AXIS Insurance cyber policy application, held
The questions of the AXIS Cyber Application for Small Business, held and mapped to the ISO 27001:2022 controls, the SOC 2 criteria and the NIST CSF 2.0 outcomes each one reaches. The source document (read 2026-10-11). The date shown is the date this copy was read, not a version the form itself states. This page quotes only the question each mapped row needs and states its source; it does not publish the carrier's form. A complete form would be held only under a stated policy for copyrighted forms. AXIS Insurance is a source document, never a customer.
This document's questions reach 76 of 290 held controls. Whether an applicant is offered cover is the carrier’s underwriting decision. 5 questions here are flagged knockout (a "no" is a common decline point) and 0 flagged warranty (an answer the carrier relies on, that can affect cover if wrong).
Application question With respect to each of the following types of Personal Information, what is the approximate number of unique individuals whose Personal Information is collected, stored, used or processed by the Applicant or by a third party on behalf of the applicant?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does the Applicant sell or share Personal Information?
ISO 27001:2022 A.5.34 Privacy and protection of personal identifiable information (PII)
Evidence to have on file (guidance, our wording)
- The topic-specific privacy and PII protection policy and its communication to relevant parties
- Privacy procedures communicated to everyone who processes PII
ISO 27001:2022 A.5.31 Legal, statutory, regulatory and contractual requirements
Evidence to have on file (guidance, our wording)
- A register of applicable laws, regulations and contractual obligations for information security, with the countries covered, the approach to meeting each and a named responsible owner
- Records of periodic review of the register and of new or changed legislation identified
SOC 2 P1.1 Privacy notice to data subjects
Evidence to have on file (guidance, our wording)
- Published privacy notice with effective date and version history
- Evidence notice is presented at collection points (forms, apps)
SOC 2 P3.1 Collecting personal information consistent with objectives
Evidence to have on file (guidance, our wording)
- Data inventory showing purpose for each personal data field
- Privacy review of new collection forms or features
NIST CSF 2.0 GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Evidence to have on file (guidance, our wording)
- Legal and regulatory obligations register with owners
- Contractual security clauses summary across customer base
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
Application question Does the Applicant store or process Personal Information on behalf of a third party?
ISO 27001:2022 A.5.34 Privacy and protection of personal identifiable information (PII)
Evidence to have on file (guidance, our wording)
- The topic-specific privacy and PII protection policy and its communication to relevant parties
- Privacy procedures communicated to everyone who processes PII
ISO 27001:2022 A.5.31 Legal, statutory, regulatory and contractual requirements
Evidence to have on file (guidance, our wording)
- A register of applicable laws, regulations and contractual obligations for information security, with the countries covered, the approach to meeting each and a named responsible owner
- Records of periodic review of the register and of new or changed legislation identified
ISO 27001:2022 A.5.19 Information security in supplier relationships
Evidence to have on file (guidance, our wording)
- The topic-specific supplier relationship policy and its communication record
- A supplier inventory categorized by type and by the information, services and infrastructure each can access
SOC 2 P1.1 Privacy notice to data subjects
Evidence to have on file (guidance, our wording)
- Published privacy notice with effective date and version history
- Evidence notice is presented at collection points (forms, apps)
SOC 2 P3.1 Collecting personal information consistent with objectives
Evidence to have on file (guidance, our wording)
- Data inventory showing purpose for each personal data field
- Privacy review of new collection forms or features
NIST CSF 2.0 GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Evidence to have on file (guidance, our wording)
- Legal and regulatory obligations register with owners
- Contractual security clauses summary across customer base
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
Application question Does the Applicant store or process Corporate Information?
No held control answers this line.
Application question Is the Applicant required to be compliant with the PCI DSS?
This is an attestation question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question How many payment card transactions does the Applicant process annually?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Is the Applicant currently compliant with the PCI DSS requirements for its merchant level?
This is an attestation question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Which version of PCI-DSS was the Applicant assessed against?
ISO 27001:2022 A.8.24 Use of cryptography
Evidence to have on file (guidance, our wording)
- The topic-specific cryptography policy with approved algorithms, key lengths, protocols and usage by information classification
- Evidence of encryption on endpoints, removable media and data in transit, aligned with the policy
ISO 27001:2022 A.5.15 Access control
Evidence to have on file (guidance, our wording)
- The topic-specific access control policy, approved and communicated, reflecting owner-defined business and security requirements
- Access control rules or role models mapping entities (users, services, devices) to rights, consistent with classification
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
SOC 2 CC6.7 Restricting and protecting information in transmission, movement and removal
Evidence to have on file (guidance, our wording)
- TLS and encryption standards for data in transit
- Removable media policy and technical enforcement
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
Application question Does the Applicant have a written privacy policy or privacy notice reviewed by an attorney and updated at least annually?
ISO 27001:2022 A.5.34 Privacy and protection of personal identifiable information (PII)
Evidence to have on file (guidance, our wording)
- The topic-specific privacy and PII protection policy and its communication to relevant parties
- Privacy procedures communicated to everyone who processes PII
ISO 27001:2022 A.5.31 Legal, statutory, regulatory and contractual requirements
Evidence to have on file (guidance, our wording)
- A register of applicable laws, regulations and contractual obligations for information security, with the countries covered, the approach to meeting each and a named responsible owner
- Records of periodic review of the register and of new or changed legislation identified
SOC 2 P1.1 Privacy notice to data subjects
Evidence to have on file (guidance, our wording)
- Published privacy notice with effective date and version history
- Evidence notice is presented at collection points (forms, apps)
SOC 2 P3.1 Collecting personal information consistent with objectives
Evidence to have on file (guidance, our wording)
- Data inventory showing purpose for each personal data field
- Privacy review of new collection forms or features
NIST CSF 2.0 GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Evidence to have on file (guidance, our wording)
- Legal and regulatory obligations register with owners
- Contractual security clauses summary across customer base
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
Application question Does the Applicant have a written information security policy?
Answer options on this form: No / Yes.
ISO 27001:2022 A.5.1 Policies for information security
Evidence to have on file (guidance, our wording)
- The top-level information security policy with top management approval, covering the definition, objectives or objective-setting framework, principles, commitments to requirements and continual improvement, role assignments and the exceptions procedure
- The register of topic-specific policies with an owner, approving manager and version for each
ISO 27001:2022 A.5.2 Information security roles and responsibilities
Evidence to have on file (guidance, our wording)
- A documented roles and responsibilities matrix covering asset protection, specific security processes, risk management and residual risk acceptance, and user duties
- Named risk owners with evidence that they accepted residual risks
ISO 27001:2022 A.5.4 Management responsibilities
Evidence to have on file (guidance, our wording)
- Evidence that security briefings on roles and responsibilities occur before access is granted, such as onboarding checklists tied to access provisioning
- Role-specific guidance documents setting out security expectations
SOC 2 CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3)
Evidence to have on file (guidance, our wording)
- Current organisation chart including security, IT operations, compliance and privacy functions
- Job descriptions or RACI naming security and privacy responsibilities
SOC 2 CC5.3 Deploying controls through policies and procedures (COSO principle 12)
Evidence to have on file (guidance, our wording)
- Approved information security policy set with owners and review dates
- Evidence of annual policy review and approval
NIST CSF 2.0 GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
Evidence to have on file (guidance, our wording)
- Cybersecurity risk management policy approved by leadership
- Policy linkage matrix to standards and procedures
NIST CSF 2.0 GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
Evidence to have on file (guidance, our wording)
- Board cyber accountability charter
- Executive cyber scorecard with named owners
Application question When was this policy last updated?
