Snapshot 33115
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
EficodeTrust Center eficode.com security@eficode.com Overview Controls Security and compliance security rating 799 / 950 Industry Average 726 ISO 27001 ISO 27701:2019 UK Cyber Essentials Security links Privacy Policy About Eficode is a DevOps, AI, Software, Automation, and Design company employing a total of 650+ professionals in Europe and US. Eficode is privately owned, the biggest individual owners being Private Equity Investor Investcorp and Finnish Tech Consulting Group Oy (TCG). Eficode is headquartered in Helsinki, Finland and also has offices in Denmark, Germany, Norway, The Netherlands, Poland, Sweden, Switzerland, The United Kingdom and The United States of America. Updates Annual ISAE 3402 Type II Assurance Audit Successfully Completed Security Last updated Dec 9, 2025 Overview We are pleased to announce that Eficode has successfully concluded its annual ISAE 3402 Type II assurance audit for Eficode ROOT, demonstrating our ongoing commitment to maintaining a strong security and compliance posture for our customers and partners. What This Means This milestone reflects our dedication to: Ensuring the confidentiality, integrity, and availability of customer data. Continuously improving our security controls and operational processes. Details of the Achievement Milestone: ISAE 3402 Type II Assurance Audit Successfully Completed Conducted by: KPMG Period/Scope: Eficode Managed Services - Eficode ROOT platform Result: The auditor concluded that Eficode’s controls operated effectively throughout the audit period Why This Matters to You This achievement provides additional assurance that our services and internal operations are aligned with internationally recognized standards and undergo continuous review and improvement. Customers benefit through: Stronger security controls and governance Enhanced monitoring and risk management Increased transparency into our security practices What’s Next We continue advancing our security and compliance program with upcoming initiatives such as: Continued integration of security automation across Eficode ROOT Preparation for future audit cycles and certifications Need More Information? More details are available in our Trust Center documentation. If you have questions, feel free to contact us at security@eficode.com Yours sincerely, Jussi Helminen Head of Security Read more Controls See all 377 Security policies and procedures A formally defined information security program is documented, communicated & maintained. Information security program scope covers internal issues and external threats. Information security program resourcing is aligned to the organization's risk strategy, with adequate funding, staffing, and tools allocated. + 81 more Asset management Asset management program is approved by management and includes assigned ownership and responsibilities for maintaining, reviewing, and managing asset controls. Asset register is maintained. Acceptable use policy for information and associated assets has been developed, communicated and maintained effectively. + 82 more Infrastructure management Networks are segmented into domains with clearly defined perimeters on separate networks, based on a thorough evaluation of each domain’s security requirements. Networks segmented into domains based on an evaluation of the security requirements for each domain. Client data is logically or physically segregated and isolated from other clients’ data across networks, storage, applications, and backups. + 13 more Data protection Periodic user access reviews are conducted. Unique IDs are required for authentication across systems and devices. User access rights are granted on a least-privilege basis, aligned with each role’s business needs. + 59 more Application security A secure development life cycle process is defined, implemented, and integrated into all development projects. Software development, testing, and staging environments are kept separate from the production environment. Security experts are engaged for development on all applications. + 37 more Risk management Formal risk assessment process is defined and implemented. Risks are assessed and prioritized using defined risk acceptance criteria that consider business impact and likelihood of exploitation. Cybersecurity risk appetite and risk tolerance statements are formally documented, communicated to relevant stakeholders, and reviewed on a defined schedule. + 29 more Operational resilience Scoped data backed up and stored offsite. Backup and related restoration procedures tested at least annually. Backup procedure in place for all information, software, and systems. + 55 more Resources Security questionnaires Information Security Questionnaire Last updated Feb 10, 2026 The purpose of this questionnaire is to provide visibility and insights towards Eficode's stakeholders, e.g., customers, and partners, about Eficode's security practices and capabilities Documents Modern Slavery Statement Last updated Jun 25, 2026 List of Sub-Processors Last updated Mar 4, 2026 ISAE3402 Type 2 - Bridge Letter - 2025 Last updated Jan 19, 2026 Eficode Group Oy - ISAE3402 Type II Report 2025 Last updated Dec 8, 2025 Re-Sale of Third Party Software Licenses Terms and Conditions Last updated Nov 19, 2025 Eficode terms for Microsoft Azure Cloud Solution Provider Last updated Nov 19, 2025 Data Processing Addendum for Eficode Advisory and Support Last updated Nov 20, 2025 Eficode Advisory and Support Service Terms Last updated Nov 19, 2025 Data Protection Policy - Public Last updated Nov 17, 2025 Security Policy - Public Last updated Nov 17, 2025 Cyber Essentials Plus Certificate Last updated Nov 19, 2025 ISO27701:2019 Certificate Last updated Sep 17, 2025 ISO27001:2022 Certificate Last updated Sep 17, 2025 Security policies and procedures Controls Information security program established Information security A formally defined information security program is documented, communicated & maintained. Published Oct 1, 2025 Eficode has established and maintains a formally defined Information Security Management System (ISMS) that governs all security-related practices. The ISMS is documented in policies, standards, and procedures that are approved by management, aligned with ISO/IEC 27001, and made available to all employees through internal communication channels. The program is supported by: Governance: Security responsibilities and accountabilities are clearly defined across leadership, business units, and operational teams. Communication: Security policies and requirements are communicated to employees through onboarding, mandatory annual training, and periodic awareness campaigns. Maintenance: The ISMS is continuously maintained through regular risk assessments, internal and external audits to ensure it remains effective and aligned with evolving business and regulatory requirements. Continual improvement: Lessons from incidents, audit findings, and management reviews feed into updates of the program to ensure ongoing maturity and effectiveness. This ensures that the information security program is not only documented, but also operationalized, understood across the organization, and regularly updated to remain effective. Information security program scope covers internal issues and external threats. Published Oct 1, 2025 Our Information Security Program and ISMS are designed to address both internal and external risks. The scope explicitly includes internal issues such as organizational processes, technology usage, employee awareness, and insider threats, as well as external risks including cyberattacks, regulatory changes, and supply chain dependencies. Risk assessments are conducted regularly to identify and evaluate both internal and external factors that may impact the confidentiality, integrity, and availability of information assets. Controls, policies, and incident response procedures are established to mitigate these risks. The scope is reviewed periodically and updated to reflect changes in the threat landscape and business environment, ensuring comprehensive coverage of all relevant issues. Information security program resourcing is aligned to the organization's risk strategy, with adequate funding, staffing, and tools allocated. Published Oct 1, 2025 The Information Security Program is resourced in alignment with the organization’s overall risk strategy. Budget, staffing, and tooling decisions are based on periodic risk assessments and management reviews to ensure that resources are proportional to identified risks and business priorities. Adequate funding is allocated annually to support security operations, compliance obligations, and resilience initiatives, while specialized tools and platforms are deployed to mitigate threats effectively. Staffing levels are reviewed regularly to ensure sufficient expertise and capacity, with additional training and external partners engaged when needed. This approach ensures that security resources remain adequate, risk-driven, and capable of supporting the organization’s strategic objectives and resilience commitments. Information security governance program implemented Information security Information security policy is enforced by an appointed owner. Published Oct 1, 2025 Our Information Security Policy is owned and enforced by the Head of Security, who is accountable for its governance and continuous improvement. The Head of Security ensures that the policy is formally approved by senior management, communicated across the organization, and consistently applied. Enforcement is supported through mandatory employee training, management oversight, technical controls, and internal audits. The Head of Security also ensures the policy is reviewed at least annually, or upon significant organizational or regulatory changes, to remain effective and aligned with business objectives and the evolving threat landscape. Executive leadership provides effective oversight and governance of the cybersecurity programme, fostering a risk-aware culture and driving continuous improvement. Published Oct 1, 2025 Executive leadership provides oversight of the cybersecurity program through formal governance structures, regular reporting, and active participation in risk management activities. The leadership team reviews key risk indicators, audit results, and incident reports to ensure accountability and alignment with business strategy. By endorsing the ISMS, allocating resources, and requiring periodic reviews, they foster a risk-aware culture across the organization. Their involvement ensures that cybersecurity is integrated into decision-making and that the program evolves through continuous improvement, adapting to new business needs and an evolving threat landscape. Information security and IT processes are retained in-house and/or outsourced with the same information security governance. Published Oct 1, 2025 Our information security and IT processes are delivered through a combination of in-house teams and carefully selected outsourced providers. Regardless of delivery model, the same information security governance framework applies, ensuring that policies, controls, and oversight remain consistent across all environments. Third-party providers undergo security due diligence, contractual safeguards (including ISO 27001 alignment, GDPR compliance, and SCCs where applicable), and are monitored through periodic reviews and audits. This approach ensures that both internal and external operations adhere to the same security standards, minimizing risk and maintaining uniform governance. All projects involving systems, applications, and platforms undergo an information security assessment. Published Oct 1, 2025 All projects that involve systems, applications, or platforms undergo an information security assessment as part of our governance process. These assessments evaluate potential risks to confidentiality, integrity, and availability, and ensure that security requirements are addressed before implementation or change. The process includes risk-based reviews by the Security Team, alignment with ISO 27001 controls, and consideration of regulatory and contractual obligations. This ensures that new initiatives and changes are securely designed, compliant, and consistent with the organization’s risk strategy. Information security strategy, policies and standards are reviewed on an annual basis and after major changes. Published Oct 1, 2025 Our information security strategy, policies, and standards are formally reviewed at least once per year and whenever significant organizational, technological, or regulatory changes occur. The reviews are led by the Head of Security, with executive oversight, to ensure continued alignment with the organization’s risk strategy, compliance obligations, and evolving threat landscape. Updates are communicated to employees and integrated into training and operational processes, ensuring that policies remain current, effective, and actionable. Compliance with information security policies is regularly and consistently monitored and managed. Published Oct 1, 2025 Compliance with information security policies is actively monitored through internal audits, automated controls, and management oversight. The Head of Security ensures consistent enforcement and follow-up on any issues identified. This approach ensures policies are applied uniformly and remain effective across the organization. Personnel have access to a clearly defined and confidential channel for promptly reporting suspected security events, policy violations, or observed weaknesses. Published Oct 1, 2025 Personnel have access to a confidential reporting channel for suspected security events, policy violations, or weaknesses. Reports are reviewed by the Security Team and handled promptly, ensuring issues are investigated and addressed while protecting the reporter’s confidentiality. Policy objectives and requirements align with the strategic direction of the organization and are integrated into the organization's processes. Published Oct 1, 2025 Information security policy objectives and requirements are aligned with the organization’s strategic direction and risk strategy. They are integrated into business and IT processes to ensure security is embedded in daily operations and decision-making. A process is in place for identifying, correcting, and preventing recurrence of nonconformities in the information security program. Published Oct 1, 2025 A defined process exists for identifying and addressing nonconformities in the information security program. Corrective and preventive actions are taken to resolve issues, with follow-up reviews ensuring they do not recur and improvements are embedded into the ISMS. Deployed AI systems include defined human oversight roles for human-in-the-loop intervention and override of automated decisions when required. Published Oct 1, 2025 Deployed AI systems include defined human oversight roles to ensure accountability and control. Human-in-the-loop mechanisms are in place to intervene or override automated decisions when required, maintaining compliance, ethical use, and alignment with business and regulatory requirements. Risk management objectives are formally defined, approved by relevant stakeholders, and reviewed periodically. Published Oct 1, 2025 Risk management objectives are formally defined and approved by relevant stakeholders to ensure alignment with business priorities. They are reviewed periodically as part of the ISMS cycle to remain effective against evolving risks and organizational changes. Objectives and metrics are monitored to assess adherence to the information security policy and its effectiveness. Published Oct 1, 2025 Objectives, KPIs, and OKRs are regularly monitored to measure adherence to the information security policy and its effectiveness. Results are reviewed by the Head of Security and management to ensure performance is on track and to drive continual improvement of the ISMS. Management communicates and enforces the requirement that all personnel apply the organization’s security policies and procedures. Published Oct 1, 2025 Management clearly communicates the requirement that all personnel follow the organization’s security policies and procedures. Compliance is enforced through mandatory training, regular reminders, and oversight by the Head of Security to ensure consistent application across the organization. Compliance with information security policies is recorded and tracked in a risk register or equivalent system until resolved. Published Oct 1, 2025 Compliance with information security policies is recorded and tracked in the organization’s risk register or equivalent system. Issues remain logged until resolved, ensuring accountability, visibility, and continuous improvement of the ISMS. Reviews are conducted to ensure personnel, systems, and processes operate in compliance with applicable information security policies, standards, and procedures. Published Oct 1, 2025 Regular reviews are conducted to confirm that personnel, systems, and processes comply with information security policies, standards, and procedures. Findings are documented and addressed to ensure ongoing alignment and effectiveness of the ISMS. Critical dependencies are documented, prioritized based on impact, and communicated to relevant stakeholders. Published Oct 1, 2025 Critical dependencies are identified and documented within the information security program. They are prioritized based on business impact and communicated to relevant stakeholders to ensure awareness, risk mitigation, and continuity planning. Critical services relied on by external stakeholders are identified, documented and communicated appropriately. Published Oct 1, 2025 Critical services relied on by external stakeholders are identified and documented as part of our ISMS. These services are communicated appropriately to ensure transparency, continuity planning, and alignment with stakeholder expectations. Stakeholder groups relevant to cybersecurity risk management are identified, and their needs and expectations are documented and reviewed periodically. Published Oct 1, 2025 Relevant stakeholder groups for cybersecurity risk management are identified, and their needs and expectations are documented. These are reviewed periodically to ensure the information security program remains aligned with business priorities and stakeholder requirements. Information security-related legal, regulatory, statutory, and contractual obligations are identified, documented, and reviewed on a scheduled basis. Published Oct 1, 2025 Information security-related legal, regulatory, statutory, and contractual obligations are identified and documented within the ISMS. They are reviewed on a scheduled basis to ensure ongoing compliance and alignment with evolving requirements. Cybersecurity operations are continuously improved based on observations and lessons learned from the execution of routine processes, procedures, and team activities. Published Oct 1, 2025 Cybersecurity operations are continuously improved through a structured process of capturing observations and lessons learned from daily activities, incident response, audits, and team exercises. These insights are documented and analyzed to identify gaps, strengthen existing controls, and introduce new measures where needed. Management reviews and follow-up actions ensure that improvements are implemented effectively, fostering a culture of continual learning and adaptation. This approach ensures that cybersecurity capabilities mature over time and remain aligned with evolving threats and business requirements. Risk assessment policies and procedures established Information security Documented risk assessment process for information security. Published Oct 1, 2025 A documented risk assessment process is in place to identify, evaluate, and treat information security risks. The process follows ISO 27001 principles, with risks recorded in the risk register, prioritized by impact and likelihood, and reviewed periodically or upon significant changes. This ensures consistent, transparent, and repeatable risk management across the organization. Responsibilities for assessing and accepting residual information security risks are defined and assigned. Published Oct 1, 2025 Responsibilities for assessing and accepting residual information security risks are formally defined and assigned within the