Acme

Production datastores can only be reached with individually issued, approved authentication mechanisms such as personal SSH keys or short-lived certificates.

Privileged access to encryption keys is limited to authorised personnel with a documented business need.

Systems and applications require a unique username and password, or an approved SSH key, for every person who signs in.

Confidential and sensitive customer data may not be used or stored in non-production systems or environments, as defined by policy.

Access to production applications is limited to authorised users only.

The access control policy describes how the following access control activities are carried out:

• adding new users;
• changing existing users; and/or
• removing access for a user.

Privileged access to production databases is limited to authorised users with a documented business need.

Privileged access to firewall configuration is limited to authorised users with a documented business need.

Privileged access to production operating systems is limited to authorised users with a documented business need.

Privileged access to the production network is limited to authorised users with a documented business need.

Electronic media holding confidential information is wiped or destroyed following industry practice, and a certificate of destruction is issued for every device.

Portable and removable media used by the company is encrypted.

Anti-malware software is installed on systems commonly targeted by malicious attacks and is configured to update automatically, log events and run on every relevant system.

Background checks are completed for new employees before they start.

Contractor agreements include the code of conduct or a reference to it.

Employees acknowledge the code of conduct when hired, and violations are handled through a documented disciplinary process.

Contractors sign a confidentiality agreement when they are engaged.

Employees sign a confidentiality agreement during onboarding.

Managers complete performance reviews for their direct reports at least once a year.

In-scope system components must be configured with passwords that meet the company's policy.

Datastores that hold sensitive customer data are encrypted at rest.

Control self-assessments are performed at least annually to confirm that controls are in place and working as intended. Findings are tracked and remediated, and where a remediation SLA applies, fixes are completed within it.

Strong, current encryption protocols protect confidential and sensitive data whenever it travels over public networks.

Formal policies set out the requirements for the following IT and engineering functions:

• vulnerability management;
• system monitoring.

Business continuity and disaster recovery plans describe how communication continues and information security is maintained if key personnel become unavailable.

The company holds cybersecurity insurance to reduce the financial impact of business disruptions.

Production runs across multiple availability zones so operations can resume from another data center if one is lost.

System capacity is reviewed on an ongoing basis and changes are made so processing capacity keeps up with demand.

A configuration management process ensures system configurations are deployed consistently across the environment.

A formal system development life cycle (SDLC) governs the design, acquisition, implementation, change (including emergency change) and maintenance of information systems and related technology.

A current description of the in-scope system is maintained for the audit report.

The board, or a committee of it, is briefed by senior management at least annually on cybersecurity and privacy risk, and gives feedback and direction as needed.

A documented charter describes the board's responsibility for overseeing internal control.

Board members have the expertise needed to oversee management's ability to design, implement and operate information security controls, and engage outside experts when required.

Formal retention and disposal procedures govern how company and customer data is kept and securely deleted.

Customer data containing confidential information is removed from the application environment, following best practice, when a customer leaves the service.

A data classification policy ensures confidential data is properly secured and limited to authorised personnel.

Deletion requests are validated and, once confirmed, the requested data is deleted in line with applicable laws and regulations.

Corrections or deletions of an individual's personal data are passed on to authorised users and to third parties the data was shared with.

Before granting access to personal data, the company verifies the identity of the individual or their authorised representative, with a level of assurance that fits the request.

Processes are in place to capture, log and verify privacy requests, questions, complaints and disputes about access, review, correction and deletion of personal data. Requests are recorded in the company's tracking system for audit purposes.

Personal data is securely disposed of when it is no longer needed, and is anonymised or deleted from systems.

Personal data disclosed for legal purposes is logged, tracked and kept in the company's designated tracking system.

Individuals, customers or designated account holders can update their personal data through a self-service portal or by contacting the company.