Binary Defense

Employee Training (9.9.3)

Monitoring Physical Access (9.1.1)

Formal organizational structures, including governance frameworks and reporting lines, are established and documented to ensure clear accountability and operational efficiency.

Compliance Scorecard has established HR policies and procedures, including Code of Conduct, and, employees are required to acknowledge them either upon hire and annually.

Security policies are reviewed and approved by the security committee at least annually to ensure they remain current, relevant, and aligned with organizational and regulatory requirements.

All personnel including those responsible for system security, availability, and confidentiality commitments complete security awareness training on an annual basis.

Organizational structures and defined roles are maintained in the platform and made available to employees upon request to ensure accessibility and transparency.

An information security committee is established with a defined structure, reporting lines, and responsibilities. The committee is aligned with the organization???s governance framework to oversee and guide information security strategy and initiatives.

Approved security policies are published to the Compliance Scorecard platform, ensuring all employees have access to the latest versions of company policies.

A formal risk management process is established to evaluate risks based on identified threats and specified tolerances. This process includes defining risk assessment methodologies, risk categories, and evaluation criteria.

Risk assessments are performed at least annually during security committee management meetings and include evaluations of the following: -Organizational structure, capability, capacity, reporting lines, authorities, and responsibilities. -Environmental, regulatory, and technological changes that have occurred. -The need for additional tools and resources to achieve business objectives. -Threats and vulnerabilities affecting the achievement of commitments to clients.

Results of the risk assessment, including identified risks and recommended actions, are communicated to the respective owners to ensure accountability for addressing risks.

Identified risks and associated action items are documented and tracked through an ongoing risk register to monitor progress and ensure timely resolution.

DE.AE-02: Potentially adverse events are analyzed to better understand associated activities

DE.AE-04: The estimated impact and scope of adverse events are understood

DE.AE-08: Incidents are declared when adverse events meet the defined incident criteria

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission

ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded

ID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded

ID.RA-06: Risk responses are chosen, prioritized, planned, tracked, and communicated

ID.RA-08: Processes for receiving, analyzing, and responding to vulnerability disclosures are established

PR.IR-01: Networks and environments are protected from unauthorized logical access and usage

PR.IR-02: The organization's technology assets are protected from environmental threats

PR.IR-04: Adequate resource capacity to ensure availability is maintained

3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?

3rd Party Access Controls 1 - Are unique credentials used for 3rd party, partner, contractor, and/or vendor access to systems that connect to the organization's domain?

Segmentation - Are there mechanisms in place to segment the organization's internal network from any shared network space occupied by vendors and partners?

Defines ESAs??? supervisory and coordinating roles.

Clarifies ECB involvement in oversight activities.