| CONSENSUS ASSESSMENTS INITIATIVE QUESTIONNAIRE v3.0.1 |
| Control Group | CGID | CID | Control Specification | Consensus Assessment Questions | Responses | ACME Compliance | CCM v3.0.1 Compliance Mapping |
| Assigned to | AICPA TSC 2009 | AICPA
Trust Service Criteria (SOC 2SM Report) | AICPA TSC 2014 | BITS Shared Assessments
AUP v5.0 | BITS Shared Assessments
SIG v6.0 | BSI Germany | Canada PIPEDA | CCM V1.X | COBIT 4.1 | COBIT 5.0 | COPPA | CSA Enterprise Architecture (formerly the Trusted Cloud Initiative) | CSA Guidance V3.0 | ENISA IAF | 95/46/EC - European Union Data Protection Directive | FedRAMP Security Controls
(Final Release, Jan 2012)
--LOW IMPACT LEVEL-- | FedRAMP Security Controls
(Final Release, Jan 2012)
--MODERATE IMPACT LEVEL-- | FERPA | GAPP (Aug 2009) | HIPAA/HITECH (Omnibus Rule) | ISO/IEC 27001:2005 | ISO/IEC 27001:2013 | ITAR | Jericho Forum | Mexico - Federal Law on Protection of Personal Data Held by Private Parties | NERC CIP | NIST SP800-53 R3 | NIST SP800-53 R3 Appendix J | NZISM | ODCA UM: PA R2.0 | PCI DSS v2.0 | PCI DSS v3.0 |
| Domain > Container > Capability | Public | Private | PA ID | PA level |
| 1 | Application & Interface Security
Application Security | AIS-01 | AIS-01.1 | MY | Applications and programming interfaces (APIs) shall be designed, developed, deployed and tested in accordance with leading industry standards (e.g., OWASP for web applications) and adhere to applicable legal, statutory, or regulatory compliance obligations. | Do you use industry standards (Build Security in Maturity Model [BSIMM] benchmarks, Open Group ACS Trusted Technology Provider Framework, NIST, etc.) to build in security for your Systems/Software Development Lifecycle (SDLC)? | ACME uses its own SDLC process, relying heavily on the Agile development methodology built into its own product. ACME's SDLC includes a number of steps designed to review the source code. This includes both manual and automated source code reviews. The automatic source code reviews are conducted using a well-known tool.
ACME also conducts extensive penetration testing including automated penetration testing, external penetration testing and manual penetration as well as functional security testing of ACLs and product components. ACME SLDC includes:
1) Security teams involves in the Agile SCRUM teams
2) Code reviews, both manual and automated throughout the development process.
3) Multiple levels of penetration testing including internal and external testing.
4) Security test cases with every ACME release undergoing over 6000 standard tests cases covering security, functionality and high availability.
As AIS-01.2 below. | Partial | S3.10.0 | (S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies to enable authorized access and to prevent unauthorized access.
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined processing integrity and related security policies. | CC7.1 | I.4 | G.16.3, I.3 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-04 | COBIT 4.1 AI2.4 | APO09.03
APO13.01
BAI03.01
BAI03.02
BAI03.03
BAI03.05
MEA03.01
MEA03.02 | 312.8 and 312.10 | Application Services > Development Process > Software Quality Assurance | shared | x | Domain 10 | 6.03.01. (c) | Article: 27 (3) | NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SC-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-14 | NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SC-2
NIST SP 800-53 R3 SC-4
NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SC-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SC-10
NIST SP 800-53 R3 SC-11
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-12 (2)
NIST SP 800-53 R3 SC-12 (5)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-14
NIST SP 800-53 R3 SC-17
NIST SP 800-53 R3 SC-18 | 1.2.6 | 45 CFR 164.312(e)(2)(i) | A.11.5.6
A.11.6.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.5.2
A.12.5.4
A.12.5.5
A.12.6.1
A.15.2.1 | A9.4.2
A9.4.1,
8.1*Partial, A14.2.3,
8.1*partial, A.14.2.7
A12.6.1,
A18.2.2 | Commandment #1
Commandment #2
Commandment #4
Commandment #5
Commandment #11 | CIP-007-3 - R5.1 | SC-2
SC-3
SC-4
SC-5
SC-6
SC-7
SC-8
SC-9
SC-10
SC-11
SC-12
SC-13
SC-14
SC-17
SC-18
SC-20
SC-21
SC-22
SC-23 | AR-7 The organization designs information systems to support privacy by automating privacy controls. | 14.5
14.6 | PA17
PA31 | SGP
BSGP | PCI DSS v2.0 6.5 | 6, 6.5 |
| 2 | AIS-01.2 | MY | Do you use an automated source code analysis tool to detect security defects in code prior to production? | ACME reviews its software throughout development using a number of approaches including manual and static code reviews, 3rd party continuous testing and 3rd party application penetration testing. Low ranked or informational findings, especially where mitigating or compensating controls may be in place, are therefore not always addressed prior to major releases being made available.
Additionally, to validate secure coding efforts, a combination of rolling security testing of the current codebase by a 3rd party, static code analysis & peer review and annual/major release penetration testing by another 3rd party is performed.
Please see more information regarding automated source code analysis as described in the Application Vulnerability Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=3ebc6e25dbd0dbc01dcaf3231f961902
Penetration test reports performed by an independent third-party for each major ACME release are available on the ACME CORE here: https://community.ACME.com/community?id=community_topic&sys_id=ec499e2ddbd897c068c1fb651f96192c | Yes |
| 3 | AIS-01.3 | MY | Do you use manual source-code analysis to detect security defects in code prior to production? | As AIS-01.2 above. | Yes |
| 4 | AIS-01.4 | MY | Do you verify that all of your software suppliers adhere to industry standards for Systems/Software Development Lifecycle (SDLC) security?
| ACME does not use third parties for code development. | Not Applicable |
| 5 | AIS-01.5 | MY | (SaaS only) Do you review your applications for security vulnerabilities and address any issues prior to deployment to production? | As AIS-01.2 above. | Yes |
| 6 | Application & Interface Security
Customer Access Requirements | AIS-02 | AIS-02.1 | MY | Prior to granting customers access to data, assets, and information systems, (removed all) identified security, contractual, and regulatory requirements for customer access shall be addressed. | Are all identified security, contractual and regulatory requirements for customer access contractually addressed and remediated prior to granting customers access to data, assets and information systems? | Customers control the access to their instance, and are the owner of all information entered into their instance. ACME does not participate in the user provisioning process to customer instances, nor does it monitor or dictate the type of data stored within the instance. | N/A | S3.2a | (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public. | CC5.1 | C.2.1, C.2.3, C.2.4, C.2.6.1, H.1 | 10 (B)
11 (A+) | Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.3 | SA-01 | APO09.01
APO09.02
APO09.03
APO13.01
BAI02
DSS05
| 312.3, 312.8 and 312.10 | BOSS > Legal Services > Contracts | shared | x | Domain 10 | Article 17 (1), (2) | NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6 | NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6 | 1.2.2
1.2.6
6.2.1
6.2.2 | A.6.2.1
A.6.2.2
A.11.1.1 | A9.1.1. | Commandment #6
Commandment #7
Commandment #8 | CA-1
CA-2
CA-5
CA-6 | AP-1 The organization determines and documents the legal authority that permits the collection, use, maintenance, and sharing of personally identifiable information (PII), either generally or in support of a specific program or information system need. | 9.2 | 4.1.1, 4.2, 4.3 |
| 7 | AIS- 02.2 | MY | Are all requirements and trust levels for customers’ access defined and documented? | ACME treats all customer data equally. Any customer data that is stored or processed by a ACME instance is classified as 'Customer Confidential’ regardless of the data criticality and sensitivity level deemed by the customer. Customer, as data owner, is responsible for classifying their data according to their business needs.
If a customer environment or data is impacted, the customer will be notified via their normal support contacts as required by their SLA. ACME doesn't dictate the type of data stored within a customer's instance.
Customers are responsible for managing access to their instance. Please see additional information here: https://docs.ACME.com/bundle/geneva-ACME-platform/page/integrate/single_sign_on/concept/c_Authentication.html | Yes |
| 8 | Application & Interface Security
Data Integrity | AIS-03 | AIS-03.1 | MY | Data input and output integrity routines (i.e., reconciliation and edit checks) shall be implemented for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse. | Are data input and output integrity routines (i.e., reconciliation and edit checks) implemented for application interfaces and databases to prevent manual or systematic processing errors or corruption of data? | The ACME application supports both native input validation and more advanced validation through RegEx (regular expression) scripts.
Customers are able to customize their instances to put in place additional checks to suit their data integrity needs, particularly those related to any customized business logic that they implement. Output sanitation is also carried out to prevent XSS and associated vulnerabilities.
In addition to its input validation and output sanitation, ACME has processes in place to report any vulnerabilities and to produce patches to fix any discovered issues. ACME allows customers to chose patches and upgrades from a list of available patches and upgrade. In addition, ACME runs a Quarterly Patching Process to insure that customers are on the latest general customer-facing patch of their release family.
Please refer to the Product Documentation about using Regular Expressions in scripts here: https://docs.ACME.com/bundle/istanbul-application-development/page/script/general-scripting/concept/c_RegularExpressionsInScripts.html | Yes | S3.4 | (I3.2.0) The procedures related to completeness, accuracy, timeliness, and authorization of inputs are consistent with the documented system processing integrity policies.
(I3.3.0) The procedures related to completeness, accuracy, timeliness, and authorization of system processing, including error correction and database management, are consistent with documented system processing integrity policies.
(I3.4.0) The procedures related to completeness, accuracy, timeliness, and authorization of outputs are consistent with the documented system processing integrity policies.
(I3.5.0) There are procedures to enable tracing of information inputs from their source to their final disposition and vice versa. | PI1.2
PI1.3
PI1.5 | I.4 | G.16.3, I.3 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-05 | DSS06.02
DSS06.04 | 312.8 and 312.10 | Application Services > Programming Interfaces > Input Validation | shared | x | Domain 10 | NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-3 | NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SI-6
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)
NIST SP 800-53 R3 SI-9
NIST SP 800-53 R3 SI-10
NIST SP 800-53 R3 SI-11 | 1.2.6 | 45 CFR 164.312 (c)(1) (New)
45 CFR 164.312 (c)(2)(New)
45 CFR 164.312(e)(2)(i)(New) | A.10.9.2
A.10.9.3
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.6.1
A.15.2.1 | A13.2.1,
A13.2.2,
A9.1.1,
A9.4.1,
A10.1.1
A18.1.4 | Commandment #1
Commandment #9
Commandment #11 | CIP-003-3 - R4.2 | SI-10
SI-11
SI-2
SI-3
SI-4
SI-6
SI-7
SI-9 | AR-7 The organization designs information systems to support privacy by automating privacy controls. | 14.5
14.6 | PA25 | GP | PCI DSS v2.0 6.3.1
PCI DSS v2.0 6.3.2 | 6.3.1
6.3.2 |
| 9 | Application & Interface Security
Data Security / Integrity | AIS-04 | AIS-04.1 | MY | Policies and procedures shall be established and maintained in support of data security to include (confidentiality, integrity and availability) across multiple system interfaces, jurisdictions and business functions to prevent improper disclosure, alternation, or destruction. | Is your Data Security Architecture designed using an industry standard (e.g., CDSA, MULITSAFE, CSA Trusted Cloud Architectural Standard, FedRAMP, CAESARS)?
| ACME has a documented Information Security Policy (ISP) that covers access to ACME and its Customer’s data; of which has specific policies to address Identity, Authentication and Authorization pertaining to information systems that store or access ACME or customer data.
Further, ACME has built its continuous monitoring program on the NIST 800-53 control set.
Please refer to the Information Security Policy here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0
| Yes | (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.6 | B.1 | G.8.2.0.2, G.8.2.0.3, G.12.1, G.12.4, G.12.9, G.12.10, G.16.2, G.19.2.1, G.19.3.2, G.9.4, G.17.2, G.17.3, G.17.4, G.20.1 | 6 (B)
26 (A+) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-03 | COBIT 4.1 DS5.11 | APO09.01
APO09.02
APO09.03
APO13.01
DSS05.02
DSS06.06
MEA03.01
MEA03.02 | 312.8 and 312.10 | BOSS > Data Governance > Rules for Information Leakage Prevention | shared | x | Domain 10 | 6.02. (b)
6.04.03. (a) | Article 17 (1), (2),(3), (4) | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-13 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-4
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-8 | 1.1.0
1.2.2
1.2.6
4.2.3
5.2.1
7.1.2
7.2.1
7.2.2
7.2.3
7.2.4
8.2.1
8.2.2
8.2.3
8.2.5
9.2.1 | A.10.8.1
A.10.8.2
A.11.1.1
A.11.6.1
A.11.4.6
A.12.3.1
A.12.5.4
A.15.1.4 | A13.2.1,
A13.2.2,
A9.1.1,
A9.4.1,
A10.1.1
A18.1.4 | All | AC-1
AC-4
SC-1
SC-16 | AR-7 The organization designs information systems to support privacy by automating privacy controls. | 16.5
16.8
17.4 | PA20
PA25
PA29 | GP
P
SGP | PCI DSS v2.0 2.3
PCI DSS v2.0 3.4.1,
PCI DSS v2.0 4.1
PCI DSS v2.0 4.1.1
PCI DSS v2.0 6.1
PCI DSS v2.0 6.3.2a
PCI DSS v2.0 6.5c
PCI DSS v2.0 8.3
PCI DSS v2.0 10.5.5
PCI DSS v2.0 11.5 | 2.3
3.4.1
4.1
4.1.1
6.1
6.3.2a
6.5c, 7.1, 7.2, 7.3, 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 8.8
10.5.5, 10.8
11.5, 11.6 |
| 10 | Audit Assurance & Compliance
Audit Planning | AAC-01
| AAC-01.1 | MY | Audit plans shall be developed and maintained to address business process disruptions. Auditing plans shall focus on reviewing the effectiveness of the implementation of security operations. All audit activities must be agreed upon prior to executing any audits. | Do you produce audit assertions using a structured, industry accepted format (e.g., Cloud Audit/A6 URI Ontology, CloudTrust, SCAP/CYBEX, GRC XML, ISACA's Cloud Computing Management Audit/Assurance Program, etc.)?
| ACME provides a software-as-a-service (SaaS) solution to our enterprise customers whose regulatory requirements scope, in many cases, extends to include ACME's application and business processes. Customers are responsible for determining the regulatory requirements for the data in their instances and are able to customize the solution to meet their internal and regulatory requirements. ACME has a dedicated team to manage and drive compliance efforts, including commercial and Federal certifications, regulatory compliance, and legal compliance.
ACME's information security program is based on NIST 800-53 and ISO 27001. ACME has chosen the ISO 27001 certification to provide internal and external stakeholders with a high level of assurance that our information security policy and processes are robust and a strong control environment exists around our software-as-a-service (SaaS) instance. Therefore, ACME does not attest compliance with any customer policies, standards, and/or controls.
ACME is reviewed on an annual basis by independent third party auditors to maintain ISO 27001 certification, ISO 27018 certification, FedRAMP authorization, and MTCS certification and to obtain SSAE18 SOC 1 Type II and SOC 2 Type II reports. Additionally, ACME undergoes multiple internal audits and customer audits each year.
Note: ACME does not share its ISO 27001 Statement of Applicability (SOA) externally. The SOA details how controls are achieved and which controls are not applicable; therefore, the document could highlight to unauthorized users the areas where ACME is vulnerable.
A SOC 3 reports on the same information as a SOC 2 report. The main difference between the reports is that a SOC 3 is intended for a general audience; therefore, these reports are shorter and do not include the same details as a SOC 2 report. Due to their more general nature, SOC 3 reports can be shared openly and posted on a company's website with a seal indicating their compliance. ACME constantly evaluates its certification posture for relevant expansion. At this point, we have no plans to obtain the SOC 3 certification.
