Attachment C.xlsx
XLSX spreadsheet 103 KB Posted
- Attached to
- VIRTUAL ASSISTANCE SOFTWARE SOLUTION
- Solicitation number
- 5400017795
- Issued by
- Richland County, South Carolina
About this file
This is a Consensus Assessments Initiative Questionnaire (CAIQ) v3.0.1 document prepared for the South Carolina Department of Motor Vehicles (SCDMV) in response to an RFP for a Virtual Assistance Software Solution. The questionnaire serves as a comprehensive security and compliance assessment framework rather than a traditional procurement document. It does not contain specific product quantities, response dates, due dates, site visits, bidder conferences, or contract award information. Instead, it provides a detailed template of 300+ control questions organized across 19 security domains—including Application & Interface Security, Data Security & Information Lifecycle Management, Governance and Risk Management, Identity & Access Management, Infrastructure & Virtualization Security, and Threat and Vulnerability Management—aligned with industry standards such as ISO/IEC 27001:2013, AICPA Trust Service Criteria, and FedRAMP guidelines.
The questionnaire is designed to evaluate a cloud service provider's security posture, operational capabilities, and compliance adherence rather than to establish pricing terms, set-asides, or incumbent information. Control domains address critical areas such as encryption and key management, business continuity planning, datacenter security, incident response procedures, mobile device security, and supply chain governance. Each question maps to specific compliance frameworks and security standards, requiring providers to demonstrate their implementation of industry-recognized security controls. This assessment tool enables SCDMV to conduct due diligence on potential vendors before engaging a Virtual Assistance Software Solution, ensuring that any selected provider meets rigorous security and operational resilience standards appropriate for state motor vehicle operations.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Notice of Cancellation.doc | DOC document | |
| Amendment 2.docx | DOCX document | |
| Attachment B.xlsx | XLSX spreadsheet | |
| Amendment 1.docx | DOCX document | |
| Attachment A.pdf | ||
| Amendment 4.docx | DOCX document | |
| Solicitation.docx | DOCX document | |
| Amendment 3.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
SCDMV_RFP_CAIQ_Questionnaire
| CONSENSUS ASSESSMENTS INITIATIVE QUESTIONNAIRE v3.0.1 | ||||||||||||||
| Control Domain | Control ID | Question ID | Control Specification | Consensus Assessment Questions | Consensus Assessment Answers | Notes | CCM v3.0.1 Compliance Mapping | |||||||
| AICPA TSC 2009 | AICPA | |||||||||||||
| Trust Service Criteria (SOC 2SM Report) | AICPA TSC 2014 | CSA Enterprise Architecture (formerly the Trusted Cloud Initiative) | CSA Guidance V3.0 | ISO/IEC 27001:2005 | ISO/IEC 27001:2013 | |||||||||
| Yes | No | Not Applicable | Domain > Container > Capability | Public | Private | |||||||||
| Application & Interface Security | ||||||||||||||
| Application Security | AIS-01 | AIS-01.1 | Applications and programming interfaces (APIs) shall be designed, developed, deployed, and tested in accordance with leading industry standards (e.g., OWASP for web applications) and adhere to applicable legal, statutory, or regulatory compliance obligations. | Do you use industry standards (Build Security in Maturity Model [BSIMM] benchmarks, Open Group ACS Trusted Technology Provider Framework, NIST, etc.) to build in security for your Systems/Software Development Lifecycle (SDLC)? | S3.10.0 | (S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies to enable authorized access and to prevent unauthorized access. |
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined processing integrity and related security policies. CC7.1 Application Services > Development Process > Software Quality Assurance shared x Domain 10 A.11.5.6 A.11.6.1 A.12.2.1 A.12.2.2 A.12.2.3 A.12.2.4 A.12.5.2 A.12.5.4 A.12.5.5 A.12.6.1 A.15.2.1 A9.4.2 A9.4.1, 8.1*Partial, A14.2.3, 8.1*partial, A.14.2.7 A12.6.1, A18.2.2
| AIS-01.2 | Do you use an automated source code analysis tool to detect security defects in code prior to production? | ||||||||||||
| AIS-01.3 | Do you use manual source-code analysis to detect security defects in code prior to production? | ||||||||||||
| AIS-01.4 | Do you verify that all of your software suppliers adhere to industry standards for Systems/Software Development Lifecycle (SDLC) security? | ||||||||||||
| AIS-01.5 | (SaaS only) Do you review your applications for security vulnerabilities and address any issues prior to deployment to production? | ||||||||||||
| Application & Interface Security | |||||||||||||
| Customer Access Requirements | AIS-02 | AIS-02.1 | Prior to granting customers access to data, assets, and information systems, identified security, contractual, and regulatory requirements for customer access shall be addressed. | Are all identified security, contractual, and regulatory requirements for customer access contractually addressed and remediated prior to granting customers access to data, assets, and information systems? | S3.2a | (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public. | CC5.1 | BOSS > Legal Services > Contracts | shared | x | Domain 10 | A.6.2.1 |
A.6.2.2
| A.11.1.1 | A9.1.1. | ||||||
| AIS- 02.2 | Are all requirements and trust levels for customers’ access defined and documented? | ||||||
| Application & Interface Security | |||||||
| Data Integrity | AIS-03 | AIS-03.1 | Data input and output integrity routines (i.e., reconciliation and edit checks) shall be implemented for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse. | Are data input and output integrity routines (i.e., reconciliation and edit checks) implemented for application interfaces and databases to prevent manual or systematic processing errors or corruption of data? | S3.4 | (I3.2.0) The procedures related to completeness, accuracy, timeliness, and authorization of inputs are consistent with the documented system processing integrity policies. |
(I3.3.0) The procedures related to completeness, accuracy, timeliness, and authorization of system processing, including error correction and database management, are consistent with documented system processing integrity policies.
(I3.4.0) The procedures related to completeness, accuracy, timeliness, and authorization of outputs are consistent with the documented system processing integrity policies.
(I3.5.0) There are procedures to enable tracing of information inputs from their source to their final disposition and vice versa. PI1.2
PI1.3
PI1.5 Application Services > Programming Interfaces > Input Validation shared x Domain 10 A.10.9.2 A.10.9.3 A.12.2.1 A.12.2.2 A.12.2.3 A.12.2.4 A.12.6.1 A.15.2.1 A13.2.1, A13.2.2, A9.1.1, A9.4.1, A10.1.1 A18.1.4
| Application & Interface Security | |||||||||||
| Data Security / Integrity | AIS-04 | AIS-04.1 | Policies and procedures shall be established and maintained in support of data security to include (confidentiality, integrity, and availability) across multiple system interfaces, jurisdictions, and business functions to prevent improper disclosure, alternation, or destruction. | Is your Data Security Architecture designed using an industry standard (e.g., CDSA, MULITSAFE, CSA Trusted Cloud Architectural Standard, FedRAMP, CAESARS)? | (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.6 | BOSS > Data Governance > Rules for Information Leakage Prevention | shared | x | Domain 10 | A.10.8.1 |
A.10.8.2 A.11.1.1 A.11.6.1 A.11.4.6 A.12.3.1 A.12.5.4 A.15.1.4 A13.2.1, A13.2.2, A9.1.1, A9.4.1, A10.1.1 A18.1.4
| Audit Assurance & Compliance | |||||
| Audit Planning | AAC-01 | AAC-01.1 | Audit plans shall be developed and maintained to address business process disruptions. Auditing plans shall focus on reviewing the effectiveness of the implementation of security operations. All audit activities must be agreed upon prior to executing any audits. | Do you produce audit assertions using a structured, industry accepted format (e.g., CloudAudit/A6 URI Ontology, CloudTrust, SCAP/CYBEX, GRC XML, ISACA's Cloud Computing Management Audit/Assurance Program, etc.)? | S4.1.0 |
S4.2.0 (S4.1.0) The entity’s system security is periodically reviewed and compared with the defined system security policies.
(S4.2.0) There is a process to identify and address potential impairments to the entity’s ongoing ability to achieve its objectives in accordance with its defined system security policies. CC4.1 BOSS > Compliance > Audit Planning shared x Domain 2, 4 Clause 4.2.3 e) Clause 4.2.3b Clause 5.1 g Clause 6 A.15.3.1 Clauses 4.3(a), 4.3(b), 5.1(e), 5.1(f), 6.2(e), 9.1, 9.1(e), 9.2, 9.3(f), A12.7.1
| Audit Assurance & Compliance | |||||
| Independent Audits | AAC-02 | AAC-02.1 | Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures, and compliance obligations. | Do you allow tenants to view your SOC2/ISO 27001 or similar third-party audit or certification reports? | S4.1.0 |
S4.2.0 (S4.1.0) The entity’s system security is periodically reviewed and compared with the defined system security policies.
(S4.2.0) There is a process to identify and address potential impairments to the entity’s ongoing ability to achieve its objectives in accordance with its defined system security policies. CC4.1 BOSS > Compliance > Independent Audits shared x Domain 2, 4 Clause 4.2.3e Clause 5.1 g Clause 5.2.1 d) Clause 6 A.6.1.8 Clauses 4.3(a), 4.3(b), 5.1(e), 5.1(f), 9.1, 9.2, 9.3(f), A18.2.1
| CO-02 | AAC-02.2 | Do you conduct network penetration tests of your cloud service infrastructure regularly as prescribed by industry best practices and guidance? | |||||||||
| CO-02 | AAC-02.3 | Do you conduct application penetration tests of your cloud infrastructure regularly as prescribed by industry best practices and guidance? | |||||||||
| CO-02 | AAC-02.4 | Do you conduct internal audits regularly as prescribed by industry best practices and guidance? | |||||||||
| CO-02 | AAC-02.5 | Do you conduct external audits regularly as prescribed by industry best practices and guidance? | |||||||||
| CO-02 | AAC-02.6 | Are the results of the penetration tests available to tenants at their request? | |||||||||
| CO-02 | AAC-02.7 | Are the results of internal and external audits available to tenants at their request? | |||||||||
| AAC-02.8 | Do you have an internal audit program that allows for cross-functional audit of assessments? | ||||||||||
| Audit Assurance & Compliance | |||||||||||
| Information System Regulatory Mapping | AAC-03 | AAC-03.1 | Organizations shall create and maintain a control framework which captures standards, regulatory, legal, and statutory requirements relevant for their business needs. The control framework shall be reviewed at least annually to ensure changes that could affect the business processes are reflected. | Do you have the ability to logically segment or encrypt customer data such that data may be produced for a single tenant only, without inadvertently accessing another tenant's data? | CC3.1 | BOSS > Compliance > Information System Regulatory Mapping | shared | x | Domain 2, 4 | ISO/IEC 27001:2005 |
Clause 4.2.1 b) 2) Clause 4.2.1 c) 1) Clause 4.2.1 g) Clause 4.2.3 d) 6) Clause 4.3.3 Clause 5.2.1 a - f Clause 7.3 c) 4) A.7.2.1 A.15.1.1 A.15.1.3 A.15.1.4 A.15.1.6 Clauses 4.2(b), 4.4, 5.2(c), 5.3(ab), 6.1.2, 6.1.3, 6.1.3(b), 7.5.3(b), 7.5.3(d), 8.1, 8.3 9.2(g), 9.3, 9.3(b), 9.3(f), 10.2, A.8.2.1, A.18.1.1, A.18.1.3, A.18.1.4, A.18.1.5
| CO-05 | AAC-03.2 | Do you have the capability to recover data for a specific customer in the case of a failure or data loss? | ||
| AAC-03.3 | Do you have the capability to restrict the storage of customer data to specific countries or geographic locations? | |||
| AAC-03.4 | Do you have a program in place that includes the ability to monitor changes to the regulatory requirements in relevant jurisdictions, adjust your security program for changes to legal requirements, and ensure compliance with relevant regulatory requirements? | |||
| Business Continuity Management & Operational Resilience | ||||
| Business Continuity Planning | BCR-01 | BCR-01.1 | A consistent unified framework for business continuity planning and plan development shall be established, documented, and adopted to ensure all business continuity plans are consistent in addressing priorities for testing, maintenance, and information security requirements. Requirements for business continuity plans include the following: |
• Defined purpose and scope, aligned with relevant dependencies
• Accessible to and understood by those who will use them
• Owned by a named person(s) who is responsible for their review, update, and approval
• Defined lines of communication, roles, and responsibilities
• Detailed recovery procedures, manual work-around, and reference information
• Method for plan invocation Do you provide tenants with geographically resilient hosting options? A3.1.0
A3.3.0
A3.4.0 (A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.
