1Password Teams

Access removal is initiated upon notification from the business or HR of employee termination, role changes, or contract expiration.

All system access for terminated or disabled employees and consultants is removed within 24 hours of receiving a notification from the business or HR.

MFA is enabled on all production servers or in all environments where changes can be promoted.

Passwords must meet the following configuration requirements: Minimum length of at least 12 characters and must include at least one uppercase letter, one lowercase letter, one number, and one special character.

Agreements with Vendors and Business Partners include privacy and confidentially clauses. If any of the vendors are SaaS, then their respective SOC1/2 reports are obtained and reviewed periodically.

GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission

Brings IORPs (occupational pension funds) under the scope of ICT risk regulation.