Compliance, Mapped to Your Cloud

The following points of focus, specifically related to all engagements using the trust services criteria, highlight important characteristics relating to this criterion: * **Identifies and Manages the Inventory of Information Assets:** The entity identifies, inventories, classifies, and manages information assets. * **Restricts Logical Access:** Logical access to information assets, including hardware, data (at-rest, during processing, or in transmission), software, administrative authorities, mobile devices, output, and offline system components is restricted through the use of access control software and rule sets. * **Identifies and Authenticates Users:** Persons, infrastructure, and software are identified and authenticated prior to accessing information assets, whether locally or remotely. * **Considers Network Segmentation:** Network segmentation permits unrelated portions of the entity's information system to be isolated from each other. * **Manages Points of Access:** Points of access by outside entities and the types of data that flow through the points of access are identified, inventoried, and managed. The types of individuals and systems using each point of access are identified, documented, and managed. * **Restricts Access to Information Assets:** Combinations of data classification, separate data structures, port restrictions, access protocol restrictions, user identification, and digital certificates are used to establish access-control rules for information assets. * **Manages Identification and Authentication:** Identification and authentication requirements are established, documented, and managed for individuals and systems accessing entity information, infrastructure, and software. * **Manages Credentials for Infrastructure and Software:** New internal and external infrastructure and software are registered, authorized, and documented prior to being granted access credentials and implemented on the network or access point. Credentials are removed and access is disabled when access is no longer required or the infrastructure and software are no longer in use. * **Uses Encryption to Protect Data:** The entity uses encryption to supplement other measures used to protect data at rest, when such protections are deemed appropriate based on assessed risk. * **Protects Encryption Keys:** Processes are in place to protect encryption keys during generation, storage, use, and destruction.

The following security practices are implemented: * **Restricts Access:** The types of activities that can occur through a communication channel (for example, FTP site, router port) are restricted. * **Protects Identification and Authentication Credentials:** Identification and authentication credentials are protected during transmission outside its system boundaries. * **Requires Additional Authentication or Credentials:** Additional authentication information or credentials are required when accessing the system from outside its boundaries. * **Implements Boundary Protection Systems:** Boundary protection systems (for example, firewalls, demilitarized zones, and intrusion detection systems) are implemented to protect external access points from attempts and unauthorized access and are monitored to detect such attempts.

The following security measures are enforced: * **Restricts the Ability to Perform Transmission:** Data loss prevention processes and technologies are used to restrict the ability to authorize and execute transmission, movement, and removal of information. * **Uses Encryption Technologies or Secure Communication Channels to Protect Data:** Encryption technologies or secured communication channels are used to protect the transmission of data and other communications beyond connectivity access points. * **Protects Removable Media:** Encryption technologies and physical asset protections are used for removable media (such as USB drives and backup tapes), as appropriate. * **Protects Mobile Devices:** Processes are in place to protect mobile devices (such as laptops, smartphones, and tablets) that serve as information assets.

The organization implements the following information security measures: * **Restricts Application and Software Installation:** The ability to install applications and software is restricted to authorized individuals. * **Detects Unauthorized Changes to Software and Configuration Parameters:** Processes are in place to detect changes to software and configuration parameters that may be indicative of unauthorized or malicious software. * **Uses a Defined Change Control Process:** A management-defined change control process is used for the implementation of software. * **Uses Antivirus and Anti-Malware Software:** Antivirus and anti-malware software is implemented and maintained to provide for the interception or detection and remediation of malware. * **Scans Information Assets from Outside the Entity for Malware and Other Unauthorized Software:** Procedures are in place to scan information assets that have been transferred or returned to the entity’s custody for malware and other unauthorized software and to remove any items detected prior to its implementation on the network.

