CSA STAR

Requirements and controls

• A&A Audit and assurance

  • A&A-01 Audit program policy

    Keep approved policies and procedures that govern how audits and assurance work are planned and carried out, and review them at least once a year.

    • Internal Audit
    • Information Security & Privacy Policies
    • Management Review of Policies
    • Statutory, Regulatory & Contractual Compliance

  • A&A-02 Independent assessments

    Have qualified, independent assessors evaluate the control environment at least once a year.

    • Internal Audit
    • Security & Privacy Program Review
    • Statutory, Regulatory & Contractual Compliance

  • A&A-03 Risk-based audit planning

    Decide what to audit and when based on risk, covering the services in scope and the obligations that apply to them.

    • Internal Audit
    • Risk Framing
    • Risk Assessment

  • A&A-04 Checking compliance with obligations

    Use audits to confirm the service meets the standards, laws, regulations and contract terms that apply to it.

    • Internal Audit
    • Data Governance
    • Statutory, Regulatory & Contractual Compliance
    • Contractual Obligations Register

  • A&A-05 Audit management process

    Run audits through a defined process that covers planning, testing controls, drawing conclusions and keeping the evidence.

    • Internal Audit
    • Security & Privacy Program Review
    • ISMS Manual

  • A&A-06 Remediating audit findings

    Track every audit finding in a remediation plan with an owner and a deadline, and report progress to the people responsible.

    • Internal Audit
    • Security & Privacy Program Review
    • Assigned Security & Privacy Responsibilities

• AIS Application and interface security

  • AIS-01 Application security policy

    Keep approved policies and procedures that guide how applications are planned, built, delivered and supported securely, reviewed at least once a year.

    • Change Management Policy & Procedure
    • Information Security & Privacy Policies

  • AIS-02 Application security baseline

    Set the minimum security requirements every application must meet, whether it is built in-house or bought.

    • Change Management Policy & Procedure
    • Input Range Validation
    • Mandatory Field Validation

  • AIS-03 Application security measures

    Choose and track measures that show whether application security goals are being met.

    • Vulnerability Remediation Process
    • Centralized Flaw Remediation

  • AIS-04 Secure development lifecycle

    Follow a documented lifecycle that builds security into how applications are designed, coded, released and run.

    • Change Management Policy & Procedure
    • Secure System Modification
    • Approval of Changes
    • Security & Privacy Awareness
    • New Hire Security & Privacy Training

  • AIS-05 Automated security testing

    Test new code and releases for security problems before they go live, using automation where practical.

    • Regression Testing
    • Approval of Changes
    • Vulnerability Remediation Process
    • Penetration Testing

  • AIS-06 Secure automated deployment

    Release application code through standard, controlled and preferably automated deployment pipelines.

    • Secure System Modification
    • Approval of Changes
    • Deployment Notifications

  • AIS-07 Fixing application vulnerabilities

    Find application security weaknesses and fix them within set timeframes, automating where possible.

    • Vulnerability Remediation Process
    • Centralized Flaw Remediation
    • Penetration Testing
    • Vulnerability Management Policy & Procedure

  • AIS-08 API security

    Protect the service's programming interfaces with access control, input checks, encryption in transit, logging and regular testing.

    • Access Control Policy & Procedure
    • Transmission Confidentiality
    • Input Range Validation
    • Mandatory Field Validation
    • Centralized Security Logging
    • Penetration Testing

• BCR Business continuity and operational resilience

  • BCR-01 Business continuity policy

    Keep approved policies and procedures for business continuity and operational resilience, reviewed at least once a year.

    • Business Continuity Policy & Procedure
    • Disaster Recovery Policy

  • BCR-02 Disruption impact and risk analysis

    Work out how a disruption would affect the business and use that analysis to set recovery priorities and targets.

    • Impact Analysis
    • Risk Framing
    • Risk Assessment
    • Business Continuity Policy & Procedure

  • BCR-03 Continuity strategy

    Choose strategies that limit the effect of a disruption and allow recovery within the agreed targets.

    • Business Continuity Policy & Procedure
    • Disaster Recovery Policy

  • BCR-04 Continuity planning

    Write continuity plans that put the chosen strategies and the impact analysis into practice.

    • Business Continuity Policy & Procedure
    • Disaster Recovery Policy

  • BCR-05 Continuity documentation

    Keep continuity documents current, available to the people who need them and reviewed on schedule.

    • Business Continuity Policy & Procedure
    • Disaster Recovery Policy
    • Information Security & Privacy Policies

  • BCR-06 Continuity exercises

    Rehearse the continuity plans at least once a year and after significant changes.

    • Disaster Recovery Testing

  • BCR-07 Communication during disruption

    Agree in advance how and with whom the organization communicates during a disruption, including customers.

    • Business Continuity Policy & Procedure
    • Incident Reporting Assistance
    • Incident Management Policy & Procedure

  • BCR-08 Backups

    Back up cloud data on a regular schedule, keep the copies protected and check that they can be restored.

