Everest Insurance cyber policy application, held
The questions of the Everest Cyber Elevation Insurance Policy New Business Application, held and mapped to the ISO 27001:2022 controls, the SOC 2 criteria and the NIST CSF 2.0 outcomes each one reaches. The source document (read 2026-10-11). The date shown is the date this copy was read, not a version the form itself states. This page quotes only the question each mapped row needs and states its source; it does not publish the carrier's form. A complete form would be held only under a stated policy for copyrighted forms. Everest Insurance is a source document, never a customer.
This document's questions reach 84 of 290 held controls. Whether an applicant is offered cover is the carrier’s underwriting decision. 2 questions here are flagged knockout (a "no" is a common decline point) and 2 flagged warranty (an answer the carrier relies on, that can affect cover if wrong).
An answer about an existing state of affairs can be relied on by the carrier, but in Australia and the United Kingdom a statement by the insured is a representation, not a warranty (the Insurance Contracts Act and the Insurance Act), and the position varies by US state.
Application question In the past 24 months (or in the next 12 months), has the Applicant experienced (or is the Applicant contemplating) any actual, negotiated, or attempted mergers, acquisitions, or divestments?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Experienced a system breach, network outage lasting longer than 4 hours, hacking incident, data theft, cyber extortion threat, or denial of service attack?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Been subject to any government action, investigation or subpoena regarding any alleged violation of a privacy law or regulation?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Has the Applicant ever been subject to any complaints, including cease and desist orders, concerning the content of your website, advertising material, social media, or other publications or broadcasts?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question For Technology Errors & Omissions Liability Coverage Has the Applicant received any complaints concerning products or services provided by the Applicant or anyone else on the Applicant's behalf?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does the Applicant have a Chief Information Security Officer (CISO) or functional equivalent?
ISO 27001:2022 A.5.1 Policies for information security
Evidence to have on file (guidance, our wording)
- The top-level information security policy with top management approval, covering the definition, objectives or objective-setting framework, principles, commitments to requirements and continual improvement, role assignments and the exceptions procedure
- The register of topic-specific policies with an owner, approving manager and version for each
ISO 27001:2022 A.5.2 Information security roles and responsibilities
Evidence to have on file (guidance, our wording)
- A documented roles and responsibilities matrix covering asset protection, specific security processes, risk management and residual risk acceptance, and user duties
- Named risk owners with evidence that they accepted residual risks
ISO 27001:2022 A.5.4 Management responsibilities
Evidence to have on file (guidance, our wording)
- Evidence that security briefings on roles and responsibilities occur before access is granted, such as onboarding checklists tied to access provisioning
- Role-specific guidance documents setting out security expectations
SOC 2 CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3)
Evidence to have on file (guidance, our wording)
- Current organisation chart including security, IT operations, compliance and privacy functions
- Job descriptions or RACI naming security and privacy responsibilities
SOC 2 CC5.3 Deploying controls through policies and procedures (COSO principle 12)
Evidence to have on file (guidance, our wording)
- Approved information security policy set with owners and review dates
- Evidence of annual policy review and approval
NIST CSF 2.0 GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
Evidence to have on file (guidance, our wording)
- Cybersecurity risk management policy approved by leadership
- Policy linkage matrix to standards and procedures
NIST CSF 2.0 GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
Evidence to have on file (guidance, our wording)
- Board cyber accountability charter
- Executive cyber scorecard with named owners
Application question Does the firm have a documented Incident Response Plan?
ISO 27001:2022 A.5.24 Information security incident management planning and preparation
Evidence to have on file (guidance, our wording)
- An approved incident management plan and procedures covering evaluation, detection, classification, escalation, recovery, communication, evidence handling and post-incident review
- Incident management objectives and priorities agreed with management, including resolution time frames by severity
ISO 27001:2022 A.5.25 Assessment and decision on information security events
Evidence to have on file (guidance, our wording)
- The agreed incident categorization and prioritization scheme with criteria for declaring an incident and consequence levels
- Triage records showing each reported event assessed against the scheme
ISO 27001:2022 A.5.26 Response to information security incidents
Evidence to have on file (guidance, our wording)
- Documented incident response procedures or playbooks communicated to relevant parties
- Incident records showing containment, evidence collection, escalation, communication and formal closure
SOC 2 CC7.3 Evaluating security events to identify incidents
Evidence to have on file (guidance, our wording)
- Incident classification and severity criteria
- Security event log showing triage decisions
SOC 2 CC7.4 Responding to security incidents
Evidence to have on file (guidance, our wording)
- Incident response plan with roles and contact lists
- Incident tickets showing containment, eradication, recovery and communication
NIST CSF 2.0 RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared
Evidence to have on file (guidance, our wording)
- Incident response plan with third party invocation
- Retainer contract evidence for IR vendor
NIST CSF 2.0 RS.CO-02 Internal and external stakeholders are notified of incidents
Evidence to have on file (guidance, our wording)
- Incident notification policy and timing matrix
- Internal stakeholder communication templates
Application question If "Yes", have any table top exercises for the Incident Response Plan been conducted in the last 24 months?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does the Applicant have documented business continuity and disaster recovery plans?