Please refer to the CORE for copies of ACME's Third Party Attestations here: https://community.ACME.com/community?id=community_topic&sys_id=6c499e2ddbd897c068c1fb651f961924
ACME's support methodology is aligned with the Information Technology Infrastructure Library (ITIL) framework. The ACME product is verified by Pink Elephant's PinkVerify2011 for 11 ITIL Processes: https://www.pinkelephant.com/en-US/PinkVERIFY/PinkVERIFYToolsets.
As publicly traded company, ACME is required to comply with U.S. Securities and Exchange Commission (SEC) public reporting requirements and the Sarbanes-Oxley Act of 2002 (SOX). ACME's SEC filings are available on our public website: https://www.ACME.com/company/investor-relations/sec-filings.html. | Yes | S4.1.0
S4.2.0 | (S4.1.0) The entity’s system security is periodically reviewed and compared with the defined system security policies.
(S4.2.0) There is a process to identify and address potential impairments to the entity’s ongoing ability to achieve its objectives in accordance with its defined system security policies. | CC4.1 | L.1, L.2, L.7, L.9, L.11 | 58 (B) | CO-01 | COBIT 4.1 ME 2.1, ME 2.2 PO 9.5 PO 9.6 | APO12.04
APO12.05
APO12.06
MEA02.01
MEA02.02 | Title 16 Part 312 | BOSS > Compliance > Audit Planning | shared | x | Domain 2, 4 | 6.01. (d) | NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-7 | NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)
NIST SP 800-53 R3 PL-6 | 10.2.5 | 45 CFR 164.312(b) | Clause 4.2.3 e)
Clause 4.2.3b
Clause 5.1 g
Clause 6
A.15.3.1 | Clauses
4.3(a),
4.3(b),
5.1(e),
5.1(f),
6.2(e),
9.1,
9.1(e),
9.2,
9.3(f),
A12.7.1 | Commandment #1
Commandment #2
Commandment #3 | CA-2
CA-7
PL-6 | AR-4 Privacy Auditing and Monitoring. To promote accountability, organizations identify and address gaps in privacy compliance, management, operational, and technical controls by conducting regular assessments (e.g., internal risk assessments). Audit for effective implementation of all privacy controls identified in this appendix, organizations assess whether they: (i) implement a process to embed privacy considerations into the life cycle of personally identifiable information (PII), programs, information systems, mission/business processes, and technology; (ii) monitor for changes to applicable privacy laws, regulations, and policies; (iii) track programs, information systems, and applications that collect and maintain PII to ensure compliance; (iv) ensure that access to PII is only on a need-to-know basis; and (v) ensure that PII is being maintained and used only for the legally authorized purposes identified in the public notice(s). | 5.1, 5.3, 5.4 | PA15 | SGP | PCI DSS v2.0 2.1.2.b |
| 11 | Audit Assurance & Compliance
Independent Audits | AAC-02 | AAC-02.1 | MY | Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures and compliance obligations. | Do you allow tenants to view your SOC2/ISO 27001 or similar third-party audit or certification reports? | Please refer to the CORE for copies of ACME's Third Party Attestations here: https://community.ACME.com/community?id=community_topic&sys_id=6c499e2ddbd897c068c1fb651f961924
Note: ACME does not share its ISO 27001 Statement of Applicability (SOA) externally. The SOA details how controls are achieved and which controls are not applicable; therefore, the document could highlight to unauthorized users the areas where ACME is vulnerable.
| Yes | S4.1.0
S4.2.0 | (S4.1.0) The entity’s system security is periodically reviewed and compared with the defined system security policies.
(S4.2.0) There is a process to identify and address potential impairments to the entity’s ongoing ability to achieve its objectives in accordance with its defined system security policies. | CC4.1 | L.2, L.4, L.7, L.9, L.11 | 58 (B)
59 (B)
61 (C+, A+)
76 (B)
77 (B) | CO-02 | COBIT 4.1 DS5.5, ME2.5, ME 3.1 PO 9.6 | APO12.04
APO12.05
DSS05.07
MEA02.06
MEA02.07
MEA02.08
MEA03.01 | Title 16 Part 312 | BOSS > Compliance > Independent Audits | shared | x | Domain 2, 4 | 6.03. (e)
6.07.01. (m)
6.07.01. (n) | NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 RA-5 | NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 RA-5 (1)
NIST SP 800-53 R3 RA-5 (2)
NIST SP 800-53 R3 RA-5 (3)
NIST SP 800-53 R3 RA-5 (6)
NIST SP 800-53 R3 RA-5 (9) | 1.2.5
1.2.7
4.2.1
8.2.7
10.2.3
10.2.5 | 45 CFR 164.308 (a)(8)
45 CFR 164.308(a)(1)(ii)(D) | Clause 4.2.3e
Clause 5.1 g
Clause 5.2.1 d)
Clause 6
A.6.1.8 | Clauses
4.3(a),
4.3(b),
5.1(e),
5.1(f),
9.1,
9.2,
9.3(f),
A18.2.1 | Commandment #1
Commandment #2
Commandment #3 | Chapter VI, Section 1
Article 39, I. and VIII.
Chapter 8
Article 59 | CIP-003-3 - R1.3 - R4.3
CIP-004-3 R4 - R4.2
CIP-005-3a - R1 - R1.1 - R1.2 | CA-1
CA-2
CA-6
RA-5 | AR-4. Privacy Auditing and Monitoring. These assessments can be self-assessments or third party audits that result in reports on compliance gaps identified in programs, projects, and information systems. | 6.1 | PA18 | GP | PCI DSS v2.0 11.2
PCI DSS v2.0 11.3
PCI DSS v2.0 6.6
PCI DSS v2.0 12.1.2.b | 11.2
11.3
6.3.2, 6.6
11.2.1, 11.2.2, 11.2.3, 11.3.1, 11.3.2, 12.1.2.b, 12.8.4 |
| 12 | CO-02 | AAC-02.2 | MY | Do you conduct network penetration tests of your cloud service infrastructure regularly as prescribed by industry best practices and guidance? | ACME executes a network penetration test at least once per year. ACME tests its controls and procedures on a continuous basis. Additionally, ACME has a process to track, evaluate, and risk rank and resolve/mitigate vulnerabilities. If there are any major security issues impacting a customer, ACME follows its Security Incident Response (SIRT) process and communicates these to customers if a customer environment was affected or had the potential to be affected. ACME uses vulnerability scanning tool to perform external vulnerability scans on a daily basis and internal vulnerability scans on a weekly basis. ACME annually performs 3rd party penetration test and network penetration tests.
Please refer to the Cloud Vulnerability Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=6dec2e65dbd0dbc01dcaf3231f961918 | Yes |
| 13 | CO-02 | AAC-02.3 | MY | Do you conduct application penetration tests of your cloud infrastructure regularly as prescribed by industry best practices and guidance?
| Infrastructure vulnerability scans occur daily for external unauthenticated scanning and weekly for internal authenticated scanning.
Additionally, ACME's application penetration testing program has four aspects:
1) ACME conducts 3rd party, continuous loop testing on a ACME instance where developers check in their code as it is completed.
2) ACME uses commercially available penetration-testing tool to conduct both formal and informal penetration testing during the SDLC.
3) The third and most intensive phase is the major release penetration testing. A third party organization is given an extended period of time and access to the resources necessary to test ACME's security and occurs in two rounds. At the end of the first round of testing any issues discovered are entered into ACME problem resolution process with issues categorized as High or Critical requiring attention. At the end of the development and remediation cycle, a second round of testing is conducted again to confirm the remediation or mitigation of the discovered issues.
4) The final and most important aspect of ACME's penetration testing regime is its customer penetration-testing program. Existing customers, through a documented approval process, are permitted to perform an annual application level penetration test. The testing must be approved and conducted at a time that is agreed upon by ACME to allow ACME to continue to conduct its monitoring activities and be able to determine potential real attacks from authorized customer activities. Customers must upgrade their instances to the latest release and follow ACME's hardening guide before conducting any penetration testing to avoid large scale reporting of previously fixed issues. The customer must share all results with ACME's Application Security team.
Please refer to the Cloud Vulnerability Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=6dec2e65dbd0dbc01dcaf3231f961918 | Yes |
| 14 | CO-02 | AAC-02.4 | MY | Do you conduct internal audits regularly as prescribed by industry best practices and guidance? | ACME has a dedicated compliance team to manage and drive compliance efforts, including commercial and Federal certifications, regulatory compliance, and legal compliance.
Please refer the Internal Compliance Audit SOP here: https://community.ACME.com/community?id=community_article&sys_id=2e7ca2e1dbd0dbc01dcaf3231f9619c5
| Yes |
| 15 | CO-02 | AAC-02.5 | MY | Do you conduct external audits regularly as prescribed by industry best practices and guidance? | ACME is reviewed on an annual basis by independent third party auditors to maintain ISO 27001 certification, ISO 27018 certification, FedRAMP authorization, and MTCS certification and to obtain SSAE18 SOC 1 Type II and SOC 2 Type II reports. Additionally, ACME undergoes multiple internal audits and customer audits each year.
ACME's third party attestations are available on the ACME CORE: https://community.ACME.com/community?id=community_topic&sys_id=6c499e2ddbd897c068c1fb651f961924
Please refer to the External Audit SOP here: https://community.ACME.com/community?id=community_article&sys_id=549caae1dbd0dbc01dcaf3231f9619ec | Yes |
| 16 | CO-02 | AAC-02.6 | MY | Are the results of the penetration tests available to tenants at their request? | ACME allows their customers to perform application penetration tests on their Instances. Typically this is limited in contract to one test per year and it is required that customers complete ACME's penetration test request. There is a joint engagement call after the request is completed and a walk through of the 'get-ready' checklist occurs prior to the scan.
Customers must upgrade their instances to the latest release and follow ACME's hardening guide before conducting any penetration testing to avoid large scale reporting of previously fixed issues. The customer must share all results with ACME's Application Security team.
Additionally, ACME provides the summary reports from the third party pen tests performed on the network, and each major family release. Please refer to the Penetration Test Results here: https://community.ACME.com/community?id=community_topic&sys_id=ec499e2ddbd897c068c1fb651f96192c | Yes |
| 17 | CO-02 | AAC-02.7 | MY | Are the results of internal and external audits available to tenants at their request? | As AAC-02.5 above. | Yes |
| 18 | AAC-02.8 | MY | Do you have an internal audit program that allows for cross-functional audit of assessments? | The Governance, Risk and Compliance (GRC) team define policies, and requirements for standards, processes, procedures, baselines, guidelines and risk assessments, monitor compliance with Information security policies through internal and external audit, ensure compliance with government, regulatory and contractual information system security related requirements, coordinate customer audits, audit response, and audit mitigation, Perform internal and external audits and report results to Security Management Council, perform risk assessments in support of identifying and managing risks related to the operation of the ISMS.
Please refer to the Internal Compliance Audit SOP here: https://community.ACME.com/community?id=community_article&sys_id=2e7ca2e1dbd0dbc01dcaf3231f9619c5 | Yes |
| 19 | Audit Assurance & Compliance
Information System Regulatory Mapping | AAC-03 | AAC-03.1 | MY | Organizations shall create and maintain a control framework which captures standards, regulatory, legal, and statutory requirements relevant for their business needs. The control framework shall be reviewed at least annually to ensure changes that could affect the business processes are reflected. | Do you have the ability to logically segment or encrypt customer data such that data may be produced for a single tenant only, without inadvertently accessing another tenant's data? | ACME is a logically single-tenant environment. Customers share a hardware platform (no virtualization), but access entirely separate individual instances of the ACME platform. Each individual instance connects to a dedicated database and database service only accessible by that specific instance.
ACME's single-tenant architecture consists of three tiers that provide code and data isolation:
1) The proxy layer of the application accepts incoming requests and, based on the DNS name being requested, does a Port Address Translation before passing the requests through to the next layer.
2) The application layer is a Java application that is sandboxed with each instance only listening on a single port and running in its own JVM. This provides code isolation and prevents instances from hearing traffic destined to another instance. This also allows updates to be applied to each instance without affecting other instances.
3) The database layer provides a separate MySQL database for each instance. There is no co-mingling of data or ACLs used to keep customer data separate.
Please refer to the encryption whitepaper here: https://community.ACME.com/community?id=community_article&sys_id=f67ce2e1dbd0dbc01dcaf3231f961929 | Yes | CC3.1 | COBIT 4.1 ME 3.1 | APO12.01
APO12.02
APO12.03
MEA03.01 | 312.4 | BOSS > Compliance > Information System Regulatory Mapping | shared | x | Domain 2, 4 | ISO/IEC 27001:2005
Clause 4.2.1 b) 2)
Clause 4.2.1 c) 1)
Clause 4.2.1 g)
Clause 4.2.3 d) 6)
Clause 4.3.3
Clause 5.2.1 a - f
Clause 7.3 c) 4)
A.7.2.1
A.15.1.1
A.15.1.3
A.15.1.4
A.15.1.6 | Clauses
4.2(b),
4.4,
5.2(c),
5.3(ab),
6.1.2,
6.1.3,
6.1.3(b),
7.5.3(b),
7.5.3(d),
8.1,
8.3
9.2(g),
9.3,
9.3(b),
9.3(f),
10.2,
A.8.2.1,
A.18.1.1,
A.18.1.3,
A.18.1.4,
A.18.1.5 | 1.2
2.2
3.3
5.2 | PCI DSS v2.0 3.1.1
PCI DSS v2.0 3.1 | 3.1 |
| 20 | CO-05 | AAC-03.2 | MY | Do you have capability to recover data for a specific customer in the case of a failure or data loss? | ACME has a formally documented Information System Contingency Plan (ISCP) which describes the recovery resources, procedures, and priorities necessary to provide seamless customer access in the event a disaster takes place that impacts customer data at the data center(s). The ISCP is dependent on ACME's Advanced High Availability (AHA) data center architecture which provides replication and redundancy. ACME's data centers are arranged in pairs. All customer production data is stored in both data centers in a pair and kept in sync using asynchronous database replication. Subproduction instances are only located in a single data center and are not replicated between data centers. Both data centers in a pair are active at all times and have identical processing capabilities; each data center has the ability to support the combined production load of the pair. Each data center has multiple ISPs coming into every data center cage, redundant network paths throughout the network, redundant disks in RAID arrays, redundant power suppliers, and many other hardware and configurations designed to remove single points of failure from the architecture. In the event of a disaster, ACME activates a failover process that transfers customer operations to the alternate data center in the pair. From this perspective, ACME is providing customers with business continuity as opposed to disaster recovery.
Please refer to the ISCP here: https://community.ACME.com/community?id=community_article&sys_id=aa4c22a1dbd0dbc01dcaf3231f9619a2
Please refer to the Backup and Restoration SOP here: https://community.ACME.com/community?id=community_article&sys_id=955d6629dbd0dbc01dcaf3231f96191c | Yes |
| 21 | AAC-03.3 | MY | Do you have the capability to restrict the storage of customer data to specific countries or geographic locations? | Customers can nominate North America, EU (London and Amsterdam), Australia, Canada, Switzerland, Brazil, South East Asia (Singapore and Hong Kong) as their hosting location. Customers can also dictate which data center pair their data is housed in and can manage IP address restrictions to limit the transmission of data.
Once data is placed in the selected data center pair it will not be moved to another location. Customers would be notified should a data center move be required. Relocation, and transfer of data/hardware from one datacenter to another follows our change management process and would require authorization from the customer. | Yes |
| 22 | AAC-03.4 | MY | Do you have a program in place that includes the ability to monitor changes to the regulatory requirements in relevant jurisdictions, adjust your security program for changes to legal requirements, and ensure compliance with relevant regulatory requirements? | ACME has a dedicated team to manage and drive compliance efforts, including commercial and Federal certifications, regulatory compliance, and legal compliance. | Yes |
| 23 | Business Continuity Management & Operational Resilience
Business Continuity Planning | BCR-01 | BCR-01.1 | MY | A consistent unified framework for business continuity planning and plan development shall be established, documented and adopted to ensure all business continuity plans are consistent in addressing priorities for testing, maintenance, and information security requirements. Requirements for business continuity plans include the following:
• Defined purpose and scope, aligned with relevant dependencies
• Accessible to and understood by those who will use them
• Owned by a named person(s) who is responsible for their review, update, and approval
• Defined lines of communication, roles, and responsibilities
• Detailed recovery procedures, manual work-around, and reference information
• Method for plan invocation | Do you provide tenants with geographically resilient hosting options? | As AAC-03.3 above. | Yes | A3.1.0
A3.3.0
A3.4.0 | (A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.
