A Change Management Policy governs the documenting, tracking, testing, and approving of system, network, security, and infrastructure changes.
Organizational Management
Acceptable Use Policy
An Acceptable Use Policy defines standards for appropriate and secure use of company hardware and electronic systems including storage media, communication tools and internet access.
Code of Conduct
A Code of Conduct outlines ethical expectations, behavior standards, and ramifications of noncompliance.
Information Security Policy
An Information Security Policy establishes the security requirements for maintaining the security, confidentiality, integrity, and availability of applications, systems, infrastructure, and data.
Information Security Program Review
Management is responsible for the design, implementation, and management of the organization’s security policies and procedures. The policies and procedures are reviewed by management at least annually.
Disciplinary Action
Personnel who violate information security policies are subject to disciplinary action and such disciplinary action is clearly documented in one or more policies.
Confidentiality
Data Retention and Disposal Policy
A Data Retention and Disposal Policy specifies how customer data is to be retained and disposed of based on compliance requirements and contractual obligations.
Vulnerability Management
Third-Party Penetration Test
A 3rd party is engaged to conduct a network and application penetration test of the production environment at least annually. Critical and high-risk findings are tracked through resolution.
Risk Assessment
Risk Assessment
Formal risk assessments are performed, which includes the identification of relevant internal and external threats related to security, availability, confidentiality, and fraud, and an analysis of risks associated with those threats.
Network Security
Endpoint Security
Company endpoints are managed and configured with a strong password policy, anti-virus, and hard drive encryption
Access Security
Encryption-at-Rest
Service data is encrypted-at-rest.
Complex Passwords
Personnel are required to use strong, complex passwords and a second form of authentication to access sensitive systems, networks, and information
Physical Security
Physical Security Policy
A Physical Security Policy that details physical security requirements for the company facilities is in place.