The organization manages changes throughout the system life cycle using the following processes to support system availability and processing integrity: * **Manages Changes Throughout the System Life Cycle:** A process for managing system changes throughout the life cycle of the system and its components (infrastructure, data, software, and procedures). * **Authorizes Changes:** A process is in place to authorize system changes prior to development. * **Designs and Develops Changes:** A process is in place to design and develop system changes. * **Documents Changes:** A process is in place to document system changes to support ongoing maintenance of the system and to support system users in performing their responsibilities. * **Tracks System Changes:** A process is in place to track system changes prior to implementation. * **Configures Software:** A process is in place to select and implement the configuration parameters used to control the functionality of software. * **Tests System Changes:** A process is in place to test system changes prior to implementation. * **Approves System Changes:** A process is in place to approve system changes prior to implementation. * **Deploys System Changes:** A process is in place to implement system changes. * **Identifies and Evaluates System Changes:** Objectives affected by system changes are identified and the ability of the modified system to meet the objectives is evaluated throughout the system development life cycle. * **Identifies Changes in Infrastructure, Data, Software, and Procedures Required to Remediate Incidents:** Changes in infrastructure, data, software, and procedures required to remediate incidents to continue to meet objectives are identified and the change process is initiated upon identification. * **Creates Baseline Configuration of IT Technology:** A baseline configuration of IT and control systems is created and maintained. * **Provides for Changes Necessary in Emergency Situations:** A process is in place for authorizing, designing, testing, approving, and implementing changes necessary in emergency situations. Additional points of focus that apply only in an engagement using the trust services criteria for confidentiality: * **Protects Confidential Information:** The entity protects confidential information during system design, development, testing, implementation, and change processes to meet the entity’s objectives related to confidentiality. Additional points of focus that apply only in an engagement using the trust services criteria for privacy: * **Protects Personal Information:** The entity protects personal information during system design, development, testing, implementation, and change processes to meet the entity’s objectives related to privacy.

The organization addresses environmental threats and related procedures in the following ways: * **Identifies Environmental Threats:** As part of the risk assessment process, management identifies environmental threats that could impair the availability of the system, including threats resulting from adverse weather, failure of environmental control systems, electrical discharge, fire, and water. * **Designs Detection Measures:** Detection measures are implemented to identify anomalies that could result from environmental threat events. * **Implements and Maintains Environmental Protection Mechanisms:** Management implements and maintains environmental protection mechanisms to prevent and mitigate environmental events. * **Implements Alerts to Analyze Anomalies:** Management implements alerts that are communicated to personnel for analysis to identify environmental threat events. * **Responds to Environmental Threat Events:** Procedures are in place for responding to environmental threat events and for evaluating the effectiveness of those policies and procedures on a periodic basis. This includes automatic mitigation systems (e.g., uninterruptable power system and generator backup subsystem). * **Communicates and Reviews Detected Environmental Threat Events:** Detected environmental threat events are communicated to and reviewed by the individuals responsible for the management of the system and actions are taken, if necessary. * **Determines Data Requiring Backup:** Data is evaluated to determine whether backup is required. * **Performs Data Backup:** Procedures are in place for backing up data, monitoring to detect backup failures, and initiating corrective action when such failures occur. * **Addresses Offsite Storage:** Backup data is stored in a location at a distance from its principal storage location sufficient that the likelihood of a security or environmental threat event affecting both sets of data is reduced to an appropriate level. * **Implements Alternate Processing Infrastructure:** Measures are implemented for migrating processing to alternate infrastructure in the event normal processing infrastructure becomes unavailable.

The organization takes the following measures to ensure the protection and integrity of stored items and data: * **Protects Stored Items:** Stored items are protected to prevent theft, corruption, destruction, or deterioration that would prevent output from meeting specifications. * **Archives and Protects System Records:** System records are archived and archives are protected against theft, corruption, destruction, or deterioration that would prevent them from being used. * **Stores Data Completely and Accurately:** Procedures are in place to provide for the complete, accurate, and timely storage of data. * **Creates and Maintains Records of System Storage Activities:** Records of system storage activities are created and maintained completely and accurately in a timely manner.

The organization implements various access control measures to safeguard protected information assets: * **Creates or Modifies Access to Protected Information Assets:** Processes are in place to create or modify access to protected information assets based on authorization from the asset’s owner. * **Removes Access to Protected Information Assets:** Processes are in place to remove access to protected information assets when an individual no longer requires access. * **Uses Role-Based Access Controls:** Role-based access control is utilized to support segregation of incompatible functions. * **Reviews Access Roles and Rules:** The appropriateness of access roles and access rules is reviewed on a periodic basis. Inappropriate or unnecessary access is identified, and access rules are modified as appropriate.