    • Data Backup Policy
    • Data Backups
    • Backup Restoration Testing

  • BCR-09 Disaster response plan

    Keep a plan for recovering from natural and man-made disasters and update it at least once a year or after major changes.

    • Disaster Recovery Policy
    • Business Continuity Policy & Procedure

  • BCR-10 Testing the disaster response plan

    Test the disaster response plan at least once a year and after significant changes.

    • Disaster Recovery Testing

  • BCR-11 Equipment redundancy

    Back up critical equipment with redundant capacity placed far enough away to survive the same incident.

    • Data Backups
    • Capacity & Performance Management
    • Subservice Organization Evaluation

• CCC Change control and configuration management

  • CCC-01 Change management policy

    Keep approved policies and procedures for managing the risk of changes to applications, systems, infrastructure and configuration.

    • Change Management Policy & Procedure

  • CCC-02 Quality testing of changes

    Put changes through a defined quality process with testing and release criteria before they reach production.

    • Regression Testing
    • Approval of Changes
    • Change Management Policy & Procedure

  • CCC-03 Change tracking tools

    Use tools that manage, track and record changes to the organization's assets.

    • Secure System Modification
    • Approval of Changes
    • Deployment Notifications

  • CCC-04 Blocking unauthorized changes

    Stop people without authorization from adding, removing, updating or managing organizational assets.

    • Approval of Changes
    • Identity Validation
    • Production Database Access Restriction

  • CCC-05 Changes affecting customers

    Limit changes that affect customer-owned environments to those the customer agreement allows or the customer approves.

    • Contractual Obligations Register
    • Change Management Policy & Procedure

  • CCC-06 Configuration baselines

    Define approved baseline configurations for assets and apply them whenever an authorized change is made.

    • Change Management Policy & Procedure
    • Secure System Modification
    • Impact Analysis

  • CCC-07 Detecting configuration drift

    Watch for deviations from the approved baselines and act on them.

    • Impact Analysis
    • Anomalous Behavior Detection
    • Centralized Security Logging

  • CCC-08 Change exceptions

    Handle emergency and exceptional changes through a documented route that includes approval and a later review.

    • Change Management Policy & Procedure
    • Approval of Changes

  • CCC-09 Rolling back changes

    Be able to return a system to a known good state when a change causes errors or security problems.

    • Change Management Policy & Procedure
    • Data Backups

• CEK Cryptography, encryption and key management

  • CEK-01 Encryption and key management policy

    Keep approved policies and procedures for cryptography and key management, reviewed at least once a year.

    • Encryption Policy & Procedure

  • CEK-02 Cryptography responsibilities

    Name who is responsible for cryptography, encryption and key management.

    • Encryption Policy & Procedure
    • Cybersecurity Responsibilities

  • CEK-03 Protecting data with cryptography

    Use proven, standards-based cryptography to protect data both when stored and when transmitted.

    • Encryption of Data at Rest
    • Transmission Confidentiality
    • Full Device Encryption
    • Encryption Policy & Procedure

  • CEK-04 Choice of algorithms

    Pick encryption algorithms that suit the sensitivity of the data, the risk and the performance needs.

    • Encryption Policy & Procedure

  • CEK-05 Changes to cryptography

    Review, approve and record changes to cryptographic mechanisms and keys through change management.

    • Encryption Policy & Procedure
    • Change Management Policy & Procedure

  • CEK-06 Weighing cryptographic changes

    Consider the risks, costs and benefits before changing encryption systems or the rules around them.

    • Encryption Policy & Procedure
    • Risk Framing

  • CEK-07 Encryption risk

    Cover encryption and key management in the risk assessment and treatment process.

    • Risk Framing
    • Risk Assessment
    • Encryption Policy & Procedure

  • CEK-08 Customer key management

    Where the service offers it, let customers manage their own encryption keys and explain clearly how this works.

    • Encryption Policy & Procedure
    • Shared Responsibility Model

  • CEK-09 Auditing encryption and keys

    Audit encryption and key management systems and practices at least once a year and after security events.

    • Internal Audit
    • Encryption Policy & Procedure

  • CEK-10 Generating keys

    Create keys with approved libraries and strong sources of randomness.

    • Encryption Policy & Procedure
    • Encryption of Data at Rest

  • CEK-11 Single-purpose keys

    Give each secret or private key one defined purpose and manage it on that basis.

    • Encryption Policy & Procedure

  • CEK-12 Rotating keys

    Replace keys on a schedule set by their permitted lifetime, the risk of exposure and any legal rules.

    • Encryption Policy & Procedure
    • Encryption of Data at Rest

  • CEK-13 Revoking keys

    Withdraw keys before their planned expiry when they may be exposed or their holder no longer needs them.

    • Encryption Policy & Procedure

  • CEK-14 Destroying keys

    Securely destroy keys that are no longer needed, including those kept outside hardware security modules.

    • Encryption Policy & Procedure

  • CEK-15 Activating keys

    Control and authorize the step where a newly created key is put into use.

