Snapshot 256028
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Monitored and Powered by Trust Centre www.hive.co Categories Explore our security controls by category Access Control and Authorization Data Management and Protection Disaster Recovery Email Security Endpoint Security Infrastructure Security Monitoring and Incident Response Organizational Security Risk Management Vulnerability Management Access Control and Authorization Access granting process used Implement a formal access granting process that ensures new access privileges are assigned based on the principle of least privilege, and require at least one employee to endorse the granting of new access. Account inventory maintained An inventory of user accounts on critical and high-risk vendors that have access to in-scope systems and services is maintained, including essential details such as account owners, access privileges, associated roles, and vendor relationships where applicable. The inventory is reviewed and updated at least annually. Dormant accounts disabled Monitor for dormant user accounts and disable or remove accounts that have been inactive for an extended period. Employee access regularly reviewed Employee access is reviewed at least annually to ensure that access privileges are appropriate and that former employees or users do not retain unauthorized access. MFA required for administrative access Multi-factor authentication (MFA) is required for administrative access to critical systems and services unless a documented exception is in place where MFA is not supported. MFA required for applications Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this safeguard. MFA required for critical services Multi-factor authentication (MFA) is required for accessing critical services and infrastructure unless a documented exception is in place where MFA is not supported. MFA required for infrastructure access Require multi-factor authentication (MFA) for accessing sensitive infrastructure. MFA adds an extra layer of security by requiring users to provide additional authentication factors beyond their passwords. Password management policy enforced Strictly enforce the organization’s password management policy to guarantee compliance with security standards. Enforcing this policy includes implementing technical controls, monitoring adherence, and responding to non-compliance. Password management policy established A password management policy is established that mandates strong, complex passwords and prohibits the reuse of previous passwords. Data Management and Protection Consent for collecting and managing data obtained Implement a consent mechanism that is freely given, specific, informed, and unambiguous. The consent requests must be clearly distinguishable from other matters, in an easily accessible form, using clear and simple language. For sensitive data, obtain explicit consent unless another exception applies. Maintain a record of obtained consents, including what the data subject has consented to and when. Regularly review and renew consents, especially if your purposes for processing change. Do not make services conditional on consent unless the data is necessary for that service. Criminal record data processing managed If you process any data related to criminal convictions or offenses, verify that you have the legal authority to process this data. Implement strict access controls and security measures for this sensitive data. Document your legal basis and safeguards for processing criminal record data. Make sure you're not maintaining a comprehensive register of criminal convictions unless under official authority. Data encrypted at rest All sensitive data is encrypted when stored on systems or devices. Data encrypted in-transit All data is encrypted when transmitted over networks, both within the organization's internal network and external connections. Data inventory maintained An accurate and up-to-date inventory of all data assets is maintained, covering data stored in databases, file shares, or cloud storage. Data management and retention policy established A data management and retention policy is established, outlining guidelines for how long data should be retained and how it should be managed throughout its lifecycle. Data masking procedures used Implement data masking procedures to replace sensitive or personally identifiable information with fictitious but realistic data. Ensure data masking is applied consistently across all non-production environments, such as development, testing, and training systems, to protect the confidentiality of sensitive data. Data processing integrity and output validated Define and establish quality control measures to verify the completeness, accuracy, and timeliness of your output. This can look like implementing automated data validation checks, setting up data reconciliation processes, establishing review and approval workflows for critical outputs, creating data quality dashboards for real-time monitoring, and implementing version control systems for data processing scripts. Set up real-time monitoring of these measures and create error logs and incident reports where applicable. Data transfer mechanisms established Establish proper data transfer mechanisms to protect personal data when it's transferred across borders or to third parties. Identify all instances where personal data is transferred outside your organization or to different jurisdictions. Assess the adequacy of data protection measures in recipient countries or organizations. Implement appropriate transfer mechanisms (e.g., standard contractual clauses, binding corporate rules) based on the nature of the transfer and the recipient. Establish processes to regularly review and update transfer mechanisms as regulatory requirements or organizational practices change. Maintain documentation of all data transfer arrangements and their legal bases. External privacy inquiries managed Establish and maintain a system for handling all privacy-related inquiries, including general questions, complaints, disputes, and specific requests for personal information access and correction. Privacy disclosure and notification mechanisms established Implement and maintain active communication channels for informing individuals about specific instances of personal data collection, use, and disclosure. The goal is to provide timely, context-specific privacy information beyond what's in the general privacy policy. Develop templates for data sharing, policy changes, and breach notifications so they can be sent to the relevant stakeholders when needed. This includes identifying relevant authorities, setting up systems to deliver these notices via appropriate channels (e.g., app, email), and establishing a process to handle responses to these notifications. Regularly review and update these mechanisms. Privacy policy created and maintained A privacy policy is developed, regularly updated, and made accessible to all relevant parties. The goal is to enable transparent communication of data handling practices and to protect individuals' privacy rights. Disaster Recovery Automated backups enabled Automated backups are enabled for all high-risk data and critical systems. Business continuity and disaster recovery policy established A comprehensive business continuity and disaster recovery policy is established, outlining the organization's strategies for responding to disruptive