ISO 27001:2022 A.5.29 Information security during disruption
Evidence to have on file (guidance, our wording)
- Business continuity plans that contain information security requirements and the controls, systems and tools needed during disruption
- A documented analysis of which security controls must be adapted during disruption and how
ISO 27001:2022 A.5.30 ICT readiness for business continuity
Evidence to have on file (guidance, our wording)
- The business impact analysis with prioritized activities, supporting ICT services and their RTOs, and RPOs for required information
- Selected ICT continuity strategies covering before, during and after disruption
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 CC9.1 Mitigating risks of business disruption
Evidence to have on file (guidance, our wording)
- Business continuity and disaster recovery plans covering the in-scope service
- Business impact analysis
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
NIST CSF 2.0 PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
Evidence to have on file (guidance, our wording)
- Resilience architecture patterns for critical services
- Failover and failback tested with evidence
NIST CSF 2.0 RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
Evidence to have on file (guidance, our wording)
- Recovery plan with triggers and decision rights
- Execution log of recovery activities
Application question If "Yes", have they been tested in the prior 12 months?
Answer options on this form: No / Yes.
No held control answers this line.
Application question Does the Applicant's privacy policy allow for the sharing of Confidential Information with third parties?
Answer options on this form: No / Yes.
ISO 27001:2022 A.5.34 Privacy and protection of personal identifiable information (PII)
Evidence to have on file (guidance, our wording)
- The topic-specific privacy and PII protection policy and its communication to relevant parties
- Privacy procedures communicated to everyone who processes PII
ISO 27001:2022 A.5.31 Legal, statutory, regulatory and contractual requirements
Evidence to have on file (guidance, our wording)
- A register of applicable laws, regulations and contractual obligations for information security, with the countries covered, the approach to meeting each and a named responsible owner
- Records of periodic review of the register and of new or changed legislation identified
ISO 27001:2022 A.5.19 Information security in supplier relationships
Evidence to have on file (guidance, our wording)
- The topic-specific supplier relationship policy and its communication record
- A supplier inventory categorized by type and by the information, services and infrastructure each can access
SOC 2 P1.1 Privacy notice to data subjects
Evidence to have on file (guidance, our wording)
- Published privacy notice with effective date and version history
- Evidence notice is presented at collection points (forms, apps)
SOC 2 P3.1 Collecting personal information consistent with objectives
Evidence to have on file (guidance, our wording)
- Data inventory showing purpose for each personal data field
- Privacy review of new collection forms or features
NIST CSF 2.0 GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Evidence to have on file (guidance, our wording)
- Legal and regulatory obligations register with owners
- Contractual security clauses summary across customer base
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
Application question If "Yes", does the Applicant have agreements with these vendors or other third parties which requires the other party to indemnify the Applicant for legal liability arising out the third party's loss, release, or disclosure of this information?
ISO 27001:2022 A.5.19 Information security in supplier relationships
Evidence to have on file (guidance, our wording)
- The topic-specific supplier relationship policy and its communication record
- A supplier inventory categorized by type and by the information, services and infrastructure each can access
ISO 27001:2022 A.5.20 Addressing information security within supplier agreements
Evidence to have on file (guidance, our wording)
- Supplier agreements containing security clauses proportionate to the relationship, such as classification mapping, agreed controls, incident notification, subcontracting, right to audit and termination terms
- A register of contracts, memoranda and information-sharing arrangements with outside parties showing what information each covers and when it was last reviewed
ISO 27001:2022 A.5.21 Managing information security in the information and communication technology (ICT) supply chain
Evidence to have on file (guidance, our wording)
- Security requirements included in ICT acquisition specifications and contracts, including flow-down to sub-suppliers
- Software component information such as SBOMs and descriptions of security functions and secure configuration obtained from product suppliers
SOC 2 CC9.2 Assessing and managing vendor and business partner risk
Evidence to have on file (guidance, our wording)
- Vendor inventory with risk tiers and the review frequency set for each tier
- Due diligence records, for example vendor SOC reports reviewed with complementary controls noted
SOC 2 P6.4 Privacy commitments from vendors and third parties
Evidence to have on file (guidance, our wording)
- Data processing agreements with privacy clauses
- Periodic assessments of vendors' privacy compliance
NIST CSF 2.0 GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
Evidence to have on file (guidance, our wording)
- Third party risk management program charter
- Supplier risk policy with tiering criteria
NIST CSF 2.0 GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
Evidence to have on file (guidance, our wording)
- Standard supplier security requirements catalog
- Contract clause library with cyber obligations
Application question Does the Applicant collect or store personally identifiable information in or from countries that have data localization laws (e.g., the European Union, United Kingdom, Russia, China, India, Brazil?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question If "Yes", does the Applicant expect to be in compliance with all data localization laws in the next 12 months?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does the Applicant have a continuous monitoring program to detect and maintain an inventory of all hardware and software on to its network?
ISO 27001:2022 A.5.9 Inventory of information and other associated assets
Evidence to have on file (guidance, our wording)
- The asset inventories (information, hardware, software, virtual, facilities and others) with owner, classification and location fields populated
- Reconciliation records between inventories and discovery tooling, or evidence that installs, changes and removals update the inventory automatically
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
NIST CSF 2.0 ID.AM-01 Inventories of hardware managed by the organization are maintained
Evidence to have on file (guidance, our wording)
- Hardware inventory with last seen and owner fields
- Automated discovery feeds reconciled against CMDB
NIST CSF 2.0 ID.AM-02 Inventories of software, services, and systems managed by the organization are maintained
Evidence to have on file (guidance, our wording)
- Software inventory with licensing and version data
- SaaS application register with owner and data class
Application question Does the Applicant deploy system configuration management tools that enforce and redeploy configuration settings to systems (e.g., operating systems and software applications) at regular intervals?