    • Encryption Policy & Procedure

  • CEK-16 Suspending keys

    Monitor, review and approve when keys are put on hold and when they are brought back into use.

    • Encryption Policy & Procedure

  • CEK-17 Deactivating keys

    Take keys out of use through a controlled process once their validity period ends.

    • Encryption Policy & Procedure

  • CEK-18 Archiving keys

    Store retired keys in a protected archive with tightly limited access for as long as they may be needed.

    • Encryption Policy & Procedure
    • Encryption of Data at Rest

  • CEK-19 Compromised keys

    Deal with keys suspected of exposure through a defined process that stops them protecting any new data.

    • Encryption Policy & Procedure
    • Incident Management Policy & Procedure

  • CEK-20 Recovering keys

    Assess the business impact of losing access to keys and keep a reliable way to recover them.

    • Encryption Policy & Procedure
    • Encryption of Data at Rest

  • CEK-21 Key inventory

    Keep a record of cryptographic keys with their status and stage in the key lifecycle.

    • Encryption Policy & Procedure

• DCS Datacenter security

  • DCS-01 Physical and environmental security policy

    Keep approved policies and procedures for protecting facilities against physical and environmental threats, reviewed at least once a year.

    • Physical Protection Policy & Procedure
    • Subservice Organization Evaluation

  • DCS-02 Disposal of equipment used off-site

    Securely dispose of equipment used outside the organization's premises so no data can be recovered from it.

    • Media Disposal Policy

  • DCS-03 Authorizing off-site moves

    Require approval and a record before hardware, software or data is moved to another location.

    • Physical Protection Policy & Procedure
    • Media Disposal Policy

  • DCS-04 Secure areas

    Set rules that keep offices, rooms and facilities holding sensitive information safe to work in.

    • Physical Protection Policy & Procedure
    • Clear Desk & Clear Screen

  • DCS-05 Moving physical media

    Protect physical storage media while it is being carried between locations.

    • Media Disposal Policy
    • Physical Protection Policy & Procedure

  • DCS-06 Asset classification

    Classify physical and logical assets according to the business risk they carry.

    • Data Classification Labels
    • Data Classification Policy
    • Inventory of Infrastructure Assets

  • DCS-07 Asset records and tracking

    Record all relevant physical and logical assets in every location and keep track of them.

    • Inventory of Infrastructure Assets
    • Inventory of Endpoint Assets
    • Asset Inventory Updates

  • DCS-08 Controlled physical entry points

    Protect areas that hold sensitive systems with physical perimeters and controlled entry points such as guarded or badge-controlled doors.

    • Physical Protection Policy & Procedure
    • Subservice Organization Evaluation

  • DCS-09 Identifying equipment

    Use the identity of a device as one of the factors when deciding whether to accept its connection.

    • Inventory of Endpoint Assets
    • Endpoint Encryption

  • DCS-10 Authorized entry to secure areas

    Let only authorized people into secure areas, and record and review who entered.

    • Physical Protection Policy & Procedure
    • Subservice Organization Evaluation

  • DCS-11 Physical surveillance

    Watch facility perimeters and entry points with surveillance systems.

    • Subservice Organization Evaluation
    • Shared Responsibility Model

  • DCS-12 Training for physical incidents

    Prepare facility staff to respond to break-ins and other adverse physical events.

    • Physical Protection Policy & Procedure
    • Subservice Organization Evaluation

  • DCS-13 Cabling protection

    Protect power and network cabling from tapping, interference and damage, and inspect it periodically.

    • Subservice Organization Evaluation
    • Shared Responsibility Model

  • DCS-14 Environmental conditions

    Keep temperature, humidity and similar conditions within the range the equipment needs, and monitor them.

    • Subservice Organization Evaluation
    • Physical Protection Policy & Procedure

  • DCS-15 Utilities

    Protect, maintain and regularly test power and other supporting utilities.

    • Subservice Organization Evaluation
    • Physical Protection Policy & Procedure

  • DCS-16 Equipment location

    Keep critical equipment away from places with high environmental risk, such as flood zones, or add safeguards where that is not possible.

    • Subservice Organization Evaluation
    • Physical Protection Policy & Procedure

  • DCS-17 Facility performance measures

    Define and track measures of facility capacity, performance and security, and act when they slip.

    • Capacity & Performance Management
    • Subservice Organization Evaluation

  • DCS-18 Resilient facility operations

    Run facility operations so they keep working through component failures and other disruptions.

    • Data Backups
    • Disaster Recovery Policy
    • Business Continuity Policy & Procedure
    • Disaster Recovery Testing
    • Subservice Organization Evaluation

• DSP Data security and privacy

  • DSP-01 Data security and privacy policy

    Keep approved policies and procedures for classifying, protecting and handling data through its whole lifecycle in line with the law, reviewed at least once a year.

    • Data Protection Policy & Procedure
    • Data Classification Policy
    • Information Security & Privacy Policies

  • DSP-02 Secure disposal of data

    Remove data from storage media with accepted methods so it cannot be recovered.