ISMS. The Head of Security leads the assessment process, while acceptance of residual risks is escalated to appropriate management levels to ensure accountability and alignment with the organization’s risk appetite. Information security risk assessment process address the risks to architecture, infrastructure, software, operations, business, cybersecurity, and IT services. Published Oct 1, 2025 The information security risk assessment process covers risks across architecture, infrastructure, software, operations, business processes, cybersecurity, and IT services. This comprehensive scope ensures that all relevant areas are evaluated for potential threats and vulnerabilities, with controls and treatments defined to maintain confidentiality, integrity, and availability. Risk assessment process includes evaluation of the potential consequences of identified risks and the likelihood of their recurrence. Published Oct 1, 2025 The risk assessment process includes evaluating the potential consequences of identified risks, their likelihood of recurrence, and the potential financial impact. This ensures risks are prioritized effectively, with treatment plans addressing not only operational and security concerns but also possible financial exposure to the organization. Strategic cybersecurity opportunities are characterized and incorporated into risk management discussions and decision-making. Published Oct 1, 2025 Strategic cybersecurity opportunities, such as new technologies, process improvements, and automation, are identified and characterized as part of the risk management process. These opportunities are incorporated into discussions and decision-making to balance risk reduction with innovation and business value. Information security policy framework established Information security An information security policy is implemented and maintained with clearly defined and measurable objectives. Published Oct 1, 2025 An information security policy is implemented and maintained with clearly defined, measurable objectives that align with the organization’s strategic direction. Objectives are tracked through KPIs and operational key results to ensure effectiveness and drive continual improvement of the ISMS. Information security policies are based on accepted frameworks, and industry practices. Published Oct 1, 2025 Information security policies are based on internationally accepted frameworks and industry best practices, including ISO 27001 and related standards. This ensures policies are aligned with recognized controls, regulatory requirements, and evolving security practices. Topic-specific policies are defined and approved. Published Oct 1, 2025 Topic-specific information security policies are formally defined to address key areas including but not limited to access control, incident response, acceptable use, and data protection. These policies are reviewed and approved by the top management to ensure consistency, effectiveness, and alignment with the overall ISMS. Information security policies and procedures cover third-party risk management. Published Oct 1, 2025 Information security policies and procedures include requirements for third-party risk management. Vendors and partners are subject to security due diligence, contractual safeguards, and periodic reviews to ensure they comply with the organization’s security and regulatory obligations. Information security policies and standards are formally approved by senior management. Published Oct 1, 2025 Information security policies and standards are formally approved by the CEO and senior management. This ensures alignment with organizational objectives and risk strategy, while providing clear authority, accountability, and direction for enforcement across the organization. Effective exceptions and exemptions process for information security policies, standards and procedures. Published Oct 1, 2025 An established exceptions and exemptions process is in place for information security policies, standards, and procedures. Requests are formally documented, reviewed by the Head of Security, and approved by appropriate management to ensure risks are assessed, mitigated, and tracked until closure. Cybersecurity policies are periodically updated to reflect evolving threats, regulatory and technological changes, and strategic objectives, with updates communicated to all relevant stakeholders. Published Oct 1, 2025 Cybersecurity policies are reviewed and updated periodically to address evolving threats, regulatory changes, technological developments, and strategic objectives. Updates are communicated to all relevant stakeholders to ensure awareness, compliance, and consistent application across the organization. Acknowledgement of policies by new personnel before being granted access to the organization's information and assets. Published Oct 1, 2025 All new personnel are required to acknowledge the organization’s information security policies before being granted access to information and assets. In addition, all existing personnel must annually attest to the policies and guidelines to reinforce accountability and ensure continued awareness. Records and information handling program implemented Information security Records are protected from unauthorized disclosure, misuse, loss, destruction, or alteration. Published Oct 1, 2025 Records are safeguarded against unauthorized disclosure, misuse, loss, destruction, or alteration through access controls, encryption, backup procedures, and monitoring. These measures ensure the confidentiality, integrity, and availability of records throughout their lifecycle. IT operations governance established IT operations management Documented and approved operating procedures for information processing facilities are maintained and made available to personnel responsible for their execution. Published Oct 2, 2025 Operational IT responsibilities are formally defined. Published Oct 2, 2025 Operational IT responsibilities are formally defined and assigned to ensure accountability and clarity. This structure supports consistent execution of IT processes and alignment with security and business objectives. Executive management ensures IT operations policies and procedures are aligned with the organization’s strategy and information security objectives. Published Oct 2, 2025 Executive management ensures IT operations policies and procedures align with the organization’s overall strategy and information security objectives. This oversight guarantees that IT operations support business goals while maintaining security and compliance. A defined process exists to conduct independent reviews of IT operations policies and procedures at least annually. Published Oct 2, 2025 A defined process is in place to conduct independent reviews of IT operations policies and procedures at least annually. These reviews validate effectiveness, ensure alignment with organizational objectives, and drive continual improvement. Operational change management program established IT operations management Documented operational change management policy approved by management, communicated to appropriate constituents, and assigned an owner. Published Oct 2, 2025 A documented operational change management policy is approved by management and assigned an owner for accountability. The policy is communicated to all relevant stakeholders to ensure changes are controlled, consistent, and aligned with business and security requirements. All operational changes require formal operational and security impact assessment and approval prior to implementation. Published Oct 2, 2025 Operational change management policy defines categories of changes based on severity, risk, or business impact. Published Oct 2, 2025 The operational change management policy defines categories of changes based on severity, risk, and business impact. This categorization ensures appropriate levels of review, approval, and control are applied to each change. Operational change management policy includes procedures for addressing emergency changes. Published Oct 2, 2025 The operational change management policy includes defined procedures for handling emergency changes. These ensure urgent issues are addressed quickly while maintaining proper documentation, approval, and post-implementation review. Operational change management policy includes multi-stakeholder review or a change advisory board. Published Oct 2, 2025 The operational change management policy includes provisions for multi-stakeholder review, with a Change Advisory Board (CAB) being established. This ensures future changes will be evaluated with input from relevant stakeholders to balance business, operational, and security considerations. Operational change management policy includes testing and rollback plans for all high-impact changes. Published Oct 2, 2025 The operational change management policy requires testing and documented rollback plans for all high-impact changes. This ensures changes can be validated before deployment and quickly reversed if issues arise, minimizing disruption and risk. Operational change management program implemented IT operations management Information security requirements are implemented when new systems are introduced, upgraded, or enhanced. Published Oct 2, 2025 Security requirements for new, upgraded, or enhanced systems are defined based on data classification and are integrated into project planning and delivery. Published Oct 2, 2025 Information security specifications for new, upgraded, or enhanced systems are developed using requirements from policies and regulations. Published Oct 2, 2025 Information security specifications for new, upgraded, or enhanced systems are developed based on organizational policies, regulatory obligations, and industry standards. This ensures systems are designed and implemented in compliance with security and legal requirements. Business continuity requirements are considered for new, upgraded, or enhanced systems. Published Oct 2, 2025 Business continuity requirements are incorporated into the design and implementation of new, upgraded, or enhanced systems. This ensures resilience, availability, and recovery capabilities are built in to support critical business operations. Implementation of new and upgraded systems follows defined change management procedures. Published Oct 2, 2025 The implementation of new and upgraded systems follows defined change management procedures. This ensures proper review, approval, testing, and documentation to minimize risk and maintain operational stability. Testing is required for validation of all controls required for new, upgraded, or enhanced systems. Published Oct 2, 2025 Testing is required to validate all security and operational controls for new, upgraded, or enhanced systems. This ensures that controls function as intended before systems are deployed into production. Emergency changes follow an expedited approval process, requiring authorized management sign-off prior to implementation. Published Oct 2, 2025 Emergency changes follow an expedited approval process that still requires authorized management sign-off before implementation. This balances the need for rapid response with proper oversight and accountability. All changes are documented and reviewed after implementation for appropriateness and security impact. Published Oct 2, 2025 Installation of software on operational systems is restricted to authorized personnel. Published Oct 2, 2025 Installation of software on operational systems is restricted to authorized personnel only. This control prevents unauthorized changes, reduces security risks, and ensures system integrity is maintained. Independent security assessments undertaken Compliance management External independent assessments of the information-security programme are conducted at least annually. Published Oct 2, 2025 External independent assessments of the information security program are conducted at least annually. These assessments validate compliance with ISO 27001, ISAE 3402 (Eficode ROOT), and other obligations, while also providing assurance of program effectiveness to stakeholders. Industry recognized third-party information security certifications held. Published Oct 2, 2025 Criteria for independence of external reviewers are defined and documented. Published Oct 2, 2025 Criteria for the independence of external reviewers are defined and documented to ensure objectivity and impartiality. This guarantees that assessments provide reliable assurance of the effectiveness of the information security program. Scope and objectives of independent assessments of the information security program are clearly defined in advance. Published Oct 2, 2025 The scope and objectives of independent assessments of the information security program are clearly defined in advance. This ensures reviews are comprehensive, aligned with organizational priorities, and provide meaningful assurance of control effectiveness. Responsibility for planning, coordinating, and responding to independent security assessments is formally defined and assigned. Published Oct 2, 2025 Responsibility for planning, coordinating, and responding to independent security assessments is formally defined and assigned to the Head of Security. This ensures accountability, effective coordination, and timely implementation of corrective actions. Results of independent assessments are reviewed by management and used to improve. Published Oct 2, 2025 Results of independent assessments are reviewed by management to ensure findings are understood and addressed. Identified improvements are incorporated into the ISMS to strengthen security controls and drive continuous improvement. Internal audits of the information security program are conducted at planned intervals, in addition to external reviews. Published Oct 2, 2025 Internal audits of the information security program are conducted at least annually alongside external reviews. These audits provide assurance of ongoing compliance, identify areas for improvement, and support the continual effectiveness of the ISMS. Intellectual property and licensing Compliance management Topic-specific policies define acceptable use and protection of intellectual property, including software, documents, media, and trademarks. Published Oct 2, 2025 Only licensed or authorized software and content are permitted; ownership records and usage compliance are reviewed periodically. Published Oct 2, 2025 Only licensed, authorized, or approved open-source software and content are permitted for use within the organization. Ownership records, license obligations, and usage compliance are reviewed periodically to ensure adherence to contractual and regulatory requirements, including open-source license terms. Human resources policy established Human resources security Documented human-resources security policy and procedures are formally approved, maintained, and communicated to all relevant personnel. Published Oct 2, 2025 A documented human resources security policy and supporting procedures are formally approved, maintained, and communicated to all relevant personnel. These ensure security requirements are applied consistently throughout the employee lifecycle and aligned with organizational objectives. Human resources security policy effectiveness is reviewed at least annually using HR metrics and audit findings. Published Oct 2, 2025 The effectiveness of the human resources security policy is reviewed at least annually using HR metrics and audit findings. This ensures the policy remains relevant, effective, and aligned with organizational and regulatory requirements. Confidentiality and non-disclosure agreements are reviewed periodically to ensure alignment with legal and business requirements. Published Oct 2, 2025 Confidentiality and non-disclosure agreements are reviewed periodically to ensure they remain aligned with current legal, regulatory, and business requirements. This ensures ongoing protection of sensitive and proprietary information. Background checks in place Human resources security Human resources policies include constituent background screening criteria. Published Oct 2, 2025 Human resources policies include background screening criteria for relevant personnel, taking into account differences in local legislation across the countries where the organization operates. This ensures compliance with legal requirements while maintaining appropriate security and trust standards. Background checks are performed pre-employment, and periodically as required by industry-specific standards or regulations. Published Oct 2, 2025 Background checks are conducted pre-employment and repeated periodically when required by role, industry standards, or regulatory obligations. This ensures that personnel in sensitive or high-trust roles continue to meet security and compliance requirements. Personnel security procedures in place Human resources security Human resources security policy includes a disciplinary process for non-compliance. Published Oct 2, 2025 The human resources security policy includes a defined disciplinary process for cases of non-compliance. This ensures consistent handling of violations and reinforces accountability for adhering to security requirements. Human resources security policy defines constituent accountability for the use and misuse of their access credentials. Published Oct 2, 2025 The human resources security policy defines individual accountability for the use and misuse of access credentials. This ensures personnel understand their responsibilities and the consequences of improper use, supporting secure access management. Terminated constituents understand their continuing information security responsibilities upon termination or role change. Published Oct 2, 2025 Terminated personnel are reminded of their continuing information security responsibilities during the offboarding process. This ensures awareness of confidentiality and non-disclosure obligations even after termination or role change. Human resources policy includes treatment of insider threats, misuse, or negligence. Published Oct 2, 2025 The human resources security policy addresses the treatment of insider threats, misuse, and negligence. It defines processes for detection, investigation, and disciplinary action to mitigate risks and protect organizational assets. Human resources security policy includes onboarding procedures that communicate information security responsibilities to all personnel including contract personnel. Published Oct 2, 2025 The human resources security policy includes onboarding procedures that communicate information security responsibilities to all personnel, including contractors. This ensures consistent awareness and accountability from the start of the engagement. Human resources security policy includes procedures for terminating contract personnel and ensuring information security responsibilities are upheld. Published Oct 2, 2025 The human resources security policy includes procedures for terminating contract personnel that ensure access is revoked and information security responsibilities are upheld. This safeguards organizational assets and enforces continuing confidentiality obligations. Employment agreements established and implemented Human resources security Constituents are required to sign employment agreements. Published Oct 2, 2025 Employment agreements define personnel information security responsibilities, including acknowledgment of the Code of Conduct and Acceptable Use Policy. Published Oct 2, 2025 Employment agreements define personnel information security responsibilities, including acknowledgment of the organization’s Code of Conduct and Acceptable Use Policy. This ensures all personnel are aware of and accountable for adhering to security and ethical standards. Employment agreements include acknowledgement of confidentiality/non-disclosure policies. Published Oct 2, 2025 Employment agreements include acknowledgment of confidentiality and non-disclosure policies. This ensures personnel formally commit to protecting sensitive information and maintaining confidentiality throughout and after their employment. Security training conducted Human resources security Personnel with dedicated information security responsibilities are required to engage in continuing education programs. Published Oct 2, 2025 Personnel with dedicated information security responsibilities are required to engage in continuing education based on their specific role, regulatory requirements, and evolving organizational needs. This ensures they maintain the skills and knowledge necessary to address emerging threats and technologies. All new hires are required to complete information security awareness training during onboarding. Published Oct 2, 2025 All new hires are required to complete information security awareness training during the onboarding process. This ensures they understand organizational security policies, responsibilities, and best practices from the start of employment. All personnel, regardless of role, are required to complete general information security awareness training at least annually. Published Oct 2, 2025 All personnel, regardless of role, are required to complete general information security awareness training at least annually. This ensures consistent awareness of security responsibilities and reinforces a culture of accountability across the organization. Information security responsibilities specific to each role are embedded into onboarding and functional training processes. Published Oct 2, 2025 Information security responsibilities specific to each role are embedded into onboarding and functional training processes. This ensures personnel understand and can apply the security requirements relevant to their job functions. Information security training effectiveness is periodically evaluated to ensure personnel understand and apply security responsibilities. Published Oct 2, 2025 The effectiveness of information security training is periodically evaluated to ensure personnel understand and apply their security responsibilities. Feedback, testing, and audit results are used to confirm awareness levels and drive continuous improvement. Asset management Controls Asset management program governance in place Asset management program Asset management program is approved by management and includes assigned ownership and responsibilities for maintaining, reviewing, and managing asset controls. Published Oct 3, 2025 Asset register is maintained. Published Oct 3, 2025 An asset register is maintained to record and track all relevant information assets. This ensures visibility, accountability, and effective management of assets throughout their lifecycle. Acceptable use policy for information and associated assets has been developed, communicated and maintained effectively. Published Oct 3, 2025 An Acceptable Use Policy for information and associated assets has been developed, formally communicated, and is maintained effectively. This ensures personnel understand their responsibilities and appropriate use of organizational assets. Information handling policy or procedure developed, communicated and maintained effectively. Published Oct 3, 2025 All asset types are identified and recorded in the asset inventory with assigned owners. Published Oct 3, 2025 Asset lifecycle is managed from acquisition through disposal, including reassignment, decommissioning, and return of assets. Published Oct 3, 2025 Processes ensure the return of all organizational assets upon termination or internal role change, including devices, credentials, and documentation, with responsibilities defined in policy. Published Oct 3, 2025 Processes are in place to ensure the return of all organizational assets upon termination or internal role change, including devices, credentials, and documentation. Topic-specific policies for information classification, labelling, and transfer are documented, communicated, and maintained. Published Oct 3, 2025 Topic-specific policies for information classification, labeling, and transfer are documented, communicated, and maintained. These policies ensure information is appropriately identified, protected, and handled throughout its lifecycle. Information classification and data handling policies established Asset management program Information handling policy includes storage requirements. Published Oct 3, 2025 Information handling policy defines security requirements for electronic transmission of data, including the use of secure protocols and approved file transfer services. Published Oct 3, 2025 Information handling policy ensures the information's classification is properly labeled in its physical and electronic formats. Published Oct 3, 2025 Records retention policy and retention schedule cover paper and electronic records. Published Oct 3, 2025 A records retention policy and retention schedule are in place covering both paper and electronic records. This ensures records are retained for the required duration to meet legal, regulatory, and business needs, and securely disposed of when no longer needed. A data retention and destruction policy is implemented that defines storage duration and business/legal requirements for records. Published Oct 3, 2025 Inventories of designated data types and their associated metadata are maintained and reviewed periodically. Published Oct 3, 2025 Inventories of designated data types and their associated metadata are maintained and reviewed periodically. This ensures visibility, accountability, and proper management of data in line with classification, regulatory, and business requirements. Authorized internal and external network communication paths and data flows are documented, maintained, and reviewed annually. Published Oct 3, 2025 Authorized internal and external network communication paths are documented, maintained, and reviewed annually. This ensures secure, controlled, and compliant data movement across organizational networks. Secure data-destruction procedures ensure information and media are irretrievably deleted when no longer required for business, legal, or regulatory purposes. Published Oct 3, 2025 Secure data destruction procedures are implemented to ensure information and media are irretrievably deleted when no longer required for business, legal, or regulatory purposes. This protects sensitive data from unauthorized recovery or misuse. Data loss prevention (DLP) solution in place Asset management program A data loss prevention (DLP) solution is implemented. Published Oct 3, 2025 A data loss prevention (DLP) solution is implemented at the network and application level across key collaboration and productivity platforms. This ensures sensitive information is monitored and protected within core business systems, reducing the risk of unauthorized access, transfer, or exposure. Data loss prevention (DLP) security solution includes a handling process if data loss is suspected or occurs. Published Oct 3, 2025 The data loss prevention (DLP) solution includes a defined handling process for suspected or confirmed data loss incidents. This process ensures timely investigation, containment, remediation, and reporting to minimize impact and prevent recurrence. Measures prevent sensitive, unauthorized, or malicious data from entering AI datasets. Published Oct 3, 2025 Data loss prevention (DLP) security solution covers all relevant data channels, including email, endpoints, cloud storage, and file transfers. Published Oct 3, 2025 Data loss prevention (DLP) solution generates alerts and logs for policy violations, with reporting to responsible teams. Published Oct 3, 2025 The data loss prevention (DLP) solution generates alerts and logs for policy violations. These are reported to responsible teams for timely review, investigation, and remediation to ensure effective oversight and incident response. Data loss prevention (DLP) policies and rules are reviewed periodically and updated based on evolving threats or compliance requirements. Published Oct 3, 2025 Security tool coverage and effectiveness are monitored via defined metrics. Published Oct 3, 2025 Security tool coverage and effectiveness are monitored using defined metrics and performance indicators. Results are reviewed by responsible teams to ensure controls remain effective and aligned with organizational security objectives. Encryption and key management procedures established and implemented Asset management program Encryption keys are managed and maintained for scoped data. Published Nov 6, 2025 Encryption keys are securely managed and maintained for scoped data. Key management processes ensure proper generation, storage, rotation, and retirement to protect the confidentiality and integrity of sensitive information. Encryption keys are generated in a manner consistent with key management industry standards. Published Nov 6, 2025 Encryption is applied to scoped data at rest, based on data classification and risk. Published Nov 6, 2025 Encryption is applied to scoped data at rest in accordance with data classification and risk level. This ensures sensitive information is protected against unauthorized access and meets regulatory and contractual requirements. Encryption is applied to scoped data in transit, based on data classification and risk. Published Nov 6, 2025 Encryption and key management practices are defined in a documented policy aligned with industry standards. Published Nov 6, 2025 DNS queries are encrypted (e.g., DoH, DoT) and monitored for anomalies to detect abuse and protect privacy. Published Nov 6, 2025 DNS queries are encrypted using secure protocols such as DNS over HTTPS (DoH) or DNS over TLS (DoT) to protect privacy and prevent interception or tampering. Monitoring mechanisms are in place to identify anomalies in DNS activity, helping to detect potential abuse, malware communication, or other security threats. Only approved cryptographic algorithms and trusted libraries are permitted for encryption and key management. Published Nov 6, 2025 Only approved cryptographic algorithms, such as AES-256 for data at rest and TLS 1.2+ for data in transit, are permitted, along with trusted libraries that meet NIST and ISO/IEC standards. This ensures encryption and key management follow industry best practices, providing strong protection and reducing the risk of vulnerabilities from weak or unverified implementations. Security tooling, automation, and integration program established Asset management program Security-specific tools are implemented to support key information security functions. Published Nov 6, 2025 Security-specific tools are implemented to support key information security functions, including monitoring, incident detection, vulnerability management, and compliance assurance. These tools provide visibility into the security posture and enable timely response to potential threats. Security tools supporting key controls are inventoried, with defined owners and documented purpose. Published Nov 6, 2025 Security tools supporting key controls are inventoried with defined ownership and documented purpose. This ensures accountability, proper maintenance, and alignment of tool usage with organizational security objectives. Security tooling integrates with operational platforms to support automated or auditable workflows. Published Nov 6, 2025 Security tooling is integrated with operational platforms to enable automated and auditable workflows. This integration enhances efficiency, ensures consistent application of controls, and provides traceability for security-related activities. Asset management policy enforced Asset management program Procedures and controls for transferring information are defined and enforced. Published Nov 6, 2025 Procedures and controls for transferring information are defined and enforced to ensure secure handling of data during transmission. These include encryption, authentication, and approval requirements to protect information integrity and confidentiality. Scoped data is not sent or received via physical media. Published Nov 6, 2025 Scoped data is not transferred via physical media. All data exchanges occur through secure, approved digital channels to maintain confidentiality, integrity, and traceability. Media containing scoped data is securely wiped or destroyed upon disposal, with disposal actions logged and approved. Published Nov 6, 2025 Media containing scoped data is securely wiped or physically destroyed upon disposal to prevent data recovery. All disposal actions are logged and approved to ensure accountability and compliance with security and regulatory requirements. Chain-of-custody is maintained when transporting data. Published Nov 6, 2025 A documented chain of custody is maintained when transporting data to ensure accountability and integrity throughout the transfer process. This control prevents unauthorized access, loss, or tampering during transit. Supplier-provided services, including systems storing or processing organizational data, are inventoried and reviewed for security compliance. Published Nov 6, 2025 Supplier-provided services, including systems that store or process organizational data, are inventoried and periodically reviewed for security compliance. This ensures third parties meet organizational security requirements and maintain appropriate safeguards for entrusted data. Mobile device management program in place Endpoint security User endpoint device management program developed and communicated effectively. Published Oct 3, 2025 Endpoint security configuration standards are implemented, maintained, and apply to all user devices. Published Oct 3, 2025 Endpoint security configuration standards are implemented, maintained, and applied to all user devices. These standards ensure consistent protection through controls such as encryption, secure configuration, and regular updates. Policies and procedures define protection requirements for off-premises use of organizational assets. Published Oct 3, 2025 Endpoint-device configurations are centrally enforced and continuously monitored through secure configuration-management processes. Published Oct 3, 2025 Enterprise-issued user endpoint devices are registered and configured according to organizational security policies prior to accessing corporate resources. Published Oct 3, 2025 All enterprise-issued user endpoint devices are registered and configured in line with organizational security policies before being granted access to corporate resources. This ensures devices meet security requirements and reduces the risk of unauthorized or insecure access. Enterprise-issued mobile devices are issued to authorized personnel only. Published Oct 3, 2025 Remote wipe or data loss protection is enabled for all user endpoint devices. Published Oct 3, 2025 Remote wipe and data loss protection capabilities are enabled for all user endpoint devices. This ensures that, in the event of loss or theft, organizational data can be securely erased to prevent unauthorized access. Registered endpoint devices are reviewed periodically and unauthorized or unused devices are removed. Published Oct 3, 2025 Registered endpoint devices are reviewed periodically to ensure compliance with security requirements. Unauthorized or unused devices are removed from the environment to maintain an accurate inventory and reduce risk exposure. Personal devices accessing organizational data are subject to mobile application management (MAM) or containerization controls, or are explicitly disallowed. Published Oct 3, 2025 The use of personal devices to access organizational data is not permitted. This policy ensures that only enterprise-managed and secured devices are used, maintaining full control over data protection and compliance. Installation of unapproved or high-risk applications on endpoint devices is restricted based on device type and risk level. Published Oct 3, 2025 Endpoints protected from malicious content Endpoint security Web filter in place to block access to websites containing malicious, illegal, or inappropriate content. Published Oct 3, 2025 Security event logs are reviewed regularly. Published Oct 3, 2025 Robust physical security controls implemented Physical security Physical access to secure areas is managed, controlled, and monitored through access mechanisms. Published Nov 6, 2025 Physical access to secure areas is managed, controlled, and monitored through approved access mechanisms such as keycards or tokens. These controls ensure that only authorized personnel can enter restricted areas, protecting sensitive assets and information. Physical security perimeters use barriers and secured access points. Published Nov 6, 2025 Physical security perimeters are established with secured access points and robust access controls appropriate for office environments. These measures ensure that only authorized personnel can enter areas containing sensitive information or critical assets. Physical access control credentials are updated or revoked promptly upon personnel role changes or termination. Published Nov 6, 2025 Physical access control credentials are updated or revoked promptly upon personnel role changes or termination. This ensures that only authorized individuals retain access to secure areas, reducing the risk of unauthorized entry. Only authorized personnel are granted physical access to secure areas, based on role and business need. Published Nov 6, 2025 Physical access to secure areas is granted only to authorized personnel based on role and business need. This ensures access is restricted to individuals with legitimate responsibilities, maintaining the security of sensitive areas and assets. Visitors to secure areas are logged, issued temporary credentials if needed, and escorted at all times. Published Nov 6, 2025 Visitors to secure areas are always escorted by authorized personnel and are not issued access credentials. All visitors are required to sign a non-disclosure agreement (NDA) prior to entry, ensuring confidentiality and controlled access to sensitive areas. Perimeter controls are reviewed periodically to ensure they remain effective and appropriate to the risk environment. Published Nov 6, 2025 Perimeter controls are reviewed periodically to ensure they remain effective and appropriate to the current risk environment. This review process helps identify necessary adjustments to maintain adequate protection of facilities and assets. Secure areas are continuously monitored for unauthorized access. Published Nov 6, 2025 Secure areas are continuously monitored for unauthorized access through physical or electronic surveillance measures. This ensures timely detection and response to any attempted or actual security breaches. Personnel are required to follow documented procedures when working in secure areas, including restrictions on unauthorized devices and activities. Published Nov 6, 2025 Personnel are required to follow documented procedures when working in secure areas, including restrictions on unauthorized devices and activities. These procedures help maintain the confidentiality and integrity of sensitive information and reduce the risk of security incidents. Physical protections such as reinforced doors, surveillance systems, and intrusion detection are implemented. Published Nov 6, 2025 Physical protections, such as surveillance systems, including but not limited to intrusion detection, are implemented based on the results of risk assessments. This ensures that physical security measures are proportionate to identified risks and appropriate for each facility’s environment. Clear desk and clear screen policies are defined and enforced. Published Nov 6, 2025 Clear desk and clear screen policies are defined and enforced to prevent unauthorized access to sensitive information. These policies ensure that confidential data is protected when workstations are unattended or outside of business hours. Storage media containing sensitive information is protected from unauthorized access, copying, or removal. Published Nov 6, 2025 The use of physical storage media for sensitive information is forbidden by default. Exceptions may be granted only through formal approval by the security unit, ensuring strict control and adherence to organizational security requirements. Storage media is securely wiped before reassignment or reuse. Published Nov 6, 2025 Storage media is securely wiped before reassignment or reuse to ensure no residual data remains accessible. This control protects sensitive information from unauthorized recovery or disclosure. Cables carrying data or supporting information services are protected against unauthorized access, interference, or damage. Published Nov 6, 2025 Cables carrying data or supporting information services are protected against unauthorized access, interference, or damage. Physical and environmental controls ensure the integrity and