ISO 27001:2022 A.8.9 Configuration management
Evidence to have on file (guidance, our wording)
- Approved secure configuration templates or baselines for each platform, derived from vendor or independent guidance, with review dates
- Configuration records or a CMDB showing owner, last change date, template version and relationships between assets
SOC 2 CC8.1 Managing changes to procedures, software, data and infrastructure
Evidence to have on file (guidance, our wording)
- Change management policy covering normal, standard and emergency changes
- Sample of change tickets with approval, testing evidence and deployer different from author
NIST CSF 2.0 PR.PS-01 Configuration management practices are established and applied
Evidence to have on file (guidance, our wording)
- Configuration management standards by platform
- Hardening baselines and compliance reports
Application question Vulnerability Assessment and Remediation Does the Applicant have a formal process in place to detect software/application vulnerabilities and automatically push critical updates and patches to all computing resources?
ISO 27001:2022 A.8.8 Management of technical vulnerabilities
Evidence to have on file (guidance, our wording)
- A software asset inventory with vendor, product, version, deployment location and responsible owner
- Defined vulnerability management roles and a list of monitored vulnerability information sources
ISO 27001:2022 A.8.19 Installation of software on operational systems
Evidence to have on file (guidance, our wording)
- Procedures for installing and updating operational software, including authorization, testing and rollback planning
- Change and deployment records showing management authorization, successful testing and the administrator who performed the installation
ISO 27001:2022 A.8.29 Security testing in development and acceptance
Evidence to have on file (guidance, our wording)
- Security test plans with schedules, inputs, expected outputs, evaluation criteria and decisions, scaled to the system's importance and change impact
- Security test results covering authentication, access restriction, cryptography, secure coding and configuration
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
NIST CSF 2.0 ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded
Evidence to have on file (guidance, our wording)
- Vulnerability scanning coverage report
- Vulnerability triage workflow with severity SLAs
NIST CSF 2.0 PR.PS-02 Software is maintained, replaced, and removed commensurate with risk
Evidence to have on file (guidance, our wording)
- Software lifecycle policy with end of support tracking
- Patch management cadence and exception register
Application question If "Yes", is the length of time required for the deployment of critical updates and patches less than or equal to 2 weeks?
ISO 27001:2022 A.8.8 Management of technical vulnerabilities
Evidence to have on file (guidance, our wording)
- A software asset inventory with vendor, product, version, deployment location and responsible owner
- Defined vulnerability management roles and a list of monitored vulnerability information sources
ISO 27001:2022 A.8.19 Installation of software on operational systems
Evidence to have on file (guidance, our wording)
- Procedures for installing and updating operational software, including authorization, testing and rollback planning
- Change and deployment records showing management authorization, successful testing and the administrator who performed the installation
ISO 27001:2022 A.8.29 Security testing in development and acceptance
Evidence to have on file (guidance, our wording)
- Security test plans with schedules, inputs, expected outputs, evaluation criteria and decisions, scaled to the system's importance and change impact
- Security test results covering authentication, access restriction, cryptography, secure coding and configuration
SOC 2 CC7.1 Detecting configuration changes and new vulnerabilities
Evidence to have on file (guidance, our wording)
- Hardening standards or benchmarks for in-scope platforms
- Configuration compliance scan results
NIST CSF 2.0 ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded
Evidence to have on file (guidance, our wording)
- Vulnerability scanning coverage report
- Vulnerability triage workflow with severity SLAs
NIST CSF 2.0 PR.PS-02 Software is maintained, replaced, and removed commensurate with risk
Evidence to have on file (guidance, our wording)
- Software lifecycle policy with end of support tracking
- Patch management cadence and exception register
Application question Has the Applicant conducted a simulated phishing campaign in the last 12 months?
This is a loss history question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does the Applicant use multi-factor authentication for access to critical applications or databases (including those that contain personally identifiable information, private health information or payment card information?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
Flagged warranty: where the carrier declares its answers to be the basis of the contract, this is an answer the carrier relies on and that can affect cover if it is wrong.
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
ISO 27001:2022 A.5.17 Authentication information
Evidence to have on file (guidance, our wording)
- Credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided
- Evidence that initial credentials are unique, delivered over protected channels and changed at first use
ISO 27001:2022 A.5.34 Privacy and protection of personal identifiable information (PII)
Evidence to have on file (guidance, our wording)
- The topic-specific privacy and PII protection policy and its communication to relevant parties
- Privacy procedures communicated to everyone who processes PII
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
SOC 2 P1.1 Privacy notice to data subjects
Evidence to have on file (guidance, our wording)
- Published privacy notice with effective date and version history
- Evidence notice is presented at collection points (forms, apps)
NIST CSF 2.0 PR.AA-03 Users, services, and hardware are authenticated
Evidence to have on file (guidance, our wording)
- Multi factor authentication coverage report
- Phishing resistant authentication rollout plan
NIST CSF 2.0 GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Evidence to have on file (guidance, our wording)
- Legal and regulatory obligations register with owners
- Contractual security clauses summary across customer base
Application question Does the Applicant restrict access based on job function and responsibilities?