(A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.
(A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies. CC3.1
A1.2
A1.3 BOSS > Operational Risk Management > Business Continuity provider x Domain 7, 8 Clause 5.1 A.6.1.2 A.14.1.3 A.14.1.4 Clause 5.1(h) A.17.1.2 A.17.1.2 RS-03 BCR-01.2 Do you provide tenants with infrastructure service failover capability to other providers? Clause 5.1 A.6.1.2 A.14.1.3 A.14.1.4
| Business Continuity Management & Operational Resilience | |||||||||||||
| Business Continuity Testing | BCR-02 | BCR-02.1 | Business continuity and security incident response plans shall be subject to testing at planned intervals or upon significant organizational or environmental changes. Incident response plans shall involve impacted customers (tenant) and other business relationships that represent critical intra-supply chain business process dependencies. | Are business continuity plans subject to testing at planned intervals or upon significant organizational or environmental changes to ensure continuing effectiveness? | A3.3 | (A3.3) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies. | A1.2 | BOSS > Operational Risk Management > Business Continuity | provider | x | Domain 7, 8 | A.14.1.5 | A17.3.1 |
| Business Continuity Management & Operational Resilience | |||||||||||||
| Power / Telecommunications | BCR-03 | BCR-03.1 | Data center utilities services and environmental conditions (e.g., water, power, temperature and humidity controls, telecommunications, and internet connectivity) shall be secured, monitored, maintained, and tested for continual effectiveness at planned intervals to ensure protection from unauthorized interception or damage, and designed with automated fail-over or other redundancies in the event of planned or unplanned disruptions. | Do you provide tenants with documentation showing the transport route of their data between your systems? | A3.2.0 |
A3.4.0 (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.
(A3.4.0) Procedures exist to protect against unauthorized access to system resource. A1.1 A1.2
| A1.3 | Infra Services > Facility Security > Environmental Risk Management | provider | x | Domain 7, 8 | A.9.2.2 |
| A.9.2.3 | A11.2.2, |
A11.2.3 RS-08 BCR-03.2 Can tenants define how their data is transported and through which legal jurisdictions? A.9.2.2 A.9.2.3
| Business Continuity Management & Operational Resilience | |||
| Documentation | BCR-04 | BCR-04.1 | Information system documentation (e.g., administrator and user guides, and architecture diagrams) shall be made available to authorized personnel to ensure the following: |
• Configuring, installing, and operating the information system
• Effectively using the system’s security features Are information system documents (e.g., administrator and user guides, architecture diagrams, etc.) made available to authorized personnel to ensure configuration, installation and operation of the information system? S3.11.0
A.2.1.0 (S3.11.0) Procedures exist to provide that personnel responsible for the design, development, implementation, and operation of systems affecting security have the qualifications and resources to fulfill their responsibilities.
(A.2.1.0) The entity has prepared an objective description of the system and its boundaries and communicated such description to authorized users. CC1.3
CC1.4
| CC2.1 | SRM > Policies and Standards > Job Aid Guidelines | shared | x | Domain 7, 8 | Clause 4.3.3 | |
| A.10.7.4 | Clause 9.2(g) | |||||
| Business Continuity Management & Operational Resilience | ||||||
| Environmental Risks | BCR-05 | BCR-05.1 | Physical protection against damage from natural causes and disasters, as well as deliberate attacks, including fire, flood, atmospheric electrical discharge, solar induced geomagnetic storm, wind, earthquake, tsunami, explosion, nuclear accident, volcanic activity, biological hazard, civil unrest, mudslide, tectonic activity, and other forms of natural or man-made disaster shall be anticipated, designed, and have countermeasures applied. | Is physical protection against damage (e.g., natural causes, natural disasters, deliberate attacks) anticipated and designed with countermeasures applied? | A3.1.0 |
A3.2.0 (A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.
(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable. CC3.1
A1.1
| A1.2 | Infra Services > Facility Security > Environmental Risk Management | provider | x | Domain 7, 8 | A.9.1.4 |
| A.9.2.1 | A11.1.4, |
A11.2.1
| Business Continuity Management & Operational Resilience | |||||
| Equipment Location | BCR-06 | BCR-06.1 | To reduce the risks from environmental threats, hazards, and opportunities for unauthorized access, equipment shall be kept away from locations subject to high probability environmental risks and supplemented by redundant equipment located at a reasonable distance. | Are any of your data centers located in places that have a high probability/occurrence of high-impact environmental risks (floods, tornadoes, earthquakes, hurricanes, etc.)? | A3.1.0 |
A3.2.0 (A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.