availability of network and communication infrastructure. Physical security policy established Physical security A physical security program is established and communicated, with a defined owner. Published Nov 6, 2025 A physical security program is established, formally communicated, and assigned a defined owner responsible for its governance and maintenance. This ensures consistent implementation of physical security measures and accountability for protecting facilities, assets, and personnel. Security perimeters are formally defined and implemented based on risk and business requirements to protect areas containing sensitive information and critical assets. Published Nov 6, 2025 Security perimeters are formally defined and implemented based on risk assessments and business requirements. This ensures that areas containing sensitive information and critical assets are appropriately protected against unauthorized access or environmental threats. Physical security program is reviewed at least annually and following significant changes. Published Nov 6, 2025 The physical security program is reviewed at least annually and after significant organizational or environmental changes. This ensures its continued effectiveness, relevance, and alignment with current risks and business requirements. Physical security procedures for visitors enforced Physical security Visitors are required to sign in and out and provide valid ID. Published Nov 6, 2025 Visitors are required to sign in and out upon arrival and departure and must present valid identification. This process ensures traceability, accountability, and verification of visitor identity before being granted escorted access to the premises. Visitors required to wear a badge distinguishing them from employees. Published Nov 6, 2025 Visitors are required to wear a clearly identifiable badge that distinguishes them from employees. This control ensures easy identification of non-personnel within secure areas and supports effective access management and monitoring. Visitor logs are maintained for at least 90 days. Published Nov 6, 2025 Visitor logs are maintained for a minimum of 90 days to provide traceability and support security investigations if needed. This ensures accountability and documentation of all physical access to organizational premises. Activities of visitors and third-party personnel are monitored for potential security incidents. Published Nov 6, 2025 Activities of visitors and third-party personnel are monitored while on premises to identify and prevent potential security incidents. Continuous oversight ensures adherence to security requirements and protects sensitive areas from unauthorized actions. Robust environmental protection controls established Physical security Procedures to address physical and environmental threats have been identified and implemented. Published Nov 6, 2025 Procedures to address physical and environmental threats have been identified and implemented to protect personnel, facilities, and assets. These include measures for fire prevention, power failure, water damage, and other environmental risks based on assessed threats. Environmental controls include water damage protection measures. Published Nov 6, 2025 Environmental controls include protection measures against water damage such as leak detection, raised equipment placement, and drainage safeguards. These measures reduce the risk of system disruption and data loss from water-related incidents. Environmental controls include HVAC and humidity controls. Published Nov 6, 2025 Environmental controls include HVAC and humidity management systems to maintain stable temperature and air quality in critical areas. These controls help prevent equipment failure and ensure reliable operation of information processing facilities. Environmental controls include heat and smoke detectors and fire suppression. Published Nov 6, 2025 Environmental controls include heat and smoke detection systems as well as fire suppression mechanisms. These measures ensure early detection and effective response to fire-related incidents, protecting personnel, equipment, and critical information assets. Equipment is located in areas protected against fire, flooding, dust, and vibration. Published Nov 6, 2025 Equipment is located in areas that provide protection against fire, flooding, dust, and vibration. This ensures environmental factors do not compromise the availability, integrity, or functionality of critical systems and infrastructure. Backup and maintenance of critical equipment and systems in place Physical security Critical supporting utilities are designed and implemented. Published Nov 6, 2025 Critical supporting utilities, such as power, cooling, and network infrastructure, are designed and implemented to ensure continuous operation of essential systems. These utilities provide redundancy and resilience to minimize the impact of disruptions. Generator or generator area in offices and facilities. Published Nov 6, 2025 Uninterruptible Power Supply (UPS) systems are installed in offices and facilities to maintain power continuity for critical equipment during outages or fluctuations. This ensures the protection of systems and data while supporting orderly shutdown or recovery procedures if extended interruptions occur. Maintenance support contracts in place for critical infrastructure and equipment. Published Nov 6, 2025 Maintenance support contracts are in place for critical infrastructure and equipment to ensure timely repairs, updates, and preventive maintenance. These agreements help maintain system availability, performance, and compliance with operational and security requirements. Physical and environmental protection controls tested Physical security Preventive and corrective maintenance is scheduled and performed for all critical IT and building systems. Published Nov 6, 2025 Preventive and corrective maintenance is scheduled and performed for all critical IT and building systems to ensure reliability, safety, and availability. Maintenance activities are documented and tracked, with issues remediated promptly to minimize downtime and operational risk. Uninterruptible power supply (UPS) systems are tested at least annually. Published Nov 6, 2025 Uninterruptible Power Supply (UPS) systems are tested at least annually to verify their operational effectiveness and capacity. Regular testing ensures reliable backup power and reduces the risk of system outages during power interruptions. Security alarm systems tested at least annually. Published Nov 6, 2025 Security alarm systems are tested at least annually to verify their operational effectiveness and reliability. Regular testing ensures timely detection of physical security incidents and supports compliance with safety and security requirements. Fire alarms tested at least annually. Published Nov 6, 2025 Fire alarm systems are tested according to local regulations and prescribed testing schedules. This ensures compliance with safety requirements and reliable detection and response to fire incidents. Fire suppression systems are tested at least annually. Published Nov 6, 2025 Fire suppression systems are tested in accordance with local regulations and prescribed testing schedules. This ensures compliance with safety standards and reliable activation in the event of a fire incident. Generators are tested at least monthly. Published Nov 6, 2025 Generators are tested according to local regulations and at least monthly where applicable. Regular testing ensures operational readiness and reliable power continuity for critical systems during outages. Supporting utilities are regularly tested and maintained, with failure detection mechanisms in place. Published Nov 6, 2025 Supporting utilities are regularly tested and maintained to ensure their reliability and availability. Failure detection mechanisms are in place to provide early warning of issues, enabling timely response and minimizing operational disruption. Infrastructure management Controls Networks are segregated Network security Networks are segmented into domains with clearly defined perimeters on separate networks, based on a thorough evaluation of each domain’s security requirements. Published Nov 6, 2025 Networks are segmented into separate domains with clearly defined perimeters based on security requirements. This segmentation limits the spread of threats, isolates sensitive systems, and ensures that access and controls are appropriately tailored to each network domain. Networks segmented into domains based on an evaluation of the security requirements for each domain. Published Nov 6, 2025 Networks are segmented into domains based on an evaluation of each domain’s specific security requirements. This segmentation approach limits the spread of potential threats, isolates critical systems, and ensures that access controls are appropriately applied according to risk. Client data is logically or physically segregated and isolated from other clients’ data across networks, storage, applications, and backups. Published Nov 6, 2025 Client data is logically or physically segregated and isolated from other clients’ data across networks, storage, applications, and backups. This ensures data integrity, confidentiality, and compliance with contractual and regulatory requirements. The rationale for network segmentation decisions is documented and reviewed periodically. Published Nov 6, 2025 The rationale for network segmentation decisions is documented and reviewed periodically to ensure continued effectiveness and relevance. This process confirms that segmentation controls remain aligned with evolving business operations, risk assessments, and security requirements. Network security policies and procedures in place Network security Management approved policy for remote access to scoped systems and data. Published Nov 6, 2025 A management-approved policy governs remote access to scoped systems and data. It defines authorization, authentication, and encryption requirements to ensure secure connections and protect sensitive information from unauthorized access. Wireless policy or program has assigned owner and has been approved by management. Published Nov 6, 2025 A wireless security policy and program are established with an assigned owner and management approval. This ensures accountability, consistent application of controls, and secure operation of wireless networks across the organization. Security and hardening standards for network devices are defined and enforced. Published Nov 6, 2025 Security and hardening standards for network devices are defined and enforced to ensure consistent protection across the network infrastructure. These standards cover configuration, patching, and access controls to reduce vulnerabilities and maintain a secure environment. Formally defined network security policy is implemented and maintained. Published Nov 6, 2025 A formally defined network security policy is implemented and maintained to govern the secure design, operation, and management of network infrastructure. This policy ensures consistent application of controls and alignment with organizational and regulatory requirements. Network architecture incorporates Zero Trust principles such as least privilege access, segmentation, and continuous verification where applicable. Published Nov 6, 2025 The network architecture includes least privilege access, segmentation, and continuous verification where applicable. This approach minimizes attack surfaces, limits lateral movement, and ensures that access is continuously validated based on context and risk. Remote access requires strong authentication (e.g., MFA, VPN with least privilege). Published Nov 6, 2025 Remote access requires strong authentication mechanisms such as multi-factor authentication (MFA) and VPN connections configured with least privilege. These controls ensure that only authorized users can securely access scoped systems and data. Remote work requires the use of organization-managed or approved devices with secure configurations. Published Nov 6, 2025 All work, whether performed remotely or on-site, is conducted using organization-managed or approved devices with secure configurations. This ensures consistent protection of systems and data regardless of work location. Information accessed, processed, or stored remotely must be protected through secure storage, screen locking, and physical safeguards. Published Nov 6, 2025 Information accessed, processed, or stored remotely must be protected using secure storage, screen locking, and appropriate physical safeguards. These measures prevent unauthorized access and ensure the confidentiality and integrity of organizational data in all work environments. Network traffic and services are continuously monitored to detect anomalies, suspicious activity, and potential indicators of compromise. Published Nov 6, 2025 Network traffic and services are continuously monitored to detect anomalies, suspicious activity, and potential indicators of compromise. This ongoing monitoring enables rapid detection and response to threats, supporting the overall integrity and resilience of the organization’s network environment. Security of Network Services Network security Security requirements for internal and outsourced network services are defined, approved, and implemented. Published Nov 6, 2025 Security requirements for both internal and outsourced network services are defined, approved, and implemented. This ensures consistent protection, compliance, and oversight across all network environments, including those managed by third parties. Security controls and service levels for network services are regularly monitored and reviewed for effectiveness and compliance. Published Nov 6, 2025 Security controls and service levels for network services are regularly monitored and reviewed to ensure effectiveness and compliance. This process helps maintain consistent protection, identify gaps, and drive continual improvement in network security management. Security responsibilities for network service delivery and maintenance are defined and documented. Published Nov 6, 2025 Security responsibilities for network service delivery and maintenance are clearly defined and documented. This ensures accountability, consistent implementation of controls, and effective coordination between internal teams and external service providers. Data protection Controls Access control processes established and implemented Access management Periodic user access reviews are conducted. Published Nov 6, 2025 Periodic user access reviews are conducted to verify that access rights remain appropriate to roles and responsibilities. This process ensures timely removal or adjustment of unnecessary privileges and helps maintain the principle of least privilege. Unique IDs are required for authentication across systems and devices. Published Nov 6, 2025 Unique user IDs are required for authentication across all systems and devices. This ensures accountability, enables activity tracking, and supports effective monitoring and audit of user actions. User access rights are granted on a least-privilege basis, aligned with each role’s business needs. Published Nov 6, 2025 User access rights are granted based on the principle of least privilege, ensuring users receive only the access necessary to perform their job functions. This minimizes the risk of unauthorized access and supports effective control over sensitive systems and data. Process in place to modify access rights of users who have changed roles. Published Nov 6, 2025 A defined process is in place to modify access rights when users change roles or responsibilities. This ensures that access remains appropriate to current duties and prevents unauthorized access to systems or data. Inactive user IDs disabled or deleted after defined periods of inactivity. Published Nov 6, 2025 Inactive user IDs are disabled or deleted after a defined period of inactivity. This control reduces the risk of unauthorized access by ensuring unused accounts cannot be exploited. Process that allows authenticators to be revoked when necessary. Published Nov 6, 2025 A defined process exists to revoke authenticators, such as passwords, tokens, or certificates, when necessary. This ensures that compromised or no-longer-authorized credentials are promptly invalidated, maintaining secure access control. Use of privileged accounts is logged and monitored to detect misuse or unauthorized activity. Published Nov 6, 2025 The use of privileged accounts is logged and continuously monitored to detect misuse or unauthorized activity. This ensures accountability, supports timely incident detection, and strengthens overall access control security. Access exceptions and temporary access are documented, time-bound, and approved through a formal process. Published Nov 6, 2025 Access exceptions and temporary access are documented, time-bound, and approved through a formal process. This ensures that elevated or exceptional permissions are controlled, monitored, and revoked promptly after the defined purpose is fulfilled. Use of privileged utility programs is restricted, approved, and monitored. Published Nov 6, 2025 The use of privileged utility programs is restricted to authorized personnel, approved through a formal process, and continuously monitored. This ensures such programs are used only for legitimate administrative purposes and prevents misuse or unauthorized system access. Access to information and other associated assets is restricted through technical and procedural controls. Published Nov 6, 2025 Access to information and associated assets is restricted through a combination of technical and procedural controls. These include authentication, authorization, and policy-based mechanisms to ensure that only authorized personnel can access sensitive systems and data. Privileged access rights are reviewed at least quarterly. Published Nov 6, 2025 Privileged access rights are reviewed at least quarterly to ensure they remain appropriate to current roles and responsibilities. This regular review helps prevent privilege creep, detect unauthorized access, and maintain effective access control. Policies include prompt removal of physical and logical access rights upon termination or change of employment. Published Nov 6, 2025 Policies require the prompt removal of both physical and logical access rights upon termination or change of employment. This ensures that only current, authorized personnel retain access, reducing the risk of unauthorized entry or data exposure. Identities are verified prior to provisioning access to systems and services. Published Nov 6, 2025 Identities are verified before provisioning access to systems and services to ensure that only legitimate users are granted authorization. This verification process helps prevent unauthorized access and supports the integrity of the organization’s access management controls. Identity lifecycle processes are implemented to provision, update, and revoke access for all user and system identities. Published Nov 6, 2025 Identity lifecycle processes are implemented to provision, update, and revoke access for all user and system identities. These processes ensure access remains appropriate throughout the identity’s lifecycle and that rights are promptly removed when no longer required. Identity proofing strength is proportional to the context of access and credentials are bound accordingly. Published Nov 6, 2025 Identity lifecycle management processes are implemented to provision, modify, and revoke access for all user and system identities. This ensures that access privileges remain accurate, current, and aligned with organizational policies and role requirements. Users are informed of their responsibilities for protecting access credentials and securely accessing information and systems. Published Nov 6, 2025 Users are informed of their responsibilities for protecting access credentials and securely accessing information and systems. This awareness is reinforced through training and policies to ensure proper handling of authentication methods and reduce the risk of unauthorized access. Access provisioning and deprovisioning are automated and integrated with HR or identity lifecycle processes. Published Nov 6, 2025 Access provisioning and deprovisioning are automated and integrated with HR and identity lifecycle processes. This ensures timely and accurate updates to user access based