Answer options on this form: No / Yes.
No held control answers this line.
Application question Is it based on or aligned with any of the following standards, frameworks or best practices?
No held control answers this line.
Application question Does the Applicant have a written business continuity plan?
ISO 27001:2022 A.5.29 Information security during disruption
Evidence to have on file (guidance, our wording)
- Business continuity plans that contain information security requirements and the controls, systems and tools needed during disruption
- A documented analysis of which security controls must be adapted during disruption and how
ISO 27001:2022 A.5.30 ICT readiness for business continuity
Evidence to have on file (guidance, our wording)
- The business impact analysis with prioritized activities, supporting ICT services and their RTOs, and RPOs for required information
- Selected ICT continuity strategies covering before, during and after disruption
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 CC9.1 Mitigating risks of business disruption
Evidence to have on file (guidance, our wording)
- Business continuity and disaster recovery plans covering the in-scope service
- Business impact analysis
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
NIST CSF 2.0 PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
Evidence to have on file (guidance, our wording)
- Resilience architecture patterns for critical services
- Failover and failback tested with evidence
NIST CSF 2.0 RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
Evidence to have on file (guidance, our wording)
- Recovery plan with triggers and decision rights
- Execution log of recovery activities
Application question How frequently is this plan tested?
ISO 27001:2022 A.5.29 Information security during disruption
Evidence to have on file (guidance, our wording)
- Business continuity plans that contain information security requirements and the controls, systems and tools needed during disruption
- A documented analysis of which security controls must be adapted during disruption and how
ISO 27001:2022 A.5.30 ICT readiness for business continuity
Evidence to have on file (guidance, our wording)
- The business impact analysis with prioritized activities, supporting ICT services and their RTOs, and RPOs for required information
- Selected ICT continuity strategies covering before, during and after disruption
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 CC9.1 Mitigating risks of business disruption
Evidence to have on file (guidance, our wording)
- Business continuity and disaster recovery plans covering the in-scope service
- Business impact analysis
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
NIST CSF 2.0 PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
Evidence to have on file (guidance, our wording)
- Resilience architecture patterns for critical services
- Failover and failback tested with evidence
NIST CSF 2.0 RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
Evidence to have on file (guidance, our wording)
- Recovery plan with triggers and decision rights
- Execution log of recovery activities
Application question Does the Applicant have a written disaster recovery plan?
ISO 27001:2022 A.5.29 Information security during disruption
Evidence to have on file (guidance, our wording)
- Business continuity plans that contain information security requirements and the controls, systems and tools needed during disruption
- A documented analysis of which security controls must be adapted during disruption and how
ISO 27001:2022 A.5.30 ICT readiness for business continuity
Evidence to have on file (guidance, our wording)
- The business impact analysis with prioritized activities, supporting ICT services and their RTOs, and RPOs for required information
- Selected ICT continuity strategies covering before, during and after disruption
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 CC9.1 Mitigating risks of business disruption
Evidence to have on file (guidance, our wording)
- Business continuity and disaster recovery plans covering the in-scope service
- Business impact analysis
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
NIST CSF 2.0 PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
Evidence to have on file (guidance, our wording)
- Resilience architecture patterns for critical services
- Failover and failback tested with evidence
NIST CSF 2.0 RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
Evidence to have on file (guidance, our wording)
- Recovery plan with triggers and decision rights
- Execution log of recovery activities
Application question Does the Applicant have a written incident response plan?
Answer options on this form: No / Yes.
ISO 27001:2022 A.5.24 Information security incident management planning and preparation
Evidence to have on file (guidance, our wording)
- An approved incident management plan and procedures covering evaluation, detection, classification, escalation, recovery, communication, evidence handling and post-incident review
- Incident management objectives and priorities agreed with management, including resolution time frames by severity
ISO 27001:2022 A.5.25 Assessment and decision on information security events
Evidence to have on file (guidance, our wording)
- The agreed incident categorization and prioritization scheme with criteria for declaring an incident and consequence levels
- Triage records showing each reported event assessed against the scheme
ISO 27001:2022 A.5.26 Response to information security incidents
Evidence to have on file (guidance, our wording)
- Documented incident response procedures or playbooks communicated to relevant parties
- Incident records showing containment, evidence collection, escalation, communication and formal closure
SOC 2 CC7.3 Evaluating security events to identify incidents
Evidence to have on file (guidance, our wording)
- Incident classification and severity criteria
- Security event log showing triage decisions
SOC 2 CC7.4 Responding to security incidents
Evidence to have on file (guidance, our wording)
- Incident response plan with roles and contact lists
- Incident tickets showing containment, eradication, recovery and communication
NIST CSF 2.0 RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared
Evidence to have on file (guidance, our wording)
- Incident response plan with third party invocation
- Retainer contract evidence for IR vendor
NIST CSF 2.0 RS.CO-02 Internal and external stakeholders are notified of incidents
Evidence to have on file (guidance, our wording)
- Incident notification policy and timing matrix
- Internal stakeholder communication templates
Application question Are copies of the business continuity/disaster recovery and incident response plans stored so that they will be accessible if the Applicant's network became completely unavailable?
ISO 27001:2022 A.5.29 Information security during disruption
Evidence to have on file (guidance, our wording)
- Business continuity plans that contain information security requirements and the controls, systems and tools needed during disruption
- A documented analysis of which security controls must be adapted during disruption and how
ISO 27001:2022 A.5.30 ICT readiness for business continuity
Evidence to have on file (guidance, our wording)
- The business impact analysis with prioritized activities, supporting ICT services and their RTOs, and RPOs for required information
- Selected ICT continuity strategies covering before, during and after disruption
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 CC9.1 Mitigating risks of business disruption
Evidence to have on file (guidance, our wording)
- Business continuity and disaster recovery plans covering the in-scope service
- Business impact analysis
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
NIST CSF 2.0 PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
Evidence to have on file (guidance, our wording)
- Resilience architecture patterns for critical services
- Failover and failback tested with evidence
NIST CSF 2.0 RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
Evidence to have on file (guidance, our wording)
- Recovery plan with triggers and decision rights
- Execution log of recovery activities
Application question Does the Applicant have a written document retention policy?
ISO 27001:2022 A.5.33 Protection of records
Evidence to have on file (guidance, our wording)
- Records handling guidelines covering storage, chain of custody, tamper prevention and disposal, aligned with the records management policy
- A retention schedule listing record types, retention periods, legal basis and permitted storage media
ISO 27001:2022 A.8.10 Information deletion
Evidence to have on file (guidance, our wording)
- The data retention topic-specific policy with deletion triggers per information type
- Configuration of automated deletion after retention periods or on data subject requests
ISO 27001:2022 A.7.14 Secure disposal or re-use of equipment
Evidence to have on file (guidance, our wording)
- A disposal and reuse procedure requiring verification that equipment is checked for storage media and sanitized
- Sanitization or destruction certificates identifying each device, method used and verifier
SOC 2 P4.2 Retaining personal information
Evidence to have on file (guidance, our wording)
- Retention schedule for personal information categories
- Evidence of automated retention enforcement
SOC 2 P4.3 Securely disposing of personal information
Evidence to have on file (guidance, our wording)
- Deletion request log with completion evidence
- Anonymisation or destruction procedure
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
Application question Does the Applicant have a written recordkeeping policy?