ISO 27001:2022 A.5.15 Access control
Evidence to have on file (guidance, our wording)
- The topic-specific access control policy, approved and communicated, reflecting owner-defined business and security requirements
- Access control rules or role models mapping entities (users, services, devices) to rights, consistent with classification
ISO 27001:2022 A.5.16 Identity management
Evidence to have on file (guidance, our wording)
- Identity management procedure covering creation, verification, activation, change, disablement and removal
- Evidence that identities are verified against trusted documents before issue
ISO 27001:2022 A.5.18 Access rights
Evidence to have on file (guidance, our wording)
- Access request records showing owner authorization, and management approval where required, before rights were activated
- A central record of access rights per user identifier across logical and physical access
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
SOC 2 CC6.2 Registering and authorising users before issuing credentials
Evidence to have on file (guidance, our wording)
- Access request tickets with owner approval for a sample of new users, service accounts and API credentials
- Termination records reconciled to account disablement dates
NIST CSF 2.0 PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization
Evidence to have on file (guidance, our wording)
- Identity management platform configuration baseline
- Joiner mover leaver workflow with timing SLAs
NIST CSF 2.0 PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
Evidence to have on file (guidance, our wording)
- Access policy framework with role definitions
- Privileged access management deployment evidence
Application question Does the Applicant enforce password changes every 8-12 weeks?
ISO 27001:2022 A.5.17 Authentication information
Evidence to have on file (guidance, our wording)
- Credential issuance procedure requiring identity verification before new, replacement or temporary credentials are provided
- Evidence that initial credentials are unique, delivered over protected channels and changed at first use
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
NIST CSF 2.0 PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization
Evidence to have on file (guidance, our wording)
- Identity management platform configuration baseline
- Joiner mover leaver workflow with timing SLAs
Application question Is network segmentation (e.g., firewalls, software- defined networking) used to limit movement across the network?
ISO 27001:2022 A.8.20 Networks security
Evidence to have on file (guidance, our wording)
- Current network diagrams and device configuration backups for routers, switches, firewalls and wireless controllers
- Defined responsibilities and procedures for network device management, separated from system operations where appropriate
ISO 27001:2022 A.8.21 Security of network services
Evidence to have on file (guidance, our wording)
- Service agreements with internal and external network providers specifying security features, service levels and requirements
- Right-to-audit clauses and third-party attestations from network and managed security service providers, with records of review
ISO 27001:2022 A.8.22 Segregation of networks
Evidence to have on file (guidance, our wording)
- Network segmentation design defining domains by trust, criticality, sensitivity or organizational unit, with the assessment that justified it
- Firewall or filtering router rules controlling traffic between domains, with rule review records
SOC 2 CC6.6 Protection against threats from outside the system boundary
Evidence to have on file (guidance, our wording)
- Firewall and security group rule sets with review evidence
- MFA enforced on VPN, remote and administrative access
NIST CSF 2.0 PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
Evidence to have on file (guidance, our wording)
- Network segmentation design with zones and trust levels
- Firewall and access control list governance
NIST CSF 2.0 DE.CM-01 Networks and network services are monitored to find potentially adverse events
Evidence to have on file (guidance, our wording)
- Network flow telemetry coverage map by segment
- IDS or NDR sensor inventory with placement diagram
Application question VPN, remote desktop?
ISO 27001:2022 A.6.7 Remote working
Evidence to have on file (guidance, our wording)
- The topic-specific remote working policy defining conditions, permitted work, information classifications allowed and systems accessible
- Remote access configuration showing multi-factor authentication, secure channels or virtual desktops
ISO 27001:2022 A.8.20 Networks security
Evidence to have on file (guidance, our wording)
- Current network diagrams and device configuration backups for routers, switches, firewalls and wireless controllers
- Defined responsibilities and procedures for network device management, separated from system operations where appropriate
ISO 27001:2022 A.8.22 Segregation of networks
Evidence to have on file (guidance, our wording)
- Network segmentation design defining domains by trust, criticality, sensitivity or organizational unit, with the assessment that justified it
- Firewall or filtering router rules controlling traffic between domains, with rule review records
SOC 2 CC6.6 Protection against threats from outside the system boundary
Evidence to have on file (guidance, our wording)
- Firewall and security group rule sets with review evidence
- MFA enforced on VPN, remote and administrative access
NIST CSF 2.0 PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
Evidence to have on file (guidance, our wording)
- Network segmentation design with zones and trust levels
- Firewall and access control list governance
Application question Does the Applicant maintain redundant backups of sensitive and critical system information?
ISO 27001:2022 A.8.13 Information backup
Evidence to have on file (guidance, our wording)
- The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO
- Backup job monitoring reports with evidence that failed jobs were investigated and rerun
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
ISO 27001:2022 A.5.29 Information security during disruption
Evidence to have on file (guidance, our wording)
- Business continuity plans that contain information security requirements and the controls, systems and tools needed during disruption
- A documented analysis of which security controls must be adapted during disruption and how
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
SOC 2 A1.3 Testing recovery plan procedures
Evidence to have on file (guidance, our wording)
- Disaster recovery or continuity test plan and results in the period
- Backup restore test records with verification of completeness
NIST CSF 2.0 PR.DS-11 Backups of data are created, protected, maintained, and tested
Evidence to have on file (guidance, our wording)
- Backup policy with frequency and retention
- Backup integrity test reports
NIST CSF 2.0 PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
Evidence to have on file (guidance, our wording)
- Resilience architecture patterns for critical services
- Failover and failback tested with evidence
Application question If "Yes", is there at least one backup destination that is maintained offline?
Flagged knockout: the wording of this question makes a "no" a common point at which a cyber application is declined or referred.
Flagged warranty: where the carrier declares its answers to be the basis of the contract, this is an answer the carrier relies on and that can affect cover if it is wrong.