    • Media Disposal Policy
    • Data Retention Policy

  • DSP-03 Data inventory

    Keep an inventory that covers at least sensitive and personal data.

    • Personal Data Inventory
    • Inventory of Infrastructure Assets
    • Data Classification Labels

  • DSP-04 Data classification

    Classify data by its type and how sensitive it is.

    • Data Classification Labels
    • Data Classification Policy

  • DSP-05 Data flow records

    Document where data is stored, processed and sent, and review those records at least once a year and after changes.

    • Network & Data Flow Diagrams
    • Personal Data Inventory

  • DSP-06 Data owners

    Name an owner for each category of personal and sensitive data and review the assignments at least once a year.

    • Personal Data Inventory
    • Inventory of Infrastructure Assets
    • Data Classification Labels

  • DSP-07 Security by design and by default

    Build data protection into systems from the start and ship them with protective settings turned on.

    • Change Management Policy & Procedure
    • Privacy by Design Policy
    • Encryption of Data at Rest

  • DSP-08 Privacy by design and by default

    Design systems and processes with privacy built in and default settings that respect privacy law.

    • Privacy by Design Policy
    • Data Protection Policy & Procedure

  • DSP-09 Privacy impact assessments

    Assess the risks to individuals before starting processing of personal data that could seriously affect them.

    • Data Protection Impact Assessments

  • DSP-10 Transferring sensitive data

    Protect personal and sensitive data from unauthorized access while it is transferred, and only transfer it where the law allows.

    • Transmission Confidentiality
    • Cross-Border Data Transfers

  • DSP-11 Individual data rights

    Let people access, correct and delete their personal data as the law requires.

    • Data Subject Requests
    • Published Privacy Policy

  • DSP-12 Purpose limitation

    Use personal data only for the purposes stated in the privacy notice or agreed with the person.

    • Data Protection Policy & Procedure
    • Published Privacy Policy
    • Personal Data Inventory
    • Consent Management

  • DSP-13 Sub-processing of personal data

    Control how personal data is passed to and handled by sub-processors.

    • Processor Data Protection Agreements
    • Third-Party Criticality Assessments
    • Vendor Management Policy & Procedure

  • DSP-14 Disclosing sub-processors

    Tell customers which sub-processors can reach their data before those sub-processors start work.

    • Service Supply Chain Transparency
    • Processor Data Protection Agreements
    • Vendor Management Policy & Procedure

  • DSP-15 Production data outside production

    Require approval before production data is used in development or test environments.

    • Test Data Protection

  • DSP-16 Retention and deletion

    Keep data only as long as business needs and the law require, then delete it.

    • Data Retention Policy
    • Media Disposal Policy

  • DSP-17 Protecting sensitive data

    Apply technical and organizational safeguards to sensitive data at every stage of its life.

    • Encryption of Data at Rest
    • Transmission Confidentiality
    • Data Classification Policy
    • Data Classification Labels
    • Production Database Access Restriction

  • DSP-18 Requests from authorities

    Handle requests from authorities for customer data through a defined process and tell the affected customer unless the law forbids it.

    • Data Protection Policy & Procedure
    • Cybersecurity Responsibilities
    • Statutory, Regulatory & Contractual Compliance

  • DSP-19 Data location

    Know and record the physical locations where data, including backups, is stored and processed.

    • Network & Data Flow Diagrams
    • Personal Data Inventory
    • Cross-Border Data Transfers

• GRC Governance, risk and compliance

  • GRC-01 Governance program policy

    Keep approved policies and procedures for a leadership-backed information governance program, reviewed at least once a year.

    • Security Governance Program
    • Information Security & Privacy Policies
    • Management Review of Policies

  • GRC-02 Risk management program

    Run a formal program to identify, assess, treat, accept and monitor cloud security and privacy risks.

    • Risk Framing
    • Risk Assessment
    • Risk Assessment Policy & Procedure
    • Management Review of Risks

  • GRC-03 Policy reviews

    Review all relevant policies at least once a year or when the organization changes significantly.

    • Management Review of Policies
    • Information Security & Privacy Policies

  • GRC-04 Policy exceptions

    Grant and record exceptions to policy through an approved process when a policy cannot be followed.

    • Security Governance Program
    • Information Security & Privacy Policies
    • Risk Assessment Policy & Procedure

  • GRC-05 Information security program

    Run an information security program that covers every relevant area of the matrix.

    • Security Governance Program
    • ISMS Manual
    • Assigned Security & Privacy Responsibilities
    • Security & Privacy Program Review

  • GRC-06 Governance roles

    Define and document who plans, runs and improves the governance programs.

    • Assigned Security & Privacy Responsibilities
    • Compliance Program Manager
    • Cybersecurity Responsibilities

  • GRC-07 Mapping legal and regulatory requirements

    Identify and record the standards, laws and regulations that apply to the organization and its systems.

    • Data Governance
    • Statutory, Regulatory & Contractual Compliance
    • Contractual Obligations Register

  • GRC-08 Security interest groups

    Stay in contact with cloud security and privacy communities and the relevant authorities.