No held control answers this line.
Application question Do these policies enable the Applicant to identify all Personal Information subjected to the following activities during the last 12 months?
ISO 27001:2022 A.5.34 Privacy and protection of personal identifiable information (PII)
Evidence to have on file (guidance, our wording)
- The topic-specific privacy and PII protection policy and its communication to relevant parties
- Privacy procedures communicated to everyone who processes PII
ISO 27001:2022 A.5.31 Legal, statutory, regulatory and contractual requirements
Evidence to have on file (guidance, our wording)
- A register of applicable laws, regulations and contractual obligations for information security, with the countries covered, the approach to meeting each and a named responsible owner
- Records of periodic review of the register and of new or changed legislation identified
SOC 2 P1.1 Privacy notice to data subjects
Evidence to have on file (guidance, our wording)
- Published privacy notice with effective date and version history
- Evidence notice is presented at collection points (forms, apps)
SOC 2 P3.1 Collecting personal information consistent with objectives
Evidence to have on file (guidance, our wording)
- Data inventory showing purpose for each personal data field
- Privacy review of new collection forms or features
NIST CSF 2.0 GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Evidence to have on file (guidance, our wording)
- Legal and regulatory obligations register with owners
- Contractual security clauses summary across customer base
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
Application question Do these policies enable the Applicant to identify the source(s) from which Personal Information was collected, sold or shared?
ISO 27001:2022 A.5.34 Privacy and protection of personal identifiable information (PII)
Evidence to have on file (guidance, our wording)
- The topic-specific privacy and PII protection policy and its communication to relevant parties
- Privacy procedures communicated to everyone who processes PII
ISO 27001:2022 A.5.31 Legal, statutory, regulatory and contractual requirements
Evidence to have on file (guidance, our wording)
- A register of applicable laws, regulations and contractual obligations for information security, with the countries covered, the approach to meeting each and a named responsible owner
- Records of periodic review of the register and of new or changed legislation identified
SOC 2 P1.1 Privacy notice to data subjects
Evidence to have on file (guidance, our wording)
- Published privacy notice with effective date and version history
- Evidence notice is presented at collection points (forms, apps)
SOC 2 P3.1 Collecting personal information consistent with objectives
Evidence to have on file (guidance, our wording)
- Data inventory showing purpose for each personal data field
- Privacy review of new collection forms or features
NIST CSF 2.0 GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Evidence to have on file (guidance, our wording)
- Legal and regulatory obligations register with owners
- Contractual security clauses summary across customer base
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
Application question Do these policies enable the Applicant to identify the business purpose(s) for which Personal Information was collected, sold or shared?
ISO 27001:2022 A.5.34 Privacy and protection of personal identifiable information (PII)
Evidence to have on file (guidance, our wording)
- The topic-specific privacy and PII protection policy and its communication to relevant parties
- Privacy procedures communicated to everyone who processes PII
ISO 27001:2022 A.5.31 Legal, statutory, regulatory and contractual requirements
Evidence to have on file (guidance, our wording)
- A register of applicable laws, regulations and contractual obligations for information security, with the countries covered, the approach to meeting each and a named responsible owner
- Records of periodic review of the register and of new or changed legislation identified
SOC 2 P1.1 Privacy notice to data subjects
Evidence to have on file (guidance, our wording)
- Published privacy notice with effective date and version history
- Evidence notice is presented at collection points (forms, apps)
SOC 2 P3.1 Collecting personal information consistent with objectives
Evidence to have on file (guidance, our wording)
- Data inventory showing purpose for each personal data field
- Privacy review of new collection forms or features
NIST CSF 2.0 GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Evidence to have on file (guidance, our wording)
- Legal and regulatory obligations register with owners
- Contractual security clauses summary across customer base
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
Application question Does the Applicant employ any Intrusion Detection and Prevention solutions (IDP), e.g. anti- virus software?
ISO 27001:2022 A.8.15 Logging
Evidence to have on file (guidance, our wording)
- The topic-specific logging policy defining purposes, events to be logged, fields captured, retention and protection
ISO 27001:2022 A.8.16 Monitoring activities
Evidence to have on file (guidance, our wording)
- A documented monitoring scope covering network traffic, system access, configuration files, security tool logs, code integrity and resource use, with retention periods
- Baselines of normal behaviour for systems and user groups, and the detection rules built on them
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
SOC 2 CC7.2 Monitoring system components for anomalies
Evidence to have on file (guidance, our wording)
- Alert rules and sample of triaged alerts
- Threat intelligence sources in use
NIST CSF 2.0 DE.CM-01 Networks and network services are monitored to find potentially adverse events
Evidence to have on file (guidance, our wording)
- Network flow telemetry coverage map by segment
- IDS or NDR sensor inventory with placement diagram
NIST CSF 2.0 PR.PS-04 Log records are generated and made available for continuous monitoring
Evidence to have on file (guidance, our wording)
- Logging policy by data class and system tier
- Centralized log collection architecture
Application question Is Remote Desktop Protocol (RDP) enabled?
ISO 27001:2022 A.6.7 Remote working
Evidence to have on file (guidance, our wording)
- The topic-specific remote working policy defining conditions, permitted work, information classifications allowed and systems accessible
- Remote access configuration showing multi-factor authentication, secure channels or virtual desktops
ISO 27001:2022 A.8.20 Networks security
Evidence to have on file (guidance, our wording)
- Current network diagrams and device configuration backups for routers, switches, firewalls and wireless controllers
- Defined responsibilities and procedures for network device management, separated from system operations where appropriate
ISO 27001:2022 A.8.22 Segregation of networks
Evidence to have on file (guidance, our wording)
- Network segmentation design defining domains by trust, criticality, sensitivity or organizational unit, with the assessment that justified it
- Firewall or filtering router rules controlling traffic between domains, with rule review records
SOC 2 CC6.6 Protection against threats from outside the system boundary
Evidence to have on file (guidance, our wording)
- Firewall and security group rule sets with review evidence
- MFA enforced on VPN, remote and administrative access
NIST CSF 2.0 PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
Evidence to have on file (guidance, our wording)
- Network segmentation design with zones and trust levels
- Firewall and access control list governance
Application question Is RDP accessible externally?
ISO 27001:2022 A.6.7 Remote working
Evidence to have on file (guidance, our wording)
- The topic-specific remote working policy defining conditions, permitted work, information classifications allowed and systems accessible
- Remote access configuration showing multi-factor authentication, secure channels or virtual desktops
ISO 27001:2022 A.8.20 Networks security
Evidence to have on file (guidance, our wording)
- Current network diagrams and device configuration backups for routers, switches, firewalls and wireless controllers
- Defined responsibilities and procedures for network device management, separated from system operations where appropriate
ISO 27001:2022 A.8.22 Segregation of networks
Evidence to have on file (guidance, our wording)
- Network segmentation design defining domains by trust, criticality, sensitivity or organizational unit, with the assessment that justified it
- Firewall or filtering router rules controlling traffic between domains, with rule review records
SOC 2 CC6.6 Protection against threats from outside the system boundary
Evidence to have on file (guidance, our wording)
- Firewall and security group rule sets with review evidence
- MFA enforced on VPN, remote and administrative access
NIST CSF 2.0 PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
Evidence to have on file (guidance, our wording)
- Network segmentation design with zones and trust levels
- Firewall and access control list governance
Application question Is Multi Factor Authentication used for access?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
ISO 27001:2022 A.5.17 Authentication information
Evidence to have on file (guidance, our wording)
- Credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided
- Evidence that initial credentials are unique, delivered over protected channels and changed at first use
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
NIST CSF 2.0 PR.AA-03 Users, services, and hardware are authenticated
Evidence to have on file (guidance, our wording)
- Multi factor authentication coverage report
- Phishing resistant authentication rollout plan
Application question If remote access is available, does the Applicant implement MFA for all remote access?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
ISO 27001:2022 A.5.17 Authentication information
Evidence to have on file (guidance, our wording)
- Credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided
- Evidence that initial credentials are unique, delivered over protected channels and changed at first use
ISO 27001:2022 A.6.7 Remote working
Evidence to have on file (guidance, our wording)
- The topic-specific remote working policy defining conditions, permitted work, information classifications allowed and systems accessible
- Remote access configuration showing multi-factor authentication, secure channels or virtual desktops
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
SOC 2 CC6.6 Protection against threats from outside the system boundary
Evidence to have on file (guidance, our wording)
- Firewall and security group rule sets with review evidence
- MFA enforced on VPN, remote and administrative access
NIST CSF 2.0 PR.AA-03 Users, services, and hardware are authenticated
Evidence to have on file (guidance, our wording)
- Multi factor authentication coverage report
- Phishing resistant authentication rollout plan
NIST CSF 2.0 PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
Evidence to have on file (guidance, our wording)
- Network segmentation design with zones and trust levels
- Firewall and access control list governance
Application question Does the Applicant or its Managed Security Service Provider, if applicable, implement MFA for all administrator access?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
ISO 27001:2022 A.5.17 Authentication information
Evidence to have on file (guidance, our wording)
- Credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided
- Evidence that initial credentials are unique, delivered over protected channels and changed at first use
ISO 27001:2022 A.8.2 Privileged access rights
Evidence to have on file (guidance, our wording)
- An inventory of privileged accounts per system (operating systems, databases, applications, cloud consoles) mapped to named individuals
- Authorization records for each privileged grant with approver, justification and expiry
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
SOC 2 CC6.3 Role-based access, least privilege and segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
NIST CSF 2.0 PR.AA-03 Users, services, and hardware are authenticated
Evidence to have on file (guidance, our wording)
- Multi factor authentication coverage report
- Phishing resistant authentication rollout plan
NIST CSF 2.0 PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
Evidence to have on file (guidance, our wording)
- Access policy framework with role definitions
- Privileged access management deployment evidence
Application question What is the Applicant's Critical Patching Target?
ISO 27001:2022 A.8.8 Management of technical vulnerabilities
Evidence to have on file (guidance, our wording)
- A software asset inventory with vendor, product, version, deployment location and responsible owner
- Defined vulnerability management roles and a list of monitored vulnerability information sources
ISO 27001:2022 A.8.19 Installation of software on operational systems
Evidence to have on file (guidance, our wording)
- Procedures for installing and updating operational software, including authorization, testing and rollback planning
- Change and deployment records showing management authorization, successful testing and the administrator who performed the installation
ISO 27001:2022 A.8.29 Security testing in development and acceptance
Evidence to have on file (guidance, our wording)
- Security test plans with schedules, inputs, expected outputs, evaluation criteria and decisions, scaled to the system's importance and change impact
- Security test results covering authentication, access restriction, cryptography, secure coding and configuration
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
NIST CSF 2.0 ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded
Evidence to have on file (guidance, our wording)
- Vulnerability scanning coverage report
- Vulnerability triage workflow with severity SLAs
NIST CSF 2.0 PR.PS-02 Software is maintained, replaced, and removed commensurate with risk
Evidence to have on file (guidance, our wording)
- Software lifecycle policy with end of support tracking
- Patch management cadence and exception register
Application question Does the Applicant employ an Endpoint Detection and Response solution (EDR) that covers 100% of its environment?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
ISO 27001:2022 A.8.7 Protection against malware
Evidence to have on file (guidance, our wording)
- Anti-malware deployment and update status reports across endpoints, servers and gateways
- Application allowlisting and malicious website blocking configurations
ISO 27001:2022 A.8.1 User end point devices
Evidence to have on file (guidance, our wording)
- The topic-specific endpoint policy covering classification limits, registration, software restrictions, updates, network connection rules, encryption, malware protection, remote wipe, backup and port control
- Device management (MDM or endpoint management) reports showing enrolment, encryption, patch level, firewall and anti-malware status
SOC 2 CC6.8 Preventing and detecting unauthorised or malicious software
Evidence to have on file (guidance, our wording)
- Endpoint protection coverage report across servers and workstations
- Local administrator and software installation restrictions
NIST CSF 2.0 PR.PS-05 Installation and execution of unauthorized software are prevented
Evidence to have on file (guidance, our wording)
- Application allowlist policy and tooling configuration
- Endpoint protection deployment reports
NIST CSF 2.0 DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
Evidence to have on file (guidance, our wording)
- EDR coverage report by asset class
- File integrity monitoring baseline and drift alerts
Application question Does the Applicant employ any of the following SPF DKIM DMARC solutions?
ISO 27001:2022 A.8.23 Web filtering
Evidence to have on file (guidance, our wording)
- Current rules on safe, proper use of online resources
- Web filtering or secure web gateway configuration showing blocked categories such as malicious, phishing, command and control, illegal content and upload sites
ISO 27001:2022 A.8.7 Protection against malware
Evidence to have on file (guidance, our wording)
- Anti-malware deployment and update status reports across endpoints, servers and gateways
- Application allowlisting and malicious website blocking configurations
ISO 27001:2022 A.5.14 Information transfer
Evidence to have on file (guidance, our wording)
- The topic-specific information transfer policy and its communication record
- Transfer agreements with third parties covering recipient authentication, protection levels, incident liability and labelling
SOC 2 CC6.8 Preventing and detecting unauthorised or malicious software
Evidence to have on file (guidance, our wording)
- Endpoint protection coverage report across servers and workstations
- Local administrator and software installation restrictions
NIST CSF 2.0 PR.PS-05 Installation and execution of unauthorized software are prevented
Evidence to have on file (guidance, our wording)
- Application allowlist policy and tooling configuration
- Endpoint protection deployment reports
Application question Does the Applicant maintain a Normal Vulnerability Management patching target within 30 days?
ISO 27001:2022 A.8.8 Management of technical vulnerabilities
Evidence to have on file (guidance, our wording)
- A software asset inventory with vendor, product, version, deployment location and responsible owner
- Defined vulnerability management roles and a list of monitored vulnerability information sources
ISO 27001:2022 A.8.19 Installation of software on operational systems
Evidence to have on file (guidance, our wording)
- Procedures for installing and updating operational software, including authorization, testing and rollback planning
- Change and deployment records showing management authorization, successful testing and the administrator who performed the installation
ISO 27001:2022 A.8.29 Security testing in development and acceptance
Evidence to have on file (guidance, our wording)
- Security test plans with schedules, inputs, expected outputs, evaluation criteria and decisions, scaled to the system's importance and change impact
- Security test results covering authentication, access restriction, cryptography, secure coding and configuration
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
NIST CSF 2.0 ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded
Evidence to have on file (guidance, our wording)
- Vulnerability scanning coverage report
- Vulnerability triage workflow with severity SLAs
NIST CSF 2.0 PR.PS-02 Software is maintained, replaced, and removed commensurate with risk
Evidence to have on file (guidance, our wording)
- Software lifecycle policy with end of support tracking
- Patch management cadence and exception register
Application question Does the Applicant have a Security Operations Center (SOC) or utilize a Managed Security Service Provider?