ISO 27001:2022 A.8.13 Information backup
Evidence to have on file (guidance, our wording)
- The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO
- Backup job monitoring reports with evidence that failed jobs were investigated and rerun
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
SOC 2 A1.3 Testing recovery plan procedures
Evidence to have on file (guidance, our wording)
- Disaster recovery or continuity test plan and results in the period
- Backup restore test records with verification of completeness
NIST CSF 2.0 PR.DS-11 Backups of data are created, protected, maintained, and tested
Evidence to have on file (guidance, our wording)
- Backup policy with frequency and retention
- Backup integrity test reports
Application question Personally Identifiable Information (PII) (non-public information such as social security numbers, driver's licenses, phone numbers, and email addresses?
ISO 27001:2022 A.5.34 Privacy and protection of personal identifiable information (PII)
Evidence to have on file (guidance, our wording)
- The topic-specific privacy and PII protection policy and its communication to relevant parties
- Privacy procedures communicated to everyone who processes PII
ISO 27001:2022 A.5.31 Legal, statutory, regulatory and contractual requirements
Evidence to have on file (guidance, our wording)
- A register of applicable laws, regulations and contractual obligations for information security, with the countries covered, the approach to meeting each and a named responsible owner
- Records of periodic review of the register and of new or changed legislation identified
SOC 2 P1.1 Privacy notice to data subjects
Evidence to have on file (guidance, our wording)
- Published privacy notice with effective date and version history
- Evidence notice is presented at collection points (forms, apps)
SOC 2 P3.1 Collecting personal information consistent with objectives
Evidence to have on file (guidance, our wording)
- Data inventory showing purpose for each personal data field
- Privacy review of new collection forms or features
NIST CSF 2.0 GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Evidence to have on file (guidance, our wording)
- Legal and regulatory obligations register with owners
- Contractual security clauses summary across customer base
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
Application question Private Health Information (PHI) (e.g., healthcare or medical records?
ISO 27001:2022 A.5.34 Privacy and protection of personal identifiable information (PII)
Evidence to have on file (guidance, our wording)
- The topic-specific privacy and PII protection policy and its communication to relevant parties
- Privacy procedures communicated to everyone who processes PII
ISO 27001:2022 A.5.31 Legal, statutory, regulatory and contractual requirements
Evidence to have on file (guidance, our wording)
- A register of applicable laws, regulations and contractual obligations for information security, with the countries covered, the approach to meeting each and a named responsible owner
- Records of periodic review of the register and of new or changed legislation identified
SOC 2 P1.1 Privacy notice to data subjects
Evidence to have on file (guidance, our wording)
- Published privacy notice with effective date and version history
- Evidence notice is presented at collection points (forms, apps)
SOC 2 P3.1 Collecting personal information consistent with objectives
Evidence to have on file (guidance, our wording)
- Data inventory showing purpose for each personal data field
- Privacy review of new collection forms or features
NIST CSF 2.0 GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Evidence to have on file (guidance, our wording)
- Legal and regulatory obligations register with owners
- Contractual security clauses summary across customer base
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
Application question Payment Card Information (PCI) (e.g., credit card, debit card numbers or other financial account numbers?
ISO 27001:2022 A.5.3 Segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
ISO 27001:2022 A.6.3 Information security awareness, education and training
Evidence to have on file (guidance, our wording)
- A documented awareness, education and training programme aligned with the policies and planned by role, including external personnel
- Completion records for initial training of new starters and role changers and for periodic refreshers
ISO 27001:2022 A.8.5 Secure authentication
Evidence to have on file (guidance, our wording)
- An authentication standard linking required authentication strength to information classification and system criticality
- MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules
SOC 2 CC6.3 Role-based access, least privilege and segregation of duties
Evidence to have on file (guidance, our wording)
- the bank or treasury platform dual-authorisation setup and the payment approval workflow, showing a second approver on a different device above the threshold
- the callback or out-of-band verification procedure for a change to payee bank details, with a dated example
SOC 2 CC3.3 Considering fraud risk (COSO principle 8)
Evidence to have on file (guidance, our wording)
- Fraud risk assessment or fraud section of the enterprise risk assessment
- Analysis of privileged access and data misuse scenarios
NIST CSF 2.0 PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
Evidence to have on file (guidance, our wording)
- Access policy framework with role definitions
- Privileged access management deployment evidence
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
Application question on enterprise assets (e.g., databases, file shares, backups?
ISO 27001:2022 A.8.13 Information backup
Evidence to have on file (guidance, our wording)
- The topic-specific backup policy and backup plans stating scope, extent, frequency and retention per system aligned with RPO
- Backup job monitoring reports with evidence that failed jobs were investigated and rerun
ISO 27001:2022 A.8.14 Redundancy of information processing facilities
Evidence to have on file (guidance, our wording)
- Documented availability requirements for business services and systems
- Architecture diagrams showing redundancy such as dual providers, redundant networks, separate data centres, redundant power and load-balanced instances
SOC 2 A1.2 Environmental protection, backup and recovery infrastructure
Evidence to have on file (guidance, our wording)
- Backup policy defining scope, frequency and retention
- Backup job monitoring and failure remediation records
SOC 2 A1.3 Testing recovery plan procedures
Evidence to have on file (guidance, our wording)
- Disaster recovery or continuity test plan and results in the period
- Backup restore test records with verification of completeness
NIST CSF 2.0 PR.DS-11 Backups of data are created, protected, maintained, and tested
Evidence to have on file (guidance, our wording)
- Backup policy with frequency and retention
- Backup integrity test reports
Application question on mobile assets (e.g., laptops, phones, tablets, flash drives?