(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable. CC3.1
A1.1
| A1.2 | Infra Services > Facility Security > Environmental Risk Management | provider | x | Domain 7, 8 | A.9.2.1 | A11.2.1 | |
| Business Continuity Management & Operational Resilience | |||||||
| Equipment Maintenance | BCR-07 | BCR-07.1 | Policies and procedures shall be established, and supporting business processes and technical measures implemented, for equipment maintenance ensuring continuity and availability of operations and support personnel. | If using virtual infrastructure, does your cloud solution include independent hardware restore and recovery capabilities? | A3.2.0 |
A4.1.0 (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.
(A4.1.0) The entity’s system availability and security performance is periodically reviewed and compared with the defined system availability and related security policies. A1.1 A1.2
| CC4.1 | Infra Services > Equipment Maintenance > | provider | x | Domain 7, 8 | A.9.2.4 | A11.2.4 | ||||
| OP-04 | BCR-07.2 | If using virtual infrastructure, do you provide tenants with a capability to restore a Virtual Machine to a previous state in time? | A.9.2.4 | |||||||
| OP-04 | BCR-07.3 | If using virtual infrastructure, do you allow virtual machine images to be downloaded and ported to a new cloud provider? | A.9.2.4 | |||||||
| OP-04 | BCR-07.4 | If using virtual infrastructure, are machine images made available to the customer in a way that would allow the customer to replicate those images in their own off-site storage location? | A.9.2.4 | |||||||
| OP-04 | BCR-07.5 | Does your cloud solution include software/provider independent restore and recovery capabilities? | A.9.2.4 | |||||||
| Business Continuity Management & Operational Resilience | ||||||||||
| Equipment Power Failures | BCR-08 | BCR-08.1 | Protection measures shall be put into place to react to natural and man-made threats based upon a geographically-specific business impact assessment. | Are security mechanisms and redundancies implemented to protect equipment from utility service outages (e.g., power failures, network disruptions, etc.)? | A3.2.0 | (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable. | A1.1 | |||
| A1.2 | Infra Services > Facility Security > Environmental Risk Management | provider | x | Domain 7, 8 | A.9.2.2 |
A.9.2.3 A 9.2.4 A.11.2.2, A.11.2.3, A.11.2.4
| Business Continuity Management & Operational Resilience | |||
| Impact Analysis | BCR-09 | BCR-09.1 | There shall be a defined and documented method for determining the impact of any disruption to the organization (cloud provider, cloud consumer) that must incorporate the following: |
• Identify critical products and services
• Identify all dependencies, including processes, applications, business partners, and third party service providers
• Understand threats to critical products and services
• Determine impacts resulting from planned or unplanned disruptions and how these vary over time
• Establish the maximum tolerable period for disruption
• Establish priorities for recovery
• Establish recovery time objectives for resumption of critical products and services within their maximum tolerable period of disruption
• Estimate the resources required for resumption Do you provide tenants with ongoing visibility and reporting of your operational Service Level Agreement (SLA) performance? A3.1.0
A3.3.0
A3.4.0 (A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.
(A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.
(A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies. CC3.1
A1.2
A1.3 ITOS > Service Delivery > Information Technology Resiliency - Resiliency Analysis provider x Domain 7, 8 ISO/IEC 27001:2005 A.14.1.2 A 14.1.4 A.17.1.1 A.17.1.2 RS-02 BCR-09.2 Do you make standards-based information security metrics (CSA, CAMM, etc.) available to your tenants? ISO/IEC 27001:2005 A.14.1.2 A 14.1.4 RS-02 BCR-09.3 Do you provide customers with ongoing visibility and reporting of your SLA performance? ISO/IEC 27001:2005 A.14.1.2 A 14.1.4
| Business Continuity Management & Operational Resilience | ||||||||||||
| Policy | BCR-10 | BCR-10.1 | Policies and procedures shall be established, and supporting business processes and technical measures implemented, for appropriate IT governance and service management to ensure appropriate planning, delivery and support of the organization's IT capabilities supporting business functions, workforce, and/or customers based on industry acceptable standards (i.e., ITIL v4 and COBIT 5). Additionally, policies and procedures shall include defined roles and responsibilities supported by regular workforce training. | Are policies and procedures established and made available for all personnel to adequately support services operations’ roles? | S2.3.0 | (S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality of data, processing integrity, system security and related security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them. | CC3.2 | SRM > Policies and Standards > Operational Security Baselines | shared | x | Domain 7, 8 | Clause 5.1 |
A 8.1.1 A.8.2.1 A 8.2.2 A.10.1.1 Clause 5.1(h) A.6.1.1 A.7.2.1 A.7.2.2 A.12.1.1
| Business Continuity Management & Operational Resilience | |||||
| Retention Policy | BCR-11 | BCR-11.1 | Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining and adhering to the retention period of any critical asset as per established policies and procedures, as well as applicable legal, statutory, or regulatory compliance obligations. Backup and recovery measures shall be incorporated as part of business continuity planning and tested accordingly for effectiveness. | Do you have technical control capabilities to enforce tenant data retention policies? | A3.3.0 |
A3.4.0
I3.20.0
I3.21.0 (A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.
(A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies.
(I3.20.0) Procedures exist to provide for restoration and disaster recovery consistent with the entity’s defined processing integrity policies.