(A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.
(A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies. | CC3.1
A1.2
A1.3 | K.1.2.3. K.1.2.4, K.1.2.5, K.1.2.6, K.1.2.7, K.1.2.11, K.1.2.13, K.1.2.15 | RS-03 | DSS04.01
DSS04.02
DSS04.03
DSS04.05 | BOSS > Operational Risk Management > Business Continuity | provider | x | Domain 7, 8 | 6.07. (a)
6.07. (b)
6.07. (c) | Article 17 (1), (2) | NIST SP800-53 R3 CP-1
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-9
NIST SP800-53 R3 CP-10 | NIST SP800-53 R3 CP-1
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-2 (1)
NIST SP800-53 R3 CP-2 (2)
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-4 (1)
NIST SP800-53 R3 CP-6
NIST SP800-53 R3 CP-6 (1)
NIST SP800-53 R3 CP-6 (3)
NIST SP800-53 R3 CP-7
NIST SP800-53 R3 CP-7 (1)
NIST SP800-53 R3 CP-7 (2)
NIST SP800-53 R3 CP-7 (3)
NIST SP800-53 R3 CP-7 (5)
NIST SP800-53 R3 CP-8
NIST SP800-53 R3 CP-8 (1)
NIST SP800-53 R3 CP-8 (2)
NIST SP800-53 R3 CP-9
NIST SP800-53 R3 CP-9 (1)
NIST SP800-53 R3 CP-9 (3)
NIST SP800-53 R3 CP-10
NIST SP800-53 R3 CP-10 (2)
NIST SP800-53 R3 CP-10 (3)
NIST SP800-53 R3 PE-17 | 45 CFR 164.308 (a)(7)(i)
45 CFR 164.308 (a)(7)(ii)(B)
45 CFR 164.308 (a)(7)(ii)(C)
45 CFR 164.308 (a)(7)(ii)(E)
45 CFR 164.310 (a)(2)(i)
45 CFR 164.312 (a)(2)(ii) | Clause 5.1
A.6.1.2
A.14.1.3
A.14.1.4 | Clause 5.1(h)
A.17.1.2
A.17.1.2 | Commandment #1
Commandment #2
Commandment #3 | CP-1
CP-2
CP-3
CP-4
CP-6
CP-7
CP-8
CP-9
CP-10
PE-17 | UL-2 INFORMATION SHARING WITH THIRD PARTIES - a. Shares personally identifiable information (PII) externally, only for the authorized purposes identified in the Privacy Act and/or described in its notice(s) or for a purpose that is compatible with those purposes; b. Where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically describe the PII covered and specifically enumerate the purposes for which the PII may be used; c. Monitors, audits, and trains its staff on the authorized sharing of PII with third parties and on the consequences of unauthorized use or sharing of PII; and d. Evaluates any proposed new instances of sharing PII with third parties to assess whether the sharing is authorized and whether additional or new public notice is required. | 6.4 | PCI DSS v2.0 12.9.1
PCI DSS v2.0 12.9.3
PCI DSS v2.0 12.9.4
PCI DSS v2.0 12.9.6 | 12.9.1
12.9.3
12.9.4
12.9.6 |
| 24 | RS-03 | BCR-01.2 | MY | Do you provide tenants with infrastructure service failover capability to other providers? | ACME has a formally documented Information System Contingency Plan (ISCP) which describes the recovery resources, procedures, and priorities necessary to provide seamless customer access in the event a disaster takes place that impacts customer data at the data center(s). The ISCP is dependent on ACME's Advanced High Availability (AHA) data center architecture which provides replication and redundancy. ACME's data centers are arranged in pairs. All customer production data is stored in both data centers in a pair and kept in sync using asynchronous database replication. Subproduction instances are only located in a single data center and are not replicated between data centers. Both data centers in a pair are active at all times and have identical processing capabilities; each data center has the ability to support the combined production load of the pair. Each data center has multiple ISPs coming into every data center cage, redundant network paths throughout the network, redundant disks in RAID arrays, redundant power suppliers, and many other hardware and configurations designed to remove single points of failure from the architecture. In the event of a disaster, ACME activates a failover process that transfers customer operations to the alternate data center in the pair. From this perspective, ACME is providing customers with business continuity as opposed to disaster recovery.
The ISCP is tested annually to validate and improve the ISCP. Additionally, the failover process is informally tested on a daily basis as ACME uses failover to reduce the impact of maintenance on its service. ACME's ISCP controls are validated on an annual basis during its ISO 27001 assessment.
ACME's ISCP is reviewed at least annually by senior management and is available electronically to all employees. The ISCP is replicated between both data centers in the pair. Key ACME personnel have been trained in their emergency response and recovery roles. The executive sponsor of the ISCP is the Chief Product Officer.
The ISCP is based on National Institute of Standards and Technology (NIST) Special Publication 800-34 "Contingency Planning Guide for Information Technology (IT) Systems" which provides instructions, recommendations, and considerations for government IT contingency planning.
At this time, we do not have a remedy for dual data center loss, but have geographic diversity between data center pairs to reduce that risk.
Please refer to the AHA whitepaper here: https://community.ACME.com/community?id=community_article&sys_id=97aca625dbd0dbc01dcaf3231f9619a9 | Not Applicable | 45 CFR 164.308 (a)(7)(i)
45 CFR 164.308 (a)(7)(ii)(B)
45 CFR 164.308 (a)(7)(ii)(C)
45 CFR 164.308 (a)(7)(ii)(E)
45 CFR 164.310 (a)(2)(i)
45 CFR 164.312 (a)(2)(ii) | Clause 5.1
A.6.1.2
A.14.1.3
A.14.1.4 | NIST SP800-53 R3 CP-1
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-6
NIST SP800-53 R3 CP-7
NIST SP800-53 R3 CP-8
NIST SP800-53 R3 CP-9
NIST SP800-53 R3 CP-10
NIST SP800-53 R3 PE-17 | PCI DSS v2.0 12.9.1
PCI DSS v2.0 12.9.3
PCI DSS v2.0 12.9.4
PCI DSS v2.0 12.9.6 |
| 25 | Business Continuity Management & Operational Resilience
Business Continuity Testing | BCR-02 | BCR-02.1 | MY | Business continuity and security incident response plans shall be subject to testing at planned intervals or upon significant organizational or environmental changes. Incident response plans shall involve impacted customers (tenant) and other business relationships that represent critical intra-supply chain business process dependencies. | Are business continuity plans subject to test at planned intervals or upon significant organizational or environmental changes to ensure continuing effectiveness? | ACME has a formally documented Information System Contingency Plan (ISCP) which describes the recovery resources, procedures, and priorities necessary to provide seamless customer access in the event a disaster takes place that impacts customer data at the data center(s). The ISCP is dependent on ACME's Advanced High Availability (AHA) data center architecture which provides replication and redundancy. ACME's data centers are arranged in pairs. All customer production data is stored in both data centers in a pair and kept in sync using asynchronous database replication. Subproduction instances are only located in a single data center and are not replicated between data centers. Both data centers in a pair are active at all times and have identical processing capabilities; each data center has the ability to support the combined production load of the pair. Each data center has multiple ISPs coming into every data center cage, redundant network paths throughout the network, redundant disks in RAID arrays, redundant power suppliers, and many other hardware and configurations designed to remove single points of failure from the architecture. In the event of a disaster, ACME activates a failover process that transfers customer operations to the alternate data center in the pair. From this perspective, ACME is providing customers with business continuity as opposed to disaster recovery.
The ISCP is tested annually to validate and improve the ISCP. Additionally, the failover process is informally tested on a daily basis as ACME uses failover to reduce the impact of maintenance on its service. ACME's ISCP controls are validated on an annual basis during its ISO 27001 assessment.
ACME's ISCP is reviewed at least annually by senior management and is available electronically to all employees. The ISCP is replicated between both data centers in the pair. Key ACME personnel have been trained in their emergency response and recovery roles. The executive sponsor of the ISCP is the Chief Product Officer.
The ISCP is based on National Institute of Standards and Technology (NIST) Special Publication 800-34 "Contingency Planning Guide for Information Technology (IT) Systems" which provides instructions, recommendations, and considerations for government IT contingency planning.
At this time, we do not have a remedy for dual data center loss, but have geographic diversity between data center pairs to reduce that risk.
Please refer to the Information System Contingency Plan here: https://community.ACME.com/community?id=community_article&sys_id=aa4c22a1dbd0dbc01dcaf3231f9619a2
Please refer to the Information System Contingency Plan Test Report here: https://community.ACME.com/community?id=community_article&sys_id=e7fca6a5dbd0dbc01dcaf3231f961992
| Yes | A3.3 | (A3.3) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies. | A1.2 | K.1.3, K.1.4.3, K.1.4.6, K.1.4.7, K.1.4.8, K.1.4.9, K.1.4.10, K.1.4.11, K.1.4.12 | 52 (B)
55 (A+) | RS-04 | DSS04.04
| BOSS > Operational Risk Management > Business Continuity | provider | x | Domain 7, 8 | 6.07.01. (b)
6.07.01. (j)
6.07.01. (l) | NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4 | NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-2 (1)
NIST SP800-53 R3 CP-2 (2)
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-4 (1) | 45 CFR 164.308 (a)(7)(ii)(D) | A.14.1.5 | A17.3.1 | Commandment #1
Commandment #2
Commandment #3 | CP-2
CP-3
CP-4 | 4.4
5.2(time limit)
6.3(whenever change occurs) | PA15 | SGP | PCI DSS v2.0 12.9.2 | 12.9.2, 12.10.2 |
| 26 | Business Continuity Management & Operational Resilience
Power / Telecommunications | BCR-03 | BCR-03.1 | MY | Datacenter utilities services and environmental conditions (e.g., water, power, temperature and humidity controls, telecommunications, and internet connectivity) shall be secured, monitored, maintained, and tested for continual effectiveness at planned intervals to ensure protection from unauthorized interception or damage, and designed with automated fail-over or other redundancies in the event of planned or unplanned disruptions. | Do you provide tenants with documentation showing the transport route of their data between your systems? | ACME only controls the last mile of any communications between it and a customer. Outside of this, ACME does not have control over how communications between the customer and ACME are routed. We do, however, provide documentation on how this data flow is traced.
Please refer to the Data Flow Diagram here: https://community.ACME.com/community?id=community_topic&sys_id=ec499e2ddbd897c068c1fb651f96191a | No | A3.2.0
A3.4.0 | (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.
(A3.4.0) Procedures exist to protect against unauthorized access to system resource. | A1.1
A1.2
A1.3 | F.1 | F.1.6, F.1.6.1, F.1.6.2, F.1.9.2, F.2.10, F.2.11, F.2.12 | 9 (B)
10 (B) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | RS-08 | DSS01.03
DSS01.04
DSS01.05
DSS04.03 | 312.8 and 312.10 | Infra Services > Facility Security > Environmental Risk Management | provider | x | Domain 7, 8 | 6.08. (a)
6.09. (c)
6.09. (f)
6.09. (g) | Article 17 (1), (2) | NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3) | NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-4
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3) | A.9.2.2
A.9.2.3 | A11.2.2,
A11.2.3 | Commandment #1
Commandment #2
Commandment #3
Commandment #4
Commandment #9
Commandment #11 | PE-1
PE-4
PE-13 | 10.1
10.2
10.3
10.4
10.5
10.6 | PA15 | SGP | 4.1, 4.1.1, 9.1, 9.2 |
| 27 | RS-08 | BCR-03.2 | MY | Can tenants define how their data is transported and through which legal jurisdictions? | ACME is a public cloud facing application. The connection between the customer's browser and ACME is encrypted over TLSv1.2. ACME uses TLS to secure information in transit between the user's web browser and their ACME instance.. For other traffic such as LDAP, SMTP and FTP, customers can configure all these protocols to use TLS encryption. Thus data is not really public.
As AAC-03.3 above. | No | G.1.1 | A.9.2.2
A.9.2.3 | NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-4
NIST SP800-53 R3 PE-13 |
| 28 | Business Continuity Management & Operational Resilience
Documentation | BCR-04 | BCR-04.1 | MY | Information system documentation (e.g., administrator and user guides, and architecture diagrams) shall be made available to authorized personnel to ensure the following:
• Configuring, installing, and operating the information system
• Effectively using the system’s security features | Are information system documents (e.g., administrator and user guides, architecture diagrams, etc.) made available to authorized personnel to ensure configuration, installation and operation of the information system? | ACME has a online resources dedicated for customers to view guidelines and processes related to ACME systems in the ACME Community site here: https://community.ACME.com/community?id=community_home
Please see more information regarding system information of various ACME instances here:
https://docs.ACME.com/ | Yes | S3.11.0
A.2.1.0 | (S3.11.0) Procedures exist to provide that personnel responsible for the design, development, implementation, and operation of systems affecting security have the qualifications and resources to fulfill their responsibilities.
(A.2.1.0) The entity has prepared an objective description of the system and its boundaries and communicated such description to authorized users. | CC1.3
CC1.4
CC2.1 | G.1.1 | 56 (B)
57 (B) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | OP-02 | COBIT 4.1 DS 9, DS 13.1 | BAI08
BAI10
DSS01.01 | 312.8 and 312.10 | SRM > Policies and Standards > Job Aid Guidelines | shared | x | Domain 7, 8 | Article 17 | NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-10
NIST SP 800-53 R3 SA-5 | NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-9 (1)
NIST SP 800-53 R3 CP-9 (3)
NIST SP 800-53 R3 CP-10
NIST SP 800-53 R3 CP-10 (2)
NIST SP 800-53 R3 CP-10 (3)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1) | 1.2.6 | Clause 4.3.3
A.10.7.4 | Clause 9.2(g) | Commandment #1
Commandment #2
Commandment #4
Commandment #5
Commandment #11 | CIP-005-3a - R1.3
CIP-007-3 - R9 | CP-9
CP-10
SA-5
SA-10
SA-11 | 10.5
13.5
17.1
| PCI DSS v2.0 12.1
PCI DSS v2.0 12.2
PCI DSS v2.0 12.3
PCI DSS v2.0 12.4 | 1.1.2, 1.1.3, 2.2, 12.3
12.6 |
| 29 | Business Continuity Management & Operational Resilience
Environmental Risks | BCR-05 | BCR-05.1 | MY | Physical protection against damage from natural causes and disasters, as well as deliberate attacks, including fire, flood, atmospheric electrical discharge, solar induced geomagnetic storm, wind, earthquake, tsunami, explosion, nuclear accident, volcanic activity, biological hazard, civil unrest, mudslide, tectonic activity, and other forms of natural or man-made disaster shall be anticipated, designed, and have countermeasures applied. | Is physical protection against damage (e.g., natural causes, natural disasters, deliberate attacks) anticipated and designed with countermeasures applied? | ACME's data centers inherit physical security and environmental controls from the colocation providers. All providers enforce access to the data centers via multiple levels of locking mechanisms, including pin codes, biometrics, and access cards. ACME must pre-approve all (ACME) visitors to the data centers. Government / state-issued identification is required to authenticate visitors upon arriving. Visitors must be escorted at all times by authorized personnel. ACME reviews access control lists, access activity, and visitor logs on a monthly basis. All data centers are staffed with uniformed security guards, are designed to thwart crash/ram physical attacks, use camera surveillance (e.g. building exterior, all ingress/egress points, data center floor), and have audible alarms on controlled doors. Most data centers do not have exterior windows and no data centers have windows on the data halls; any exterior glass is alarmed for breakage. Cameras and alarms are monitored by the provider's on-site security staff. In all data centers, ACME has its own cages with its own card readers and biometric controls. All data centers are equipped with uninterruptible power supply (UPS), fire detection and suppression systems, backup generators, and heating, ventilation, and air conditioning (HVAC) systems. ACME performs an annual review of each data center, which includes a review of the ISO 27001 certification or SOC1/2 Type 2 attestation, and performs periodic on-site visits to ensure that physical security and environmental controls are operating effectively.