ISO 27001:2022 A.8.1 User end point devices
Evidence to have on file (guidance, our wording)
- The topic-specific endpoint policy covering classification limits, registration, software restrictions, updates, network connection rules, encryption, malware protection, remote wipe, backup and port control
- Device management (MDM or endpoint management) reports showing enrolment, encryption, patch level, firewall and anti-malware status
ISO 27001:2022 A.7.10 Storage media
Evidence to have on file (guidance, our wording)
- The topic-specific removable media policy and evidence it was communicated to users
- Endpoint configuration showing USB and SD ports disabled unless a business reason is approved, and monitoring of transfers to removable media
ISO 27001:2022 A.6.7 Remote working
Evidence to have on file (guidance, our wording)
- The topic-specific remote working policy defining conditions, permitted work, information classifications allowed and systems accessible
- Remote access configuration showing multi-factor authentication, secure channels or virtual desktops
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
SOC 2 CC6.7 Restricting and protecting information in transmission, movement and removal
Evidence to have on file (guidance, our wording)
- TLS and encryption standards for data in transit
- Removable media policy and technical enforcement
NIST CSF 2.0 PR.AA-06 Physical access to assets is managed, monitored, and enforced commensurate with risk
Evidence to have on file (guidance, our wording)
- Physical access control system inventory
- Badge issuance and revocation records
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
Application question over public networks (e.g., the Internet?
No held control answers this line.
Application question with third party services (e.g., cloud provider?
ISO 27001:2022 A.5.19 Information security in supplier relationships
Evidence to have on file (guidance, our wording)
- The topic-specific supplier relationship policy and its communication record
- A supplier inventory categorized by type and by the information, services and infrastructure each can access
ISO 27001:2022 A.5.20 Addressing information security within supplier agreements
Evidence to have on file (guidance, our wording)
- Supplier agreements containing security clauses proportionate to the relationship, such as classification mapping, agreed controls, incident notification, subcontracting, right to audit and termination terms
- A register of contracts, memoranda and information-sharing arrangements with outside parties showing what information each covers and when it was last reviewed
ISO 27001:2022 A.5.21 Managing information security in the information and communication technology (ICT) supply chain
Evidence to have on file (guidance, our wording)
- Security requirements included in ICT acquisition specifications and contracts, including flow-down to sub-suppliers
- Software component information such as SBOMs and descriptions of security functions and secure configuration obtained from product suppliers
SOC 2 CC9.2 Assessing and managing vendor and business partner risk
Evidence to have on file (guidance, our wording)
- Vendor inventory with risk tiers and the review frequency set for each tier
- Due diligence records, for example vendor SOC reports reviewed with complementary controls noted
SOC 2 P6.4 Privacy commitments from vendors and third parties
Evidence to have on file (guidance, our wording)
- Data processing agreements with privacy clauses
- Periodic assessments of vendors' privacy compliance
NIST CSF 2.0 GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
Evidence to have on file (guidance, our wording)
- Third party risk management program charter
- Supplier risk policy with tiering criteria
NIST CSF 2.0 GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
Evidence to have on file (guidance, our wording)
- Standard supplier security requirements catalog
- Contract clause library with cyber obligations
Application question Are all terminals EMV enabled?
ISO 27001:2022 A.8.24 Use of cryptography
Evidence to have on file (guidance, our wording)
- The topic-specific cryptography policy with approved algorithms, key lengths, protocols and usage by information classification
- Evidence of encryption on endpoints, removable media and data in transit, aligned with the policy
ISO 27001:2022 A.5.15 Access control
Evidence to have on file (guidance, our wording)
- The topic-specific access control policy, approved and communicated, reflecting owner-defined business and security requirements
- Access control rules or role models mapping entities (users, services, devices) to rights, consistent with classification
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
SOC 2 CC6.7 Restricting and protecting information in transmission, movement and removal
Evidence to have on file (guidance, our wording)
- TLS and encryption standards for data in transit
- Removable media policy and technical enforcement
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
Application question Are the POS and corporate networks segregated?
ISO 27001:2022 A.8.24 Use of cryptography
Evidence to have on file (guidance, our wording)
- The topic-specific cryptography policy with approved algorithms, key lengths, protocols and usage by information classification
- Evidence of encryption on endpoints, removable media and data in transit, aligned with the policy
ISO 27001:2022 A.5.15 Access control
Evidence to have on file (guidance, our wording)
- The topic-specific access control policy, approved and communicated, reflecting owner-defined business and security requirements
- Access control rules or role models mapping entities (users, services, devices) to rights, consistent with classification
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
SOC 2 CC6.7 Restricting and protecting information in transmission, movement and removal
Evidence to have on file (guidance, our wording)
- TLS and encryption standards for data in transit
- Removable media policy and technical enforcement
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
Application question Is access to the internet from terminals restricted for employees?