    • Cybersecurity Responsibilities

• HRS Human resources security

  • HRS-01 Background screening

    Screen new staff, contractors and third parties in line with local law, the data they will reach and the risks involved.

    • Personnel Screening
    • Human Resources Policy & Procedure

  • HRS-02 Acceptable use

    Set rules for how people may use the organization's devices, systems and data.

    • Rules of Behavior

  • HRS-03 Clean desk

    Make sure unattended workspaces leave no confidential information exposed.

    • Clear Desk & Clear Screen

  • HRS-04 Remote and home working

    Protect information that is accessed, handled or stored away from the office, including at home.

    • Endpoint Security Policy
    • Endpoint Encryption
    • Session Lock
    • Rules of Behavior

  • HRS-05 Returning assets

    Recover the organization's assets from people when their work for the organization ends.

    • Human Resources Policy & Procedure
    • People Operations Owner
    • Inventory of Endpoint Assets

  • HRS-06 Leaving or changing roles

    Define and communicate the steps and responsibilities that apply when someone changes role or leaves, including removing access.

    • Termination of Employment
    • Human Resources Policy & Procedure
    • People Operations Owner

  • HRS-07 Agreements before access

    Have new staff sign their employment terms before they are given access to company information.

    • Code of Business Conduct
    • New Hire Policy Acknowledgement
    • Human Resources Policy & Procedure

  • HRS-08 Security terms in employment agreements

    Make following the organization's security and privacy policies part of every employment agreement.

    • Code of Business Conduct
    • New Hire Policy Acknowledgement
    • Human Resources Policy & Procedure

  • HRS-09 Staff security responsibilities

    Write down the security and privacy duties each role has towards information assets.

    • Roles & Responsibilities
    • Cybersecurity Responsibilities
    • Organizational Structure

  • HRS-10 Confidentiality agreements

    Define the confidentiality terms staff and others must accept, and review them regularly.

    • New Hire Policy Acknowledgement
    • Periodic Policy Acknowledgement
    • Management Review of Policies

  • HRS-11 Security awareness training

    Give all staff security awareness training when they join and regular refreshers afterwards.

    • Security & Privacy Awareness
    • New Hire Security & Privacy Training
    • Periodic Security & Privacy Training

  • HRS-12 Training on sensitive data

    Train staff who handle personal or sensitive data on how to treat it and on their related duties.

    • New Hire Security & Privacy Training
    • Periodic Security & Privacy Training
    • Security & Privacy Awareness

  • HRS-13 Staff compliance duties

    Make sure staff know they are responsible for following policies, procedures and legal obligations.

    • New Hire Policy Acknowledgement
    • Periodic Policy Acknowledgement
    • Code of Business Conduct
    • Publishing Security & Privacy Documentation

• IAM Identity and access management

  • IAM-01 Identity and access policy

    Keep approved identity and access management policies and procedures, reviewed at least once a year.

    • Access Control Policy & Procedure

  • IAM-02 Credentials management policy

    Set out, approve and review how passwords, keys and other credentials are issued, stored, rotated and revoked.

    • Access Control Policy & Procedure
    • Password Management Guidelines
    • Multi-Factor Authentication

  • IAM-03 Identity inventory

    Keep and regularly review a record of the identities on each system and the access each one holds.

    • User Access Reviews
    • Identity Validation
    • User Privilege Reviews

  • IAM-04 Separation of duties

    Split conflicting duties between people when granting access to information assets.

    • Segregation of Duties
    • Identity Validation

  • IAM-05 Least privilege

    Give each user only the access their role needs.

    • Identity Validation
    • Production Database Access Restriction
    • User Privilege Reviews

  • IAM-06 Granting access

    Request, approve and set up user access through a defined process.

    • Access Control Policy & Procedure
    • Identity Validation

  • IAM-07 Changing and removing access

    Adjust or remove access promptly when people change roles or leave.

    • Termination of Employment
    • Production System Access Review
    • User Access Reviews

  • IAM-08 Access reviews

    Review user access regularly to confirm it still fits each person's role.

    • Production System Access Review
    • User Privilege Reviews
    • User Access Reviews

  • IAM-09 Separating privileged roles

    Keep administrative control over data, encryption keys and logging in separate hands.

    • Segregation of Duties
    • Production Database Access Restriction
    • User Privilege Reviews

  • IAM-10 Managing privileged access

    Grant privileged access only for as long as it is needed and under controls that prevent misuse.

    • Production Database Access Restriction
    • User Privilege Reviews
    • Multi-Factor Authentication

  • IAM-11 Customer approval of privileged access

    Where agreed with customers, get their approval before provider staff use privileged access to their data or environment.

    • Contractual Obligations Register
    • Shared Responsibility Model
    • Production Database Access Restriction

  • IAM-12 Unique identities

    Give every user and system its own identity so that actions can be traced to it.