As AAC-03.2 above. | Yes | A3.1.0
A3.2.0 | (A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.
(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable. | CC3.1
A1.1
A1.2 | F.1 | F.2.9, F.1.2.21, F.5.1, F.1.5.2, F.2.1, F.2.7, F.2.8 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | RS-05 | DSS01.03
DSS01.04
DSS01.05
| Infra Services > Facility Security > Environmental Risk Management | provider | x | Domain 7, 8 | 6.07. (d)
6.08. (a)
6.09. (a)
6.09. (b)
6.09. (d) | Article 17 (1), (2) | NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15 | NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-18 | 8.2.4 | 45 CFR 164.308 (a)(7)(i)
45 CFR 164.310(a)(2)(ii) (New) | A.9.1.4
A.9.2.1 | A11.1.4,
A11.2.1 | Commandment #1
Commandment #2
Commandment #3 | CIP-004-3 R3.2 | PE-1
PE-13
PE-14
PE-15
PE-18 | 8.1
8.4 | PA15 | SGP | 3.5.2, 3.6.3, 3.7,
5.1, 5.2, 5.3,
6.1, 6.2,
7.1, 7.2,
9.1, 9.2, 9.3, 9.4, 9.5, 9.6,
9.7, 9.8, 9.9,
12.2 |
| 30 | Business Continuity Management & Operational Resilience
Equipment Location | BCR-06 | BCR-06.1 | MY | To reduce the risks from environmental threats, hazards, and opportunities for unauthorized access, equipment shall be kept away from locations subject to high probability environmental risks and supplemented by redundant equipment located at a reasonable distance. | Are any of your data centers located in places that have a high probability/occurrence of high-impact environmental risks (floods, tornadoes, earthquakes, hurricanes, etc.)? | ACME's data centers are arranged in 8 pairs (for a total of 16 data centers) across 4 geographic regions including Asia Pacific Japan (APJ), Europe, Middle East, and Africa (EMEA), North America, and South America. Within several of these regions, there are specific country pairs for Canadian, US, Australian, and Swiss customers. All data centers are Tier 3 or higher, from recognized colocation providers, and must have either an ISO 27001 certification or SOC1/2 Type 2 attestation. ACME performs an annual review of each data center, which includes a review of the ISO 27001 certification or SOC1/2 Type 2 attestation, and performs periodic on-site visits.
Customers can dictate which data center pair their data is housed in and can manage IP address restrictions to limit the transmission of data. Customers would be notified should a data center move be required. | Yes | A3.1.0
A3.2.0 | (A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.
(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable. | CC3.1
A1.1
A1.2 | F.1 | F.2.9, F.1.2.21, F.5.1, F.1.5.2, F.2.1, F.2.7, F.2.8 | 53 (A+)
75 (C+, A+) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | RS-06 | DSS01.04
DSS01.05
| 312.8 and 312.10 | Infra Services > Facility Security > Environmental Risk Management | provider | x | Domain 7, 8 | 6.07. (d)
6.08. (a)
6.09. (a)
6.09. (b)
6.09. (d) | Article 17 (1), (2) | NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15 | NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-5
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-18 | 45 CFR 164.310 (c) | A.9.2.1 | A11.2.1 | Commandment #1
Commandment #2
Commandment #3 | PE-1
PE-5
PE-14
PE-15
PE-18 | 8.1 | PA15 | SGP | PCI DSS v2.0 9.1.3
PCI DSS v2.0 9.5
PCI DSS v2.0 9.6
PCI DSS v2.0 9.9
PCI DSS v2.0 9.9.1 | 9.1.3
9.5
9.6
9.9
9.9.1, 12.2 |
| 31 | Business Continuity Management & Operational Resilience
Equipment Maintenance | BCR-07 | BCR-07.1 | MY | Policies and procedures shall be established, and supporting business processes and technical measures implemented, for equipment maintenance ensuring continuity and availability of operations and support personnel. | If using virtual infrastructure, does your cloud solution include independent hardware restore and recovery capabilities? | In the ACME data center environment, there are no hypervisors or host based emulation used. | Not Applicable | A3.2.0
A4.1.0 | (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.
(A4.1.0) The entity’s system availability and security performance is periodically reviewed and compared with the defined system availability and related security policies. | A1.1
A1.2
CC4.1 | F.2.19 | 1 (B) | OP-04 | COBIT 4.1 A13.3 | BAI03.10
BAI04.03
BAI04.04
DSS03.05 | Infra Services > Equipment Maintenance > | provider | x | Domain 7, 8 | 6.09. (h) | Article 17 (1) | NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-5 | NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-2 (1)
NIST SP 800-53 R3 MA-3
NIST SP 800-53 R3 MA-3 (1)
NIST SP 800-53 R3 MA-3 (2)
NIST SP 800-53 R3 MA-3 (3)
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-4 (1)
NIST SP 800-53 R3 MA-4 (2)
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 MA-6 | 5.2.3
8.2.2
8.2.3
8.2.4
8.2.5
8.2.6
8.2.7 | 45 CFR 164.310 (a)(2)(iv) | A.9.2.4 | A11.2.4 | Commandment #2
Commandment #5
Commandment #11 | CIP-007-3 - R6.1 - R6.2 - R6.3 - R6.4 | MA-2
MA-3
MA-4
MA-5
MA-6 | 3.3
12.1
12.5
14.5 (software)
| PA8
PA15 | BSGP
SGP | 10.8, 11.6 |
| 32 | OP-04 | BCR-07.2 | MY | If using virtual infrastructure, do you provide tenants with a capability to restore a Virtual Machine to a previous state in time? | See BCR-07.1 | Not Applicable | COBIT 4.1 A13.3 | 45 CFR 164.310 (a)(2)(iv) | A.9.2.4 | NIST SP800-53 R3 MA-2
NIST SP800-53 R3 MA-3
NIST SP800-53 R3 MA-4
NIST SP800-53 R3 MA-5
NIST SP800-53 R3 MA-6 |
| 33 | OP-04 | BCR-07.3 | MY | If using virtual infrastructure, do you allow virtual machine images to be downloaded and ported to a new cloud provider? | See BCR-07.1 | Not Applicable | COBIT 4.1 A13.3 | 45 CFR 164.310 (a)(2)(iv) | A.9.2.4 | NIST SP800-53 R3 MA-2
NIST SP800-53 R3 MA-3
NIST SP800-53 R3 MA-4
NIST SP800-53 R3 MA-5
NIST SP800-53 R3 MA-6 |
| 34 | OP-04 | BCR-07.4 | MY | If using virtual infrastructure, are machine images made available to the customer in a way that would allow the customer to replicate those images in their own off-site storage location? | See BCR-07.1 | Not Applicable | COBIT 4.1 A13.3 | 45 CFR 164.310 (a)(2)(iv) | A.9.2.4 | NIST SP800-53 R3 MA-2
NIST SP800-53 R3 MA-3
NIST SP800-53 R3 MA-4
NIST SP800-53 R3 MA-5
NIST SP800-53 R3 MA-6 |
| 35 | OP-04 | BCR-07.5 | MY | Does your cloud solution include software/provider independent restore and recovery capabilities? | ACME's backup and restore are initiated and managed by ACME.
Customers may reach out to ACME (via Customer Support or their Account Representative) to request that Compliance includes them in the next ISCP test. Customers who participate in an ISCP test review the results and performance, can provide feedback, and sign their approval of the final report. Customers with a strong regulatory need may request (via a change ticket) a failover/transfer or restore from backup of their specific instance. Customers are responsible for documenting this activity to meet their regulatory requirements.
Customers can extract data from their instances at their discretion and on a schedule in accordance with their requirements.
Please refer to the Backup and Restoration SOP here: https://community.ACME.com/community?id=community_article&sys_id=955d6629dbd0dbc01dcaf3231f96191c | Not Applicable | COBIT 4.1 A13.3 | 45 CFR 164.310 (a)(2)(iv) | A.9.2.4 | NIST SP800-53 R3 MA-2
NIST SP800-53 R3 MA-3
NIST SP800-53 R3 MA-4
NIST SP800-53 R3 MA-5
NIST SP800-53 R3 MA-6 |
| 36 | Business Continuity Management & Operational Resilience
Equipment Power Failures | BCR-08 | BCR-08.1 | MY | Protection measures shall be put into place to react to natural and man-made threats based upon a geographically-specific Business Impact Assessment | Are security mechanisms and redundancies implemented to protect equipment from utility service outages (e.g., power failures, network disruptions, etc.)? | As BCR-05.1 and BCR-06.1 above.
Please refer to the AHA white paper here: https://community.ACME.com/community?id=community_article&sys_id=97aca625dbd0dbc01dcaf3231f9619a9 | Yes | A3.2.0 | (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable. | A1.1
A1.2 | F.1 | F.1.6, F.1.6.1, F.1.6.2, F.1.9.2, F.2.10, F.2.11, F.2.12 | 54 (A+) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | RS-07 | DSS01.04
DSS01.05
DSS04.01
DSS04.02
DSS04.03 | 312.8 and 312.10 | Infra Services > Facility Security > Environmental Risk Management | provider | x | Domain 7, 8 | 6.08. (a)
6.09. (e)
6.09. (f) | Article 17 (1), (2) | NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-12
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-14 | NIST SP800-53 R3 CP-8
NIST SP800-53 R3 CP-8 (1)
NIST SP800-53 R3 CP-8 (2)
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-9
NIST SP800-53 R3 PE-10
NIST SP800-53 R3 PE-11
NIST SP800-53 R3 PE-12
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
NIST SP800-53 R3 PE-14 | A.9.2.2
A.9.2.3
A 9.2.4 | A.11.2.2,
A.11.2.3,
A.11.2.4 | Commandment #1
Commandment #2
Commandment #3 | CP-8
PE-1
PE-9
PE-10
PE-11
PE-12
PE-13
PE-14 | 8.1
8.2
8.3
8.4 | PA15 | SGP |
| 37 | Business Continuity Management & Operational Resilience
Impact Analysis | BCR-09 | BCR-09.1 | MY | There shall be a defined and documented method for determining the impact of any disruption to the organization (cloud provider, cloud consumer) that must incorporate the following:
• Identify critical products and services
• Identify all dependencies, including processes, applications, business partners, and third party service providers
• Understand threats to critical products and services
• Determine impacts resulting from planned or unplanned disruptions and how these vary over time
• Establish the maximum tolerable period for disruption
• Establish priorities for recovery
• Establish recovery time objectives for resumption of critical products and services within their maximum tolerable period of disruption
• Estimate the resources required for resumption | Do you provide tenants with ongoing visibility and reporting of your operational Service Level Agreement (SLA) performance? | ACME’s production environment is monitored 365x7x24 (everyday of the year) for network, infrastructure, performance and availability with alerts attended to by our SRE team, events are addressed and escalated based on the SLAs documented in the customer contract. | Yes | A3.1.0
A3.3.0
A3.4.0 | (A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.
(A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.
(A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies. | CC3.1
A1.2
A1.3 | K.2 | RS-02 | BAI06.01
BAI10.01
BAI10.02
BAI10.03
DSS04.01
DSS04.02 | ITOS > Service Delivery > Information Technology Resiliency - Resiliency Analysis | provider | x | Domain 7, 8 | 6.02. (a)
6.03.03. (c)
6.07. (a)
6.07. (b)
6.07. (c) | Article 17 (1), (2) | NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 RA-3 | NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 RA-3 | 45 CFR 164.308 (a)(7)(ii)(E) | ISO/IEC 27001:2005
A.14.1.2
A 14.1.4 | A.17.1.1
A.17.1.2 | Commandment #1
Commandment #2
Commandment #3 | CIP-007-3 - R8 - R8.1 - R8.2 - R8.3 | RA-3 | 6.4 | PA8
PA15 | BSGP
SGP |
| 38 | RS-02 | BCR-09.2 | MY | Do you make standards-based information security metrics (CSA, CAMM, etc.) available to your tenants? | Customers may interact with ACME via their Account Representative, Customer Support, the Customer Portal, or their SAM (if purchased). These may include quarterly reviews of performance and SLAs, incident reviews, real-time reviews of availability (Customer Portal), or other metrics.
ACME has formal documented information security policies. The information security policy and standards (ISP/ISS) address purpose, scope, responsibilities, management commitment, coordination among organizational entities, compliance, and relevant administrative and technical security controls.
Please refer to the Information Security Policy here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0
Please refer to the Information Security Standards here: https://community.ACME.com/community?id=community_article&sys_id=0b1d62e5dbd0dbc01dcaf3231f9619f5 | Yes | 45 CFR 164.308 (a)(7)(ii)(E) | ISO/IEC 27001:2005
A.14.1.2
A 14.1.4 | NIST SP800-53 R3 RA-3 |
| 39 | RS-02 | BCR-09.3 | MY | Do you provide customers with ongoing visibility and reporting of your SLA performance? | As BCR-09.1 above. | Yes | 45 CFR 164.308 (a)(7)(ii)(E) | ISO/IEC 27001:2005
A.14.1.2
A 14.1.4 | NIST SP800-53 R3 RA-3 |
| 40 | Business Continuity Management & Operational Resilience
Policy | BCR-10 | BCR-10.1 | MY | Policies and procedures shall be established, and supporting business processes and technical measures implemented, for appropriate IT governance and service management to ensure appropriate planning, delivery and support of the organization's IT capabilities supporting business functions, workforce, and/or customers based on industry acceptable standards (i.e., ITIL v4 and COBIT 5). Additionally, policies and procedures shall include defined roles and responsibilities supported by regular workforce training. | Are policies and procedures established and made available for all personnel to adequately support services operations’ roles? | ACME develops and maintains controlled documents for internal and external use. Documents are created in a controlled manner that meets ACME's policy and contractual commitments. The Document Control SOPs ensure consistency in the generation and management of ACME controlled documents. Controlled documents are created based upon defined templates and undergo multiple reviews before being published. In addition to change requests, documents are reviewed periodically. The review period will be no less than biennially; however, reviews can also be triggered annually as determined by regulations, customer contracts, or by management decisions. A defined process exists to obsolete a document.
Operational documents are used for the development, implementation, and support of customer products and services; corporate documents are used for the internal business operations of ACME.
Please refer the Document Control SOP (Operational documents) here: https://community.ACME.com/community?id=community_article&sys_id=63ace625dbd0dbc01dcaf3231f96190b
Please refer the Document Control SOP (Corporate documents) here: https://community.ACME.com/community?id=community_article&sys_id=e66d2e29dbd0dbc01dcaf3231f961951 | Yes | S2.3.0 | (S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality of data, processing integrity, system security and related security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them. | CC3.2 | G.1.1 | 45 (B) | OP-01 | COBIT 4.1 DS13.1 | APO01
APO07.01
APO07.03
APO09.03
DSS01.01 | SRM > Policies and Standards > Operational Security Baselines | shared | x | Domain 7, 8 | 6.03. (c) | NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-5 | NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-4 (1)
NIST SP 800-53 R3 MA-4 (2)
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)
NIST SP 800-53 R3 SA-12 | 8.2.1 | Clause 5.1
A 8.1.1
A.8.2.1
A 8.2.2
A.10.1.1 | Clause 5.1(h)
A.6.1.1
A.7.2.1
A.7.2.2
A.12.1.1 | Commandment #1
Commandment #2
Commandment #3
Commandment #6
Commandment #7 | CM-2
CM-3
CM-4
CM-5
CM-6
CM-9
MA-4
SA-3
SA-4
SA-5
SA-8
SA-10
SA-11
SA-12 | PCI DSS v2.0 12.1
PCI DSS v2.0 12.2
PCI DSS v2.0 12.3
PCI DSS v2.0 12.4 | 4.3, 10.8,
11.1.2,
12.1
12.2
12.3
12.4
12.5, 12.5.3,
12.6, 12.6.2,
12.10 |
| 41 | Business Continuity Management & Operational Resilience
Retention Policy | BCR-11 | BCR-11.1 | MY | Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining and adhering to the retention period of any critical asset as per established policies and procedures, as well as applicable legal, statutory, or regulatory compliance obligations. Backup and recovery measures shall be incorporated as part of business continuity planning and tested accordingly for effectiveness. | Do you have technical control capabilities to enforce tenant data retention policies? | ACME does not delete customer records. Retention of customer records is a customer responsibility. Per the standard contract with customers, ACME will retain customer data, at minimum, for 45 days after the termination of a business contract between the customer and ACME. | Not Applicable | A3.3.0
A3.4.0
I3.20.0
I3.21.0 | (A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.