(I3.21.0) Procedures exist to provide for the completeness, accuracy, and timeliness of backup data and systems. A1.2
A1.3
I3.21 BOSS > Data Governance > Data Retention Rules shared x Domain 5 Clause 4.3.3 A.10.5.1 A.10.7.3 Clauses 9.2(g) 7.5.3(b)
5.2 (c) 7.5.3(d) 5.3(a) 5.3(b) 8.1 8.3 A.12.3.1 A.8.2.3
| DG-04 | BCR-11.2 | Do you have a documented procedure for responding to requests for tenant data from governments or third parties? | ||||
| BCR-11.4 | Have you implemented backup or redundancy mechanisms to ensure compliance with regulatory, statutory, contractual or business requirements? | |||||
| BCR-11.5 | Do you test your backup or redundancy mechanisms at least annually? | |||||
| Change Control & Configuration Management | ||||||
| New Development / Acquisition | CCC-01 | CCC-01.1 | Policies and procedures shall be established, and supporting business processes and technical measures implemented, to ensure the development and/or acquisition of new data, physical or virtual applications, infrastructure network and systems components, or any corporate, operations and/or data center facilities have been pre-authorized by the organization's business leadership or other accountable business role or function. | Are policies and procedures established for management authorization for development or acquisition of new applications, systems, databases, infrastructure, services, operations and facilities? | S3.12.0 |
S3.10.0
S3.13.0 (S3.12.0) Procedures exist to maintain system components, including configurations consistent with the defined system security policies.
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies.
(S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system. CC7.2
CC7.1
CC7.4 ITOS > IT Operation > Architecture Governance shared x None A.6.1.4 A.6.2.1 A.12.1.1 A.12.4.1 A.12.4.2 A.12.4.3 A.12.5.5 A.15.1.3 A.15.1.4 A.14.1.1 A.12.5.1 A.14.3.1 A.9.4.5 8.1* (partial) A.14.2.7 A.18.1.3 A.18.1.4
| CCC-01.2 | Is documentation available that describes the installation, configuration, and use of products/services/features? | |||||
| Change Control & Configuration Management | ||||||
| Outsourced Development | CCC-02 | CCC-02.1 | External business partners shall adhere to the same policies and procedures for change management, release, and testing as internal developers within the organization (e.g., ITIL service management processes). | Do you have controls in place to ensure that standards of quality are being met for all software development? | S3.10.0 |
S3.13 (S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system availability, confidentiality of data, processing integrity, systems security and related security policies.
(S3.13) Procedures exist to provide that only authorized, tested, and documented changes are made to the system. CC7.1
CC7.4 ITOS > IT Operation > Architecture Governance shared x None A.6.1.8 A.6.2.1 A.6.2.3 A.10.1.4 A.10.2.1 A.10.2.2 A.10.2.3 A.10.3.2 A.12.1.1 A.12.2.1 A.12.2.2 A.12.2.3 A.12.2.4 A.12.4.1 A.12.4.2 A.12.4.3 A.12.5.1 A.12.5.2 A.12.5.3 A.12.5.5 A.12.6.1 A.13.1.2 A.15.2.1 A.15.2.2 A18.2.1 A.15.1.2 A.12.1.4 8.1* (partial) 8.1* (partial) A.15.2.1 8.1* (partial) A.15.2.2 A.14.2.9 A.14.1.1 A.12.5.1 A.14.3.1 A.9.4.5 8.1* (partial) A.14.2.2 8.1* (partial) A.14.2.3 8.1* (partial) A.14.2.4 8.1* (partial) A.14.2.7 A.12.6.1 A.16.13 A.18.2.2 A.18.2.3 RM-04 CCC-02.2 Do you have controls in place to detect source code security defects for any outsourced software development activities? A.6.1.8 A.6.2.1 A.6.2.3 A.10.1.4 A.10.2.1 A.10.2.2 A.10.2.3 A.10.3.2 A.12.1.1 A.12.2.1 A.12.2.2 A.12.2.3 A.12.2.4 A.12.4.1 A.12.4.2 A.12.4.3 A.12.5.1 A.12.5.2 A.12.5.3 A.12.5.5 A.12.6.1 A.13.1.2 A.15.2.1 A.15.2.2
| Change Control & Configuration Management | |||||
| Quality Testing | CCC-03 | CCC-03.1 | Organizations shall follow a defined quality change control and testing process (e.g., ITIL Service Management) with established baselines, testing, and release standards which focus on system availability, confidentiality, and integrity of systems and services. | Do you provide your tenants with documentation that describes your quality assurance process? | A3.13.0 |
C3.16.0 I3.14.0 S3.10.0
S3.13 (A3.13.0, C3.16.0, I3.14.0, S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system availability, confidentiality of data, processing integrity, systems security and related security policies.
(S3.13) Procedures exist to provide that only authorized, tested, and documented changes are made to the system. CC7.1
CC7.1
CC7.1
CC7.1
CC7.4 ITOS > Service Support > Release Management shared x None A.6.1.3 A.10.1.1 A.10.1.4 A.10.3.2 A.12.1.1 A.12.2.1 A.12.2.2 A.12.2.3 A.12.2.4 A.12.4.1 A.12.4.2 A.12.4.3 A.12.5.1 A.12.5.2 A.12.5.3 A.12.6.1 A.13.1.2 A.15.2.1 A.15.2.2 A.6.1.1 A.12.1.1 A.12.1.4 A.14.2.9 A.14.1.1 A.12.5.1 A.14.3.1 A.9.4.5 8.1* partial A.14.2.2 8.1* partial A.14.2.3 8.1* partial A.14.2.4 A.12.6.1 A.16.1.3 A.18.2.2 A.18.2.3
| CCC-03.2 | Is documentation describing known issues with certain products/services available? | |||||
| CCC-03.3 | Are there policies and procedures in place to triage and remedy reported bugs and security vulnerabilities for product and service offerings? | |||||
| CCC-03.4 | Are mechanisms in place to ensure that all debugging and test code elements are removed from released software versions? | |||||
| Change Control & Configuration Management | ||||||
| Unauthorized Software Installations | CCC-04 | CCC-04.1 | Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. | Do you have controls in place to restrict and monitor the installation of unauthorized software onto your systems? | A3.6.0 |
S3.5.0
S3.13.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers.