ISO 27001:2022 A.8.15 Logging
Evidence to have on file (guidance, our wording)
- The topic-specific logging policy defining purposes, events to be logged, fields captured, retention and protection
ISO 27001:2022 A.8.16 Monitoring activities
Evidence to have on file (guidance, our wording)
- A documented monitoring scope covering network traffic, system access, configuration files, security tool logs, code integrity and resource use, with retention periods
- Baselines of normal behaviour for systems and user groups, and the detection rules built on them
ISO 27001:2022 A.5.19 Information security in supplier relationships
Evidence to have on file (guidance, our wording)
- The topic-specific supplier relationship policy and its communication record
- A supplier inventory categorized by type and by the information, services and infrastructure each can access
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
SOC 2 CC7.2 Monitoring system components for anomalies
Evidence to have on file (guidance, our wording)
- Alert rules and sample of triaged alerts
- Threat intelligence sources in use
NIST CSF 2.0 DE.CM-01 Networks and network services are monitored to find potentially adverse events
Evidence to have on file (guidance, our wording)
- Network flow telemetry coverage map by segment
- IDS or NDR sensor inventory with placement diagram
NIST CSF 2.0 PR.PS-04 Log records are generated and made available for continuous monitoring
Evidence to have on file (guidance, our wording)
- Logging policy by data class and system tier
- Centralized log collection architecture
Application question If yes, is it monitored 24/7?
ISO 27001:2022 A.8.15 Logging
Evidence to have on file (guidance, our wording)
- The topic-specific logging policy defining purposes, events to be logged, fields captured, retention and protection
ISO 27001:2022 A.8.16 Monitoring activities
Evidence to have on file (guidance, our wording)
- A documented monitoring scope covering network traffic, system access, configuration files, security tool logs, code integrity and resource use, with retention periods
- Baselines of normal behaviour for systems and user groups, and the detection rules built on them
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
SOC 2 CC7.2 Monitoring system components for anomalies
Evidence to have on file (guidance, our wording)
- Alert rules and sample of triaged alerts
- Threat intelligence sources in use
NIST CSF 2.0 DE.CM-01 Networks and network services are monitored to find potentially adverse events
Evidence to have on file (guidance, our wording)
- Network flow telemetry coverage map by segment
- IDS or NDR sensor inventory with placement diagram
NIST CSF 2.0 PR.PS-04 Log records are generated and made available for continuous monitoring
Evidence to have on file (guidance, our wording)
- Logging policy by data class and system tier
- Centralized log collection architecture
Application question Does the Applicant have any End-of-Life software or systems present in its environment?
ISO 27001:2022 A.8.8 Management of technical vulnerabilities
Evidence to have on file (guidance, our wording)
- A software asset inventory with vendor, product, version, deployment location and responsible owner
- Defined vulnerability management roles and a list of monitored vulnerability information sources
ISO 27001:2022 A.8.19 Installation of software on operational systems
Evidence to have on file (guidance, our wording)
- Procedures for installing and updating operational software, including authorization, testing and rollback planning
- Change and deployment records showing management authorization, successful testing and the administrator who performed the installation
ISO 27001:2022 A.8.29 Security testing in development and acceptance
Evidence to have on file (guidance, our wording)
- Security test plans with schedules, inputs, expected outputs, evaluation criteria and decisions, scaled to the system's importance and change impact
- Security test results covering authentication, access restriction, cryptography, secure coding and configuration
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
NIST CSF 2.0 ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded
Evidence to have on file (guidance, our wording)
- Vulnerability scanning coverage report
- Vulnerability triage workflow with severity SLAs
NIST CSF 2.0 PR.PS-02 Software is maintained, replaced, and removed commensurate with risk
Evidence to have on file (guidance, our wording)
- Software lifecycle policy with end of support tracking
- Patch management cadence and exception register
Application question Are these policies, practices and solutions applied to the Firewalls Intrusion detection and following?
ISO 27001:2022 A.8.15 Logging
Evidence to have on file (guidance, our wording)
- The topic-specific logging policy defining purposes, events to be logged, fields captured, retention and protection
ISO 27001:2022 A.8.16 Monitoring activities
Evidence to have on file (guidance, our wording)
- A documented monitoring scope covering network traffic, system access, configuration files, security tool logs, code integrity and resource use, with retention periods
- Baselines of normal behaviour for systems and user groups, and the detection rules built on them
ISO 27001:2022 A.8.20 Networks security
Evidence to have on file (guidance, our wording)
- Current network diagrams and device configuration backups for routers, switches, firewalls and wireless controllers
- Defined responsibilities and procedures for network device management, separated from system operations where appropriate
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
SOC 2 CC7.2 Monitoring system components for anomalies
Evidence to have on file (guidance, our wording)
- Alert rules and sample of triaged alerts
- Threat intelligence sources in use
NIST CSF 2.0 DE.CM-01 Networks and network services are monitored to find potentially adverse events
Evidence to have on file (guidance, our wording)
- Network flow telemetry coverage map by segment
- IDS or NDR sensor inventory with placement diagram
NIST CSF 2.0 PR.PS-04 Log records are generated and made available for continuous monitoring
Evidence to have on file (guidance, our wording)
- Logging policy by data class and system tier
- Centralized log collection architecture
Application question Is the local logging performed on a per-host basis?
ISO 27001:2022 A.8.15 Logging
Evidence to have on file (guidance, our wording)
- The topic-specific logging policy defining purposes, events to be logged, fields captured, retention and protection
ISO 27001:2022 A.8.16 Monitoring activities
Evidence to have on file (guidance, our wording)
- A documented monitoring scope covering network traffic, system access, configuration files, security tool logs, code integrity and resource use, with retention periods
- Baselines of normal behaviour for systems and user groups, and the detection rules built on them
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
SOC 2 CC7.2 Monitoring system components for anomalies
Evidence to have on file (guidance, our wording)
- Alert rules and sample of triaged alerts
- Threat intelligence sources in use
NIST CSF 2.0 DE.CM-01 Networks and network services are monitored to find potentially adverse events
Evidence to have on file (guidance, our wording)
- Network flow telemetry coverage map by segment
- IDS or NDR sensor inventory with placement diagram
NIST CSF 2.0 PR.PS-04 Log records are generated and made available for continuous monitoring
Evidence to have on file (guidance, our wording)
- Logging policy by data class and system tier
- Centralized log collection architecture
Application question Are local logs centralized into a log management system?
ISO 27001:2022 A.8.15 Logging
Evidence to have on file (guidance, our wording)
- The topic-specific logging policy defining purposes, events to be logged, fields captured, retention and protection
ISO 27001:2022 A.8.16 Monitoring activities
Evidence to have on file (guidance, our wording)
- A documented monitoring scope covering network traffic, system access, configuration files, security tool logs, code integrity and resource use, with retention periods
- Baselines of normal behaviour for systems and user groups, and the detection rules built on them
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
SOC 2 CC7.2 Monitoring system components for anomalies
Evidence to have on file (guidance, our wording)
- Alert rules and sample of triaged alerts
- Threat intelligence sources in use
NIST CSF 2.0 DE.CM-01 Networks and network services are monitored to find potentially adverse events
Evidence to have on file (guidance, our wording)
- Network flow telemetry coverage map by segment
- IDS or NDR sensor inventory with placement diagram
NIST CSF 2.0 PR.PS-04 Log records are generated and made available for continuous monitoring
Evidence to have on file (guidance, our wording)
- Logging policy by data class and system tier
- Centralized log collection architecture
Application question How frequently are logs audited?
ISO 27001:2022 A.8.15 Logging
Evidence to have on file (guidance, our wording)
- The topic-specific logging policy defining purposes, events to be logged, fields captured, retention and protection
ISO 27001:2022 A.8.16 Monitoring activities
Evidence to have on file (guidance, our wording)
- A documented monitoring scope covering network traffic, system access, configuration files, security tool logs, code integrity and resource use, with retention periods
- Baselines of normal behaviour for systems and user groups, and the detection rules built on them
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
SOC 2 CC7.2 Monitoring system components for anomalies
Evidence to have on file (guidance, our wording)
- Alert rules and sample of triaged alerts
- Threat intelligence sources in use
NIST CSF 2.0 DE.CM-01 Networks and network services are monitored to find potentially adverse events
Evidence to have on file (guidance, our wording)
- Network flow telemetry coverage map by segment
- IDS or NDR sensor inventory with placement diagram
NIST CSF 2.0 PR.PS-04 Log records are generated and made available for continuous monitoring
Evidence to have on file (guidance, our wording)
- Logging policy by data class and system tier
- Centralized log collection architecture
Application question How long are audit logs maintained?
ISO 27001:2022 A.8.15 Logging
Evidence to have on file (guidance, our wording)
- The topic-specific logging policy defining purposes, events to be logged, fields captured, retention and protection
ISO 27001:2022 A.8.16 Monitoring activities
Evidence to have on file (guidance, our wording)
- A documented monitoring scope covering network traffic, system access, configuration files, security tool logs, code integrity and resource use, with retention periods
- Baselines of normal behaviour for systems and user groups, and the detection rules built on them
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
SOC 2 CC7.2 Monitoring system components for anomalies
Evidence to have on file (guidance, our wording)
- Alert rules and sample of triaged alerts
- Threat intelligence sources in use
NIST CSF 2.0 DE.CM-01 Networks and network services are monitored to find potentially adverse events
Evidence to have on file (guidance, our wording)
- Network flow telemetry coverage map by segment
- IDS or NDR sensor inventory with placement diagram
NIST CSF 2.0 PR.PS-04 Log records are generated and made available for continuous monitoring
Evidence to have on file (guidance, our wording)
- Logging policy by data class and system tier
- Centralized log collection architecture
Application question Does the Applicant employ mandatory encryption to protect the following?
ISO 27001:2022 A.8.24 Use of cryptography
Evidence to have on file (guidance, our wording)
- The topic-specific cryptography policy with approved algorithms, key lengths, protocols and usage by information classification
- Evidence of encryption on endpoints, removable media and data in transit, aligned with the policy
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
NIST CSF 2.0 PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected
Evidence to have on file (guidance, our wording)
- TLS configuration standards and scan results
- VPN and zero trust network access policy
Application question Does the Applicant conduct mandatory information security, phishing and privacy training for employees and contractors at least quarterly?
ISO 27001:2022 A.8.23 Web filtering
Evidence to have on file (guidance, our wording)
- Current rules on safe, proper use of online resources
- Web filtering or secure web gateway configuration showing blocked categories such as malicious, phishing, command and control, illegal content and upload sites
ISO 27001:2022 A.8.7 Protection against malware
Evidence to have on file (guidance, our wording)
- Anti-malware deployment and update status reports across endpoints, servers and gateways
- Application allowlisting and malicious website blocking configurations
ISO 27001:2022 A.5.14 Information transfer
Evidence to have on file (guidance, our wording)
- The topic-specific information transfer policy and its communication record
- Transfer agreements with third parties covering recipient authentication, protection levels, incident liability and labelling
SOC 2 CC6.8 Preventing and detecting unauthorised or malicious software
Evidence to have on file (guidance, our wording)
- Endpoint protection coverage report across servers and workstations
- Local administrator and software installation restrictions
SOC 2 CC1.4 Attracting, developing and retaining competent people (COSO principle 4)
Evidence to have on file (guidance, our wording)
- Background check policy and completed checks for a sample of new hires and contractors
- Role competency requirements and performance review records
NIST CSF 2.0 PR.PS-05 Installation and execution of unauthorized software are prevented
Evidence to have on file (guidance, our wording)
- Application allowlist policy and tooling configuration
- Endpoint protection deployment reports
NIST CSF 2.0 PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
Evidence to have on file (guidance, our wording)
- Security awareness program curriculum
- Completion records by population
Application question Are Phishing Simulations conducted for all employees?
ISO 27001:2022 A.8.23 Web filtering
Evidence to have on file (guidance, our wording)
- Current rules on safe, proper use of online resources
- Web filtering or secure web gateway configuration showing blocked categories such as malicious, phishing, command and control, illegal content and upload sites
ISO 27001:2022 A.8.7 Protection against malware
Evidence to have on file (guidance, our wording)
- Anti-malware deployment and update status reports across endpoints, servers and gateways
- Application allowlisting and malicious website blocking configurations
ISO 27001:2022 A.5.14 Information transfer
Evidence to have on file (guidance, our wording)
- The topic-specific information transfer policy and its communication record
- Transfer agreements with third parties covering recipient authentication, protection levels, incident liability and labelling
SOC 2 CC6.8 Preventing and detecting unauthorised or malicious software
Evidence to have on file (guidance, our wording)
- Endpoint protection coverage report across servers and workstations
- Local administrator and software installation restrictions
SOC 2 CC1.4 Attracting, developing and retaining competent people (COSO principle 4)
Evidence to have on file (guidance, our wording)
- Background check policy and completed checks for a sample of new hires and contractors
- Role competency requirements and performance review records
NIST CSF 2.0 PR.PS-05 Installation and execution of unauthorized software are prevented
Evidence to have on file (guidance, our wording)
- Application allowlist policy and tooling configuration
- Endpoint protection deployment reports
NIST CSF 2.0 PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
Evidence to have on file (guidance, our wording)
- Security awareness program curriculum
- Completion records by population
Application question Does the Applicant have a report phishing email add-in enabled for all email users?
ISO 27001:2022 A.8.23 Web filtering
Evidence to have on file (guidance, our wording)
- Current rules on safe, proper use of online resources
- Web filtering or secure web gateway configuration showing blocked categories such as malicious, phishing, command and control, illegal content and upload sites
ISO 27001:2022 A.8.7 Protection against malware
Evidence to have on file (guidance, our wording)
- Anti-malware deployment and update status reports across endpoints, servers and gateways
- Application allowlisting and malicious website blocking configurations
ISO 27001:2022 A.5.14 Information transfer
Evidence to have on file (guidance, our wording)
- The topic-specific information transfer policy and its communication record
- Transfer agreements with third parties covering recipient authentication, protection levels, incident liability and labelling
SOC 2 CC6.8 Preventing and detecting unauthorised or malicious software
Evidence to have on file (guidance, our wording)
- Endpoint protection coverage report across servers and workstations
- Local administrator and software installation restrictions
SOC 2 CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14)
Evidence to have on file (guidance, our wording)
- Security awareness training content and completion records
- Published information security policies accessible to staff with change notices
NIST CSF 2.0 PR.PS-05 Installation and execution of unauthorized software are prevented
Evidence to have on file (guidance, our wording)
- Application allowlist policy and tooling configuration
- Endpoint protection deployment reports
NIST CSF 2.0 PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
Evidence to have on file (guidance, our wording)
- Security awareness program curriculum
- Completion records by population
Application question Does the Applicant conduct regular backup of data?
