Security — Control environment (CC1)
- Do you have a documented, approved information security policy?
- Do employees sign a code of conduct and confidentiality agreement?
- Are background checks performed for new hires?
- Is a person or team formally responsible for security?
Security — Communication & risk (CC2–CC3)
- Do you run security awareness training at least yearly?
- Do you perform a documented risk assessment at least yearly?
- Is there a fraud and threat risk register with owners?
Security — Monitoring (CC4–CC5)
- Are controls reviewed internally on a set schedule?
- Are identified control gaps tracked to closure?
Security — Access control (CC6)
- Is MFA enforced for all production and email access?
- Are user access reviews done at least quarterly?
- Is access removed within 24 hours of an employee leaving?
- Is data encrypted at rest and in transit?
- Are endpoints protected (disk encryption, antivirus/EDR)?
Security — Operations (CC7)
- Are logs centrally collected and monitored for alerts?
- Do you run vulnerability scans or penetration tests regularly?
- Do you have a tested incident response plan?
Security — Change & vendors (CC8–CC9)
- Are code/infrastructure changes peer-reviewed and approved?
- Are vendors risk-assessed before onboarding?
- Do you collect SOC 2 / ISO reports from critical vendors?
Availability (A1)
- Are backups automated and restore-tested?
- Do you have a documented business continuity / DR plan?
- Is system capacity and uptime monitored?
Processing integrity (PI1)
- Are data inputs validated and processing errors monitored?
- Are outputs reconciled or checked for completeness and accuracy?
Confidentiality (C1)
- Is confidential data classified and labelled?
- Is confidential data securely deleted when no longer needed?
Privacy (P1–P8)
- Do you publish a privacy notice describing data use?
- Do you capture and record consent where required?
- Can you handle data subject access and deletion requests?
0 of 30 answered