    • User Access Reviews
    • User Privilege Reviews
    • Identity Validation

  • IAM-13 Strong authentication

    Authenticate users and systems with strong methods, including multi-factor authentication for sensitive access.

    • Multi-Factor Authentication
    • Production Database Access Restriction

  • IAM-14 Managing credentials

    Handle passwords, keys and other credentials securely from the moment they are issued until they are revoked.

    • Password Management Guidelines
    • Production Database Access Restriction
    • Encryption Policy & Procedure

  • IAM-15 Authorization checks

    Use defined mechanisms to confirm that each request to reach data or system functions is authorized.

    • Access Control Policy & Procedure
    • Identity Validation

• IPY Interoperability and portability

  • IPY-01 Interoperability and portability policy

    Keep approved policies and procedures on how customers move data and connect services, reviewed at least once a year.

    • Customer Data Portability
    • Data Retention Policy

  • IPY-02 Customer data interfaces

    Offer customers programmatic interfaces they can use to reach and retrieve their data.

    • Customer Data Portability

  • IPY-03 Secure data import and export

    Move data into and out of the service using secure, standard protocols and formats.

    • Customer Data Portability
    • Transmission Confidentiality

  • IPY-04 Portability terms in contracts

    State in customer agreements how data is returned when the contract ends, in which format and how long it is kept before deletion.

    • Customer Data Portability
    • Contractual Obligations Register
    • Data Retention Policy

• I&S Infrastructure security

  • I&S-01 Infrastructure security policy

    Keep approved policies and procedures for securing infrastructure and virtualized environments, reviewed at least once a year.

    • Network Security Policy & Procedure
    • Information Security & Privacy Policies

  • I&S-02 Capacity planning

    Plan and watch resource capacity so the service keeps performing as promised.

    • Capacity & Performance Management
    • Impact Analysis

  • I&S-03 Network security

    Monitor, encrypt and restrict network traffic so that only authorized services and connections are allowed.

    • External System Connections
    • Limit Network Connections
    • Transmission Confidentiality

  • I&S-04 System hardening

    Harden hosts, guest systems and virtual infrastructure with secure baseline settings and keep them patched.

    • Vulnerability Remediation Process
    • Limit Network Connections
    • External System Connections

  • I&S-05 Separate environments

    Keep production apart from development and test environments.

    • Test Data Protection
    • Secure System Modification

  • I&S-06 Segmentation

    Segment networks and isolate tenants so customers and environments are protected from one another.

    • External System Connections
    • Limit Network Connections

  • I&S-07 Moving workloads to the cloud

    Use secure, encrypted channels and a controlled process when moving systems, applications or data into a cloud environment.

    • Transmission Confidentiality
    • Change Management Policy & Procedure

  • I&S-08 Network diagrams

    Document the network architecture, including higher-risk segments, and keep it current.

    • Network & Data Flow Diagrams

  • I&S-09 Network defense

    Detect and defend against network attacks such as unusual traffic patterns and denial of service.

    • Anomalous Behavior Detection
    • External System Connections
    • Centralized Security Logging

• LOG Logging and monitoring

  • LOG-01 Logging and monitoring policy

    Keep approved logging and monitoring policies and procedures, reviewed at least once a year.

    • Centralized Security Logging

  • LOG-02 Keeping audit logs safe

    Retain audit logs for a set period and protect them from tampering or loss.

    • Centralized Security Logging

  • LOG-03 Security alerting

    Watch applications and infrastructure for security events and alert the right people when they occur.

    • Anomalous Behavior Detection
    • Centralized Security Logging
    • Automated Incident Reporting

  • LOG-04 Access to audit logs

    Let only authorized people read audit logs and keep a record of who did.

    • Centralized Security Logging
    • Production Database Access Restriction

  • LOG-05 Reviewing audit logs

    Look through audit logs for unusual activity and follow up on what is found.

    • Anomalous Behavior Detection
    • Unauthorized Activity Monitoring
    • Incident Tracking

  • LOG-06 Clock synchronization

    Keep system clocks aligned with a reliable time source.

    • Clock Synchronization

  • LOG-07 What to log

    Decide and document which events and details must be logged, and revisit that choice periodically.

    • Centralized Security Logging

  • LOG-08 Keeping sensitive data out of logs

    Make sure secrets, credentials and unneeded personal data are not written to logs, masking them where they cannot be avoided.

    • Centralized Security Logging
    • Change Management Policy & Procedure

  • LOG-09 Log content

    Make log entries carry the details needed to investigate an event, such as the time, source and result.

    • Centralized Security Logging

  • LOG-10 Protecting audit records

    Guard audit records against unauthorized reading, changes or deletion.

    • Centralized Security Logging

  • LOG-11 Monitoring encryption

    Monitor and report on how cryptography, encryption and key management are being used and whether they are healthy.

    • Encryption of Data at Rest
    • Encryption Policy & Procedure

  • LOG-12 Logging key events

    Record key lifecycle events and other significant transactions so they can be audited later.

    • Centralized Security Logging
    • Encryption Policy & Procedure

  • LOG-13 Physical access logs

    Keep auditable records of physical access to sensitive areas.