(A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies.
(I3.20.0) Procedures exist to provide for restoration and disaster recovery consistent with the entity’s defined processing integrity policies.
(I3.21.0) Procedures exist to provide for the completeness, accuracy, and timeliness of backup data and systems. | A1.2
A1.3
I3.21
| D.2.2.9 | 36 (B) | Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.5.2 | DG-04 | COBIT 4.1 DS 4.1, DS 4.2, DS 4.5, DS 4.9, DS 11.6 | BAI09.01
BAI09.02
BAI09.03
DSS04.01
DSS04.02
DSS04.03
DSS04.04
DSS04.07
MEA03.01 | 312.3 | BOSS > Data Governance > Data Retention Rules | shared | x | Domain 5 | 6.03. (h)
6.07.01. (c) | Article 6(1) e | NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 CP-9 | NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 CP-2 (1)
NIST SP 800-53 R3 CP-2 (2)
NIST SP 800-53 R3 CP-6
NIST SP 800-53 R3 CP-6 (1)
NIST SP 800-53 R3 CP-6 (3)
NIST SP 800-53 R3 CP-7
NIST SP 800-53 R3 CP-7 (1)
NIST SP 800-53 R3 CP-7 (2)
NIST SP 800-53 R3 CP-7 (3)
NIST SP 800-53 R3 CP-7 (5)
NIST SP 800-53 R3 CP-8
NIST SP 800-53 R3 CP-8 (1)
NIST SP 800-53 R3 CP-8 (2)
NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-9 (1)
NIST SP 800-53 R3 CP-9 (3) | 5.1.0
5.1.1
5.2.2
8.2.6 | 45 CFR 164.308 (a)(7)(ii)(A)
45 CFR 164.310 (d)(2)(iv)
45 CFR 164.308(a)(7)(ii)(D) (New)
45 CFR 164.316(b)(2)(i) (New) | Clause 4.3.3
A.10.5.1
A.10.7.3 | Clauses
9.2(g)
7.5.3(b)
5.2 (c)
7.5.3(d)
5.3(a)
5.3(b)
8.1
8.3
A.12.3.1
A.8.2.3 | EAR 15 § 762.6 Period of Retention
EAR 15 CFR § 786.2 Recordkeeping | Commandment #11 | Chapter II
Article 11, 13 | CIP-003-3 - R4.1 | CP-2
CP-6
CP-7
CP-8
CP-9
SI-12
AU-11 | FTC Fair Information Principles
Integrity/Security
Security involves both managerial and technical measures to protect against loss and the unauthorized access, destruction, use, or disclosure of the data.(49) Managerial measures include internal organizational measures that limit access to data and ensure that those individuals with access do not utilize the data for unauthorized purposes. Technical security measures to prevent unauthorized access include encryption in the transmission and storage of data; limits on access through use of passwords; and the storage of data on secure servers or computers . - http://www.ftc.gov/reports/privacy3/fairinfo.shtm | 6.4
13.1 | PA10
PA29 | BSGP
SGP | PCI DSS v2.0 3.1
PCI DSS v2.0 3.1.1
PCI DSS v2.0 3.2
PCI DSS v2.0 9.9.1
PCI DSS v2.0 9.5
PCI DSS v2.0 9.6
PCI DSS v2.0 10.7 | 3.1
3.1.a
3.2
9.9.1
9.5. 9.5.1
9.6. 9.7, 9.8
10.7, 12.10.1 |
| 42 | DG-04 | BCR-11.2 | MY | Do you have a documented procedure for responding to requests for tenant data from governments or third parties? | Please refer to the Privacy statement here: https://www.ACME.com/privacy-statement.html | No |
| 43 | BCR-11.4 | MY | Have you implemented backup or redundancy mechanisms to ensure compliance with regulatory, statutory, contractual or business requirements? | As BCR-07.5 above.
Please refer to the AHA white paper here: https://community.ACME.com/community?id=community_article&sys_id=97aca625dbd0dbc01dcaf3231f9619a9 | Yes |
| 44 | BCR-11.5 | MY | Do you test your backup or redundancy mechanisms at least annually? | ACME has a formally documented Information System Contingency Plan (ISCP) which describes the recovery resources, procedures, and priorities necessary to provide seamless customer access in the event a disaster takes place that impacts customer data at the data center(s). The ISCP is dependent on ACME's Advanced High Availability (AHA) data center architecture which provides replication and redundancy. ACME's data centers are arranged in pairs. All customer production data is stored in both data centers in a pair and kept in sync using asynchronous database replication. Subproduction instances are only located in a single data center and are not replicated between data centers. Both data centers in a pair are active at all times and have identical processing capabilities; each data center has the ability to support the combined production load of the pair. Each data center has multiple ISPs coming into every data center cage, redundant network paths throughout the network, redundant disks in RAID arrays, redundant power suppliers, and many other hardware and configurations designed to remove single points of failure from the architecture. In the event of a disaster, ACME activates a failover process that transfers customer operations to the alternate data center in the pair. From this perspective, ACME is providing customers with business continuity as opposed to disaster recovery.
The ISCP is tested annually to validate and improve the ISCP. Additionally, the failover process is informally tested on a daily basis as ACME uses failover to reduce the impact of maintenance on its service. ACME's ISCP controls are validated on an annual basis during its ISO 27001 assessment.
Please refer to the ISCP here: https://community.ACME.com/community?id=community_article&sys_id=aa4c22a1dbd0dbc01dcaf3231f9619a2
Please refer to the ISCP test report here: https://community.ACME.com/community?id=community_article&sys_id=e7fca6a5dbd0dbc01dcaf3231f961992
As AAC-03.2 above. | Yes |
| 45 | Change Control & Configuration Management
New Development / Acquisition | CCC-01 | CCC-01.1 | MY | Policies and procedures shall be established, and supporting business processes and technical measures implemented, to ensure the development and/or acquisition of new data, physical or virtual applications, infrastructure network and systems components, or any corporate, operations and/or datacenter facilities have been pre-authorized by the organization's business leadership or other accountable business role or function. | Are policies and procedures established for management authorization for development or acquisition of new applications, systems, databases, infrastructure, services, operations and facilities? | ACME's Vendor Security Risk Assessment (VSRA) Program ensures that vendors have appropriate security controls and business disciplines in place to effectively minimize risks to themselves, to ACME, and to customers of ACME. The VSRA process begins with a pre-assessment that is used to identify the assets that will be involved and to determine the level of assessment to be performed; each assessment is tailored for the type of service and assets that will be involved. The Compliance team works with the vendor and internal business owner to gather information to address the controls identified for the assessment. The output of this assessment is reflected in a Vendor Risk Assessment Report, which is used as an input to contract language. On an annual basis, active existing vendors will be reviewed for change in scope and status of security controls to ensure no new risks have been introduced and all existing risks are addressed. ACME reviews independent, third party attestations and/or certifications (e.g. ISO 27001, SOC 1, SOC 2) to ensure that the vendor's information security program is operating effectively.
Please refer to the VSRA SOP here: https://community.ACME.com/community?id=community_article&sys_id=ebfca6a5dbd0dbc01dcaf3231f961993
ACME has secure development processes and tests code throughout the development lifecycle. To validate secure coding efforts, a combination of rolling security testing of the current codebase by a 3rd party, static code analysis & peer review and annual/major release penetration testing by another 3rd party is performed.
ACME develops code using best practices and guidelines from organizations such as OWASP. The requirement to appropriately sanitize and filter input, perform bounds checking and so on in order to mitigate against common attacks such as XSS and SQL injection is documented in ACME policy.
Please refer to the Software Development Lifecycle SOP here: https://community.ACME.com/community?id=community_article&sys_id=bb1c6e21dbd0dbc01dcaf3231f961923
Please refer to the Code Control SOP here: https://community.ACME.com/community?id=community_article&sys_id=88ac6225dbd0dbc01dcaf3231f961902 | Yes | S3.12.0
S3.10.0
S3.13.0 | (S3.12.0) Procedures exist to maintain system components, including configurations consistent with the defined system security policies.
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies.
(S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system. | CC7.2
CC7.1
CC7.4 | I.2 | I.1.1, I.1.2, I.2. 7.2, I.2.8, I.2.9, I.2.10, I.2.13, I.2.14, I.2.15, I.2.18, I.2.22.6, L.5 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | RM-01 | COBIT 4.1 A12, A 16.1 | APO01.02
APO01.06
BAI02.04
BAI06.01 | ITOS > IT Operation > Architecture Governance | shared | x | None | 6.03. (a) | NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4 | NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7) | 1.2.6 | A.6.1.4
A.6.2.1
A.12.1.1
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.5
A.15.1.3
A.15.1.4 | A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5
8.1* (partial) A.14.2.7
A.18.1.3
A.18.1.4 | Commandment #1
Commandment #2
Commandment #3 | CA-1
CM-1
CM-9
PL-1
PL-2
SA-1
SA-3
SA-4 | 12.1 | PCI DSS v2.0 6.3.2 | 6.3.2, 12.3.4 |
| 46 | CCC-01.2 | MY | Is documentation available that describes the installation, configuration and use of products/services/features? | ACME has online resources dedicated for customers to view guidelines and processes related to ACME systems in the ACME Community site here: https://community.ACME.com
Please see more information regarding system hardening and instrastrcure management of current and past ACME instances here: https://docs.ACME.com/ | Yes |
| 47 | Change Control & Configuration Management
Outsourced Development | CCC-02 | CCC-02.1 | MY | External business partners shall adhere to the same policies and procedures for change management, release, and testing as internal developers within the organization (e.g. ITIL service management processes). | Do you have controls in place to ensure that standards of quality are being met for all software development? | Please refer to the Information Security Policy for information on secure coding practices here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0
Please refer to the Code Control SOP on ACME process of storing, tracking, and accessing software files here: https://community.ACME.com/community?id=community_article&sys_id=88ac6225dbd0dbc01dcaf3231f961902
Please refer to the Verification SOP here: https://community.ACME.com/community?id=community_article&sys_id=9d9c2ee1dbd0dbc01dcaf3231f96196e | Not Applicable | S3.10.0
S3.13 | (S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system availability, confidentiality of data, processing integrity, systems security and related security policies.
(S3.13) Procedures exist to provide that only authorized, tested, and documented changes are made to the system. | CC7.1
CC7.4 | C.2
I.1
I.2
I.4 | C.2.4, G.4, G6, I.1, I.4.4, I.4.5, I.2.7.2, I.2.8, I.2.9, I.2.15, I.2.18, I.2.22.6, I.2.7.1, I.2.13, I.2.14, I.2.17, I.2.20, I.2.22.2, I.2.22.4, I.2.22.7, I.2.22.8, I.2.22.9, I.2.22.10, I.2.22.11, I.2.22.12, I.2.22.13, I.2.22.14, I.3, J.1.2.10, L.7, L.9, L.10 | 27 (B) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | RM-04 | APO07.06
APO09.03
APO09.04
APO10.01
APO10.04
APO10.05
APO11.01
APO11.02
APO11.04
APO11.05 | ITOS > IT Operation > Architecture Governance | shared | x | None | NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-9 | NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)
NIST SP 800-53 R3 SA-12 | A.6.1.8
A.6.2.1
A.6.2.3
A.10.1.4
A.10.2.1
A.10.2.2
A.10.2.3
A.10.3.2
A.12.1.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.1
A.12.5.2
A.12.5.3
A.12.5.5
A.12.6.1
A.13.1.2
A.15.2.1
A.15.2.2 | A18.2.1
A.15.1.2
A.12.1.4
8.1* (partial)
8.1* (partial) A.15.2.1
8.1* (partial) A.15.2.2
A.14.2.9
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5
8.1* (partial) A.14.2.2
8.1* (partial) A.14.2.3
8.1* (partial) A.14.2.4
8.1* (partial) A.14.2.7
A.12.6.1
A.16.13
A.18.2.2
A.18.2.3 | Commandment #1
Commandment #2
Commandment #3 | SA-4
SA-5
SA-8
SA-9
SA-10
SA-11
SA-12
SA-13 | 2.2
4.1
| PA17 | SGP | PCI DSS v2.0 3.6.7
PCI DSS v2.0 6.4.5.2
PCI DSS v2.0 7.1.3
PCI DSS v2.0 8.5.1
PCI DSS v2.0 9.1
PCI DSS v2.0 9.1.2
PCI DSS v2.0 9.2b
PCI DSS v2.0 9.3.1
PCI DSS v2.0 10.5.2
PCI DSS v2.0 11.5
PCI DSS v2.0 12.3.1
PCI DSS v2.0 12.3.3 | 2.1, 2.2.4, 2.3, 2.5
3.3, 3.4, 3.6
4.1, 4.2
6.3.1, 6.3.2, 6.4.2, 6.4.3, 6.4.4, 6.4.5.2
6.7
7.1, 7.1.3, 7.1.4
8.3, 8.5.1, 8.7
9.1
9.1.2
9.2
10.5
11.5
12.3
12.8 |
| 48 | RM-04 | CCC-02.2 | MY | Do you have controls in place to detect source code security defects for any outsourced software development activities? | ACME does not use outsourced development.
Please refer to the Verification SOP here: https://community.ACME.com/community?id=community_article&sys_id=9d9c2ee1dbd0dbc01dcaf3231f96196e | Not Applicable | A.6.1.8
A.6.2.1
A.6.2.3
A.10.1.4
A.10.2.1
A.10.2.2
A.10.2.3
A.10.3.2
A.12.1.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.1
A.12.5.2
A.12.5.3
A.12.5.5
A.12.6.1
A.13.1.2
A.15.2.1
A.15.2.2 | NIST SP800-53 R3 SA-4
NIST SP800-53 R3 SA-5
NIST SP800-53 R3 SA-8
NIST SP800-53 R3 SA-9
NIST SP800-53 R3 SA-10
NIST SP800-53 R3 SA-11 NIST SP800-53 R3 SA-12 NIST SP800-53 R3 SA-13 | PCI DSS v2.0 3.6.7
PCI DSS v2.0 6.4.5.2
PCI DSS v2.0 7.1.3
PCI DSS v2.0 8.5.1
PCI DSS v2.0 9.1
PCI DSS v2.0 9.1.2
PCI DSS v2.0 9.2b
PCI DSS v2.0 9.3.1
PCI DSS v2.0 10.5.2
PCI DSS v2.0 11.5
PCI DSS v2.0 12.3.1
PCI DSS v2.0 12.3.3 |
| 49 | Change Control & Configuration Management
Quality Testing | CCC-03 | CCC-03.1 | MY | Organization shall follow a defined quality change control and testing process (e.g. ITIL Service Management) with established baselines, testing and release standards which focus on system availability, confidentiality and integrity of systems and services | Do you provide your tenants with documentation that describes your quality assurance process? | ACME's QMS is based on the ISO 9001 standard. Although the program is not certified, the QMS is reviewed throughout the year via customer-led audits and ACME-led quarterly internal audits. Observations from these audits are tracked and discussed with the functional owners and management. Remediation associated with the observations is tracked to closure and discussed with customers on a periodic basis.
ACME uses a process-based QMS that contains interrelated policies, standard operating procedures (SOP), work instructions, and other supporting documents such as guidelines, standards, templates, and forms to improve and control the design, development, and delivery of ACME services. ACME's Quality Manual Policy details the roles and responsibilities of the various ACME teams, the documents supporting the QMS, and the management review process. Quality records are managed via ACME's Document Control SOP for controlled documents. Records supporting certain activities in SOPs, such as test data, are maintained in ACME tools or shared drives. All of these are supported by audit trails for access and/or changes.