incidents and supporting business continuity. Data recovery process established Establish a data recovery process that defines procedures for recovering data in case of data loss, corruption, or system failures. A robust data recovery process helps minimize downtime and data loss in critical situations. Disaster recovery plans tested Regularly test the organization's disaster recovery plans to ensure their effectiveness and identify areas for improvement. Testing helps validate the ability to recover critical systems and operations in the event of a disaster. Recovery data isolated Isolate the recovery data from the production environment to prevent accidental overwriting or corruption of backups. Keeping recovery data separate helps maintain the integrity and availability of backup copies. Email Security DMARC policy and verification used DMARC (Domain-based Message Authentication, Reporting, and Conformance) policy and verification mechanisms are implemented to prevent email spoofing and phishing attacks. Email settings block malicious content Email settings are configured to block malicious content, including malicious attachments, links, and scripts. Endpoint Security Anti-malware deployed on end-user devices Anti-malware or antivirus solutions are deployed on end-user devices, such as laptops and workstations. Data encrypted on end-user devices Data stored on end-user devices (e.g., laptops, mobile devices) is encrypted to protect it in case of device loss or theft. Firewall maintained on end-user devices Firewalls are installed and properly maintained on end-user devices, such as laptops and workstations. Mobile device management (MDM) used A mobile device management (MDM) solution is used to manage and secure end-user devices. Infrastructure Security Active discovery tools used An active discovery tool is used to identify assets connected to the enterprise's network, configured to execute daily or more frequently. Automated security scanning performed on infrastructure Automated security scanning software is deployed on all infrastructure components including servers and network devices. Buckets not exposed publicly Cloud storage buckets are not exposed to the public internet unless a documented business justification is in place. Configuration management system established Implement a configuration management system to manage and control the configuration of systems, applications, and infrastructure. Configuration management helps maintain consistency and security across the IT environment. Firewall restricts public access to infrastructure Firewalls are configured to restrict public access to the organization's infrastructure components. Infrastructure changes logged Maintain a log of all infrastructure changes to track and document modifications made to critical systems and services. Logging infrastructure changes aids in audit trails, incident investigations, and accountability. Infrastructure changes require review Implement a review process for all proposed infrastructure changes before implementation. Reviews ensure that changes comply with security policies, do not introduce vulnerabilities, and align with the organization's requirements. Infrastructure deployed using an infrastructure-as-code tool Adopt an infrastructure-as-code (IaC) approach to deploy and manage the organization's infrastructure components. IaC tools enable consistent and version-controlled infrastructure deployment, reducing the risk of configuration errors. Production deployment access restricted Limit access to production deployment environments to authorized personnel only. This control helps prevent unauthorized changes or deployments that may disrupt critical services. Unauthorized assets addressed and removed Ensure that a process exists to address unauthorized assets on a periodic basis. This process should include regular audits of all assets and a procedure for handling unauthorized assets when they are discovered. Unique production database authentication enforced Enforce unique authentication mechanisms for accessing production databases, such as a unique username and password or SSH key. VPN used Utilize Virtual Private Network (VPN) connections to secure remote communications between users and the organization's internal network. VPNs provide encrypted and authenticated tunnels, ensuring secure data transmission over untrusted networks. Web Application Firewall (WAF) used Implement a Web Application Firewall (WAF) to protect web applications from various cyber threats, such as SQL injection, cross-site scripting, and other application-layer attacks. Monitoring and Incident Response Audit log management process maintained Maintain a robust and up-to-date audit log management process. This process should include guidelines for capturing, storing, and monitoring audit logs, ensuring the availability and integrity of essential security event data. Audit logs collected Audit logs are collected from critical systems and applications, capturing security events for incident detection, investigation, and compliance. Breach notification process established A breach notification process is established that outlines procedures for detecting, assessing, and reporting security breaches. Incident response exercises performed Conduct regular incident response exercises to test the organization's response capabilities and identify areas for improvement. Incident response exercises can include tabletop exercises, simulations, or red teaming activities. Incident response policy established An incident response policy is established that outlines the organization's approach and procedures for detecting, responding to, and recovering from cybersecurity incidents. Log management used Implement a centralized log management solution to collect, store, and analyze logs from various systems and applications. Centralized log management simplifies log review, correlation, and monitoring for potential security incidents. Organizational Security Acceptable use policy established Establish and maintain an acceptable use policy that outlines permissible activities, systems, and data access for all users, contractors, and third parties interacting with the organization's information assets and technologies. Asset inventory maintained Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with the potential to store or process data. This can include end-user devices, network devices, IoT devices, and servers. Asset management policy established Establish an asset management policy that outlines the guidelines for managing the organization's assets throughout their lifecycle. Board charter documented Document the Board charter, which outlines the responsibilities, roles, and authority of the Board of Directors. The charter sets the framework for effective corporate governance and oversight. Board expertise developed Ensure that the Board of Directors possesses the expertise and skills necessary to provide effective oversight and guidance on various business and industry matters. Board meetings conducted Conduct regular Board meetings to review organizational performance, strategic direction, and major decisions. Board meetings provide a platform for informed decision-making and governance. Code of conduct established A code of conduct is established that outlines the expected behavior and ethical standards for all employees. Company security commitments externally communicated