(S3.5.0) Procedures exist to protect against infection by computer viruses, malicious code, and unauthorized software.
(S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system. CC5.5
CC5.8
CC7.4 ITOS > Service Support > Configuration Management -> Software Management shared x None A.10.1.3 A.10.4.1 A.11.5.4 A.11.6.1 A.12.4.1 A.12.5.3 A.6.1.2 A.12.2.1 A.9.4.4 A.9.4.1 A.12.5.1 8.1* (partial) A.14.2.4
| Change Control & Configuration Management | |||
| Production Changes | CCC-05 | CCC-05.1 | Policies and procedures shall be established for managing the risks associated with applying changes to: |
• Business-critical or customer (tenant)-impacting (physical and virtual) applications and system-system interface (API) designs and configurations.
• Infrastructure network and systems components.
| Technical measures shall be implemented to provide assurance that all changes directly correspond to a registered change request, business-critical or customer (tenant), and/or authorization by, the customer (tenant) as per agreement (SLA) prior to deployment. | Do you provide tenants with documentation that describes your production change management procedures and their roles/rights/responsibilities within it? | A3.16.0 | ||||
| S3.13.0 | (A3.16.0, S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system. | CC7.4 | ||||
| CC7.4 | ITOS > Service Support > Release Management | shared | x | None | A.10.1.4 |
A.12.5.1 A.12.5.2 A.12.1.4 8.1* (partial) A.14.2.2 8.1* (partial) A.14.2.3
| Data Security & Information Lifecycle Management | |||||
| Classification | DSI-01 | DSI-01.1 | Data and objects containing data shall be assigned a classification by the data owner based on data type, value, sensitivity, and criticality to the organization. | Do you provide a capability to identify virtual machines via policy tags/metadata (e.g., tags can be used to limit guest operating systems from booting/instantiating/transporting data in the wrong country)? | S3.8.0 |
C3.14.0 (S3.8.0) Procedures exist to classify data in accordance with classification policies and periodically monitor and update such classifications as necessary.
(C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies. CC3.1
| CC3.1 | BOSS > Data Governance > Data Classification | shared | x | Domain 5 | A.7.2.1 | A.8.2.1 | |||
| DG-02 | DSI-01.2 | Do you provide a capability to identify hardware via policy tags/metadata/hardware tags (e.g., TXT/TPM, VN-Tag, etc.)? | |||||||
| DG-02 | DSI-01.3 | Do you have a capability to use system geographic location as an authentication factor? | |||||||
| DG-02 | DSI-01.4 | Can you provide the physical location/geography of storage of a tenant’s data upon request? | |||||||
| DG-02 | DSI-01.5 | Can you provide the physical location/geography of storage of a tenant's data in advance? | |||||||
| DSI-01.6 | Do you follow a structured data-labeling standard (e.g., ISO 15489, Oasis XML Catalog Specification, CSA data type guidance)? | ||||||||
| DSI-01.7 | Do you allow tenants to define acceptable geographical locations for data routing or resource instantiation? | ||||||||
| Data Security & Information Lifecycle Management | |||||||||
| Data Inventory / Flows | DSI-02 | DSI-02.1 | Policies and procedures shall be established, and supporting business processes and technical measures implemented, to inventory, document, and maintain data flows for data that is resident (permanently or temporarily) within the service's geographically distributed (physical and virtual) applications and infrastructure network and systems components and/or shared with other third parties to ascertain any regulatory, statutory, or supply chain agreement (SLA) compliance impact, and to address any other business risks associated with the data. Upon request, provider shall inform customer (tenant) of compliance impact and risk, especially if customer data is used as part of the services. | Do you inventory, document, and maintain data flows for data that is resident (permanent or temporary) within the services' applications and infrastructure network and systems? | BOSS > Data Governance > Handling / Labeling / Security Policy | Domain 5 | Clause |
4.2 5.2, 7.5, 8.1
| DSI-02.2 | Can you ensure that data does not migrate beyond a defined geographical residency? | |||||
| Data Security & Information Lifecycle Management | ||||||
| E-commerce Transactions | DSI-03 | DSI-03.1 | Data related to electronic commerce (e-commerce) that traverses public networks shall be appropriately classified and protected from fraudulent activity, unauthorized disclosure, or modification in such a manner to prevent contract dispute and compromise of data. | Do you provide open encryption methodologies (3.4ES, AES, etc.) to tenants in order for them to protect their data if it is required to move through public networks (e.g., the Internet)? | S3.6 |
I13.3.a-e
I3.4.0 (S3.6) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks.
(I13.3.a-e) The procedures related to completeness, accuracy, timeliness, and authorization of system processing, including error correction and database management, are consistent with documented system processing integrity policies.