    • Physical Protection Policy & Procedure
    • Subservice Organization Evaluation

  • LOG-14 Monitoring failures

    Detect failures and anomalies in the monitoring setup itself and report them to the people accountable.

    • Centralized Security Logging
    • Anomalous Behavior Detection
    • Automated Incident Reporting

• SEF Incident management, e-discovery and cloud forensics

  • SEF-01 Incident management policy

    Keep approved security incident management policies and procedures, reviewed at least once a year.

    • Incident Management Policy & Procedure

  • SEF-02 Timely incident handling

    Build the timely handling of security incidents into the way the service is managed.

    • Incident Management Policy & Procedure
    • Incident Tracking

  • SEF-03 Incident response plan

    Keep an incident response plan that names the internal roles and the customers, authorities and other parties to involve.

    • Incident Management Policy & Procedure
    • Data Breach Notification Policy

  • SEF-04 Testing incident response

    Rehearse the incident response plan at planned intervals and after significant changes.

    • Incident Response Exercises
    • Incident Management Policy & Procedure

  • SEF-05 Incident measures

    Define and track measures of incident handling, such as volume and response times.

    • Incident Tracking

  • SEF-06 Event triage

    Sort security events through defined steps to decide which ones are incidents.

    • Incident Tracking
    • Automated Incident Reporting
    • Incident Management Policy & Procedure

  • SEF-07 Handling incidents

    Contain, remove and recover from confirmed incidents by following the documented process.

    • Incident Management Policy & Procedure
    • Incident Tracking
    • Breach Risk Assessment & Notification

  • SEF-08 Breach notification

    Tell affected customers and authorities about security breaches within the time limits set by contracts and law.

    • Breach Risk Assessment & Notification
    • Data Breach Notification Policy
    • PII Breach Notification Guidelines

  • SEF-09 Incident records

    Keep complete, protected records of each incident and the actions taken, for as long as required.

    • Incident Tracking

  • SEF-10 External contacts

    Keep current contact details for authorities, regulators and other parties that may need to be involved in an incident or investigation.

    • Cybersecurity Responsibilities
    • Incident Management Policy & Procedure

• STA Supply chain management, transparency and accountability

  • STA-01 Supply chain risk policy

    Keep approved policies and procedures for managing risk from suppliers and the wider supply chain, reviewed at least once a year.

    • Vendor Management Policy & Procedure
    • Third-Party Criticality Assessments

  • STA-02 Shared responsibility policy

    Keep policies and procedures that apply the shared security responsibility model inside the organization.

    • Shared Responsibility Model

  • STA-03 Shared responsibility across the supply chain

    Apply, document and manage the shared responsibility model across the suppliers behind the service.

    • Shared Responsibility Model
    • Subservice Organization Evaluation

  • STA-04 Shared responsibility guidance

    Explain to customers how the shared responsibility model applies to the service they use.

    • Shared Responsibility Model
    • Publishing Security & Privacy Documentation

  • STA-05 Control ownership

    Record which party owns each control under the shared responsibility model.

    • Shared Responsibility Model

  • STA-06 Reviewing provider responsibility documents

    Review the shared responsibility documents of the cloud services the organization relies on.

    • Shared Responsibility Model
    • Subservice Organization Evaluation
    • Management Review of Third-Party Risks

  • STA-07 Operating owned controls

    Put in place, run and audit the controls the organization owns under the shared responsibility model.

    • Shared Responsibility Model
    • Internal Audit

  • STA-08 Supplier inventory

    Keep a record of every supply chain relationship.

    • Third-Party Criticality Assessments
    • Subservice Organization Evaluation

  • STA-09 Service component list

    Keep a current list of the third-party services and key components that make up the service and share it with customers as agreed.

    • Service Supply Chain Transparency
    • Third-Party Criticality Assessments
    • Inventory of Infrastructure Assets

  • STA-10 Supplier risk reviews

    Review the risks attached to each supplier relationship at regular intervals.

    • Third-Party Criticality Assessments
    • Management Review of Third-Party Risks
    • Subservice Organization Evaluation

  • STA-11 Customer service agreements

    Set out the agreed security, privacy and service terms in the agreements between the organization and its customers.

    • Contractual Obligations Register
    • Processor Data Protection Agreements

  • STA-12 Reviewing agreements

    Review supply chain agreements at least once a year.

    • Contractual Obligations Register
    • Management Review of Third-Party Risks

  • STA-13 Supply chain compliance checks

    Check at least once a year that the organization and its supply chain conform to the agreed standards, policies and procedures.

    • Internal Audit
    • Subservice Organization Evaluation
    • Third-Party Criticality Assessments

  • STA-14 Supplier agreement compliance

    Hold suppliers to the security, privacy, audit and service terms in their agreements.

    • Third-Party Criticality Assessments
    • Subservice Organization Evaluation
    • Processor Data Protection Agreements
    • Vendor Management Policy & Procedure

  • STA-15 Supplier governance reviews

    Periodically review how suppliers govern and manage their own risks.