ISO 27001:2022 A.5.15 Access control
Evidence to have on file (guidance, our wording)
- The topic-specific access control policy, approved and communicated, reflecting owner-defined business and security requirements
- Access control rules or role models mapping entities (users, services, devices) to rights, consistent with classification
ISO 27001:2022 A.5.16 Identity management
Evidence to have on file (guidance, our wording)
- Identity management procedure covering creation, verification, activation, change, disablement and removal
- Evidence that identities are verified against trusted documents before issue
ISO 27001:2022 A.5.18 Access rights
Evidence to have on file (guidance, our wording)
- Access request records showing owner authorization, and management approval where required, before rights were activated
- A central record of access rights per user identifier across logical and physical access
SOC 2 CC6.1 Logical access security over protected information assets
Evidence to have on file (guidance, our wording)
- Asset inventory with classification for in-scope systems
- Identity provider configuration showing MFA and password policy
SOC 2 CC6.2 Registering and authorising users before issuing credentials
Evidence to have on file (guidance, our wording)
- Access request tickets with owner approval for a sample of new users, service accounts and API credentials
- Termination records reconciled to account disablement dates
NIST CSF 2.0 PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization
Evidence to have on file (guidance, our wording)
- Identity management platform configuration baseline
- Joiner mover leaver workflow with timing SLAs
NIST CSF 2.0 PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
Evidence to have on file (guidance, our wording)
- Access policy framework with role definitions
- Privileged access management deployment evidence
Application question Has legal counsel screened the use of all trademarks and service marks, including Applicant's use of domain names and metatags, to ensure they do not infringe on the intellectual property rights of others?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does the Applicant obtain written permissions or releases from third party content providers and contributors, including freelancers, independent contractors, and other talent?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does the Applicant require indemnification or hold harmless agreements from third parties (including outside advertising or marketing agencies) when the Applicant contracts with them to create or manage content on the Applicant's behalf?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question If the Applicant sells advertising space on any of its websites, are providers of advertisements required to execute indemnification and hold harmless agreements in the Applicant's favor?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Has the Applicant's privacy policy, terms of use, terms of service, and other customer policies been review by an outside counsel?
ISO 27001:2022 A.5.34 Privacy and protection of personal identifiable information (PII)
Evidence to have on file (guidance, our wording)
- The topic-specific privacy and PII protection policy and its communication to relevant parties
- Privacy procedures communicated to everyone who processes PII
ISO 27001:2022 A.5.31 Legal, statutory, regulatory and contractual requirements
Evidence to have on file (guidance, our wording)
- A register of applicable laws, regulations and contractual obligations for information security, with the countries covered, the approach to meeting each and a named responsible owner
- Records of periodic review of the register and of new or changed legislation identified
SOC 2 P1.1 Privacy notice to data subjects
Evidence to have on file (guidance, our wording)
- Published privacy notice with effective date and version history
- Evidence notice is presented at collection points (forms, apps)
SOC 2 P3.1 Collecting personal information consistent with objectives
Evidence to have on file (guidance, our wording)
- Data inventory showing purpose for each personal data field
- Privacy review of new collection forms or features
NIST CSF 2.0 GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Evidence to have on file (guidance, our wording)
- Legal and regulatory obligations register with owners
- Contractual security clauses summary across customer base
NIST CSF 2.0 PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
Evidence to have on file (guidance, our wording)
- Data at rest encryption inventory by store type
- Storage configuration baselines with attestation
Application question Does the Applicant involve legal counsel in reviewing content prior to publication or in evaluating whether it should be removed when notified that content is defamatory, infringing, in violation of a third party's privacy rights, or otherwise improper?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question What percentage of the Applicant's business involves subcontracting work to others?
This is a scoping question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does the Applicant require evidence of the errors and omissions insurance from the subcontractors?
ISO 27001:2022 A.5.19 Information security in supplier relationships
Evidence to have on file (guidance, our wording)
- The topic-specific supplier relationship policy and its communication record
- A supplier inventory categorized by type and by the information, services and infrastructure each can access
ISO 27001:2022 A.5.20 Addressing information security within supplier agreements
Evidence to have on file (guidance, our wording)
- Supplier agreements containing security clauses proportionate to the relationship, such as classification mapping, agreed controls, incident notification, subcontracting, right to audit and termination terms
- A register of contracts, memoranda and information-sharing arrangements with outside parties showing what information each covers and when it was last reviewed
ISO 27001:2022 A.5.21 Managing information security in the information and communication technology (ICT) supply chain
Evidence to have on file (guidance, our wording)
- Security requirements included in ICT acquisition specifications and contracts, including flow-down to sub-suppliers
- Software component information such as SBOMs and descriptions of security functions and secure configuration obtained from product suppliers
SOC 2 CC9.2 Assessing and managing vendor and business partner risk
Evidence to have on file (guidance, our wording)
- Vendor inventory with risk tiers and the review frequency set for each tier
- Due diligence records, for example vendor SOC reports reviewed with complementary controls noted
SOC 2 P6.4 Privacy commitments from vendors and third parties
Evidence to have on file (guidance, our wording)
- Data processing agreements with privacy clauses
- Periodic assessments of vendors' privacy compliance
NIST CSF 2.0 GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
Evidence to have on file (guidance, our wording)
- Third party risk management program charter
- Supplier risk policy with tiering criteria
NIST CSF 2.0 GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
Evidence to have on file (guidance, our wording)
- Standard supplier security requirements catalog
- Contract clause library with cyber obligations
Application question Does the Applicant use a written contract with clients?
No held control answers this line.
Application question Does an attorney review such contracts prior to use?
This is a media liability question, not a control requirement. It reaches no held control.
No held control answers this line.
Application question Does the standard contract contain hold harmless clauses for the benefit of the Applicant?