The organization has established the following measures for detecting and managing security events: * **Implements Detection Policies, Procedures, and Tools:** Detection policies and procedures are defined and implemented, and detection tools are implemented on infrastructure and software to identify anomalies in operation or unusual activity on systems. Procedures may include: 1. A defined governance process for security event detection and management that includes provision of resources. 2. Use of intelligence sources to identify newly discovered threats and vulnerabilities. 3. Logging of unusual system activities. * **Designs Detection Measures:** Detection measures are designed to identify anomalies that could result from: 1. Compromise of physical barriers. 2. Unauthorized actions of authorized personnel. 3. Use of compromised identification and authentication credentials. 4. Unauthorized access from outside the system boundaries. 5. Compromise of authorized external parties. 6. Implementation or connection of unauthorized hardware and software. * **Implements Filters to Analyze Anomalies:** Management has implemented procedures to filter, summarize, and analyze anomalies to identify security events. * **Monitors Detection Tools for Effective Operation:** Management has implemented processes to monitor the effectiveness of detection tools.

The organization has established a comprehensive incident response program with the following components: * **Assigns Roles and Responsibilities:** Roles and responsibilities for the design, implementation, maintenance, and execution of the incident response program are assigned, including the use of external resources when necessary. * **Contains Security Incidents:** Procedures are in place to contain security incidents that actively threaten entity objectives. * **Mitigates Ongoing Security Incidents:** Procedures are in place to mitigate the effects of ongoing security incidents. * **Ends Threats Posed by Security Incidents:** Procedures are in place to end the threats posed by security incidents through closure of the vulnerability, removal of unauthorized access, and other remediation actions. * **Restores Operations:** Procedures are in place to restore data and business operations to an interim state that permits the achievement of entity objectives. * **Develops and Implements Communication Protocols for Security Incidents:** Protocols for communicating security incidents and actions taken to affected parties are developed and implemented to meet the entity's objectives. * **Obtains Understanding of Nature of Incident and Determines Containment Strategy:** An understanding of the nature and severity of the security incident is obtained to determine the appropriate containment strategy, including: 1. A determination of the appropriate response time frame. 2. The determination and execution of the containment approach. * **Remediates Identified Vulnerabilities:** Identified vulnerabilities are remediated through the development and execution of remediation activities. * **Communicates Remediation Activities:** Remediation activities are documented and communicated in accordance with the incident-response program. * **Evaluates the Effectiveness of Incident Response:** The design of incident-response activities is evaluated for effectiveness on a periodic basis. * **Periodically Evaluates Incidents:** Periodically, management reviews incidents related to security, availability, processing integrity, confidentiality, and privacy and identifies the need for system changes based on incident patterns and root causes. * **Communicates Unauthorized Use and Disclosure:** Events that resulted in unauthorized use or disclosure of personal information are communicated to the data subjects, legal and regulatory authorities, and others as required. * **Application of Sanctions:** The conduct of individuals and organizations operating under the authority of the entity and involved in the unauthorized use or disclosure of personal information is evaluated and, if appropriate, sanctioned in accordance with entity policies and legal and regulatory requirements.

The organization implements the following steps to manage and recover from security incidents: * **Restores the Affected Environment:** The activities restore the affected environment to functional operation by rebuilding systems, updating software, installing patches, and changing configurations, as needed. * **Communicates Information About the Event:** Communications about the nature of the incident, recovery actions taken, and activities required for the prevention of future security events are made to management and others as appropriate (internal and external). * **Determines Root Cause of the Event:** The root cause of the event is determined. * **Implements Changes to Prevent and Detect Recurrences:** Additional architecture or changes to preventive and detective controls, or both, are implemented to prevent and detect recurrences on a timely basis. * **Improves Response and Recovery Procedures:** Lessons learned are analyzed and the incident-response plan and recovery procedures are improved. * **Implements Incident-Recovery Plan Testing:** Incident-recovery plan testing is performed on a periodic basis. The testing includes: 1. Development of testing scenarios based on threat likelihood and magnitude. 2. Consideration of relevant system components from across the entity that can impair availability. 3. Scenarios that consider the potential for the lack of availability of key personnel. 4. Revision of continuity plans and systems based on test results.