ACME provides IQOQ systems upon customer request. When a customer makes a request for a qualified instance, the instance is provisioned or migrated to a qualified server. Once migrated to a qualified server, the customer receives a copy of the server and instance IQOQ documentation, which is stored in a change ticket on the ACME HI instance. IQOQ documentation includes the executed hardening checklist(s) and qualification tool reports. At a high-level, the main difference between IQOQ and non-IQOQ systems is the level of documentation available. IQOQ server qualification and instance migration requests have been completed for multiple companies, including Fortune 500 companies in the pharmaceutical, R&D, and medical device industries.
Generally, IQOQ requests are scheduled within 15 days of request receipt and take 30 days to perform and complete the required documentation; however, due to the executing team's backlog, scheduling may be set for weeks/months after the request date. On the day of migration, the customer should not expect more than 15 minutes of downtime. During the qualification period, customers should avoid requesting any CI changes, such as cloning from another instance or adding/removing CIs (e.g. app nodes). Besides the downtime, customers may access the instance as usual during the qualification period.
Please refer to the Quality Policy to view ACME's commitment to continuously improve the Quality management System (QMS) here: https://community.ACME.com/community?id=community_article&sys_id=764d6229dbd0dbc01dcaf3231f9619e4
Please refer to the Quality Manual Policy here: https://community.ACME.com/community?id=community_article&sys_id=ad5ca6a1dbd0dbc01dcaf3231f961966
Please refer to the System Architecture Server Installation IQOQ Checklist here: https://community.ACME.com/community?id=community_article&sys_id=261caa21dbd0dbc01dcaf3231f9619a1 | Yes | A3.13.0
C3.16.0
I3.14.0
S3.10.0
S3.13 | (A3.13.0, C3.16.0, I3.14.0, S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system availability, confidentiality of data, processing integrity, systems security and related security policies.
(S3.13) Procedures exist to provide that only authorized, tested, and documented changes are made to the system. | CC7.1
CC7.1
CC7.1
CC7.1
CC7.4 | C.1.7, G.1, G.6, I.1, I.4.5, I.2.18, I.22.1, I.22.3, I.22.6, I.2.23, I.2.22.2, I.2.22.4, I.2.22.7. I.2.22.8, I.2.22.9, I.2.22.10, I.2.22.11, I.2.22.12, I.2.22.13, I.2.22.14,I.2.20, I.2.17, I.2.7.1, I.3, J.2.10, L.9 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | RM-03 | COBIT 4.1 PO 8.1 | APO11.01
APO11.02
APO11.04
APO11.05
BAI02.04
BAI03.06
BAI03.08
BAI07.03
BAI07.05 | ITOS > Service Support > Release Management | shared | x | None | 6.03.01. (b)
6.03.01. (d) | NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-5 | NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1) | 9.1.0
9.1.1
9.2.1
9.2.2 | A.6.1.3
A.10.1.1
A.10.1.4
A.10.3.2
A.12.1.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.1
A.12.5.2
A.12.5.3
A.12.6.1
A.13.1.2
A.15.2.1
A.15.2.2 | A.6.1.1
A.12.1.1
A.12.1.4
A.14.2.9
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5
8.1* partial A.14.2.2
8.1* partial A.14.2.3
8.1* partial A.14.2.4
A.12.6.1
A.16.1.3
A.18.2.2
A.18.2.3 | Commandment #1
Commandment #2
Commandment #3 | CM-1
CM-2
SA-3
SA-4
SA-5
SA-8
SA-10
SA-11
SA-13 | 12.1
14.1
14.2 | PCI DSS v2.0 1.1.1
PCI DSS v2.0 6.1
PCI DSS v2.0 6.4 | 6.1
6.2
6.3
6.4
6.5
6.6
6.7 |
| 50 | CCC-03.2 | MY | Is documentation describing known issues with certain products/services available? | ACME provides information about known issues with in the product documentation within the specific release notes.
Please refer to the Product Release Notes here: https://docs.ACME.com/search?q=&labels=9 | Yes |
| 51 | CCC-03.3 | MY | Are there policies and procedures in place to triage and remedy reported bugs and security vulnerabilities for product and service offerings? | ACME has incident and security incident standard operating procedures including notification processes for affected customers.
Please refer the Information Security Policy here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0
Please refer the Vulnerability Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=6dec2e65dbd0dbc01dcaf3231f961918
Please refer the Maintenance Release management SOP here: https://community.ACME.com/community?id=community_article&sys_id=716c2ea1dbd0dbc01dcaf3231f961995 | Yes |
| 52 | CCC-03.4 | MY | Are mechanisms in place to ensure that all debugging and test code elements are removed from released software versions? | ACME provides verification plans, summary reports, traceability matrix, validations plans, penetration tests, and patch test summaries for all major releases.
Please refer to the Code Control SOP for more information on software source file handling here: https://community.ACME.com/community?id=community_article&sys_id=88ac6225dbd0dbc01dcaf3231f961902
Please refer to the SDLC SOP here: https://community.ACME.com/community?id=community_article&sys_id=bb1c6e21dbd0dbc01dcaf3231f961923 | Yes |
| 53 | Change Control & Configuration Management
Unauthorized Software Installations | CCC-04 | CCC-04.1 | MY | Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. | Do you have controls in place to restrict and monitor the installation of unauthorized software onto your systems? | ACME uses Puppet as its standard configuration tool. If the server doesn't have a standard configuration, which includes software, the tool overwrites the system with the standard configuration. Alerts are issued and attended to by security staff on standard configuration deviations.
In addition, ACME employees do not have administrator access to their workstations and do not have the ability to install unauthorized software onto their systems.
| Yes | A3.6.0
S3.5.0
S3.13.0 | (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers.
(S3.5.0) Procedures exist to protect against infection by computer viruses, malicious code, and unauthorized software.
(S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system. | CC5.5
CC5.8
CC7.4 | G.1
I.2 | G.2.13, G.20.2,G.20.4, G.20.5, G.7, G.7.1, G.12.11, H.2.16, I.2.22.1, I.2.22.3, I.2.22.6, I.2.23 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | RM-05 | APO13.01
BAI06.01
BAI10
DSS05.03
DSS05.04
DSS05.05
DSS05.07
DSS06.03 | 312.8 and 312.10 | ITOS > Service Support > Configuration Management -> Software Mangement | shared | x | None | NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-8
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-3 | NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 CM-8
NIST SP 800-53 R3 CM-8 (1)
NIST SP 800-53 R3 CM-8 (3)
NIST SP 800-53 R3 CM-8 (5)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1) | 3.2.4
8.2.2 | A.10.1.3
A.10.4.1
A.11.5.4
A.11.6.1
A.12.4.1
A.12.5.3 | A.6.1.2
A.12.2.1
A.9.4.4
A.9.4.1
A.12.5.1
8.1* (partial) A.14.2.4 | Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment #11 | CM-1
CM-2
CM-3
CM-5
CM-7
CM-8
CM-9
SA-6
SA-7
SI-1
SI-3
SI-4
SI-7 | FTC Fair Information Principles
Involves both managerial and technical measures to protect against loss and the unauthorized access, destruction, use, or disclosure of the data.(49) Managerial measures include internal organizational measures that limit access to data and ensure that those individuals with access do not utilize the data for unauthorized purposes. Technical security measures to prevent unauthorized access include encryption in the transmission and storage of data; limits on access through use of passwords; and the storage of data on secure servers or computers . - http://www.ftc.gov/reports/privacy3/fairinfo.shtm | 14.1 | 1.3.3
2.1, 2.2.2
3.6
4.1
5.1, 5.2, 5.3, 5.4
6.2
7.1
9.1
9.1.1
9.1.2
9.1.3
9.2
9.3
9.4
9.4.1
9.4.2
9.4.3
10.1, 10.2, 10.3, 10.4, 10.5, 10.6, 10.7
11.1, 11.4, 11.5
12.3 |
| 54 | Change Control & Configuration Management
Production Changes | CCC-05 | CCC-05.1 | MY | Policies and procedures shall be established for managing the risks associated with applying changes to business-critical or customer (tenant) impacting (physical and virtual) application and system-system interface (API) designs and configurations, as well as infrastructure network and systems components. Technical measures shall be implemented to provide assurance that, prior to deployment, all changes directly correspond to a registered change request, business-critical or customer (tenant) , and/or authorization by, the customer (tenant) as per agreement (SLA). | Do you provide tenants with documentation that describes your production change management procedures and their roles/rights/responsibilities within it? | Please refer to the Change Management SOP for information on service management change lifecycle activities including, but not limited to, coordination of impact assessment, categorization, management of change approval and management of change implementation, back out, and review here: https://community.ACME.com/community?id=community_article&sys_id=140d2aa5dbd0dbc01dcaf3231f961900 | Yes | A3.16.0
S3.13.0 | (A3.16.0, S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system. | CC7.4
CC7.4 | I.2.17, I.2.20, I.2.22 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | RM-02 | COBIT 4.1 A16.1, A17.6 | BAI06.01
BAI06.02
BAI06.03
BAI06.04
BAI07.01
BAI07.03
BAI07.04
BAI07.05
BAI07.06 | ITOS > Service Support > Release Management | shared | x | None | 6.03. (a) | NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 PL-5
NIST SP 800-53 R3 SI-2 | NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 PL-5
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-6
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1) | 1.2.6 | 45 CFR 164.308 (a)(5)(ii)(C)
45 CFR 164.312 (b) | A.10.1.4
A.12.5.1
A.12.5.2 | A.12.1.4
8.1* (partial) A.14.2.2
8.1* (partial) A.14.2.3 | Commandment #1
Commandment #2
Commandment #3
Commandment #11 | CIP-003-3 - R6 | CA-1
CA-6
CA-7
CM-2
CM-3
CM-5
CM-6
CM-9
PL-2
PL-5
SI-2
SI-6
SI-7 | AR- 4. Privacy Monitoring and Auditing. Organizations also: (i) implement technology to audit for the security, appropriate use, and loss of PII; (ii) perform reviews to ensure physical security of documents containing PII; (iii) assess contractor compliance with privacy requirements; and (iv) ensure that corrective actions identified as part of the assessment process are tracked and monitored until audit findings are corrected. The organization Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO) coordinates monitoring and auditing efforts with information security officials and ensures that the results are provided to senior managers and oversight officials. | 12.1
12.4 | PA14 | SGP | PCI DSS v2.0 1.1.1
PCI DSS v2.0 6.3.2
PCI DSS v2.0 6.4
PCI DSS v2.0 6.1 | 1.1.1
6.3.2
6.4.5 |
| 55 | Data Security & Information Lifecycle Management
Classification | DSI-01 | DSI-01.1 | MY | Data and objects containing data shall be assigned a classification by the data owner based on data type, value, sensitivity, and criticality to the organization. | Do you provide a capability to identify virtual machines via policy tags/metadata (e.g., tags can be used to limit guest operating systems from booting/instantiating/transporting data in the wrong country, etc.)?
| ACME does not make use of virtual machines. | Not Applicable | S3.8.0
C3.14.0 | (S3.8.0) Procedures exist to classify data in accordance with classification policies and periodically monitor and update such classifications as necessary.
(C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies. | CC3.1
CC3.1 | D.1.3, D.2.2 | DG-02 | COBIT 4.1 PO 2.3, DS 11.6 | APO01.06
APO03.02
APO08.01
APO09.03
APO13.01
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
DSS05.05
DSS06.06 | 312.3 | BOSS > Data Governance > Data Classification | shared | x | Domain 5 | 6.04.03. (a) | Article 4 (1),
Article 12, Article 17 | NIST SP 800-53 R3 RA-2 | NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 AC-4 | 1.2.3
1.2.6
4.1.2
8.2.1
8.2.5
8.2.6 | A.7.2.1 | A.8.2.1 | Commandment #9 | General Provisions, Article 3, V. and VI. | CIP-003-3 - R4 - R5 | RA-2
AC-4 | DM-1 Minimization of Personsally Identifidable Information. DM-2 Data Retention & Disposal. DM-3 Minimization of PII used in Testing, Training, and Research. |
PA10 |
SGP | PCI DSS v2.0 9.7.1
PCI DSS v2.0 9.10
PCI DSS v2.0 12.3 | 3.1
9.6.1, 9.7.1
9.10
12.3 |
| 56 | DG-02 | DSI-01.2 | MY | Do you provide a capability to identify hardware via policy tags/metadata/hardware tags (e.g., TXT/TPM, VN-Tag, etc.)? | No, as this is only applicable for IaaS, not SaaS or PaaS. | Not Applicable |
| 57 | DG-02 | DSI-01.3 | MY | Do you have a capability to use system geographic location as an authentication factor? | Management of access to the customer's instance is the responsibility of the customer administration team.
ACME does not access any data stored by customers beyond what is required to provide support to its customer, except with customer's permission. Additionally, ACME controls remote access to its sensitive resources and the production systems and network. Remote access is controlled through Cisco VPN and SecurID, which prevent users from gaining access to these resources. ACME utilizes RSA SecurID for multi-factor authentication for network access to privileged (including administrative access) accounts for production. Access is governed by internal policy.
ACME provides at no additional cost a plugin called the 'IP Address Control plugin'. Customers may use this plugin to restrict instance level access to named ACME support personal and can specify who from ACME can access the instance and when. This can also be configured to prevent any ACME support access to the instance unless this is explicitly updated to allow access.
ACME customers can implement IP address restrictions within their instances.
Please refer to the instructions for the IP Address Control Plugin here: https://docs.ACME.com/bundle/kingston-platform-administration/page/administer/login/task/t_AccessControl.html | Yes |
| 58 | DG-02 | DSI-01.4 | MY | Can you provide the physical location/geography of storage of a tenant’s data upon request?
| ACME uses 3rd party colocation providers for its data centers. Data centers are arranged in 8 pairs (for a total of 16 data centers) across 4 geographic regions including Asia Pacific Japan (APJ), Europe, Middle East, and Africa (EMEA), North America, and South America. Each customer is located in a data center pair within 1 of these regions. Within several of these regions, there are specific country pairs for Canadian, US, Australian, and Swiss customers. All data centers are Tier 3 or higher, from recognized colocation providers, and must have either an ISO 27001 certification or SOC1/2 Type 2 attestation. ACME performs an annual review of each data center, which includes a review of the ISO 27001 certification or SOC1/2 Type 2 attestation, and performs periodic on-site visits.
Please refer to your customer contract for details regarding the location of your data center pair. Customers can dictate which data center pair their data is housed in and can manage IP address restrictions to limit the transmission of data. Customers would be notified should a data center move be required.
| Yes |
| 59 | DG-02 | DSI-01.5 | MY | Can you provide the physical location/geography of storage of a tenant's data in advance?
(DG-02.5: Do you allow tenants to define acceptable geographical locations for data routing or resource instantiation? ) | As DSI-01.4 above. | Yes |
| 60 | DSI-01.6 | MY | Do you follow a structured data-labeling standard (e.g., ISO 15489, Oasis XML Catalog Specification, CSA data type guidance)? | ACME does not knowingly store sensitive events in system logs. ACME treats all customer data, including audit logs equally. Any customer data that is stored or processed by a ACME instance is classified as 'Customer Restricted' regardless of the data criticality and sensitivity level deemed by the customer. Customers are responsible for classifying their data according to their business needs.