(I3.4.0) The procedures related to completeness, accuracy, timeliness, and authorization of outputs are consistent with the documented system processing integrity policies. CC5.7
PI1.5 SRM > Cryptographic Services > Data in Transit Encryption shared x Domain 2 A.7.2.1 A.10.6.1 A.10.6.2 A.10.9.1 A.10.9.2 A.15.1.4 A.8.2.1 A.13.1.1 A.13.1.2 A.14.1.2 A.14.1.3 A.18.1.4 IS-28 DSI-03.2 Do you utilize open encryption methodologies any time your infrastructure components need to communicate with each other via public networks (e.g., Internet-based replication of data from one environment to another)? A.7.2.1 A.10.6.1 A.10.6.2 A.10.9.1 A.10.9.2 A.15.1.4
| Data Security & Information Lifecycle Management | ||||||||||||
| Handling / Labeling / Security Policy | DSI-04 | DSI-04.1 | Policies and procedures shall be established for labeling, handling, and the security of data and objects which contain data. Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data. | Are policies and procedures established for labeling, handling and the security of data and objects that contain data? | S3.2.a | (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public. | CC5.1 | BOSS > Data Governance > Handling / Labeling / Security Policy | shared | x | Domain 5 | A.7.2.2 |
A.10.7.1 A.10.7.3 A.10.8.1 A.8.2.2 A.8.3.1 A.8.2.3 A.13.2.1 DG-03 DSI-04.2 Are mechanisms for label inheritance implemented for objects that act as aggregate containers for data? A.7.2.2 A.10.7.1 A.10.7.3 A.10.8.1
| Data Security & Information Lifecycle Management | |||||
| Nonproduction Data | DSI-05 | DSI-05.1 | Production data shall not be replicated or used in non-production environments. Any use of customer data in non-production environments requires explicit, documented approval from all customers whose data is affected, and must comply with all legal and regulatory requirements for scrubbing of sensitive data elements. | Do you have procedures in place to ensure production data shall not be replicated or used in non-production environments? | C3.5.0 |
S3.4.0
C3.21.0 (C3.5.0) The system procedures provide that confidential information is disclosed to parties only in accordance with the entity’s defined confidentiality and related security policies.
(S3.4.0) Procedures exist to protect against unauthorized access to system resources.
(C3.21.0) Procedures exist to provide that confidential information is protected during the system development, testing, and change processes in accordance with defined system confidentiality and related security policies. C1.3
CC5.6
C1.1 SRM > Policies and Standards > Technical Standard (Data Management Security Standard) shared x Domain 5 A.7.1.3 A.10.1.4 A.12.4.2 A.12.5.1 A.8.1.3 A.12.1.4 A.14.3.1 8.1* (partial) A.14.2.2.
| Data Security & Information Lifecycle Management | |||||
| Ownership / Stewardship | DSI-06 | DSI-06.1 | All data shall be designated with stewardship, with assigned responsibilities defined, documented, and communicated. | Are the responsibilities regarding data stewardship defined, assigned, documented, and communicated? | S2.2.0 |
S2.3.0
S3.8.0 (S2.2.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users.
(S2.3.0) Responsibility and accountability for the entity’s system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.
(S3.8.0) Procedures exist to classify data in accordance with classification policies and periodically monitor and update such classifications as necessary CC2.3
CC3.1 BOSS > Data Governance > Data Ownership / Stewardship shared x Domain 5 A.6.1.3 A.7.1.2 A.15.1.4 A.6.1.1 A.8.1.2 A.18.1.4
| Data Security & Information Lifecycle Management | |||||
| Secure Disposal | DSI-07 | DSI-07.1 | Policies and procedures shall be established with supporting business processes and technical measures implemented for the secure disposal and complete removal of data from all storage media, ensuring data is not recoverable by any computer forensic means. | Do you support secure deletion (e.g., degaussing/cryptographic wiping) of archived and backed-up data as determined by the tenant? | C3.5.0 |
S3.4.0 (C3.5.0) The system procedures provide that confidential information is disclosed to parties only in accordance with the entity’s defined confidentiality and related security policies.
(S3.4.0) Procedures exist to protect against unauthorized access to system resources. C1.3
| CC5.6 | BOSS > Data Governance > Secure Disposal of Data | shared | x | Domain 5 | A.9.2.6 |
| A.10.7.2 | A.11.2.7 |
A.8.3.2 DG-05 DSI-07.2 Can you provide a published procedure for exiting the service arrangement, including assurance to sanitize all computing resources of tenant data once a customer has exited your environment or has vacated a resource? A.9.2.6 A.10.7.2
| Datacenter Security | |||||
| Asset Management | DCS-01 | DCS-01.1 | Assets must be classified in terms of business criticality, service-level expectations, and operational continuity requirements. A complete inventory of business-critical assets located at all sites and/or geographical locations and their usage over time shall be maintained and updated regularly, and assigned ownership by defined roles and responsibilities. | Do you maintain a complete inventory of all of your critical assets that includes ownership of the asset? | S3.1.0 |
C3.14.0
S1.2.b-c (S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats.
(C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies.
(S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to define protection requirements, access rights and access restrictions, and retention and destruction policies.
c. Assessing risks on a periodic basis. CC3.1
| CC3.1 | ITOS > Service Support > Configuration Management - Physical Inventory | provider | x | Domain 8 | A.7.1.1 | |
| A.7.1.2 | Annex A.8 | |||||
| FS-08 | DCS-01.2 | Do you maintain a complete inventory of all of your critical supplier relationships? | A.7.1.1 |
A.7.1.2
| Datacenter Security | |||||||||||||
| Controlled Access Points | DCS-02 | DCS-02.1 | Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) shall be implemented to safeguard sensitive data and information systems. | Are physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) implemented? | A3.6.0 | (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. | CC5.5 | Infra Services > Facility Security > Controlled Physical Access | provider | x | Domain 8 | A.9.1.1 | A.11.1.1 |
A.11.1.2
| Datacenter Security | ||||||||||
| Equipment Identification | DCS-03 | DCS-03.1 | Automated equipment identification shall be used as a method of connection authentication. Location-aware technologies may be used to validate connection authentication integrity based on known equipment location. | Is automated equipment identification used as a method to validate connection authentication integrity based on known equipment location? | S3.2.a | (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public. | CC5.1 | > > | Domain 8 | A.11.4.3 |
| Datacenter Security | ||||||||||
| Offsite Authorization | DCS-04 | DCS-04.1 | Authorization must be obtained prior to relocation or transfer of hardware, software, or data to an offsite premises. | Do you provide tenants with documentation that describes scenarios in which data may be moved from one physical location to another (e.g., offsite backups, business continuity failovers, replication)? | S3.2.f |
C3.9.0 (S3.2.f) f. Restriction of access to offline storage, backup data, systems, and media.