ISO 27001:2022 A.8.13 Information backup
Evidence to have on file (guidance, our wording)
- The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO
- Backup job monitoring reports with evidence that failed jobs were investigated and rerun
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
SOC 2 A1.3 Testing recovery plan procedures
Evidence to have on file (guidance, our wording)
- Disaster recovery or continuity test plan and results in the period
- Backup restore test records with verification of completeness
NIST CSF 2.0 PR.DS-11 Backups of data are created, protected, maintained, and tested
Evidence to have on file (guidance, our wording)
- Backup policy with frequency and retention
- Backup integrity test reports
Application question Is Critical Information backed up at least?
ISO 27001:2022 A.8.13 Information backup
Evidence to have on file (guidance, our wording)
- The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO
- Backup job monitoring reports with evidence that failed jobs were investigated and rerun
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
SOC 2 A1.3 Testing recovery plan procedures
Evidence to have on file (guidance, our wording)
- Disaster recovery or continuity test plan and results in the period
- Backup restore test records with verification of completeness
NIST CSF 2.0 PR.DS-11 Backups of data are created, protected, maintained, and tested
Evidence to have on file (guidance, our wording)
- Backup policy with frequency and retention
- Backup integrity test reports
Application question Which of the following does the Applicant utilize Tapes Disks Cloud for backups?
ISO 27001:2022 A.8.13 Information backup
Evidence to have on file (guidance, our wording)
- The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO
- Backup job monitoring reports with evidence that failed jobs were investigated and rerun
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
SOC 2 A1.3 Testing recovery plan procedures
Evidence to have on file (guidance, our wording)
- Disaster recovery or continuity test plan and results in the period
- Backup restore test records with verification of completeness
NIST CSF 2.0 PR.DS-11 Backups of data are created, protected, maintained, and tested
Evidence to have on file (guidance, our wording)
- Backup policy with frequency and retention
- Backup integrity test reports
Application question Where are backups stored?
ISO 27001:2022 A.8.13 Information backup
Evidence to have on file (guidance, our wording)
- The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO
- Backup job monitoring reports with evidence that failed jobs were investigated and rerun
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
SOC 2 A1.3 Testing recovery plan procedures
Evidence to have on file (guidance, our wording)
- Disaster recovery or continuity test plan and results in the period
- Backup restore test records with verification of completeness
NIST CSF 2.0 PR.DS-11 Backups of data are created, protected, maintained, and tested
Evidence to have on file (guidance, our wording)
- Backup policy with frequency and retention
- Backup integrity test reports
Application question Are backups subject to the following measures?
ISO 27001:2022 A.8.13 Information backup
Evidence to have on file (guidance, our wording)
- The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO
- Backup job monitoring reports with evidence that failed jobs were investigated and rerun
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
SOC 2 A1.3 Testing recovery plan procedures
Evidence to have on file (guidance, our wording)
- Disaster recovery or continuity test plan and results in the period
- Backup restore test records with verification of completeness
NIST CSF 2.0 PR.DS-11 Backups of data are created, protected, maintained, and tested
Evidence to have on file (guidance, our wording)
- Backup policy with frequency and retention
- Backup integrity test reports
Application question Is full recovery from a backup tested at least annually?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
ISO 27001:2022 A.8.13 Information backup
Evidence to have on file (guidance, our wording)
- The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO
- Backup job monitoring reports with evidence that failed jobs were investigated and rerun
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
ISO 27001:2022 A.5.29 Information security during disruption
Evidence to have on file (guidance, our wording)
- Business continuity plans that contain information security requirements and the controls, systems and tools needed during disruption
- A documented analysis of which security controls must be adapted during disruption and how
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
SOC 2 A1.3 Testing recovery plan procedures
Evidence to have on file (guidance, our wording)
- Disaster recovery or continuity test plan and results in the period
- Backup restore test records with verification of completeness
NIST CSF 2.0 PR.DS-11 Backups of data are created, protected, maintained, and tested
Evidence to have on file (guidance, our wording)
- Backup policy with frequency and retention
- Backup integrity test reports
NIST CSF 2.0 PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
Evidence to have on file (guidance, our wording)
- Resilience architecture patterns for critical services
- Failover and failback tested with evidence
Application question In the event of an interruption of the Applicant's network, at most how long is the Applicant's recovery time objective (RTO) for critical systems, applications, and processes?
ISO 27001:2022 A.5.29 Information security during disruption
Evidence to have on file (guidance, our wording)
- Business continuity plans that contain information security requirements and the controls, systems and tools needed during disruption
- A documented analysis of which security controls must be adapted during disruption and how
ISO 27001:2022 A.5.30 ICT readiness for business continuity
Evidence to have on file (guidance, our wording)
- The business impact analysis with prioritized activities, supporting ICT services and their RTOs, and RPOs for required information
- Selected ICT continuity strategies covering before, during and after disruption
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 CC9.1 Mitigating risks of business disruption
Evidence to have on file (guidance, our wording)
- Business continuity and disaster recovery plans covering the in-scope service
- Business impact analysis
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
NIST CSF 2.0 PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
Evidence to have on file (guidance, our wording)
- Resilience architecture patterns for critical services
- Failover and failback tested with evidence
NIST CSF 2.0 RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
Evidence to have on file (guidance, our wording)
- Recovery plan with triggers and decision rights
- Execution log of recovery activities
Application question Has the Applicant's RTO been validated in the last 12 months?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question In the event Critical Information, or critical systems, applications or processes became unavailable, at most how long would it take to materially interrupt the Applicant's business?
No held control answers this line.
Application question Are any of the Applicant's products or services used in the collection, use, processing, sharing, sale, profit from, possession, retention and destruction of Biometric Information?
ISO 27001:2022 A.5.33 Protection of records
Evidence to have on file (guidance, our wording)
- Records handling guidelines covering storage, chain of custody, tamper prevention and disposal, aligned with the records management policy
- A retention schedule listing record types, retention periods, legal basis and permitted storage media
ISO 27001:2022 A.8.10 Information deletion
Evidence to have on file (guidance, our wording)
- The data retention topic-specific policy with deletion triggers per information type
- Configuration of automated deletion after retention periods or on data subject requests
ISO 27001:2022 A.7.14 Secure disposal or re-use of equipment
Evidence to have on file (guidance, our wording)
- A disposal and reuse procedure requiring verification that equipment is checked for storage media and sanitized
- Sanitization or destruction certificates identifying each device, method used and verifier
SOC 2 P4.2 Retaining personal information
Evidence to have on file (guidance, our wording)
- Retention schedule for personal information categories
- Evidence of automated retention enforcement
SOC 2 P4.3 Securely disposing of personal information
Evidence to have on file (guidance, our wording)
- Deletion request log with completion evidence
- Anonymisation or destruction procedure
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
NIST CSF 2.0 GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Evidence to have on file (guidance, our wording)
- Legal and regulatory obligations register with owners
- Contractual security clauses summary across customer base
Application question What is the daily average number of transactions transferring first party funds?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question What is the average value transferred each day?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question What is the average value of any one transfer?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does the Applicant employ a protocol to confirm transfer instructions including a call back, email or an alternative method of authenticating the instruction?