ACME has a documented Information Security Policy (ISP) that covers access to ACME and its Customer’s data; of which has specific policies to address Identity, Authentication and Authorization pertaining to information systems that store or access ACME or customer data. | Not Applicable |
| 61 | DSI-01.7 | MY | Do you allow tenants to define acceptable geographical locations for data routing or resource instantiation? | As DSI-01.4 and and DSI-01.3 above. | Yes |
| 62 | Data Security & Information Lifecycle Management
Data Inventory / Flows | DSI-02 | DSI-02.1 | MY | Policies and procedures shall be established to inventory, document, and maintain data flows for data that is resident (permanently or temporarily) within the service's applications and infrastructure network and systems. In particular, providers shall ensure that data that is subject to geographic residency requirements not be migrated beyond its defined bounds. | Do you inventory, document, and maintain data flows for data that is resident (permanent or temporary) within the services' applications and infrastructure network and systems? | ACME does not dictate, monitor or maintain the data customers enter into their instance. | N/A | APO01.06
APO03.01
APO03.02
APO09.01
APO09.01
BAI06.03
BAI09.01
BAI10.01
BAI10.02
BAI10.03
BAI10.04
BAI10.05 | BOSS > Data Governance > Handling / Labeling / Security Policy | Domain 5 | Clause
4.2
5.2,
7.5,
8.1 | TR-2 SYSTEM OF RECORDS NOTICES AND PRIVACY ACT STATEMENTS | 1.1.3
12.3.3 |
| 63 | DSI-02.2 | MY | Can you ensure that data does not migrate beyond a defined geographical residency? | As DSI-01.4 above. | Yes |
| 64 | Data Security & Information Lifecycle Management
eCommerce Transactions | DSI-03 | DSI-03.1 | MY | Data related to electronic commerce (e-commerce) that traverses public networks shall be appropriately classified and protected from fraudulent activity, unauthorized disclosure, or modification in such a manner to prevent contract dispute and compromise of data. | Do you provide open encryption methodologies (3.4ES, AES, etc.) to tenants in order for them to protect their data if it is required to move through public networks (e.g., the Internet)? | **Data at Rest**
ACME does not encrypt customer data by default. Customers can choose column, full disk, or Edge Encryption to encrypt their data:
1) Column encryption of customer added fields and attachments: Provides data encryption using AES128/256 or 3DES symmetric key encryption. The customer provides the keys for this encryption. Data stored in these fields cannot be searched or reported on and this does not support out of the box fields. Please see "Encryption support" in our product documentation: https://docs.ACME.com/bundle/jakarta-ACME-platform/page/administer/encryption/concept/c_EncryptionSupport.html.
2) Full disk encryption: Provides data encryption via self-encrypting hard drives with AES256 encryption. This delivers "at-rest" protection only and is focused solely on preventing data exposure through the loss or theft of hard disks holding customer data.
3) Edge Encryption: Provides data encryption via a proxy application that resides in a customer's network. Customers have the ability to create and control the encryption keys within their own network. This encrypts data before it is sent from the customer's environment to the ACME instance. The data always remains encrypted while stored in the instance; the data, encryption keys, and encryption configuration are never accessible by ACME. Please see "Edge Encryption" in our product documentation: https://docs.ACME.com/bundle/jakarta-ACME-platform/page/administer/edge-encryption/reference/edge-encryption.html
For additional information, please see the "Data Encryption with ACME" whitepaper available on the ACME CORE.
**Data in Transit**
ACME customers access their instances over the Internet using forced Transport Layer Security (TLS) encryption (AES128/256) for all user access. The level of encryption is based on the browser and must be configured by the customer as ACME does not modify any browser settings. All attempts to access ACME over HTTP are redirected to HTTPS. ACME administrators connect to the production network using an IPSEC VPN tunnel.
For integrations such as LDAP and Web Services, ACME provides customers with the ability to encrypt traffic. LDAP can be configured to run over SSL; this requires customers to provide a certificate for the specific LDAP server. Certificates may also be stored within an instance to allow encrypted transmission for Web Services integrations. FTPS and SCP can be used as file transfer methods to securely transfer files to ACME. | Yes | S3.6
I13.3.a-e
I3.4.0 | (S3.6) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks.
(I13.3.a-e) The procedues related to completeness, accuracy, timeliness, and authorization of system processing, including error correction and database management, are consistent with documented system processing integrity policies.
(I3.4.0) The procedures related to completeness, accuracy, timeliness, and authorization of outputs are consistent with the documented system processing integrity policies. | CC5.7
PI1.5 | G.4
G.11
G.16
G.18
I.3
I.4 | G.19.1.1, G.19.1.2, G.19.1.3, G.10.8, G.9.11, G.14, G.15.1 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-28 | COBIT 4.1 DS 5.10 5.11 | APO01.06
APO03.02
APO08.01
APO13.01
APO13.02
DSS05
DSS06
| 312.8 and 312.10 | SRM > Cryptographic Services > Data in Transit Encryption | shared | x | Domain 2 | Article 17 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-22
NIST SP 800-53 R3 AU-1 | NIST SP 800-53 R3 AC-22
NIST SP 800-53 R3 AU-10
NIST SP 800-53 R3 AU-10 (5)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1) | 3.2.4
4.2.3
7.1.2
7.2.1
7.2.2
8.2.1
8.2.5 | 45 CFR 164.312(e)(1)
45 CFR 164.312(e)(2)(i) | A.7.2.1
A.10.6.1
A.10.6.2
A.10.9.1
A.10.9.2
A.15.1.4 | A.8.2.1
A.13.1.1
A.13.1.2
A.14.1.2
A.14.1.3
A.18.1.4 | Commandment #4
Commandment #5
Commandment #9
Commandment #10
Commandment #11 | AC-14
AC-21
AC-22
IA-8
AU-10
SC-4
SC-8
SC-9 | TR-2 SYSTEM OF RECORDS NOTICES AND PRIVACY ACT STATEMENTS | PA25
PA21
PA5 | GP
GP
BSGP | PCI-DSS v2.0 2.1.1
PCI-DSS v2.0 4.1
PCI-DSS v2.0 4.1.1
PCI DSS v2.0 4.2 | 2.1.1
3.1
4.1
4.1.1
4.2 |
| 65 | IS-28 | DSI-03.2 | MY | Do you utilize open encryption methodologies any time your infrastructure components need to communicate with each other via public networks (e.g., Internet-based replication of data from one environment to another)? | As DSI-03.1 above. | Yes | COBIT 4.1 DS 5.10 5.11 | 45 CFR 164.312(e)(1)
45 CFR 164.312(e)(2)(i) | A.7.2.1
A.10.6.1
A.10.6.2
A.10.9.1
A.10.9.2
A.15.1.4 | NIST SP800-53 R3 AC-14
NIST SP800-53 R3 AC-21
NIST SP800-53 R3 AC-22
NIST SP800-53 R3 IA-8
NIST SP800-53 R3 AU-10
NIST SP800-53 R3 SC-4
NIST SP800-53 R3 SC-8
NIST SP800-53 R3 SC-9 | PCI-DSS v2.0 2.1.1
PCI-DSS v2.0 4.1
PCI-DSS v2.0 4.1.1
PCI DSS v2.0 4.2 |
| 66 | Data Security & Information Lifecycle Management
Handling / Labeling / Security Policy | DSI-04 | DSI-04.1 | MY | Policies and procedures shall be established for labeling, handling, and the security of data and objects which contain data. Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data. | Are policies and procedures established for labeling, handling and the security of data and objects that contain data? | ACME has defined the information labeling and handling procedures in its Media Handling SOP, which describes how the reuse, disposal and destruction of physical media must be handled. Equipment (with customer data), such as hard drives, that need to be destroyed or sanitized is stored in a lockbox in the ACME cage; a label is attached to identify customer sensitive, and the associated HI ticket number for tracking. Annually, or when the contained media device count reaches 50, a third party vendor destroys the media on site within the ACME cage.
Please refer to Datacenter Media Handling SOP here: https://community.ACME.com/community?id=community_article&sys_id=293c2a61dbd0dbc01dcaf3231f961924
Please refer to Disk Destruction SOP here: https://community.ACME.com/community?id=community_article&sys_id=67bc6e25dbd0dbc01dcaf3231f9619d1
Please refer the Customer Data Handling SOP here: https://community.ACME.com/community?id=community_article&sys_id=967ca2e1dbd0dbc01dcaf3231f96190e
| Yes | S3.2.a | (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public. | CC5.1 | G.13 | D.2.2 | DG-03 | COBIT 4.1 PO 2.3, DS 11.6 | APO01.06
APO03.02
APO08.01
APO09.03
APO13.01
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
DSS05.05
DSS06.06 | 312.2 | BOSS > Data Governance > Handling / Labeling / Security Policy | shared | x | Domain 5 | 6.03.05. (b) | Article 22
Article 23 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-12 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-16
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-3
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-12 | 99.31.(a)(1)(ii) | 1.1.2
5.1.0
7.1.2
8.1.0
8.2.5
8.2.6 | A.7.2.2
A.10.7.1
A.10.7.3
A.10.8.1 | A.8.2.2
A.8.3.1
A.8.2.3
A.13.2.1 | Commandment #8
Commandment #9
Commandment #10 | Chapter II
Article 8, 9, 11, 12, 14, 18, 19, 20, 21 | CIP-003-3 - R4 - R4.1 | AC-16
MP-1
MP-3
PE-16
SI-12
SC-9 | DM-1 Minimization of Personally Identifiable Information. DM-2 Data Retention & Disposal. DM-3 Minimization of PII used in Testing, Training, and Research. SE-1 INVENTORY OF PERSONALLY IDENTIFIABLE INFORMATION | 13.1 | PCI DSS v2.0 9.5
PCI DSS v2.0 9.6
PCI DSS v2.0 9.7.1
PCI DSS v2.0 9.7.2
PCI DSS v2.0 9.10 | 9.5, 9.5.1
9.6
9.7
9.8
9.9 |
| 67 | DG-03 | DSI-04.2 | MY | Are mechanisms for label inheritance implemented for objects that act as aggregate containers for data?
| As DSI-04.1 above. | Yes | COBIT 4.1 PO 2.3, DS 11.6 | A.7.2.2
A.10.7.1
A.10.7.3
A.10.8.1 | NIST SP800-53 R3 AC-16
NIST SP800-53 R3 MP-1
NIST SP800-53 R3 MP-3
NIST SP800-53 R3 PE-16
NIST SP800-53 R3 SI-12
NIST SP800-53 R3 SC-9 | PCI DSS v2.0 9.5
PCI DSS v2.0 9.6
PCI DSS v2.0 9.7.1
PCI DSS v2.0 9.7.2
PCI DSS v2.0 9.10 |
| 68 | Data Security & Information Lifecycle Management
Nonproduction Data | DSI-05 | DSI-05.1 | MY | Production data shall not be replicated or used in non-production environments. | Do you have procedures in place to ensure production data shall not be replicated or used in non-production environments? | ACME does not access any data stored by customers beyond what is required to provide support to its customer, except with customer's permission. Additionally, ACME controls remote access to its sensitive resources and the production systems and network. Remote access is controlled through Cisco VPN and SecurID, which prevent users from gaining access to these resources. ACME utilizes RSA SecurID for multi-factor authentication for network access to privileged (including administrative access) accounts for production. Access is governed by internal policy.
ACME does not use customer data in in our non-production environments by policy, unless the customer specifically approves the use.
Additionally, ACME maintains its test data in the test environment, which is segregated from the production environment. ACME typically does not use customer data as test data, except in the case of testing certain qualities including without limitation the interoperability and stability of the next release of the Subscription Service, in such case, ACME and the subject customer will enter into a “Data Test Agreement” with specific terms and conditions stipulating the handling of the test data, which covers the terms on, scope, access, reproduction and destruction of the test data.
Please refer the Customer Data Handling SOP here: https://community.ACME.com/community?id=community_article&sys_id=967ca2e1dbd0dbc01dcaf3231f96190e | Yes | C3.5.0
S3.4.0
C3.21.0 | (C3.5.0) The system procedures provide that confidential information is disclosed to parties only in accordance with the entity’s defined confidentiality and related security policies.
(S3.4.0) Procedures exist to protect against unauthorized access to system resources.
(C3.21.0) Procedures exist to provide that confidential information is protected during the system development, testing, and change processes in accordance with defined system confidentiality and related security policies. | C1.3
CC5.6
C1.1 | I.2.18 | DG-06 | APO01.06
BAI01.01
BAI03.07
BAI07.04 | SRM > Policies and Standards > Technical Standard (Data Management Security Standard) | shared | x | Domain 5 | 6.03. (d) | NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1) | 1.2.6 | 45 CFR 164.308(a)(4)(ii)(B) | A.7.1.3
A.10.1.4
A.12.4.2
A.12.5.1 | A.8.1.3
A.12.1.4
A.14.3.1
8.1* (partial) A.14.2.2. | Commandment #9
Commandment #10
Commandment #11 | CIP-003-3 - R6 | SA-11
CM-04 | DM-1 Minimization of Personally Identifiable Information. DM-2 Data Retention & Disposal. DM-3 Minimization of PII used in Testing, Training, and Research. SE-1 INVENTORY OF PERSONALLY IDENTIFIABLE INFORMATION | 17.8 | PCI DSS v2.0 6.4.3 | 6.4.3 |
| 69 | Data Security & Information Lifecycle Management
Ownership / Stewardship | DSI-06 | DSI-06.1 | MY | All data shall be designated with stewardship, with assigned responsibilities defined, documented, and communicated. | Are the responsibilities regarding data stewardship defined, assigned, documented and communicated?
(DG-01: Do you follow a structured data-labeling standard (ex. ISO 15489, Oasis XML Catalog Specification, CSA data type guidance)?) | ACME operates the infrastructure that supports its services however it is ACME's customers who place ALL data in the system and ACME does not attempt to analyze its customers data. As a result ACME classifies all customer data with the same classification "Customer Restricted" and applies controls and policies to that data classification. ACME does not modify, label or classify its customer data.
As DSI-01.6 above. | Yes | S2.2.0
S2.3.0
S3.8.0 | (S2.2.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users.
(S2.3.0) Responsibility and accountability for the entity’s system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.
(S3.8.0) Procedures exist to classify data in accordance with classification policies and periodically monitor and update such classifications as necessary | CC2.3
CC3.1 | C.2.5.1, C.2.5.2, D.1.3, L.7 | Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.1.3 | DG-01 | COBIT 4.1 DS5.1, PO 2.3 | APO01.06
APO03.02
APO13.01
APO13.03 | 312.4 | BOSS > Data Governance > Data Ownership / Stewardship | shared | x | Domain 5 | Article 4 | NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-2 | NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-2 | 6.2.1 | 45 CFR 164.308 (a)(2) | A.6.1.3
A.7.1.2
A.15.1.4 | A.6.1.1
A.8.1.2
A.18.1.4 | Commandment #6
Commandment #10 | Chapter IV
Article 30 | CIP-007-3 - R1.1 - R1.2 | CA-2
PM-5
PS-2
RA-2
SA-2 | AP-1 AUTHORITY TO COLLECT. AP-2 PURPOSE SPECIFICATION. | 3.4 | 3.7
12.5.5
12.10.4 |
| 70 | Data Security & Information Lifecycle Management
Secure Disposal | DSI-07 | DSI-07.1 | MY | Any use of customer data in non-production environments requires explicit, documented approval from all customers whose data is affected, and must comply with all legal and regulatory requirements for scrubbing of sensitive data elements. | Do you support secure deletion (e.g., degaussing/cryptographic wiping) of archived and backed-up data as determined by the tenant? | Standard hosted customers would need to request this prior to contract exit. Customers who opted for dedicated hardware would have this carried out automatically. ACME retains customer data at the completion of a contract for 45 days. A customer can request a complete copy of their data during this period and ACME will provide it. But this is completely separate from backups. After this period is over data is destroyed based on formal data destruction methodologies.
Please refer to the Disk Destruction SOP here: https://community.ACME.com/community?id=community_article&sys_id=67bc6e25dbd0dbc01dcaf3231f9619d1
Please refer to the Datacenter Media Handling SOP here: https://community.ACME.com/community?id=community_article&sys_id=293c2a61dbd0dbc01dcaf3231f961924
Please refer to the Secure Data Deletion SOP here: https://community.ACME.com/community?id=community_article&sys_id=5b3d2ee5dbd0dbc01dcaf3231f9619b1 | Yes | C3.5.0
S3.4.0 | (C3.5.0) The system procedures provide that confidential information is disclosed to parties only in accordance with the entity’s defined confidentiality and related security policies.