on employment status and role changes, reducing the risk of unauthorized access. Identity assertions are cryptographically protected, securely transmitted, and verified prior to granting access. Published Nov 6, 2025 Identity assertions are cryptographically protected, securely transmitted, and verified before granting access. This ensures the authenticity and integrity of authentication data, preventing impersonation or unauthorized access to systems and services. Documented access control policy in place Access management Access control policy approved by senior management, maintained and communicated effectively. Published Nov 6, 2025 An access control policy is formally approved by senior management, maintained, and communicated effectively across the organization. This ensures consistent implementation of access management principles and alignment with business and security objectives. Segregation of duties in place for granting and approving access to scoped systems and data. Published Nov 6, 2025 Segregation of duties is enforced for granting and approving access to scoped systems and data. This ensures no single individual can authorize and provision access independently, reducing the risk of unauthorized or inappropriate access. Privileged accounts are kept distinct from standard accounts, and their use is documented and restricted to only those key roles that require them. Published Nov 6, 2025 Privileged accounts are maintained separately from standard user accounts, with their use documented and restricted to key roles requiring elevated access. This segregation ensures accountability, minimizes misuse risk, and supports strong access control practices. Authentication mechanisms are securely implemented and enforced Access management Processes in place to protect passwords and PIN numbers. Published Nov 12, 2025 Processes are in place to protect passwords and PIN numbers through secure storage, encryption, and complexity requirements. These controls ensure authentication data remains confidential and resistant to unauthorized disclosure or compromise. Authentication policy is documented, approved, and enforced across all authentication mechanisms and systems. Published Nov 12, 2025 An authentication policy is documented, approved, and enforced across all authentication mechanisms and systems. This ensures consistent implementation of secure authentication practices and alignment with organizational and regulatory requirements. Authentication credentials are securely distributed to users following identity verification. Published Nov 12, 2025 Authentication credentials are securely distributed to users only after identity verification. This process ensures that credentials are delivered safely to the intended individual, reducing the risk of unauthorized access or credential compromise. Processes are in place to securely reset or recover authentication credentials when required. Published Nov 12, 2025 Processes are established to securely reset or recover authentication credentials when required. These procedures include identity verification and controlled authorization to prevent unauthorized credential changes or misuse. Phishing-resistant authentication methods are adopted where feasible based on risk. Published Nov 12, 2025 Phishing-resistant authentication methods are adopted where feasible based on risk assessments. This strengthens protection against credential theft and social engineering attacks while aligning authentication strength with organizational risk levels. Authentication mechanisms protect against brute-force attacks. Published Nov 12, 2025 Authentication mechanisms include protections against brute-force attacks, such as account lockouts, rate limiting, and monitoring of failed login attempts. These controls prevent unauthorized access through repeated password guessing or automated attack methods. Multi-factor authentication is enforced for user access to non-public organizational systems and applications. Published Nov 12, 2025 Multi-factor authentication (MFA) is implemented for user access to organizational systems and applications based on risk. This ensures stronger verification of user identity and significantly reduces the likelihood of unauthorized access resulting from compromised credentials. Multi-factor authentication required for privileged system access. Published Nov 12, 2025 Multi-factor authentication (MFA) is required for privileged system access. This adds an additional layer of protection for critical accounts and reduces the risk of unauthorized access to sensitive systems and administrative functions. Multi-factor authentication enforced for all endpoint access. Published Nov 12, 2025 Multi-factor authentication (MFA) is enforced for all system and application access from organization-managed endpoints. This ensures strong user verification, prevents unauthorized access, and maintains secure connectivity across all devices. Compliance with MFA requirements is monitored and reviewed regularly to ensure enforcement across all applicable systems. Published Nov 12, 2025 Compliance with multi-factor authentication (MFA) requirements is monitored and reviewed regularly to ensure consistent enforcement across all applicable systems. This process helps identify gaps, maintain alignment with security policies, and ensure ongoing protection against unauthorized access. SSO is enforced across all organizational systems and applications, including both internal and third-party applications. Published Nov 12, 2025 Single Sign-On (SSO) is enforced where possible across organizational systems and applications, including both internal and third-party services. This approach centralizes authentication, improves user experience, and enhances security through consistent access management and monitoring. All SSO logins require multi-factor authentication (MFA). Published Nov 12, 2025 Multi-factor authentication (MFA) is required for all Single Sign-On (SSO) logins where feasible. This ensures secure user verification across integrated systems and applications, reducing the risk of unauthorized access while maintaining flexibility based on technical and business constraints. SSO authentication events and anomalies (e.g., failed logins, location mismatches) are monitored and integrated with security alerting. Published Nov 12, 2025 SSO authentication events and anomalies, such as failed logins or location mismatches, are monitored and integrated with security alerting. This enables rapid detection and response to potential account misuse or compromise. Administrative access to the SSO platform requires just-in-time elevation or additional verification. Published Nov 12, 2025 Administrative access to the SSO platform requires just-in-time elevation or additional verification. This ensures that privileged actions are tightly controlled, reducing the risk of unauthorized configuration changes or misuse. Access management audit trail Access management User access records are retained for at least 12 months. Published Nov 12, 2025 User access records are retained for a minimum of 12 months. This retention period ensures sufficient traceability for audits, investigations, and compliance verification activities. Session timeouts and reauthentication requirements are enforced based on risk level and inactivity thresholds. Published Nov 12, 2025 Session timeouts and reauthentication requirements are enforced based on assessed risk levels and defined inactivity thresholds. This ensures sessions remain secure and reduces the likelihood of unauthorized access through unattended or prolonged logins. Policy encompasses third-party access management Access management Third-party identities have the required trust and access level. Published Nov 12, 2025 Third-party identities are granted access based on verified trust levels and defined access requirements. This ensures external users receive only the permissions necessary for their role while maintaining security and compliance with organizational policies. Third-party access is reviewed periodically and revoked when no longer needed. Published Nov 12, 2025 Third-party access is reviewed periodically to ensure continued necessity and compliance with security requirements. Access is promptly revoked when no longer needed to minimize risk and maintain proper access control. Data privacy and protection policy in place Privacy management Data privacy and protection policy has been implemented. Published Nov 12, 2025 A data privacy and protection policy has been implemented to define how personal and sensitive information is collected, processed, stored, and shared. The policy ensures compliance with applicable data protection regulations and promotes consistent safeguarding of data across the organization. Formal privacy program covers for the protection of personal information handled on behalf of the client. Published Nov 12, 2025 Policies, guidelines, and specific instructions are in place to ensure the protection of personal information handled on behalf of clients. These measures define responsibilities and controls to maintain compliance with data protection requirements and safeguard client data. Data subjects can request removal of their personal data from AI systems where feasible. Published Nov 12, 2025 Data subjects can request the removal of their personal data from AI systems where feasible. Such requests are evaluated and fulfilled in line with legal, contractual, and technical constraints to ensure compliance with data protection obligations. Explicit consent mechanisms are implemented to ensure authorisation for sensitive data use in AI/ML training, tuning, evaluation, or inference pipelines. Published Nov 12, 2025 Explicit consent mechanisms are implemented to ensure proper authorization for the use of sensitive data in AI and ML training, tuning, evaluation, or inference pipelines. This ensures compliance with data protection regulations and ethical standards governing the use of personal and sensitive information. A privacy impact assessment (PIA) process is established and integrated into new system, service, or vendor onboarding. Published Nov 12, 2025 A privacy impact assessment (PIA) process is established and conducted where required, including during the onboarding of new systems, services, or vendors. This ensures that privacy risks are identified, evaluated, and mitigated before personal data is processed. The privacy policy explicitly aligns with applicable national and international privacy regulations. Published Nov 12, 2025 The privacy policy explicitly aligns with applicable national and international privacy regulations. This ensures that personal data is processed in compliance with legal obligations and recognized data protection standards. A process exists to monitor changes to global privacy regulations and update the privacy program accordingly. Published Nov 12, 2025 A process exists to monitor changes to global privacy regulations and update related policies, guidelines, and practices accordingly. This ensures the organization’s privacy management remains current, compliant, and aligned with evolving legal and regulatory requirements. The privacy policy is reviewed and re-approved at least annually or upon material change. Published Nov 12, 2025 The privacy policy is reviewed and re-approved at least annually or upon material change under the responsibility of the Data Protection Officer (DPO). This ensures continued compliance with evolving privacy regulations and organizational requirements. Safe handling of Personally Identifiable Information (PII) Privacy management PII is classified and labeled according to sensitivity, with corresponding handling requirements. Published Nov 12, 2025 Personally identifiable information (PII) is classified and labeled according to its sensitivity level, with defined handling requirements for each category. This ensures appropriate protection, storage, and access controls throughout the data lifecycle. Record of processing activities for all systems that handle personal data is maintained. Published Nov 12, 2025 A record of processing activities (RoPA) is maintained for all systems that handle personal data. This record documents the purposes, data types, recipients, and retention periods to ensure transparency and compliance with data protection regulations such as the GDPR. Retention schedules for PII are defined, enforced, and audited for compliance. Published Nov 12, 2025 Retention schedules for personally identifiable information (PII) are defined, enforced, and periodically audited for compliance. This ensures personal data is retained only as long as necessary for its intended purpose and disposed of securely in line with legal and regulatory requirements. Data masking is applied to sensitive information in production and reporting environments. Published Nov 12, 2025 Data masking is applied to sensitive information in production and reporting environments where feasible. This reduces the risk of unauthorized data exposure while maintaining necessary functionality for business and analytical processes. Documented policies and procedures to address cross-border and international data flows. Published Nov 12, 2025 Documented policies and procedures are in place to govern cross-border and international data flows. These ensure compliance with applicable data transfer mechanisms, such as Standard Contractual Clauses (SCCs), and maintain protection of personal data in accordance with regulatory requirements. PII disposal is logged and verified to prevent unauthorized retention. Published Nov 12, 2025 The disposal of personally identifiable information (PII) is logged and verified to ensure secure deletion and prevent unauthorized retention. This process maintains compliance with data protection regulations and supports proper lifecycle management of personal data. Clear accountability for privacy obligations Privacy management A qualified and accountable owner is designated to oversee the privacy programme and ensure compliance with all privacy requirements, including contractual client-data obligations. Published Nov 12, 2025 A qualified and accountable owner, the Data Protection Officer (DPO), is designated to oversee the privacy program and ensure compliance with all privacy requirements, including contractual client-data obligations. This role provides governance, guidance, and oversight for all personal data processing activities. Publicly facing communication channels in place to enable submission and response to privacy inquiries, complaints, and disputes. Published Nov 12, 2025 Publicly facing communication channels are established to allow individuals to submit privacy-related inquiries, complaints, and disputes. These channels ensure transparent communication and timely responses in accordance with data protection and regulatory requirements. Roles and responsibilities for privacy risk management are documented, including escalation paths. Published Nov 12, 2025 Roles and responsibilities for privacy risk management are documented, including defined escalation paths. This ensures clear accountability, effective issue resolution, and consistent management of privacy risks across the organization. Privacy management encompasses third and fourth parties Privacy management Contracts and agreements with third parties include appropriate data protection safeguards. Published Nov 12, 2025 Contracts and agreements with third parties include appropriate data protection safeguards. These provisions ensure that third parties handling personal or sensitive information comply with organizational security policies, legal requirements, and applicable data protection regulations. Third-party risk management program covers security of client scoped data. Published Nov 12, 2025 A third-party risk management program is in place that covers the security of client-scoped data. This ensures that vendors and service providers handling client information are evaluated, monitored, and required to comply with relevant security and data protection standards. Cybersecurity responsibilities for third parties and customers are documented, communicated, and coordinated across internal stakeholders and external entities. Published Nov 12, 2025 Cybersecurity responsibilities for third parties and customers are documented, communicated, and coordinated across internal stakeholders and external entities. This ensures clear accountability, effective collaboration, and consistent security practices throughout the supply chain and customer interactions. Third-party agreements require downstream suppliers to implement equivalent client data protections. Published Nov 12, 2025 Third-party agreements require downstream suppliers to implement equivalent client data protection measures. This ensures that all parties in the supply chain maintain consistent security and privacy controls aligned with contractual and regulatory requirements. Third-party due diligence includes evaluation of data protection and privacy policies, practices, and technical controls. Published Nov 12, 2025 Third-party due diligence includes evaluation of data protection and privacy policies, practices, and technical controls. This assessment ensures that vendors handling organizational or client data meet required security and compliance standards before engagement and throughout the relationship. Third-party data access and transmission are explicitly disclosed and approved. Published Nov 12, 2025 Third-party data access and transmission are explicitly disclosed and approved prior to engagement. This ensures transparency, compliance with contractual and regulatory requirements, and proper oversight of all external data handling activities. Application security Controls Secure software development practices Software development A secure development life cycle process is defined, implemented, and integrated into all development projects. Published Nov 13, 2025 A secure development life cycle (SDLC) process is defined, implemented, and integrated into all development projects. This ensures security is embedded at every stage of software development, from design and coding to testing and deployment, reducing vulnerabilities and improving overall product security. Software development, testing, and staging environments are kept separate from the production environment. Published Nov 13, 2025 Software development, testing, and staging environments are kept separate from the production environment. This segregation prevents unintended changes, reduces the risk of unauthorized access to live data, and ensures that testing and development activities do not impact production systems. Security experts are engaged for development on all applications. Published Nov 13, 2025 Security expertise is engaged for development activities across all applications. Security specialists provide guidance on secure design, coding practices, and risk mitigation, ensuring that security is embedded throughout the development lifecycle and aligned with organizational standards. Third-party or outsourced development is governed by security requirements, auditability, and contract clauses. Published Nov 13, 2025 Third-party or outsourced development is governed by defined security requirements, auditability expectations, and contractual clauses. While Eficode does not currently use external or third-party software development, these controls are established to ensure that, if such engagements occur, they meet organizational security standards and compliance obligations. Secure code reviews include analysis of vulnerability to recent attacks. Published Nov 13, 2025 Secure code reviews include analysis of vulnerabilities related to recent and emerging attack techniques. This ensures that code is evaluated not only against established secure coding practices but also against current threat trends to reduce the risk of exploitation. Web server patches, service packs, and hot fixes are tested, documented, and approved prior to deployment. Published Nov 13, 2025 Web server patches, service packs, and hot fixes are tested, documented, and approved prior to deployment. This ensures updates are applied safely, do not introduce instability, and maintain the security and integrity of production environments. Adversarial testing is conducted to improve AI models’ resistance to adversarial inputs. Published Nov 13, 2025 Adversarial testing is conducted