Controls

Internal Security Assessment

Internal security assessments are performed at least annually, covering systems, access permissions, and security controls. Assessments may be conducted internally or by a third party.

Incident Response

The organization maintains an incident response plan covering detection, containment, eradication, recovery, and post-incident review. The plan is tested at least annually.

Vendor Risk Management

Security and privacy risk assessments are performed before engaging vendors involving data exchange or technical integration. An approved vendor and software list is maintained.

Physical Security

Office and data center facilities are secured with badge access, visitor logs, surveillance cameras, and clean desk policies. Business continuity plans are maintained and tested.

Privacy and Notices

The organization publishes privacy policies, security notices, and terms of use. Customers are promptly notified of any material changes.

Risk Management

The organization maintains a formal risk management program that includes identification, assessment, mitigation, monitoring, and periodic review of risks.