ISO 27001:2022 A.5.19 Information security in supplier relationships
Evidence to have on file (guidance, our wording)
- The topic-specific supplier relationship policy and its communication record
- A supplier inventory categorized by type and by the information, services and infrastructure each can access
ISO 27001:2022 A.5.20 Addressing information security within supplier agreements
Evidence to have on file (guidance, our wording)
- Supplier agreements containing security clauses proportionate to the relationship, such as classification mapping, agreed controls, incident notification, subcontracting, right to audit and termination terms
- A register of contracts, memoranda and information-sharing arrangements with outside parties showing what information each covers and when it was last reviewed
ISO 27001:2022 A.5.21 Managing information security in the information and communication technology (ICT) supply chain
Evidence to have on file (guidance, our wording)
- Security requirements included in ICT acquisition specifications and contracts, including flow-down to sub-suppliers
- Software component information such as SBOMs and descriptions of security functions and secure configuration obtained from product suppliers
SOC 2 CC9.2 Assessing and managing vendor and business partner risk
Evidence to have on file (guidance, our wording)
- Vendor inventory with risk tiers and the review frequency set for each tier
- Due diligence records, for example vendor SOC reports reviewed with complementary controls noted
SOC 2 P6.4 Privacy commitments from vendors and third parties
Evidence to have on file (guidance, our wording)
- Data processing agreements with privacy clauses
- Periodic assessments of vendors' privacy compliance
NIST CSF 2.0 GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
Evidence to have on file (guidance, our wording)
- Third party risk management program charter
- Supplier risk policy with tiering criteria
NIST CSF 2.0 GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
Evidence to have on file (guidance, our wording)
- Standard supplier security requirements catalog
- Contract clause library with cyber obligations
Application question Does the Applicant agree to hold harmless/indemnify others?
ISO 27001:2022 A.5.19 Information security in supplier relationships
Evidence to have on file (guidance, our wording)
- The topic-specific supplier relationship policy and its communication record
- A supplier inventory categorized by type and by the information, services and infrastructure each can access
ISO 27001:2022 A.5.20 Addressing information security within supplier agreements
Evidence to have on file (guidance, our wording)
- Supplier agreements containing security clauses proportionate to the relationship, such as classification mapping, agreed controls, incident notification, subcontracting, right to audit and termination terms
- A register of contracts, memoranda and information-sharing arrangements with outside parties showing what information each covers and when it was last reviewed
ISO 27001:2022 A.5.21 Managing information security in the information and communication technology (ICT) supply chain
Evidence to have on file (guidance, our wording)
- Security requirements included in ICT acquisition specifications and contracts, including flow-down to sub-suppliers
- Software component information such as SBOMs and descriptions of security functions and secure configuration obtained from product suppliers
SOC 2 CC9.2 Assessing and managing vendor and business partner risk
Evidence to have on file (guidance, our wording)
- Vendor inventory with risk tiers and the review frequency set for each tier
- Due diligence records, for example vendor SOC reports reviewed with complementary controls noted
SOC 2 P6.4 Privacy commitments from vendors and third parties
Evidence to have on file (guidance, our wording)
- Data processing agreements with privacy clauses
- Periodic assessments of vendors' privacy compliance
NIST CSF 2.0 GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
Evidence to have on file (guidance, our wording)
- Third party risk management program charter
- Supplier risk policy with tiering criteria
NIST CSF 2.0 GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
Evidence to have on file (guidance, our wording)
- Standard supplier security requirements catalog
- Contract clause library with cyber obligations
Application question Does the Applicant have a procedure requiring the review or follow- up of complaints?
No held control answers this line.
Application question Does the Applicant have any risk management procedures in place?
ISO 27001:2022 6.1.2 Information security risk assessment
Evidence to have on file (guidance, our wording)
- A documented risk assessment methodology stating the criteria for accepting risk and the criteria for how assessments are carried out
- A risk register naming each risk, its owner, consequence, likelihood and resulting level
ISO 27001:2022 6.1.3 Information security risk treatment
Evidence to have on file (guidance, our wording)
- A risk treatment plan showing the option chosen and the controls determined for each risk
- Evidence of the comparison of determined controls with Annex A
ISO 27001:2022 A.5.7 Threat intelligence
Evidence to have on file (guidance, our wording)
- Documented threat intelligence objectives and a process covering collection, processing, analysis and dissemination
- A list of vetted internal and external intelligence sources with the rationale for selection
SOC 2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7)
Evidence to have on file (guidance, our wording)
- Risk assessment performed in the period with methodology, scoring and approvals
- Risk register listing assets with criticality ratings, threats, vulnerabilities, likelihood, impact and treatment
NIST CSF 2.0 GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders
Evidence to have on file (guidance, our wording)
- Risk management charter with objectives and KPIs
- Board approved risk objectives statement
NIST CSF 2.0 ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
Evidence to have on file (guidance, our wording)
- Inherent risk register with scoring rationale
- Risk heat map and prioritization output
Application question Does the Applicant have a formalized training program for newly hired employees?
ISO 27001:2022 A.6.3 Information security awareness, education and training
Evidence to have on file (guidance, our wording)
- A documented awareness, education and training programme aligned with the policies and planned by role, including external personnel
- Completion records for initial training of new starters and role changers and for periodic refreshers
SOC 2 CC1.4 Attracting, developing and retaining competent people (COSO principle 4)
Evidence to have on file (guidance, our wording)
- Background check policy and completed checks for a sample of new hires and contractors
- Role competency requirements and performance review records
SOC 2 CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14)
Evidence to have on file (guidance, our wording)
- Security awareness training content and completion records
- Published information security policies accessible to staff with change notices
NIST CSF 2.0 PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
Evidence to have on file (guidance, our wording)
- Security awareness program curriculum
- Completion records by population
Controls not asked in this held document (206)
None of this held document's questions reach 206 of the 290 held controls (for example A.5.5, A.5.6, A.5.8, A.5.10, A.5.11, A.5.12, A.5.13, A.5.14). That is a fact about this held document, not about what the carrier underwrites on: a carrier's fuller forms and supplements ask controls this summary does not, multi-factor authentication, offline backups and patching among them. A control here is not asserted as required, and not asserted as not required.