where applicable to evaluate and improve AI models’ resilience against manipulated or malicious inputs. This testing helps identify weaknesses, strengthen model robustness, and reduce the risk of adversarial exploitation in real-world use. Technical controls enforce resource, performance, and behaviour limits on AI systems. Published Nov 13, 2025 Technical controls are implemented to enforce resource, performance, and behavior limits on AI systems. These safeguards help prevent misuse, ensure stable operation, and reduce the risk of unintended or harmful system behavior. Access to development, test, and production environments is role-based and uses separate credentials. Published Nov 13, 2025 Access to development, test, and production environments is role-based and requires the use of separate credentials. This separation ensures proper segregation of duties, reduces the risk of unauthorized access, and maintains the integrity and security of each environment. Outsourced development is actively supervised and monitored. Published Nov 13, 2025 Outsourced development is actively supervised and monitored to ensure adherence to security requirements, coding standards, and contractual obligations. Although Eficode does not currently use outsourced development, these controls are defined to ensure proper oversight and governance if such engagements occur in the future. Security testing processes are formally defined and implemented during development and acceptance stages. Published Nov 13, 2025 Security testing processes are formally defined and implemented during both development and acceptance stages. This ensures that applications and systems are evaluated for security vulnerabilities before release and meet organizational security requirements prior to deployment. Secure coding standards are defined and applied throughout the development process. Published Nov 13, 2025 Secure coding standards are defined and applied consistently throughout the development process. These standards guide developers in implementing secure design and coding practices, helping to prevent common vulnerabilities and ensuring that applications meet security and compliance requirements. Security fixes and patches are rolled out according to defined severity-based timelines. Published Nov 13, 2025 Security fixes and patches are deployed according to defined severity-based timelines. This ensures that critical vulnerabilities are remediated promptly while maintaining a structured and risk-based approach to patch management. AI systems are assessed for known risks using established adversarial threat models. Published Nov 13, 2025 AI systems are assessed for known risks using established adversarial threat models. This helps identify potential weaknesses, evaluate how models may be targeted or manipulated, and ensure that appropriate safeguards are implemented to mitigate adversarial threats. Static and dynamic application security testing (SAST/DAST) is integrated into continuous integration/continuous deployment pipelines. Published Nov 13, 2025 Static and dynamic application security testing (SAST/DAST) is integrated into continuous integration and continuous deployment (CI/CD) pipelines. This ensures automated, consistent identification of security vulnerabilities throughout the development lifecycle and supports early remediation before production deployment. Audit activities involving operational systems are planned in advance and approved by relevant management. Published Nov 13, 2025 Audit activities involving operational systems are planned in advance and approved by relevant management. This ensures audits are coordinated, minimize operational disruption, and are conducted with appropriate oversight and authorization. Access granted for audit or assurance testing is limited to the minimum level required, authorized prior to use, and logged. Published Nov 13, 2025 Access granted for audit or assurance testing is limited to the minimum level required, authorized prior to use, and fully logged. This ensures auditors can perform necessary activities without exposing systems or data to unnecessary risk, while maintaining traceability and control. Security testing tools and auditor devices are verified to meet organizational security requirements before accessing operational systems. Published Nov 13, 2025 Security testing tools and auditor devices are verified to meet organizational security requirements before they are permitted to access operational systems. This ensures that external tools or devices do not introduce vulnerabilities, comply with security controls, and maintain the integrity of the production environment. Secure architecture design standards established Software development Management approved IT architectural plan. Published Nov 13, 2025 An IT architectural plan is formally documented and approved by management. This ensures that technology decisions align with organizational strategy, security requirements, and operational needs, providing a structured foundation for system design, integration, and future scalability. Secure design principles are documented and consistently applied across system architecture and engineering processes. Published Nov 13, 2025 Secure design principles are documented and consistently applied across system architecture and engineering processes. These principles guide decisions on system structure, data flows, access controls, and integration, ensuring that security is embedded from the earliest stages of design and maintained throughout the system’s lifecycle. Architecture reviews are conducted to validate that secure design principles are applied consistently. Published Nov 13, 2025 Architecture reviews are conducted to ensure that secure design principles are consistently applied across systems and components. These reviews validate alignment with security requirements, identify potential weaknesses early, and support secure, resilient system design. Baseline secure configurations are defined and regularly reviewed for all hardware, software, services, and networking assets. Published Nov 13, 2025 Baseline secure configurations are defined and regularly reviewed for all hardware, software, services, and networking assets. This ensures that systems are deployed and maintained according to approved security standards, reducing misconfiguration risks and supporting consistent, secure operational environments. Configuration changes are logged and monitored for unauthorized modifications. Published Nov 13, 2025 Configuration changes are logged and monitored to detect any unauthorized or unexpected modifications. This ensures traceability, supports timely investigation of anomalies, and helps maintain the integrity and security of system configurations. Developer security training implemented Software development Developers receive formal, role-specific training on secure coding, threat modeling, and privacy engineering as part of onboarding and annual refreshers. Published Nov 13, 2025 Developers receive formal, role-specific training on secure coding, threat modeling, and privacy engineering as part of their onboarding and annual refresher programs. This ensures they remain current on secure development practices and are equipped to design and build systems that meet organizational security and privacy requirements. Test data procedures implemented Software development Sensitive information is not used in the test, development, or QA environments. Published Nov 13, 2025 Sensitive information is not used in test, development, or QA environments. Non-production environments rely on anonymized or synthetic data to prevent exposure of real sensitive data and reduce the risk of unauthorized access or misuse during testing and development activities. Test data securely is destroyed following testing. Published Nov 13, 2025 Test data is securely destroyed after testing activities are completed. This ensures that temporary or synthetic data used in non-production environments does not persist longer than necessary and is handled in accordance with organizational security and data management requirements. All test data is subject to the same classification and destruction policy as production data. Published Nov 13, 2025 All test data is subject to the same classification and destruction policies as production data. This ensures that any data used in testing, whether synthetic or anonymized, is managed and disposed of securely and consistently in line with organizational requirements. Developer access management Software development Policy and procedures in place to control access to source code and development tools. Published Nov 13, 2025 Policies and procedures are in place to control access to source code and development tools. Access is granted based on role and business need, enforced through authentication and authorization controls, and regularly reviewed to ensure only authorized personnel can modify or interact with development assets. Developer access to production environments is controlled. Published Nov 13, 2025 Developer access to production environments is strictly controlled. Access is granted only when necessary, requires elevated approvals, and is monitored to ensure that production systems remain secure and changes are performed in a controlled and auditable manner. Developer access to production environments uses just-in-time elevation or temporary tokens. Published Nov 13, 2025 Developer access to production environments is granted only through just-in-time elevation or temporary access tokens. This ensures that elevated permissions are short-lived, tightly controlled, and limited to the specific tasks required, reducing the risk of unauthorized or persistent access. Access to source code is version-controlled and monitored for unauthorized changes. Published Nov 13, 2025 Access to source code is managed through version control systems that track all changes and monitor for unauthorized modifications. This provides full traceability, supports secure collaboration, and helps detect any unexpected or malicious alterations. Security analysis tools are used to detect defects in source code prior to production deployment. Published Nov 13, 2025 Security analysis tools are used to detect defects and vulnerabilities in source code prior to production deployment. This proactive approach helps identify and remediate issues early in the development cycle, improving the security and reliability of released software. Vulnerability management program established Vulnerability management Vulnerability management program and policy has been effectively developed and maintained. Published Nov 12, 2025 A vulnerability management policy and program have been effectively developed, maintained, and are aligned with organizational risk strategy. The policy defines roles, responsibilities, scanning schedules, remediation procedures, and metrics to support continuous improvement and timely response to vulnerabilities. Vulnerability scans are performed on a defined cadence, covering all internet-exposed and internal assets. Published Nov 12, 2025 Vulnerability scans are performed on a defined cadence covering all internet-exposed and internal assets. This ensures timely identification and remediation of security weaknesses, reducing the risk of exploitation and maintaining a strong security posture. Risk-based prioritization is applied using CVSS and/or exploitability data. Published Nov 12, 2025 Risk-based prioritization is applied using CVSS scores and exploitability data to assess and rank identified vulnerabilities. This approach ensures remediation efforts focus on the most critical issues that pose the greatest risk to the organization. Time-to-remediate targets are defined and tracked for high, medium, and low vulnerabilities. Published Nov 12, 2025 Time-to-remediate targets are defined and tracked for critical, high, medium, and low vulnerabilities. This ensures timely resolution of security issues based on risk severity and supports accountability in maintaining a secure environment. Penetration testing program in place Vulnerability management Third-party web application penetration tests are conducted. Published Nov 12, 2025 Third-party web application penetration tests are conducted to identify security weaknesses that could be exploited by attackers. Independent testing ensures objective assessment, validates the effectiveness of existing controls, and supports continuous improvement of application security. Penetration testing has a defined scope including web applications, internal infrastructure, and APIs where applicable. Published Nov 12, 2025 Penetration testing is performed with a defined scope that includes web applications, internal infrastructure, and APIs where applicable. This comprehensive approach ensures that potential vulnerabilities across critical systems are identified, assessed, and remediated effectively. Penetration test findings are tracked and remediated through a formal process. Published Nov 12, 2025 Penetration test findings are tracked and remediated through a formal process. This ensures that identified vulnerabilities are prioritized, assigned, and resolved in a timely manner, strengthening the organization’s overall security posture. Special interest group membership Vulnerability management Documented evidence of membership to forums relating to information security (such as ISC2, ISACA, OWASP), with an assigned role to monitor and feed insights back into the security program. Published Nov 12, 2025 The Security unit maintains active engagement with key cybersecurity special interest groups. These include national bodies, major service provider advisory channels, and community groups. This ensures timely access to threat intelligence and strengthens the organization’s overall security posture Risk management Controls Formalized risk assessment process Enterprise risk management Formal risk assessment process is defined and implemented. Published Nov 13, 2025 Risks are assessed and prioritized using defined risk acceptance criteria that consider both the business impact and the likelihood of exploitation. This ensures a consistent, structured approach to evaluating risks and supports informed decision-making on mitigation and acceptance. Risks are assessed and prioritized using defined risk acceptance criteria that consider business impact and likelihood of exploitation. Published Nov 13, 2025 Risks are assessed and prioritized using defined risk acceptance criteria that consider both the business impact and the likelihood of exploitation. This ensures a consistent, structured approach to evaluating risks and supports informed decision-making on mitigation and acceptance. Cybersecurity risk appetite and risk tolerance statements are formally documented, communicated to relevant stakeholders, and reviewed on a defined schedule. Published Nov 13, 2025 Cybersecurity risk appetite and risk tolerance statements are formally documented and communicated to relevant stakeholders. These statements are reviewed on a defined schedule to ensure they remain aligned with organizational strategy, regulatory requirements, and the evolving threat landscape. Information assets and business processes are inventoried and evaluated for risk exposure as part of the risk assessment process. Published Nov 13, 2025 Information assets and business processes are inventoried and evaluated for risk exposure as part of the risk assessment process. This ensures that risks are identified systematically, assessed for their potential impact and likelihood, and addressed through appropriate controls and mitigation measures. Risk assessments are reviewed at planned intervals and upon major changes to the business environment or threat landscape. Published Nov 13, 2025 Risk assessments are reviewed at planned intervals—at least once per year—and whenever significant changes occur in the business environment or threat landscape. This ensures that risks remain accurately understood and that mitigation measures stay aligned with current conditions and organizational priorities. Risk status and treatment outcomes are regularly communicated to enterprise risk stakeholders and incorporated into enterprise risk management (ERM) decision-making processes. Published Nov 13, 2025 Risk status and treatment outcomes are regularly communicated to enterprise risk stakeholders and incorporated into enterprise risk management (ERM) decision-making processes. This ensures transparency, supports informed prioritization, and aligns cybersecurity risk actions with broader organizational risk management objectives. 3rd-Nth party risk management program enforced Third-Nth party management A third-party risk management (TPRM) program is established and implemented. Published Nov 13, 2025 A third-party risk management (TPRM) program is established and implemented to evaluate, monitor, and manage risks associated with vendors and service providers. The program ensures that third parties handling organizational or client data meet defined security, privacy, and compliance requirements throughout the lifecycle of the engagement. All suppliers are identified and prioritized based on the criticality of their products or services to operations and cybersecurity posture. Published Nov 13, 2025 All suppliers are identified and prioritized based on the criticality of their products or services to operations and the organization’s cybersecurity posture. Suppliers are classified into four tiers, enabling a risk-based approach to oversight, assessment, and ongoing monitoring. Third-party risk management program policies, standards, and procedures are reviewed and approved by senior management. Published Nov 13, 2025 The third-party risk management program - including the Supply Chain Security Policy, Supplier Code of Conduct, and Supplier Security Schedule (which defines the minimum security requirements all suppliers must meet and commit to) - is reviewed and approved by senior management. This ensures that supplier governance practices align with organizational expectations, regulatory obligations, and overall security objectives. Third-party risk management process includes onboarding and offboarding procedures for vendors. Published Nov 13, 2025 The third-party risk management process includes defined onboarding and offboarding procedures for vendors. These procedures ensure that suppliers are assessed before engagement, meet required security controls, and have their access and data handling privileges appropriately removed or terminated when the relationship ends. Critical suppliers are identified and assessed for cybersecurity risks prior to acquisition or onboarding. Published Nov 13, 2025 All suppliers are identified and assessed for cybersecurity risks prior to acquisition or onboarding. This ensures that every vendor meets required security standards before any engagement begins and that risks are understood and managed from the outset. Third-party risk management program includes a definition of contract development, adherence and management policies and processes. Published Nov 13, 2025 The third-party risk management program includes defined policies and processes for contract development, adherence, and ongoing management. These ensure that security, privacy, and compliance requirements are incorporated into supplier agreements and consistently enforced throughout the vendor relationship lifecycle. Third-party risk management program includes requirements to review a vendor's third-party risk program. Published Nov 13, 2025 The third-party risk management program includes requirements to review a vendor’s own third-party risk program. This ensures that suppliers maintain appropriate oversight of their downstream partners and uphold security and compliance standards throughout their extended supply chain. Third parties are continuously monitored for security risk, compliance, and performance throughout the lifecycle of their products and services. Published Nov 13, 2025 Third parties are continuously monitored for security risk, compliance, and performance throughout the lifecycle of their products and services. This ongoing oversight ensures that suppliers maintain required security controls, adhere to contractual obligations, and promptly address any emerging risks or issues. Third-parties or service providers are evaluated for reassessment when there are material changes to risk posture, service