Baseline configurations and codebases for production infrastructure, systems, and applications are securely managed.
Organizational Management
Information Security Program Review
Management is responsible for the design, implementation, and management of the organization’s security policies and procedures. The policies and procedures are reviewed by management at least annually.
Internal Control Monitoring
A continuous monitoring solution monitors internal controls used in the achievement of service commitments and system requirements.
Risk Assessment
Vendor Due Diligence Review
Vendor SOC 2 reports (or equivalent) are collected and reviewed on at least an annual basis.
Access Security
Access to Product is Restricted
Non-console access to production infrastructure is restricted to users with a unique SSH key or access key
Unique Access IDs
Personnel are assigned unique IDs to access sensitive systems, networks, and information