ISO 27001:2022 A.5.3 Segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
ISO 27001:2022 A.6.3 Information security awareness, education and training
Evidence to have on file (guidance, our wording)
- A documented awareness, education and training programme aligned with the policies and planned by role, including external personnel
- Completion records for initial training of new starters and role changers and for periodic refreshers
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
SOC 2 CC6.3 Role-based access, least privilege and segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
SOC 2 CC3.3 Considering fraud risk (COSO principle 8)
Evidence to have on file (guidance, our wording)
- Fraud risk assessment or fraud section of the enterprise risk assessment
- Analysis of privileged access and data misuse scenarios
NIST CSF 2.0 PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
Evidence to have on file (guidance, our wording)
- Access policy framework with role definitions
- Privileged access management deployment evidence
Application question Does the Applicant employ a protocol requiring more than one or next-level approval?
ISO 27001:2022 A.5.3 Segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
ISO 27001:2022 A.6.3 Information security awareness, education and training
Evidence to have on file (guidance, our wording)
- A documented awareness, education and training programme aligned with the policies and planned by role, including external personnel
- Completion records for initial training of new starters and role changers and for periodic refreshers
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
SOC 2 CC6.3 Role-based access, least privilege and segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
SOC 2 CC3.3 Considering fraud risk (COSO principle 8)
Evidence to have on file (guidance, our wording)
- Fraud risk assessment or fraud section of the enterprise risk assessment
- Analysis of privileged access and data misuse scenarios
NIST CSF 2.0 PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
Evidence to have on file (guidance, our wording)
- Access policy framework with role definitions
- Privileged access management deployment evidence
Application question Does the Applicant conduct anti-fraud training of employees at least annually?
ISO 27001:2022 A.6.3 Information security awareness, education and training
Evidence to have on file (guidance, our wording)
- A documented awareness, education and training programme aligned with the policies and planned by role, including external personnel
- Completion records for initial training of new starters and role changers and for periodic refreshers
ISO 27001:2022 A.5.3 Segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
SOC 2 CC1.4 Attracting, developing and retaining competent people (COSO principle 4)
Evidence to have on file (guidance, our wording)
- Background check policy and completed checks for a sample of new hires and contractors
- Role competency requirements and performance review records
SOC 2 CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14)
Evidence to have on file (guidance, our wording)
- Security awareness training content and completion records
- Published information security policies accessible to staff with change notices
NIST CSF 2.0 PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
Evidence to have on file (guidance, our wording)
- Security awareness program curriculum
- Completion records by population
NIST CSF 2.0 PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
Evidence to have on file (guidance, our wording)
- Access policy framework with role definitions
- Privileged access management deployment evidence
Application question During the last 3 years, has the Applicant experienced any fraudulent transfer or transfer instruction, social engineering, business email compromise or phishing attack?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question What type of content does the Applicant publish or post on its website?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Is the content reviewed by an attorney prior to publishing or posting on any website owned or operated by the Applicant or its social media pages or under its accounts on third party websites?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does the attorney's review screen for the following liability risks?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does the Applicant have a process for handling allegations that content created, displayed or published by the Applicant that is defamatory or disparaging or infringes third party copyright or privacy rights?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does the Applicant have a written policy for handling requests for retractions or corrections?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does the Applicant have a written policy for checking the accuracy and originality of content created by or on behalf of the Applicant?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does the Applicant have written agreements with all third parties providing advertising services or providing content to or on behalf of the Applicant?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Do all the written agreements require the third party to defend or indemnify the Applicant against liability arising out of the third party's services or content?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Do all the written agreements require the third party to procure insurance applicable to the Applicant in the event of liability arising out of the third party's services or content?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Do any of the written agreements limit the third party's liability arising out of the third party's services or content?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question During the last 3 years, has the Applicant experienced any failure to protect Personal Information or Corporate Information in the Applicant's or its Service Provider's care/custody/control, or for which the Applicant is legally responsible?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question During the last 3 years, has the Applicant received notice of any claim, complaint or demand alleging infringement of a privacy right or failure to comply with a privacy regulation pertaining to Personal Information in the Applicant's or its Service Provider's care/custody/control, or for which the Applicant is legally responsible?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question During the last 3 years, has the Applicant experienced any failure of the security of its network?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question During the last 3 years, has the Applicant received notice of any claim, complaint or demand alleging or arising out of any failure of the security of its network?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question During the last 3 years, has the Applicant been the subject of any civil or administrative proceeding, civil investigation or subpoena or request for information by a government agency or data protection or other organization having authority to enforce a privacy regulation authority?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does any director, officer or employee of the Applicant, its parent company or any of its subsidiaries or affiliates have knowledge or information about any fact, circumstances, incident, event or transaction that may give rise to a claim, complaint or demand alleging a privacy or security incident or media liability?
Prior-knowledge question. This asks whether the applicant knows of any circumstance that could give rise to a claim. A wrong answer here is the classic route to a prior-knowledge exclusion or rescission, so it is the highest-consequence line on the form, not a line to leave unread. It reaches no control by itself: it is about what the applicant knows, not a control to hold.
No held control answers this line.
Application question Have any of these matters been reported to another insurer?
This is an attestation question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question In response to any of these matters, has the Applicant commenced or completed any change to its network and information security and handling practices, or other changes, to remediate the effects of the matter or remove a vulnerability that gave rise to the matter?
ISO 27001:2022 A.8.8 Management of technical vulnerabilities
Evidence to have on file (guidance, our wording)
- A software asset inventory with vendor, product, version, deployment location and responsible owner
- Defined vulnerability management roles and a list of monitored vulnerability information sources
ISO 27001:2022 A.8.19 Installation of software on operational systems
Evidence to have on file (guidance, our wording)
- Procedures for installing and updating operational software, including authorization, testing and rollback planning
- Change and deployment records showing management authorization, successful testing and the administrator who performed the installation
ISO 27001:2022 A.8.29 Security testing in development and acceptance
Evidence to have on file (guidance, our wording)
- Security test plans with schedules, inputs, expected outputs, evaluation criteria and decisions, scaled to the system's importance and change impact
- Security test results covering authentication, access restriction, cryptography, secure coding and configuration
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
NIST CSF 2.0 ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded
Evidence to have on file (guidance, our wording)
- Vulnerability scanning coverage report
- Vulnerability triage workflow with severity SLAs
NIST CSF 2.0 PR.PS-02 Software is maintained, replaced, and removed commensurate with risk
Evidence to have on file (guidance, our wording)
- Software lifecycle policy with end of support tracking
- Patch management cadence and exception register
Controls not asked in this held document (214)
None of this held document's questions reach 214 of the 290 held controls (for example A.5.5, A.5.6, A.5.7, A.5.8, A.5.9, A.5.10, A.5.11, A.5.12). That is a fact about this held document, not about what the carrier underwrites on: a carrier's fuller forms and supplements ask controls this summary does not, multi-factor authentication, offline backups and patching among them. A control here is not asserted as required, and not asserted as not required.