Do your due diligence by verifying assessment responses. This is a defensible step that helps ensure you are getting truthful answers. We recommend that you add a few more requirements every year in order to gradually expand the body of evidence.
You can ask for evidence after the assessment has been submitted OR proactively set the requirements in an assessment template. This is the easier method. Learn how to set assessment requirements here.
The recommended list of administrative requirements is below:
Section 1.1 - Risk Management Practices and Integration
Risk decisions (accept, mitigate, avoid, transfer, etc.) are made by executive management personnel with the authority to do so.
If True, ask for a copy of a policy or process with management sign-off
If False, consider pursuing in remediation
If N/A, ask for a note explaining when [date] the policy/process for risk decision-making will be implemented
Section 2.1 - Policies for Information Security
The organization has defined a set of information security policies that are formally approved by executive management.
If True, ask for a copy of an approved policy showing who specifically in executive management approved it
If False, consider pursuing in remediation
If N/A, ask for a note explaining when [date] the information security policy will be implemented
Section 2.3 - Security Roles and Responsibilities
Information security roles and responsibilities are formally defined and documented.
If True, ask for a copy of an organizational chart or information security role definition document
If False, consider pursuing in remediation
If N/A, ask for a note explaining when [date] the information security roles will be defined and documented
Section 2.4 - Separation of Duties
Care has been taken to ensure that no single person can access, modify and/or use information resources without authorization or detection.
If True, ask for a copy of policy or process showing how separation of duties is defined and enforced
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Where separation of duties is not feasible, compensating controls such as activity monitoring, audit trails, and management supervision are in place.
If True, ask for a copy of a policy or process showing how compensating controls are defined and enforced
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 3.2 - Management Responsibilities
Personnel activity is monitored to detect potential cybersecurity events.
If True, ask for a copy of a policy or process explaining how monitoring controls are defined and enforced
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date when this will be reviewed for applicability
Section 3.3 - Information Security Awareness, Education, and Training
Employees, contractors, and third party resources receive security awareness training prior to being granted access to information resources.
If True, ask for a copy of a policy or process showing that employees, contractors and third party resources are provided security awareness training prior to being granted access to information resources
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 3.4 - Specialized Information Security Education and Training
Privileged users have received specialized instruction and training.
If True, ask for a copy of a policy or screenshots of training examples provided
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 3.5 - Termination or Change of Employment Responsibilities
Post-employment processes (account removal, password changes, etc.) are processed and validated immediately for involuntary terminations.
If True, ask for a copy of a policy or process showing that post-employment processes (account removal, password changes, etc.) are processed and validated immediately for involuntary terminations
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 4.1 - Inventory of Assets
Physical devices and systems within the organization are all inventoried.
If True, ask for a copy of a policy or process showing that physical devices and systems within the organization are all inventoried
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Software platforms and applications within the organization are inventoried.
If True, ask for a copy of a policy or process explaining how inventory is conducted and maintained and/or screenshots of inventory
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 4.5 - Cloud Service Security Management
A complete, up to date, and detailed inventory of all cloud services is maintained.
If True, ask for a copy of a policy or process explaining how inventory is conducted and maintained and/or screenshots of inventory
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Data transferred to and from the cloud is all encrypted.
If True, ask for a copy of a policy or process
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 5.1 - Access Control Policy
Segregation of access control roles is sufficient (e.g., access request, access authorization, and access administration).
If True, ask for a copy of a policy or process
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
A periodic review of user accounts and access rights is conducted according to a defined process and procedure.
If True, ask for a copy of a policy or process and/or screenshots of most current review document with dates of review
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 5.2 - Account Management
The use of shared user accounts is prohibited by the organization.
If True, ask for a copy of a policy or process
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
System/service accounts are inventoried and specifically authorized.
If True, ask for a copy of a policy or process
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 5.4 - Secure Log-on Procedures
User authentication is required for access to all internal and confidential information resources.
If True, ask for a copy of a policy or process
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 6.1 - Encryption Policy and Control
Encryption requirements for protecting data at rest are documented.
If True, ask for a copy of a policy or process
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Encrypted data transfer solutions are provided to users (e.g., encrypted email, SFTP).
If True, ask for a copy of a policy or process and/or a screenshot of secure transfer solution(s) in use
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 7.1 - Mobile Device Policy
The organization requires access controls for mobile devices.
If True, ask for a copy of a policy or process
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Remote disable, wipe, and account lockout are documented mobile device security requirements.
If True, ask for a copy of a policy or process
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 7.3 - Documented Operating Procedures
Documented operating procedures for the installation and configuration of server systems exist and are followed.