offerings or contracts. Published Nov 13, 2025 Third parties and service providers are evaluated for reassessment whenever there are material changes to their risk posture, service offerings, or contractual terms. This ensures that evolving risks are identified promptly and that supplier controls continue to meet organizational security and compliance requirements. Cybersecurity risks from suppliers and third parties are included in risk communication across relevant business units and leadership. Published Nov 13, 2025 Cybersecurity risks associated with suppliers and third parties are included in risk communication across relevant business units and leadership. This ensures that stakeholders have visibility into supply chain risks and can make informed decisions regarding mitigation, prioritization, and ongoing oversight. Third-party risk management program requires third parties to disclose and provide visibility into their 3rd/Nth party dependencies. Published Nov 13, 2025 The third-party risk management program requires suppliers to disclose and provide visibility into their own third- and Nth-party dependencies. This ensures that downstream risks within the extended supply chain are identified, assessed, and managed in alignment with organizational security and compliance requirements. Third-party risk management program includes requirements for traceability of subcontracted services or software components. Published Nov 13, 2025 The third-party risk management program includes requirements for traceability of subcontracted services and software components. This ensures transparency into the full supply chain, enabling identification, assessment, and monitoring of downstream dependencies that may impact security, compliance, or operational resilience. Third-party risk management program includes consideration of 4th and Nth parties in the ICT supply chain. Published Nov 13, 2025 The third-party risk management program includes consideration of 4th parties within the ICT supply chain. This ensures visibility into key downstream dependencies beyond direct suppliers and supports more comprehensive assessment and management of supply chain risks. Third-party risk program defines periodic and event-based reassessment criteria. Published Nov 13, 2025 The third-party risk management program defines both periodic and event-based reassessment criteria. This ensures that suppliers are routinely evaluated at scheduled intervals and re-evaluated when significant changes occur in their risk posture, services, or environment. Cloud services are evaluated for security risks and compliance prior to acquisition or use. Published Nov 13, 2025 Cloud services are evaluated for security risks and compliance prior to acquisition or use. This ensures that all cloud providers meet organizational security requirements, regulatory obligations, and contractual expectations before being approved for onboarding. Cloud services are configured and monitored in accordance with defined security policies and contractual requirements. Published Nov 13, 2025 Cloud services are configured and monitored in accordance with defined security policies and contractual requirements. This ensures that cloud environments maintain proper security controls, comply with organizational standards, and remain aligned with regulatory and customer obligations throughout their use. Exit strategies and processes are documented for cloud services. Published Nov 13, 2025 Exit strategies and processes are documented for cloud services to ensure continuity, security, and proper data handling during service termination or migration. These processes define requirements for data extraction, secure deletion, contract closure, and transition planning to minimize operational and security risks. Hardware and software are verified for authenticity and integrity prior to acquisition or use, using trusted sources and validation mechanisms. Published Nov 13, 2025 Hardware and software are verified for authenticity and integrity prior to acquisition or use. Only trusted sources and approved validation mechanisms are used to ensure components are legitimate, uncompromised, and aligned with organizational security requirements. Supply chain risk considerations are integrated into enterprise risk management activities, including risk registers, strategy reviews, and prioritization processes. Published Nov 13, 2025 Supply chain risk considerations are integrated into enterprise risk management activities, including entries in risk registers, strategy reviews, and prioritization processes. This ensures that supplier-related risks are evaluated alongside other organizational risks and are addressed through coordinated, enterprise-wide decision-making. Supply chain security practices are integrated into the organization's cybersecurity and enterprise risk management programs. Published Nov 13, 2025 Supply chain security practices are integrated into the organization’s cybersecurity and enterprise risk management programs. This ensures that risks originating from suppliers, service providers, and downstream dependencies are assessed, monitored, and managed as part of the broader security and risk governance framework. Contractual obligations cover Nth parties Third-Nth party management Third-party contracts obligate sub-suppliers (4th/Nth parties) to implement privacy and information-security controls equivalent to those required of the primary supplier. Published Nov 13, 2025 Third-party contracts obligate sub-suppliers (including 4th parties) to implement privacy and information security controls equivalent to those required of the primary supplier. This ensures consistent protection of data and services throughout the extended supply chain and maintains alignment with organizational and regulatory requirements. All third-party and outsourced service provider relationships require confidentiality and/or non-disclosure agreements. Published Nov 13, 2025 All third-party and outsourced service provider relationships require confidentiality and/or non-disclosure agreements. These agreements ensure that any information shared with external parties is protected and handled in accordance with organizational security and privacy requirements. Third-party contracts include fourth/Nth party privacy and security control requirements where applicable. Published Nov 13, 2025 Third-party contracts include requirements for fourth-party privacy and security controls where applicable. This ensures that downstream entities handling organizational or client data maintain security standards consistent with those expected of primary suppliers. Third-party contracts require notification within a defined timeframe upon breach or significant incident. Published Nov 13, 2025 Third-party contracts require suppliers to notify the organization within a defined timeframe in the event of a breach or significant security incident. This ensures timely awareness, enables rapid response, and supports effective coordination of mitigation and communication activities. Contracts include the right to audit or request evidence of compliance from subcontractors and 4th parties. Published Nov 13, 2025 Contracts include the right to audit or request evidence of compliance from subcontractors and applicable fourth parties where feasible. This ensures visibility into downstream security practices and enables the organization to verify that required controls are implemented and maintained throughout the extended supply chain. Data processing agreements and security/privacy clauses are mandated in all third-party contracts involving personal or sensitive data. Published Nov 13, 2025 Data processing agreements and security/privacy clauses are mandated in all third-party contracts involving the processing of personally identifiable information (PII) or other sensitive data. This ensures that suppliers handling such data comply with applicable legal, regulatory, and organizational security requirements. Operational resilience Controls Backup processes implemented Business continuity Scoped data backed up and stored offsite. Published Nov 13, 2025 Scoped data is backed up and stored offsite to ensure availability and resilience in the event of system failures, outages, or disasters. Offsite storage safeguards critical information from local disruptions and supports timely recovery in line with business continuity and security requirements. Backup and related restoration procedures tested at least annually. Published Nov 13, 2025 Backup and restoration procedures are tested at least annually to verify their effectiveness and ensure that critical data can be recovered reliably. Regular testing supports business continuity readiness and validates that backup processes function as intended. Backup procedure in place for all information, software, and systems. Published Nov 13, 2025 A backup procedure is in place for information, software, and systems based on criticality and risk assessment. This ensures that resources essential to business continuity and security are backed up appropriately and can be restored in the event of data loss or system disruption. Backup data is encrypted in transit. Published Nov 13, 2025 Backup data is encrypted at rest. Published Nov 13, 2025 Backup data is encrypted in transit to protect it from interception, tampering, or unauthorized access during transfer. This ensures the confidentiality and integrity of data as it moves between systems or to offsite storage locations. Backup data is protected from unauthorized access. Published Nov 13, 2025 Backup data is protected from unauthorized access through strict access controls, encryption, and segregation of backup environments. These measures ensure that only authorized personnel can access backup repositories, maintaining the confidentiality and integrity of stored data. Backup procedures clearly define recovery point objectives (RPO) and recovery time objectives (RTO), which are reviewed and updated based on risk and business impact. Published Nov 13, 2025 Backup procedures clearly define recovery point objectives (RPO) and recovery time objectives (RTO). These objectives are reviewed and updated based on risk assessments and business impact to ensure that data restoration and service recovery align with organizational continuity requirements. Immutable or isolated backup copies are maintained, preventing modification or deletion for a defined retention period. Published Nov 13, 2025 Immutable or isolated backup copies are maintained to prevent modification or deletion for a defined retention period. This ensures that critical data remains protected against corruption, ransomware, or unauthorized changes, supporting reliable recovery during incidents. Business continuity plans in place Business continuity Formal procedures for business continuity have been developed and documented. Published Nov 13, 2025 Formal business continuity procedures have been developed and documented to ensure the organization can maintain or quickly resume critical operations during disruptions. These procedures define roles, responsibilities, recovery strategies, and communication processes to support organizational resilience and continuity. Procedures are in place to ensure ICT continuity plans are regularly tested, evaluated for effectiveness, and approved by management. Published Nov 13, 2025 Procedures are in place to ensure ICT continuity plans are regularly tested and evaluated for effectiveness. Test results and updates are reviewed and approved by management, ensuring that continuity capabilities remain aligned with business needs and evolving risks. Business continuity procedures include the continuity of information security activities and processes including intrusion detection, vulnerability management and log collection. Published Nov 13, 2025 Business continuity procedures include the continuation of key information security activities and processes - such as intrusion detection, vulnerability management, and log collection - to ensure that essential security functions remain operational during disruptions. This maintains visibility, threat detection, and risk management even under adverse conditions. Business continuity plans include specific provisions for cloud-hosted services, including roles and responsibilities shared with cloud providers. Published Nov 13, 2025 Business continuity plans include specific provisions for cloud-hosted services, outlining recovery expectations as well as the roles and responsibilities shared with cloud providers. This ensures clarity on joint obligations, supports coordinated response during service disruptions, and maintains continuity of critical cloud-based operations. Information security requirements (confidentiality, integrity, and availability) are maintained during disruptions. Published Nov 13, 2025 Information security requirements - confidentiality, integrity, and availability - are maintained during disruptions through established continuity procedures, technical safeguards, and predefined recovery strategies. These measures ensure that security controls remain effective and that critical information remains protected even under adverse operating conditions. Redundancy mechanisms for critical systems are tested regularly. Published Nov 13, 2025 Redundancy mechanisms for critical systems are tested regularly to ensure they function as intended during outages or disruptions. Regular testing validates failover capabilities and supports the continuous availability of essential services. Technical redundancy mechanisms are implemented to prevent downtime and ensure continuous system operation during outages. Published Nov 13, 2025 Technical redundancy mechanisms are implemented to prevent downtime and ensure continuous system operation during outages. These measures provide failover capability, maintain service availability, and reduce the impact of hardware failures, network disruptions, or other operational interruptions. System and infrastructure resource usage is monitored and adjusted to meet current and forecasted capacity needs, including stress testing of critical systems. Published Nov 13, 2025 System and infrastructure resource usage is continuously monitored and adjusted to meet current and forecasted capacity needs. Critical systems undergo stress testing to validate performance under load and ensure they can scale and operate reliably during peak demand or unexpected spikes. Integrity of restored systems and data is verified after an incident, and restoration is confirmed complete only after systems return to normal operating status. Published Nov 13, 2025 The integrity of restored systems and data is verified following an incident to ensure they are accurate, complete, and uncompromised. Restoration is confirmed only after systems return to normal operating status, ensuring safe and reliable resumption of business operations. Disaster recovery procedures established Business continuity Disaster recovery procedure in place to restore the security of information for critical business processes in the event of an interruption or failure. Published Nov 13, 2025 A disaster recovery procedure is in place to restore the security of information supporting critical business processes in the event of an interruption or failure. This procedure defines recovery responsibilities, data restoration steps, and validation requirements to ensure that information security - confidentiality, integrity, and availability - is reestablished promptly and effectively. Disaster recovery procedure in place to ensure that there are appropriate personnel ready to deal with any disruptions. Published Nov 13, 2025 A disaster recovery procedure is in place to ensure that appropriate personnel are prepared and available to respond to disruptions. Roles, responsibilities, and escalation paths are clearly defined so that trained staff can act quickly and effectively to restore operations and maintain information security. Formal disaster recovery procedures include specific actions to be taken in response to a disruptive event for each affected area. Published Nov 13, 2025 Formal disaster recovery procedures include specific actions to be taken in response to a disruptive event for each affected area. These actions outline step-by-step recovery tasks, responsibilities, and required resources, ensuring a coordinated and effective response tailored to the impact on each system or function. Proactive detection of potential incidents Cybersecurity incident management Regular reviews of events are conducted to detect suspicious activity or potential incidents affecting systems with scoped data. Published Nov 13, 2025 Regular reviews of events are conducted to detect suspicious activity or potential incidents affecting systems with scoped data. This includes continuous monitoring through managed detection and response (MDR) services and a security information and event management (SIEM) platform, ensuring timely identification and escalation of security threats. Regular security monitoring includes alerts for malware infections and suspicious activity. Published Nov 13, 2025 Regular security monitoring includes alerts for malware infections and suspicious activity. These alerts are generated through monitoring tools and detection mechanisms to ensure timely identification, investigation, and response to potential security threats. A proactive detection capability is established and maintained . Published Nov 13, 2025 A proactive detection capability is established and maintained to identify potential threats before they impact systems or data. This includes continuous monitoring, threat intelligence, anomaly detection, and automated alerting to ensure early identification and rapid response to emerging security risks. Detection processes include automated correlation of logs, threat intelligence, and anomaly detection across endpoints, network, and cloud. Published Nov 13, 2025 Detection processes include automated correlation of logs, threat intelligence, and anomaly detection across endpoints, network, and cloud environments. This integrated approach enables early identification of suspicious patterns and potential threats, improving the speed and accuracy of incident detection. Threat intelligence from internal and external sources is collected and analysed to identify adversary tactics, techniques, and procedures (TTPs). Published Nov 13, 2025 Threat intelligence from both internal and external sources is collected and analysed to identify adversary tactics, techniques, and procedures (TTPs). This enables proactive detection, supports informed decision-making, and enhances the organization’s ability to anticipate and mitigate emerging threats. A documented process is in place to receive, analyze, and respond to vulnerability disclosures from internal and external sources, including coordinated disclosure from researchers or third parties. Published Nov 13, 2025 A documented process is in place to receive, analyze, and respond to vulnerability disclosures from both internal and external sources. This includes coordinated disclosure from security researchers or third parties, ensuring that identified vulnerabilities are assessed, prioritized, and remediated in a structured and timely manner. Security alerts are tuned for false positives, prioritized based on asset criticality, and reviewed regularly. Published Nov 13, 2025 Security alerts are tuned to reduce false positives and prioritized based on asset criticality and risk. Alerts are reviewed regularly to ensure they remain effective, actionable, and aligned with the organization’s threat landscape. Detection and response capabilities are thoroughly tested, and improvements from these exercises are identified and implemented. Published Nov 13, 2025 Detection and response capabilities are regularly tested through structured exercises, such as simulations and incident response drills. Results from these tests are analyzed to identify gaps and improvement opportunities, which are then implemented to strengthen overall security readiness and resilience. Adversarial threat detection techniques and remediation steps address data poisoning or evasion attacks against AI models. Published Nov 13, 2025 Adversarial threat detection and remediation are addressed through existing data governance, security monitoring, and incident response practices. These include validating