ScalePad Cognition

Access to client data requires a unique ID assigned to each user.

All system access for terminated or disabled employees and consultants is removed within 24 hours of receiving a notification from the business or HR.

All access requests, including those for employees, temporary employees, consultants, and system accounts, are reviewed and approved by the appropriate level of business and IT management before provisioning.

Authorize, design, develop, implement, operate, approve, and document changes to infrastructure, data, software, and procedures.

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

GV.OC-04: Critical objectives, capabilities, and services that stakeholders depend on or expect from the organization are understood and communicated

GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks

GV.OV-03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed

RS.MI-01: Incidents are contained

RS.MI-02: Incidents are eradicated

7.10 Storage media - Storage media shall be managed through their life cycle of acquisition, use, transportation, and disposal in accordance with the organization's classification scheme and handling requirements.

7.14 Secure disposal or re-use of equipment - Items of equipment containing storage media shall be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use.

Facilitates international collaboration on ICT matters.