If True, ask for a copy of a policy or process for configuration and/or screenshots of configuration-matching documented procedures
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Detailed operating procedures and instructions for backups are documented, reviewed, and kept up to date.
If True, ask for a copy of a policy or process for backups and/or screenshot of last documented review
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 7.5 - Controls Against Malware
Malicious code protection mechanisms (anti-virus, spam guard, adware, spyware, etc.) are in place, are up to date and rely on multiple software solutions, limiting single points of failure.
If True, ask for a copy of a policy or process for malicious code protection and/or screenshots of solutions in place
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 7.7 - Event Logging
Logging and monitoring settings are applied consistently across all critical/important systems.
If True, ask for a copy of a policy or process for monitoring and/or screenshots of logging solutions in place
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Event and security logs are regularly reviewed according to a documented requirement and schedule.
If True, ask for a copy of a policy or process for event review and/or screenshots of solutions in place
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 7.9 - Management of Technical Vulnerabilities
Management engages in proactive vulnerability scanning to identify, assess, and address known and unknown technical vulnerabilities. Monitoring activities are performed to detect and prevent actual attacks against known and unknown vulnerabilities.
If True, ask for a copy of a policy or process for vulnerability scanning and/or screenshots of vulnerability results
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
A patch management system has been implemented which includes risk assessments against new patches.
If True, ask for a copy of a policy or process for patch management and/or screenshots of solutions in place
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 7.10 - Information Systems Audit Controls
Access control audits (user accounts, rights, privileges, and other access) are performed on a regular basis.
If True, ask for a copy of a policy or process for access control audits and/or screenshots of solutions in place
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
The results of information security audits are shared with senior management.
If True, ask for a copy of a policy or process for policy security audits reviews and/or screenshots or copy of audit review
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 7.12 - Information Transfer Policies and Procedures
Users are formally trained and made aware of common information transfer mistakes.
If True, ask for a copy of a policy or process for user training on information transfer and/or screenshots of solutions in place
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 7.13 - Information Security Requirements Analysis and Specification
The implementation of new systems includes a method for informing users and operators of their information security duties and responsibilities.
If True, ask for a copy of a policy or process
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Contracts with suppliers are in place and the contracts adequately address security requirements.
If True, ask for a copy of a policy or process
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 7.15 - Third-Party Security Risk Management
The organization has developed and maintains a current inventory of all vendors, including purpose, scope, and information security risk requirements.
If True, ask for a copy of a policy or process and/or screenshot of inventory and/or review and validation of its existence and accuracy
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Inherent and residual risks related to vendor and third party relationships are reviewed on a regular and ongoing basis.
If True, ask for a copy of a policy or process and/or screenshot of validation of review
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 8.1 - Incident Management Roles and Responsibilities
Formal incident response and escalation procedures have been adequately developed to document actions that must be taken upon knowledge of an information security event.
If True, ask for a copy of a policy or process and/or screenshot of incident response plan and/or review and validation of its existence and accuracy
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Incident response procedures are tested on a periodic basis.
If True, ask for a copy of a policy or process explaining how incident response controls are tested
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 9.1 - Planning Information Security Continuity
The organization has developed a formal business continuity plan (BCP) and/or disaster recovery (DR) process.
If True, ask for a copy of a policy or process and/or screenshot of BCP/DR plan and/or review and validation of its existence and accuracy
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Business continuity and/or disaster recovery testing and review schedules have been defined.
If True, ask for a copy of a policy or process and/or screenshot of validation of review
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 9.2 - Recovery Plan Details
The organization's recovery plans are tested on a periodic basis, and they have been tested within the past twelve (12) months.
If True, ask for a copy of a policy or process and/or screenshot of validation of testing
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 10.3 - Independent Review of Information Security
Reviews of information security policies, processes, procedures, and practices are periodically performed by an independent reviewer (e.g., internal audit, external audit, or a third party security organization specializing in such reviews).
If True, ask for a copy of a policy or process and/or screenshot of validation of review
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 10.4 - Compliance with Security Policies and Standards
Managers regularly review the level of compliance with information security policies and procedures within their respective areas of responsibility.
If True, ask for a copy of a policy or process and/or screenshot of validation of review
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Section 10.5 - Protections Against Financial Fraud
Dual control is required for all changes to payment accounts and all payment account setups.
If True, ask for a copy of a policy or process and/or screenshot of validation of review
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
The use of strong authentication is required for all access to financial systems.
If True, ask for a copy of a policy or process showing that strong authentication is in place for access to financial systems
If False, consider pursuing in remediation
If N/A, ask for a note explaining why this is not applicable and a specific date for when this will be reviewed for applicability
Related Articles