and sanitizing data entering AI pipelines, monitoring for anomalous model inputs or behavior, enforcing strict access controls, and using security analytics to detect misuse. If issues are identified, established response and rollback procedures ensure affected data or models are corrected or restored to maintain integrity. Incident response plan in place Cybersecurity incident management Cybersecurity Incident Management Program is approved and has a designated owner. Published Nov 18, 2025 Eficode maintains a formally documented Cybersecurity Incident Management Program that defines how security events are identified, assessed, escalated, and resolved. The program is approved by senior management and is aligned with our ISO 27001-certified ISMS. Ownership of the program is assigned to the Head of Security, who is responsible for maintaining the procedures, coordinating incident response activities, and ensuring ongoing effectiveness through periodic reviews and improvements. Incident-management programme has a clearly defined scope that includes all systems, networks, applications, endpoints, cloud environments, third-party services, and AI-driven systems where applicable. Published Nov 18, 2025 Eficode’s incident-management programme is defined to cover the full technology landscape used to deliver and support our services. The scope includes all corporate systems, networks, endpoints, cloud environments, and SaaS platforms, as well as third-party services that process or store organizational or client data. Where applicable, AI-driven systems are also included. This comprehensive scope ensures that any security event affecting confidentiality, integrity, or availability is detected, assessed, and handled consistently across all environments. Incident response plan includes a detailed action plan in the event of a security breach. Published Nov 18, 2025 Eficode’s incident response plan includes a structured and detailed action plan for handling security breaches. It outlines clear steps for identification, containment, eradication, recovery, communication, and post-incident review. Roles and responsibilities are defined for all involved parties, including technical teams, management, and communications. This ensures that, in the event of a security breach, Eficode can respond quickly, minimize impact, and restore normal operations in a controlled and compliant manner. Incident response plan includes an escalation process with defined escalation paths and internal communication protocols. Published Nov 18, 2025 Eficode’s incident response plan defines clear escalation paths and communication protocols to ensure timely coordination during security events. Incidents are classified by severity, with corresponding escalation requirements that specify who must be informed, when, and through which channels. Internal communication procedures guide notifications to technical teams, management, and other relevant stakeholders. This structured escalation process ensures that the right expertise and decision-makers are engaged promptly to contain and resolve incidents effectively. Incident response plan includes notifying authorities and customers of serious data breaches. Published Nov 18, 2025 Eficode’s incident response plan includes procedures for notifying relevant authorities and affected customers in the event of a serious data breach. The plan aligns with applicable data protection laws (such as GDPR), defining criteria for notifiability, required timelines, and responsible roles. When a breach involving personal or client data is confirmed, the incident team evaluates regulatory and contractual obligations and coordinates timely notifications that include the nature of the incident, impacted data, and planned remediation steps. Clocks are synchronized to enable correlation and analysis of security-related events and other recorded logging data. Published Nov 18, 2025 Centralized NTP used for clock synchronization. Incident response plan recovery phase is executed following containment and eradication and requires remediation of any affected systems discovered after incident closure. Published Nov 18, 2025 Eficode’s incident response plan defines a structured recovery phase that is initiated only after successful containment and eradication of the threat. During recovery, systems are restored, validated, and monitored to ensure they return to a secure and fully operational state. The process also includes identifying and remediating any additional systems or assets impacted but not discovered until later stages. This ensures that no residual vulnerabilities or compromised components remain after the incident is closed, supporting long-term security and service continuity. Lessons learned from information security incidents are documented and used to improve detection capabilities, response procedures, and preventive controls. Published Nov 18, 2025 Eficode documents lessons learned from all information security incidents as part of the post-incident review process. These reviews identify root causes, contributing factors, and improvement opportunities across technology, processes, and human behavior. Findings are used to enhance detection rules, refine response procedures, update preventive controls, and strengthen training and awareness. This continuous improvement loop ensures that insights from real incidents directly inform and elevate our overall security posture. Procedures ensure prompt response and communication of operational impacts from degraded AI performance or biased outputs. Published Nov 18, 2025 Although Eficode does not use AI for business-critical functions, our general incident-management and operational procedures still ensure prompt response and communication if degraded AI performance, biased outputs, or unexpected behaviors are detected. Any issues identified in AI-assisted tools or workflows are evaluated for operational impact, escalated through existing incident channels, and communicated to relevant stakeholders. This ensures visibility, timely remediation, and mitigation even though AI does not support critical service delivery. Incident response roles and responsibilities are assigned and communicated to relevant personnel, and reviewed regularly. Published Nov 18, 2025 Incident response roles and responsibilities are formally defined, assigned, and documented within Eficode’s incident management procedures. These roles - including incident handlers, technical leads, communications, and management stakeholders - are communicated to relevant personnel and reviewed regularly as part of our ISMS and incident response plan updates. This ensures clarity of accountability and effective coordination during security events. Personnel with incident response responsibilities receive training and participate in readiness exercises. Published Nov 18, 2025 Personnel with incident response responsibilities receive appropriate training and participate in readiness activities to ensure they can respond effectively to security incidents. This includes familiarization with incident response procedures, participation in tabletop exercises, and integration with our SIEM/MDR processes. These activities help validate readiness, reinforce roles and responsibilities, and ensure that responders are prepared to act quickly and confidently during real incidents. Confirmed security incidents are promptly contained through defined procedures. Published Nov 18, 2025 Eficode follows clearly defined procedures to ensure that confirmed security incidents are promptly contained. Once an incident is validated, the incident response team initiates predefined containment steps based on the incident’s severity and nature. These actions may include isolating affected systems, revoking compromised credentials, restricting network access, or applying temporary controls to limit further impact. Our MDR/SIEM partners also support rapid containment through continuous monitoring and automated response capabilities. This structured approach ensures swift stabilization of the environment and prevents the incident from spreading. Confirmed incidents are eradicated through defined procedures. Published Nov 18, 2025 Eficode uses defined and structured procedures to eradicate confirmed security incidents. After containment, the incident response team identifies and removes the root cause - such as malicious code, unauthorized access, or vulnerable configurations - to ensure the threat is fully eliminated. This may involve applying patches, resetting or revoking credentials, restoring clean configurations, or removing compromised components. Eradication activities are guided by documented processes and supported by MDR/SIEM insights to ensure thorough removal of the threat before recovery begins. Incident response plans cover all potential incident types. Published Nov 18, 2025 Eficode’s incident response plans are designed to cover a broad range of potential incident types, including malware infections, unauthorized access, data breaches, service disruptions, system misconfigurations, cloud-related incidents, and third-party impacts. The plans follow a risk-based approach and outline procedures for identifying, assessing, containing, eradicating, and recovering from diverse incident scenarios. This ensures that regardless of the nature or source of the incident, a consistent and effective response process is in place. All incident reports are triaged and validated through a defined process before escalation or response activities are initiated. Published Nov 18, 2025 Eficode uses a structured triage process to ensure all incident reports are assessed and validated before any escalation or response action is taken. Alerts from monitoring tools, user reports, and third-party notifications are evaluated to determine severity, scope, and credibility. This process helps distinguish true security incidents from false positives and ensures that response resources are focused on genuine threats. Once validated, incidents are escalated according to defined paths based on impact and urgency. Information security events are assessed using a defined process to determine whether they should be classified as incidents. Published Nov 18, 2025 Eficode follows a defined assessment process to distinguish routine security events from actual security incidents. All events detected through monitoring tools, user reports, or third-party notifications are evaluated against established criteria such as severity, impact, indicators of compromise, and potential risk to systems or data. Events meeting these criteria are formally classified as incidents and handled through the incident response procedures. This structured approach ensures consistency, accuracy, and timely escalation of events that require action. Incident classification criteria include data classification, impact to operations, regulatory exposure, and system criticality. Published Nov 18, 2025 Eficode’s incident classification criteria consider multiple factors to ensure consistent and accurate prioritization. These include the sensitivity and classification of any affected data, potential or actual impact on business operations, regulatory or contractual exposure (such as GDPR implications), and the criticality of the systems involved. By evaluating incidents against these dimensions, we can assign the appropriate severity level and ensure timely escalation, response, and communication. Incident details are shared with designated internal and external stakeholders during response activities. Published Nov 18, 2025 Eficode shares incident details with designated internal and external stakeholders in accordance with defined communication procedures. Internal teams - such as Security, IT, Legal, HR, Management, and affected service owners - are informed based on their roles and responsibilities. When required by regulation or contract, external stakeholders such as customers, partners, or authorities are notified promptly with accurate and relevant information. This ensures coordinated response, transparency, and compliance throughout the incident lifecycle. Incident response and recovery plans include participation of relevant third parties and suppliers, with defined roles, communication procedures, and testing. Published Nov 18, 2025 Eficode’s incident response and recovery plans account for the participation of relevant third parties and suppliers when their services or infrastructure form part of the impacted environment. Roles and communication expectations for critical suppliers are defined through contractual requirements, SLAs, and our third-party risk management processes. When an incident involves or may affect a supplier, we engage them through established communication channels to support investigation, containment, and recovery. Although full joint testing with suppliers is not typically required, their responsibilities - such as providing technical support, incident notifications, and recovery assistance - are clearly defined and integrated into our response procedures. Criteria for initiating the recovery phase are defined, documented, and applied during incident response. Published Nov 18, 2025 Eficode defines and documents clear criteria for when an incident moves from containment and eradication into the recovery phase. These criteria include confirmation that the threat has been neutralized, no further malicious activity is detected, affected systems have been cleaned or rebuilt, and sufficient safeguards are in place to prevent recurrence. Only when these conditions are met does the recovery phase begin, enabling controlled restoration of services, validation of system integrity, and safe return to normal operations. This ensures recovery activities are executed at the appropriate time and in a consistent, risk-aware manner. Incident response recovery actions are selected, scoped, and prioritized based on system criticality and business impact. Published Nov 18, 2025 Eficode prioritizes recovery actions using a risk-based approach that considers the criticality of affected systems, the nature of the disruption, and the business impact. Once containment and eradication are complete, recovery tasks - such as restoring services, reapplying configurations, rebuilding systems, or validating data integrity - are selected and scoped according to their importance to operations and contractual obligations. High-impact or customer-facing systems are restored first, ensuring that business continuity and service availability are re-established efficiently and safely. Recovery progress is communicated to designated internal and external stakeholders. Published Nov 18, 2025 Eficode ensures that recovery progress is communicated to relevant internal and external stakeholders through defined communication procedures. Internal stakeholders, such as management, IT teams, and affected service owners, receive updates on system status, timelines, and required actions. When applicable - such as in cases involving customers or regulatory obligations - external stakeholders are also provided timely, accurate updates on recovery progress. This structured communication approach supports transparency, coordinated decision-making, and clear expectations during the recovery process. Public updates on recovery progress are shared through approved channels using defined messaging. Published Nov 18, 2025 When an incident has public-facing impact or requires broader communication, Eficode provides updates through approved channels - such as official company statements, our website, or customer communication platforms. Messaging is prepared and approved using predefined communication guidelines to ensure accuracy, consistency, and alignment with legal, contractual, and regulatory requirements. Only authorized personnel (e.g., Communications, Legal, or Executive Management) issue public updates. This ensures stakeholders receive clear and reliable information while safeguarding confidentiality and preventing misinformation. Incident recovery is formally closed based on defined criteria, with all incident documentation completed. Published Nov 18, 2025 Eficode follows a structured closure process for all incidents. An incident is formally closed only after defined criteria are met, including confirmation that all recovery actions are complete, systems are stable, vulnerabilities are remediated, and no further malicious activity is detected. All required documentation—such as timelines, actions taken, root cause analysis, and lessons learned—is completed and stored in accordance with our incident management procedures. This ensures accuracy of records, supports accountability, and provides a solid foundation for continuous improvement. Root cause analysis is performed for all significant information security incidents. Published Nov 18, 2025 Eficode performs a structured root cause analysis (RCA) for all significant information security incidents to identify the underlying technical, procedural, or human factors that contributed to the event. The RCA process examines not only the immediate cause but also any systemic issues, control gaps, or process failures. Findings are documented and used to strengthen safeguards, update policies or procedures, and prevent recurrence. This ensures continuous improvement of the security posture and supports regulatory and contractual expectations for post-incident analysis. Relevant authorities are identified and appropriate organizational contacts are established and maintained. Published Nov 18, 2025 Eficode maintains an up-to-date understanding of the regulatory and supervisory authorities relevant to our operations, including data protection authorities and industry-specific contacts where applicable. Organizational owners - such as the Data Protection Officer and the Security team - are responsible for maintaining accurate contact information for these authorities and ensuring communication procedures are in place. This enables timely and compliant notification in the event of a notifiable incident and ensures that required reporting channels remain current and functional. Security events are analyzed in real time or near real time to assess their scope, potential business impact, and criticality. Published Nov 18, 2025 Eficode analyzes security events in real time or near real time through a combination of automated monitoring, managed detection and response (MDR) services, and SIEM-based alerting. These capabilities continuously evaluate log data, network activity, and endpoint telemetry to detect anomalies, indicators of compromise, or patterns suggesting malicious behavior. When an event is detected, its scope, potential business impact, and criticality are quickly assessed using defined triage criteria. This enables timely escalation and ensures that high-impact or time-sensitive incidents receive immediate attention. Information security incidents are recorded, tracked through resolution, and retained to support incident response improvement and reporting. Published Nov 18, 2025 Eficode records and tracks all information security incidents from initial detection through final resolution using our structured incident management process. Each incident is logged with key details such as severity, scope, timelines, actions taken, and responsible parties. Progress is monitored until all remediation steps are completed and the incident is formally closed. Incident records are retained according to policy and regulatory requirements, providing a reliable basis for trend analysis, compliance reporting, and continuous improvement of detection, response, and preventive controls. Procedures are in place to identify, collect, and preserve information relevant to security events and incidents for use as evidence. Published Nov 18, 2025 Eficode maintains documented procedures for identifying, collecting, and preserving information relevant to security events and incidents. These procedures ensure that logs, system artifacts, communications, and other potential evidence are handled in a manner that maintains integrity, authenticity, and chain of custody. Evidence is collected using approved tools and methods, with safeguards to prevent modification or loss. When necessary - such as for regulatory reporting, contractual obligations, or potential legal proceedings - the preserved evidence can support further analysis, forensic investigation, or external review.