ConnectSmart

Change-control processes and procedures are followed for all changes to system components.

Maintaining a List of Service Providers (12.8.1)

Staff Training for Breach Response (12.10.4)

List of Authorized Usage of Devices (12.3.3)

Verifying Personnel Understands Security Policies and Procedures (12.6.2)

Policy Reviews and Updates (12.1.1)

Establish, Publish, Maintain, and Disseminate a Security Policy (12.1)

Personnel Education (12.6.1)

Monitoring and Controlling All Access to Data (12.5.5)

Security Awareness Program (12.6)

Monitoring and alerts are configured by the security team to identify and notify management of incidents when thresholds are crossed on security and operational metrics. Issues, if any, are routed through incident management for resolution.

Processing capacity is monitored monthly by management to ensure that current system performance meets operational requirements.

Client incidents, if any, are reported by clients through the client portal or Jira ticketing system to ensure consistent tracking and resolution.

GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization

PR.AA-03: Users, services, and hardware are authenticated

PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

PR.PS-01: Configuration management practices are established and applied

PR.PS-02: Software is maintained, replaced, and removed commensurate with risk

Outlines ICT governance roles for senior management.

Details structural organization to manage ICT risk.

Defines the scope of digital resilience testing.

Details tools for vulnerability and performance testing.

Mandates risk controls for ICT third-party services.

Providers must be vetted prior to engagement.

Requires exit and transition strategies for continuity.

Ensures fund managers also comply with digital operational resilience obligations.