Snapshot 96688
Normalized text
Scripts and page chrome removed; this is what change detection compares.
DocuSign Envelope ID: 60CFA9B0-1390-4817-9239-DBC4AB552F48
# Topic Control Requirement Description
Multi Factor Two Factor Authentication Mechanism Integrated
1
Authentication with SMS verification code
Access Control
Role Based Access Control to both Business and
2 RBAC
Admin application users
Data In-Transit
3 HTTPS protocol with minimum TLS1.2 Encryption
Encryption
'Data at Rest' encryption using an allowed
Data at Rest
4 encryption method & Key strength aligned with
Encryption
industry standards
Encryption
Cloud IaaS provider Secure Key Store Service (AWS
5 Keys
Data Protection KMS)
Management
Segregation controls in place to prevent from
customer's Data to leak from Production to lower
6 Segregation
environments such as (DEV, QA, Test or other) and
between customer DBs in the same environment
Backup & Strict Backup & Restore Controls and Procedures in
7
Restore place to provide on-demand High Availability
Web Application Firewall to deny unwanted and
8 WAF
malicious traffic to the Application
Reasonable Security Controls in its Development
9 SDLC
process & Change Management Controls
Application Preform PTs on regular basis at least every year and
Control Penetration
10 fix critical & high findings in a reasonable timeframe
Test
at least within 7 days
Anti-DDOS (Distributed Denial of Service)
11 Anti-DDOS mechanism or service to maintain application
availability during a DDOS Attack
Vulnerability Vulnerability Scans continuously as part of CI/CD
12
Scans pipeline
Patch Management Policy where Critical & high-
Patch
13 Infrastructure level Patches are applied within 7 days of their
Management
Control release or identification via the VA scans
Server Hardening, using known best practices, both
Server
14 internal and external (publicly facing) servers on
Hardening
regular basis
Maintain Audit Logs for customers use:
Application
15 - Admin & User Access Log
Audit Logs
Audit Logs - User Behavior Analysis Log
Security Alerts around infrastructure and
16 Security Alerts
application security in place
18 Certifications ISO ISO27001 certification