Compliance, Mapped to Your Cloud

The entity communicates with external parties regarding matters affecting the functioning of internal control.

The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.

Entity's Senior Management assigns the role of Information Security Officer who is delegated to centrally-manage, coordinate, develop, implement and maintain an enterprise-wide cybersecurity and privacy program.

Entity has set up mechanism to assign and manage asset ownership responsibilities and establish a common understanding of asset protection requirements.

Entity uses Sprinto, a continuous monitoring system, to track and report the health of the information security program to the Information Security Officer and other stakeholders.

Entity's Senior Management reviews and approves all company policies annually.

Entity's Senior Management reviews and approves the state of the Information Security program including policies, standards and procedures, at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy and effectiveness.

Entity periodically updates and reviews the inventory of systems as a part of installations, removals and system updates.

Entity's Senior Management reviews and approves the Organizational Chart for all employees annually.

Entity's Senior Management reviews and approves the Risk Assessment Report annually.

Entity uses Sprinto, a continuous monitoring system, to track and report the health of the information security program to the Information Security Officer and other stakeholders.

Entity's Senior Management reviews and approves all company policies annually.

Entity's Senior Management reviews and approves the state of the Information Security program including policies, standards and procedures, at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy and effectiveness.

Entity's Senior Management reviews and approves the Organizational Chart for all employees annually.

Entity has documented policy and procedures to manage Access Control and an accompanying process to register and authorize users for issuing system credentials which grant the ability to access the critical systems.

Entity uses Sprinto, a continuous monitoring system, to alert the security team to update the access levels of team members whose roles have changed.

Entity's Senior Management or the Information Security Officer periodically reviews and ensures that access to the critical systems is restricted to only those individuals who require such access to perform their job functions.

Entity ensures that the production databases access and Secure Shell access to infrastructure entities are protected from public internet access

Entity ensures that logical access provisioning to critical systems requires approval from authorized personnel on an individual need or for a predefined role.

Ensure SSH access is tightly controlled by blocking project-wide SSH keys and enabling OS Login at both instance and project levels; also restrict overly permissive access by ensuring service accounts do not have admin privileges.

Enable OS Login at the instance and project levels to bind SSH access to IAM identities and centralize authorization.

Protect sensitive data by enforcing CMEK/CSEK for storage and Dataproc, enabling Confidential Computing, and rotating KMS keys at least every 90 days.

Block project-wide SSH keys to require per-instance SSH access and reduce shared credential risk.

Apply least privilege by avoiding default service accounts and ensuring service accounts do not have admin roles or full API access.

Apply least privilege by avoiding default service accounts and ensuring service accounts do not have admin roles or full API access.

Ensure service accounts are not over-privileged and instances do not use default service accounts with full API access.

Harden remote access by disabling IP forwarding and serial ports, restricting SSH/RDP from the internet, and disabling SQL Server remote access.

Disable VM serial port access and SQL Server remote access to reduce attack surface.

Prevent external threats by disabling IP forwarding and serial ports, restricting SSH/RDP from the internet, and disabling SQL Server remote access.

Restrict data movement channels by blocking project-wide SSH keys to enforce controlled, per-instance access.

To meet its objectives, the entity uses detection and monitoring procedures to identify changes to configurations that result in the introduction of new vulnerabilities, and susceptibilities to newly discovered vulnerabilities.

To meet its objectives, the entity uses detection and monitoring procedures to identify changes to configurations that result in the introduction of new vulnerabilities, and susceptibilities to newly discovered vulnerabilities.

To meet its objectives, the entity uses detection and monitoring procedures to identify changes to configurations that result in the introduction of new vulnerabilities, and susceptibilities to newly discovered vulnerabilities.

The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.

The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.

The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.

The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.

The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures.

The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures.

The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures.

The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures.

The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures.