal is to ensure that appropriate safeguards are in place and effective.
Policy and procedures for significant processes, which include responsibility for reporting operational failures, incidents, system problems, concerns, and user complaints (and the process for doing so through dedicated support email and phone line) are made available to internal users and clients.
The goal is to ensure that appropriate safeguards are in place and effective.
Compliance Scorecard's clients are provided onboarding materials that details security, availability, and regulatory related requirements, platform access information, and incident escalation information.
The goal is to ensure that appropriate safeguards are in place and effective.
Objective descriptions of Compliance Scorecard's system and its boundaries are made available to authorized client users through ongoing communications and the client portal.
The goal is to ensure that appropriate safeguards are in place and effective.
The organization establishes Terms of Service and/or Master Services Agreement (MSA) with its clients that define service levels, when applicable, and rules of use and additional terms for governing platform use and/or professional services.
The goal is to ensure that appropriate safeguards are in place and effective.
Future processing demands are forecasted on an ongoing basis and compared to scheduled capacity to ensure sufficient resources are available to meet anticipated needs.
The goal is to ensure that appropriate safeguards are in place and effective.
Alerts are configured to notify operations personnel of capacity issues, enabling timely response to potential system performance or availability risks.
The goal is to ensure that appropriate safeguards are in place and effective.
Client incidents, if any, are reported by clients through the client portal or Jira ticketing system to ensure consistent tracking and resolution.
The goal is to ensure that appropriate safeguards are in place and effective.
A formal risk management process is established to evaluate risks based on identified threats and specified tolerances. This process includes defining risk assessment methodologies, risk categories, and evaluation criteria.
The goal is to ensure that appropriate safeguards are in place and effective.
Risk assessments are performed at least annually during security committee management meetings and include evaluations of the following: -Organizational structure, capability, capacity, reporting lines, authorities, and responsibilities. -Environmental, regulatory, and technological changes that have occurred. -The need for additional tools and resources to achieve business objectives. -Threats and vulnerabilities affecting the achievement of commitments to clients.
The goal is to ensure that appropriate safeguards are in place and effective.
Results of the risk assessment, including identified risks and recommended actions, are communicated to the respective owners to ensure accountability for addressing risks.
The goal is to ensure that appropriate safeguards are in place and effective.
Identified risks and associated action items are documented and tracked through an ongoing risk register to monitor progress and ensure timely resolution.
The goal is to ensure that appropriate safeguards are in place and effective.
Compliance Scorecard performs and/or contracts with third parties to perform vulnerability scans & penetration tests at least annually. Issues, if any, are routed through incident and risk management processes for resolution.
The goal is to ensure that appropriate safeguards are in place and effective.
Antivirus software is installed on workstations, laptops, and systems supporting such software.
The goal is to ensure that appropriate safeguards are in place and effective.
Agreements with Vendors and Business Partners include privacy and confidentially clauses. If any of the vendors are SaaS, then their respective SOC1/2 reports are obtained and reviewed periodically.
The goal is to ensure that appropriate safeguards are in place and effective.
Authorize, design, develop, implement, operate, approve, and document changes to infrastructure, data, software, and procedures.
Desired outcome.