Key company security commitments and policies are externally communicated, including the Master Service Agreement (MSA), Security Information page, or Terms of Service. Confidentiality Agreement acknowledged by contractors Require all contractors and third-party vendors to acknowledge and sign a confidentiality agreement. This agreement ensures that sensitive information shared with external parties is protected and not disclosed to unauthorized individuals. Confidentiality Agreement acknowledged by employees All employees have acknowledged and signed a confidentiality agreement. This agreement reinforces the commitment to safeguarding sensitive information and trade secrets. Employee background checks performed Conduct thorough background checks on potential employees to verify their identity, employment history, education, and criminal record. Background checks help ensure the suitability and integrity of candidates. External support resources available (i.e., documentation) Provide external support resources, such as documentation, user guides, and knowledge bases, to assist users in utilizing the organization's services effectively. Accessible support resources promote self-service and reduce support requests. Information security program established Establish an information security program for your organization - this security program should include details such as who holds what security positions in the company, what the objectives of the program are, what the SLAs are for your applications, as well as including information about what policies you have in place and how often they are reviewed. Internal privacy policies established Develop an employee privacy policy governing the collection and use of employee data. Update internal privacy notices for employees. Clearly communicate what data is collected, how it's used, and employee rights. Establish a process for regular review and update of these policies. Internal security audit performed An internal security audit is performed annually to evaluate the effectiveness of information security controls, verify compliance with security requirements, and identify areas for improvement. Offboarding process established An offboarding process is established for departing employees to ensure that they are removed from relevant systems and accounts. Onboarding process established An onboarding process is established to ensure new employees are properly granted appropriate access privileges necessary to perform their job responsibilities. Operational procedures maintained Establish and maintain standardized operating procedures that ensure consistent, secure, and reliable operation of information systems and supporting infrastructure. Performance evaluations conducted Conduct regular performance evaluations for employees to assess their job performance, identify areas for improvement, and recognize exceptional contributions. Performance evaluations support talent development and performance management. Physical access restricted Physical access to the organization's facilities, equipment, and systems is restricted to authorized personnel only. Policies signed by relevant personnel Security policies are formally acknowledged and signed by all relevant personnel, establishing accountability for security responsibilities. Relevant authorities identified Maintain a clear record of which data protection authorities have jurisdiction over your operations, and establish reliable communication channels with them for compliance reporting and incident response. Roles and responsibilities specified Clearly define roles and responsibilities for all employees within the organization. Specifying roles helps establish accountability and ensures that employees understand their duties and expectations. Scope for compliance framework established Establish a clearly defined scope for the compliance framework that identifies relevant business processes, IT assets, and organizational boundaries. This scope should align with regulatory, security, and operational requirements, enabling consistent application of compliance controls and efficient management of risk. Service description communicated Clear and detailed service descriptions are communicated to customers or users, outlining the scope, features, and limitations of the services provided. Software development lifecycle established A well-defined and documented development lifecycle is implemented for software and applications. System changes externally communicated Communicate relevant system changes, updates, or maintenance activities to external users or customers who may be impacted. External communication helps manage expectations and maintain transparency. System changes internally communicated Ensure that system changes, updates, and maintenance activities are communicated internally to relevant teams and stakeholders. Internal communication helps coordinate efforts and minimize potential disruptions. Vendor agreements established Establish clear and well-defined agreements with third-party vendors and partners that outline responsibilities, security expectations, and service-level commitments. Risk Management Data Protection Impact Assessment (DPIA) completed Identify processing activities involving personal data that may pose high risks to individuals' privacy rights. To determine whether you need to complete a full DPIA, complete the below questionnaire in the 'recommended templates' section. If you answer "Yes" to any of the questions, you need to fill out a DPIA. You can find a template for the DPIA here: https://gdpr.eu/data-protection-impact-assessment-template/ Risk assessments performed Risk assessments are conducted at least annually to identify and evaluate potential threats and vulnerabilities that could impact the organization's assets. Risk management policy established A risk management policy is established that outlines the organization's approach to identifying, assessing, and mitigating information security risks. Vendor inventory maintained An accurate and up-to-date inventory of all vendors is maintained, including details such as the services provided, contract terms, and the scope of access they have. Vendor management program established A vendor management policy is established to assess, monitor, and manage the risks associated with third-party vendors, ensuring that external partners meet security and compliance standards. Vulnerability Management Automated software patch management performed Automate the process of deploying software patches and updates to systems and applications. Automated patch management helps ensure that critical security patches are applied promptly to address known vulnerabilities. Penetration testing performed within the last 12 months Penetration testing is conducted at least every 12 months to identify potential vulnerabilities in the organization's systems, applications, and infrastructure. Vulnerabilities scanned Regular vulnerability scans are conducted on systems and applications to identify potential security flaws. This includes automated scanning tools that systematically examine infrastructure, applications, and code repositories for known vulnerabilities. Vulnerability management policy established A vulnerability management policy is established that outlines the procedures for identifying, assessing, and remediating vulnerabilities in the organization's systems and applications.