(C3.9.0) Procedures exist to restrict physical access to the defined system including, but not limited to: facilities, backup media, and other system components such as firewalls, routers, and servers. CC5.1
| CC5.5 | SRM > Facility Security > Asset Handling | provider | x | Domain 8 | A.9.2.7 |
| A.10.1.2 | A.11.2.6 |
A.11.2.7
| Datacenter Security | ||||||||||||
| Offsite Equipment | DCS-05 | DCS-05.1 | Policies and procedures shall be established for the secure disposal of equipment (by asset type) used outside the organization's premise. This shall include a wiping solution or destruction process that renders recovery of information impossible. The erasure shall consist of a full write of the drive to ensure that the erased drive is released to inventory for reuse and deployment or securely stored until it can be destroyed. | Can you provide tenants with evidence documenting your policies and procedures governing asset management and repurposing of equipment? | S3.4 | (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.6 | BOSS > Data Governance > Secure Disposal of Data | provider | x | Domain 8 | A.9.2.5 |
| A.9.2.6 | A.8.1.1 |
A.8.1.2
| Datacenter Security | ||||||||||||
| Policy | DCS-06 | DCS-06.1 | Policies and procedures shall be established, and supporting business processes implemented, for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas storing sensitive information. | Can you provide evidence that policies, standards, and procedures have been established for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas? | A3.6.0 | (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. | CC5.5 | SRM > Policies and Standards > Information Security Policies (Facility Security Policy) | provider | x | Domain 8 | A.5.1.1 |
A.9.1.3 A.9.1.5 A.11.1.1 A.11.1.2
| DCS-06.2 | Can you provide evidence that your personnel and involved third parties have been trained regarding your documented policies, standards, and procedures? | |||||||||||||
| Datacenter Security | ||||||||||||||
| Secure Area Authorization | DCS-07 | DCS-07.1 | Ingress and egress to secure areas shall be constrained and monitored by physical access control mechanisms to ensure that only authorized personnel are allowed access. | Do you allow tenants to specify which of your geographic locations their data is allowed to move into/out of (to address legal jurisdictional considerations based on where data is stored vs. accessed)? | A3.6.0 | (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. | CC5.5 | SRM > Policies and Standards > Information Security Policy (Facility Security Policy) | provider | x | Domain 8 | A.9.1.1 | ||
| A.9.1.2 | A.11.1.6 | |||||||||||||
| Datacenter Security | ||||||||||||||
| Unauthorized Persons Entry | DCS-08 | DCS-08.1 | Ingress and egress points such as service areas and other points where unauthorized personnel may enter the premises shall be monitored, controlled and, if possible, isolated from data storage and processing facilities to prevent unauthorized data corruption, compromise, and loss. | Are ingress and egress points, such as service areas and other points where unauthorized personnel may enter the premises, monitored, controlled and isolated from data storage and process? | A3.6.0 | (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. | CC5.5 | SRM > Policies and Standards > Information Security Policy (Facility Security Policy) | provider | x | Domain 8 | A.9.1.6 | A.11.2.5 |
8.1* (partial) A.12.1.2
| Datacenter Security | |||||||||||
| User Access | DCS-09 | DCS-09.1 | Physical access to information assets and functions by users and support personnel shall be restricted. | Do you restrict physical access to information assets and functions by users and support personnel? | A3.6.0 | (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. | CC5.5 | Infra Services > Facility Security > | Domain 8 | A.9.1.1 | |
| A.9.1.2 | A.11.1.1 | ||||||||||
| Encryption & Key Management | |||||||||||
| Entitlement | EKM-01 | EKM-01.1 | Keys must have identifiable owners (binding keys to identities) and there shall be key management policies. | Do you have key management policies binding keys to identifiable owners? | SRM > Cryptographic Services > Key Management | Annex |
A.10.1 A.10.1.1 A.10.1.2
| Encryption & Key Management | |||||
| Key Generation | EKM-02 | EKM-02.1 | Policies and procedures shall be established for the management of cryptographic keys in the service's cryptosystem (e.g., lifecycle management from key generation to revocation and replacement, public key infrastructure, cryptographic protocol design and algorithms used, access controls in place for secure key generation, and exchange and storage including segregation of keys used for encrypted data or sessions). Upon request, provider shall inform the customer (tenant) of changes within the cryptosystem, especially if the customer (tenant) data is used as part of the service, and/or the customer (tenant) has some shared responsibility over implementation of the control. | Do you have a capability to allow creation of unique encryption keys per tenant? | (S3.6.0) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks. |
(S3.4) Procedures exist to protect against unauthorized access to system resources. CC5.7
CC5.6 SRM > Cryptographic Services > Key Management shared x Domain 2 Clause 4.3.3 A.10.7.3 A.12.3.2 A.15.1.6 Clauses 5.2(c) 5.3(a) 5.3(b) 7.5.3(b) 7.5.3(d) 8.1 8.3 9.2(g) A.8.2.3 A.10.1.2 A.18.1.5
| IS-19 | EKM-02.2 | Do you have a capability to manage encryption keys on behalf of tenants? | ||||
| IS-19 | EKM-02.3 | Do you maintain key management procedures? | ||||
| IS-19 | EKM-02.4 | Do you have documented ownership for each stage of the lifecycle of encryption keys? | ||||
| EKM-02.5 | Do you utilize any third party/open source/proprietary frameworks to manage encryption keys? | |||||
| Encryption & Key Management |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .