Lucy Security

Access to client data requires a unique ID assigned to each user.

A virtual firewall is implemented to monitor and control incoming and outgoing network traffic based on predetermined security rules.

All access requests, including those for employees, temporary employees, consultants, and system accounts, are reviewed and approved by the appropriate level of business and IT management before provisioning.

Compliance Scorecard performs and/or contracts with third parties to perform vulnerability scans & penetration tests at least annually. Issues, if any, are routed through incident and risk management processes for resolution.

DE.CM-01: Networks and network services are monitored to find potentially adverse events

RC.RP-02: Recovery actions are selected, scoped, prioritized, and performed

5.1 Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to, and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur

5.27 Learning from information security incidents - Knowledge gained from information security incidents shall be used to strengthen and improve the information security controls.

Creates an EU-level oversight structure for critical vendors.

Grants oversight authorities various supervisory rights.

Address Unauthorized Assets

Address Unauthorized Software