    • Management Review of Third-Party Risks
    • Third-Party Criticality Assessments

  • STA-16 Supplier data protection assessments

    Periodically assess how suppliers protect the organization's and its customers' data.

    • Third-Party Criticality Assessments
    • Subservice Organization Evaluation

• TVM Threat and vulnerability management

  • TVM-01 Vulnerability management policy

    Keep approved policies and procedures for finding, reporting and fixing vulnerabilities, reviewed at least once a year.

    • Vulnerability Management Policy & Procedure

  • TVM-02 Malware protection policy

    Keep policies and procedures that protect managed assets against malware and other malicious code or instructions.

    • Malware Protection
    • Endpoint Security Policy

  • TVM-03 Finding vulnerabilities

    Scan managed assets for vulnerabilities at least once a month.

    • Vulnerability Remediation Process

  • TVM-04 Threat modeling

    Work out how systems and services could be attacked and which safeguards each threat calls for.

    • Change Management Policy & Procedure
    • Risk Framing
    • Risk Assessment

  • TVM-05 Keeping detection current

    Keep detection tools, signatures and indicators of compromise up to date.

    • Malware Protection
    • Anomalous Behavior Detection
    • Endpoint Security Validation

  • TVM-06 Third-party library vulnerabilities

    Find and fix vulnerabilities in the third-party and open-source libraries the service uses.

    • Vulnerability Remediation Process
    • Centralized Flaw Remediation

  • TVM-07 Penetration testing

    Have independent penetration tests carried out at regular intervals.

    • Penetration Testing

  • TVM-08 Remediation timeframes

    Set and meet deadlines for fixing vulnerabilities based on the risk each one poses.

    • Vulnerability Remediation Process
    • Centralized Flaw Remediation

  • TVM-09 Prioritizing vulnerabilities

    Rank vulnerabilities for fixing by risk, using a recognized scoring method.

    • Vulnerability Remediation Process
    • Vulnerability Management Policy & Procedure

  • TVM-10 Responding to threats

    Act on identified threats in good time with measures proportionate to their risk.

    • Incident Management Policy & Procedure
    • Incident Tracking
    • Anomalous Behavior Detection

  • TVM-11 Vulnerability reporting

    Track and report how vulnerabilities are being found and fixed to the people who need to know.

    • Centralized Flaw Remediation
    • Vulnerability Remediation Process

  • TVM-12 Vulnerability management measures

    Measure at set intervals how well vulnerabilities are being found and fixed.

    • Centralized Flaw Remediation
    • Vulnerability Remediation Process

• UEM Universal endpoint management

  • UEM-01 Endpoint policy

    Keep approved policies and procedures covering every type of endpoint, reviewed at least once a year.

    • Endpoint Security Policy

  • UEM-02 Approved applications

    Keep a list of the services, applications and app sources approved for endpoints that reach or store company data.

    • Rules of Behavior
    • Endpoint Security Policy

  • UEM-03 Endpoint compatibility

    Check that operating systems and applications on endpoints work with the organization's systems and security tools.

    • Endpoint Security Policy
    • Endpoint Security Validation

  • UEM-04 Endpoint inventory

    Keep an inventory of every endpoint used to store or reach company data.

    • Inventory of Endpoint Assets
    • Session Lock

  • UEM-05 Endpoint management

    Enforce security settings on every endpoint allowed to reach company systems or data.

    • Endpoint Security Policy
    • Endpoint Encryption
    • Session Lock

  • UEM-06 Automatic screen lock

    Make endpoints lock their screens automatically after a period of inactivity.

    • Session Lock
    • Clear Desk & Clear Screen

  • UEM-07 Operating system updates

    Manage operating system, patch and application changes on endpoints through a controlled process.

    • Endpoint Security Validation

  • UEM-08 Endpoint storage encryption

    Encrypt the storage on endpoints to protect the data they hold.

    • Full Device Encryption
    • Endpoint Encryption

  • UEM-09 Endpoint anti-malware

    Run anti-malware detection and prevention on managed endpoints.

    • Malware Protection

  • UEM-10 Endpoint firewall

    Run a correctly configured software firewall on managed endpoints.

    • Endpoint Security Policy

  • UEM-11 Endpoint data loss prevention

    Use data loss prevention measures on managed endpoints in proportion to the risk.

    • Endpoint Security Policy
    • Full Device Encryption

  • UEM-12 Locating lost devices

    Be able to find lost or stolen managed mobile devices remotely.

    • Endpoint Security Policy
    • Inventory of Endpoint Assets

  • UEM-13 Remote wipe

    Be able to erase company data remotely from lost, stolen or retired managed endpoints.

    • Endpoint Security Policy
    • Media Disposal Policy

  • UEM-14 Third-party endpoints

    Require endpoints owned by third parties to meet defined security standards before they reach company assets.

    • Endpoint Security Policy
    • Vendor Management Policy & Procedure
    • Rules of Behavior