(S3.4.0) Procedures exist to protect against unauthorized access to system resources. | C1.3
CC5.6 | D.2.2.10, D.2.2.11, D.2.2.14, | 37 (B) | Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.7.5 and 4.5.3 | DG-05 | COBIT 4.1 DS 11.4 | APO01.06
APO13.01
BAI09.03
DSS01.01
| 312.3 | BOSS > Data Governance > Secure Disposal of Data | shared | x | Domain 5 | 6.03. (h) | Article 16
Article 17 | NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 PE-1 | NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 MP-6 (4)
NIST SP 800-53 R3 PE-1 | 5.1.0
5.2.3 | 45 CFR 164.310 (d)(2)(i)
45 CFR 164.310 (d)(2)(ii) | A.9.2.6
A.10.7.2 | A.11.2.7
A.8.3.2 | Commandment #11 | CIP-007-3 - R7 - R7.1 - R7.2 R7.3 | MP-6
PE-1 | DM-2 DATA RETENTION AND DISPOSAL | 13.4
13.5 | PA10
PA39
PA34
PA40 | BSGP
SGP
SGP
SGP | PCI DSS v2.0 3.1.1
PCI DSS v2.0 9.10
PCI DSS v2.0 9.10.1
PCI DSS v2.0 9.10.2
PCI DSS v2.0 3.1 | 3.1.1
9.8, 9.8.1, 9.8.2, 3.1 |
| 71 | DG-05 | DSI-07.2 | MY | Can you provide a published procedure for exiting the service arrangement, including assurance to sanitize all computing resources of tenant data once a customer has exited your environment or has vacated a resource?
| As DSI-07.1 above. | Yes | COBIT 4.1 DS 11.4 | 45 CFR 164.310 (d)(2)(i)
45 CFR 164.310 (d)(2)(ii) | A.9.2.6
A.10.7.2 | NIST SP800-53 R3 MP-6
NIST SP800-53 R3 PE-1 | PCI DSS v2.0 3.1.1
PCI DSS v2.0 9.10
PCI DSS v2.0 9.10.1
PCI DSS v2.0 9.10.2
PCI DSS v2.0 3.1 |
| 72 | Datacenter Security
Asset Management | DCS-01 | DCS-01.1 | MY | Assets must be classified in terms of business criticality, service-level expectations, and operational continuity requirements. A complete inventory of business-critical assets located at all sites and/or geographical locations and their usage over time shall be maintained and updated regularly, and assigned ownership y defined roles and responsibilities. | Do you maintain a complete inventory of all of your critical assets that includes ownership of the asset?
| ACME has a formally documented Asset Management SOP, with the purpose to ensure that assets are commissioned, tracked, managed, and decommissioned in a way that protects the confidentiality, integrity, and availability of ACME assets.
ACME's CMDB has a built-in IT Asset Management (ITAM) module that enables the deployment and discovery process to ensure that every asset is registered in CMDB. ACME does not deploy an asset until it is registered in CMDB to ensure all assets are in CMDB.
Please refer to the Datacenter Asset Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=d30d2ea5dbd0dbc01dcaf3231f9619c0 | Yes | S3.1.0
C3.14.0
S1.2.b-c | (S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats.
(C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies.
(S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to define protection requirements, access rights and access restrictions, and retention and destruction policies.
c. Assessing risks on a periodic basis. | CC3.1
CC3.1 | Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 | FS-08 | APO01.06
APO03.02
APO08.01
APO09.03
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
DSS05.05
DSS06.06 | ITOS > Service Support > Configuration Management - Physical Inventory | provider | x | Domain 8 | Article 17 | 45 CFR 164.310 (d)(2)(iii) | A.7.1.1
A.7.1.2 | Annex A.8 | NIST SP800-53 R3 CM-8 | 12.3 | PA4
PA8
PA37
PA38 | BSGP
BSGP
SGP
SGP | PCI DSS v2.0 9.9.1
PCI DSS v2.0 12.3.3
PCI DSS v2.0 12.3.4 | 9.7.1
9.9
9.9.1 |
| 73 | FS-08 | DCS-01.2 | MY | Do you maintain a complete inventory of all of your critical supplier relationships?
| As CCC-01.1 above. | Yes | 45 CFR 164.310 (d)(2)(iii) | A.7.1.1
A.7.1.2 | NIST SP800-53 R3 CM-8 | PCI DSS v2.0 9.9.1
PCI DSS v2.0 12.3.3
PCI DSS v2.0 12.3.4 |
| 74 | Datacenter Security
Controlled Access Points | DCS-02 | DCS-02.1 | MY | Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) shall be implemented to safeguard sensitive data and information systems. | Are physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks and security patrols) implemented? | ACME's data centers inherit physical security and environmental controls from the colocation providers. All providers enforce access to the data centers via multiple levels of locking mechanisms, including pin codes, biometrics, and access cards. ACME must pre-approve all (ACME) visitors to the data centers. Government / state-issued identification is required to authenticate visitors upon arriving. Visitors must be escorted at all times by authorized personnel. ACME reviews access control lists, access activity, and visitor logs on a monthly basis. All data centers are staffed with uniformed security guards, are designed to thwart crash/ram physical attacks, use camera surveillance (e.g. building exterior, all ingress/egress points, data center floor), and have audible alarms on controlled doors. Most data centers do not have exterior windows and no data centers have windows on the data halls; any exterior glass is alarmed for breakage. Cameras and alarms are monitored by the provider's on-site security staff. In all data centers, ACME has its own cages with its own card readers and biometric controls. All data centers are equipped with uninterruptible power supply (UPS), fire detection and suppression systems, backup generators, and heating, ventilation, and air conditioning (HVAC) systems. ACME performs an annual review of each data center, which includes a review of the ISO 27001 certification or SOC1/2 Type 2 attestation, and performs periodic on-site visits to ensure that physical security and environmental controls are operating effectively.
Corporate security personnel assigns badge access card privileges to users using predefined access zones to help ensure that access privileges are consistently assigned. Corporate security personnel revokes badge access privileges of terminated employees as a component of the employee termination process. All visitors to ACME offices are required to be pre-approved, sign in at the front desk, and be escorted and wear a visitor badge at all times while on premise. A quarterly review of access to all critical areas is performed to help ensure that access privileges are assigned only to current employees with a business need for access.
Please refer to the Datacenter Third Party Attestation reports here: https://community.ACME.com/community?id=community_topic&sys_id=94495e2ddbd897c068c1fb651f9619eb
Please refer to the Datacenter Access Control SOP here: https://community.ACME.com/community?id=community_article&sys_id=d24d6229dbd0dbc01dcaf3231f961929 | Yes | A3.6.0 | (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. | CC5.5 | F.2 | F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6, F.1.2.8, F.1.2. 9, F.1.2.10, F.1.2.11, F.1.2.12, F.1.2.13, F.1.2.14, F.1.2.15, F.1.2.24, F.1.3, F.1.4.2, F1.4.6, F.1.4.7, F.1.6, F.1.7,F.1.8, F.2.13, F.2.14, F.2.15, F.2.16, F.2.17, F.2.18 | 7 (B) | Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 | FS-03 | COBIT 4.1 DS 12.3 | APO13.01
DSS01.01
DSS01.05
DSS05.05
DSS06.03
DSS06.06 | 312.8 and 312.10 | Infra Services > Facility Security > Controlled Physical Access | provider | x | Domain 8 | 6.08. (a)
6.09. (i) | Article 17 | NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-8 | NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-6 (1)
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-7 (1)
NIST SP 800-53 R3 PE-8
NIST SP 800-53 R3 PE-18 | 99.31.a.1.ii | 8.2.3 | A.9.1.1 | A.11.1.1
A.11.1.2 | Commandment #1
Commandment #2
Commandment #3
Commandment #5 | CIP-006-3c R1.2 - R1.3 - R1.4 - R1.6 - R1.6.1 - R2 - R2.2 | PE-2
PE-3
PE-6
PE-7
PE-8
PE-18 | 8.1
8.2 | PA4 | BSGP
| PCI DSS v2.0 9.1 | 9.1
9.1.1
9.1.2, 9.1.3
9.2, 9.3, 9.4, 9.4.1, 9.4.2, 9.4.3, 9.4.4 |
| 75 | Datacenter Security
Equipment Identification | DCS-03 | DCS-03.1 | MY | Automated equipment identification shall be used as a method of connection authentication. Location-aware technologies may be used to validate connection authentication integrity based on known equipment location. | Is automated equipment identification used as a method to validate connection authentication integrity based on known equipment location? | ACME uses certificate based authentication in conjuction with other authentication methods in its environment that meet this requirement.
ACME has a formally documented Datacenter Asset Management SOP, with the purpose to ensure that assets are commissioned, tracked, managed, and decommissioned in a way that protects the confidentiality, integrity, and availability of ACME assets.
ACME's CMDB has a built-in IT Asset Management (ITAM) module that enables the deployment and discovery process to ensure that every asset is registered in CMDB. ACME does not deploy an asset until it is registered in CMDB to ensure all assets are in CMDB.
Please refer to the Datacenter Asset Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=d30d2ea5dbd0dbc01dcaf3231f9619c0 | Yes | S3.2.a | (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public. | CC5.1 | D.1 | D.1.1, D.1.3 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-13 | COBIT 4.1 DS5.7 | APO13.01
DSS05.02
DSS05.03
| 312.3, 312.8 and 312.10 | > > | Domain 8 | 6.05. (a) | NIST SP 800-53 R3 IA-4 | NIST SP 800-53 R3 IA-3
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-4 (4) | A.11.4.3 | Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment #8 | IA-3
IA-4 | PA22
PA33 | GP
SGP |
| 76 | Datacenter Security
Offsite Authorization | DCS-04 | DCS-04.1 | MY | Authorization must be obtained prior to relocation or transfer of hardware, software, or data to an offsite premises. | Do you provide tenants with documentation that describes scenarios in which data may be moved from one physical location to another? (e.g., offsite backups, business continuity failovers, replication) | Customer data does not leave the data center and would not be moved from one physical location to another. Please refer to BCR-11.5 for details around ACME's Advanced High Availability architecture and business continuity/disaster recovery process. | Yes | S3.2.f
C3.9.0 | (S3.2.f) f. Restriction of access to offline storage, backup data, systems, and media.
(C3.9.0) Procedures exist to restrict physical access to the defined system including, but not limited to: facilities, backup media, and other system components such as firewalls, routers, and servers. | CC5.1
CC5.5 | F.2.18, F.2.19, | Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.5 | FS-06 | EDM05.02
APO01.02
APO03.02
BAI02.03
BAI02.04
BAI03.09
BAI06.01 | 312.8 and 312.10 | SRM > Facility Security > Asset Handling | provider | x | Domain 8 | 6.08. (a)
6.09. (j) | Article 17 | NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16 | NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-17 (1)
NIST SP 800-53 R3 AC-17 (2)
NIST SP 800-53 R3 AC-17 (3)
NIST SP 800-53 R3 AC-17 (4)
NIST SP 800-53 R3 AC-17 (5)
NIST SP 800-53 R3 AC-17 (7)
NIST SP 800-53 R3 AC-17 (8)
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-17 | 45 CFR 164.310 (d)(1) (New) | A.9.2.7
A.10.1.2 | A.11.2.6
A.11.2.7 | Commandment #4
Commandment #5
Commandment #11 | AC-17
MA-1
PE-1
PE-16
PE-17 | 12.5
19.1 | PA4 | BSGP | PCI DSS v2.0 9.8
PCI DSS v2.0 9.9 | 9.6.3 |
| 77 | Datacenter Security
Offsite equipment | DCS-05 | DCS-05.1 | MY | Policies and procedures shall be established for the secure disposal of equipment (by asset type) used outside the organization's premise. This shall include a wiping solution or destruction process that renders recovery of information impossible. The erasure shall consist of a full write of the drive to ensure that the erased drive is released to inventory for reuse and deployment or securely stored until it can be destroyed. | Can (Do) you provide tenants with evidence documenting your policies and procedures governing asset management and repurposing of equipment?
| Yes, ACME provides documentation for Customers.
Please refer to the Datacenter Asset Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=d30d2ea5dbd0dbc01dcaf3231f9619c0
Please refer to the Datacenter Media Handling SOP here: https://community.ACME.com/community?id=community_article&sys_id=293c2a61dbd0dbc01dcaf3231f961924 | Yes | S3.4 | (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.6 | D.1 | D.1.1, D.2.1. D.2.2, | Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.5 | FS-07 | APO09.03
APO10.04
APO10.05
APO13.01
DSS01.02 | 312.8 and 312.10 | BOSS > Data Governance > Secure Disposal of Data | provider | x | Domain 8 | 6.05. (a)
6.05. (b)
6.05. (c) | Article 17 | NIST SP 800-53 R3 CM-8 | NIST SP 800-53 R3 CM-8
NIST SP 800-53 R3 CM-8 (1)
NIST SP 800-53 R3 CM-8 (3)
NIST SP 800-53 R3 CM-8 (5)
NIST SP 800-53 R3 SC-30 | 45 CFR 164.310 (c )
45 CFR 164.310 (d)(1) (New)
45 CFR 164.310 (d)(2)(i) (New) | A.9.2.5
A.9.2.6 | A.8.1.1
A.8.1.2 | Commandment #6
Commandment #7
Commandment #8 | CM-8 | 12.6 | PA4 | BSGP | PCI DSS v2.0 9.8
PCI DSS v2.0 9.9
PCI DSS v2.0 9.10 | 9.8, 9.8.1, 9.8.2
12.3 |
| 78 | Datacenter Security
Policy | DCS-06 | DCS-06.1 | MY | Policies and procedures shall be established, and supporting business processes implemented, for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas. | Can you provide evidence that policies, standards and procedures have been established for maintaining a safe and secure working environment in offices, rooms, facilities and secure areas? | Corporate security personnel assigns badge access card privileges to users using predefined access zones to help ensure that access privileges are consistently assigned. Corporate security personnel revokes badge access privileges of terminated employees as a component of the employee termination process. All visitors to ACME offices are required to be pre-approved, sign in at the front desk, and be escorted and wear a visitor badge at all times while on premise. A quarterly review of access to all critical areas is performed to help ensure that access privileges are assigned only to current employees with a business need for access.
Please refer to the Functional Office Physical Security SOP here: https://community.ACME.com/community?id=community_article&sys_id=ec2cae21dbd0dbc01dcaf3231f9619ee | Yes | A3.6.0 | (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. | CC5.5 | H.6 | F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6, F.1.2.8, F.1.2. 9, F.1.2.10, F.1.2.11, F.1.2.12, F.1.2.13, F.1.2.14, F.1.2.15, F.1.2.24, F.1.4.2, F1.4.6, F.1.4.7, F.1.7, F.1.8, F.2.13, F.2.14, F.2.15, F.2.16, F.2.17, F.2.18 | 7 (B) | Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 | FS-01 | COBIT 4.1 DS5.7, DS 12.1, DS 12.4 DS 4.9 | APO13.01
DSS01.04
DSS01.05
DSS04.01
DSS04.03 | SRM > Policies and Standards > Information Security Policies (Facility Security Policy) | provider | x | Domain 8 | 6.08. (a)
6.09. (i) | Article 17 | NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6 | NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-4
NIST SP 800-53 R3 PE-5
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-6 (1) | 99.31.a.1.ii | 8.2.1
8.2.2
8.2.3 | 45 CFR 164.310 (a)(1)
45 CFR 164.310 (a)(2)(ii)
45 CFR 164.308(a)(3)(ii)(A) (New)
45 CFR 164.310 (a)(2)(iii) (New) | A.5.1.1
A.9.1.3
A.9.1.5 | A.11.1.1
A.11.1.2 | Commandment #1
Commandment #2
Commandment #3
Commandment #5 | CIP-006-3c R1.2 - R1.3 - R1.4 -R2 - R2.2 | PE-2
PE-3
PE-4
PE-5
PE-6 | 4.2
8.1 | PA4 | BSGP | PCI DSS v2.0 9.1
PCI DSS v2.0 9.2
PCI DSS v2.0 9.3
PCI DSS v2.0 9.4 | 9.1
9.1.1
9.1.2
9.2
9.3
9.4
9.4.1
9.4.2
9.4.3
9.4.4 |
| 79 | DCS-06.2 | MY | Can you provide evidence that your personnel and involved third parties have been trained regarding your documented policies, standards and procedures? | ACME has a formal, multifaceted training program that includes on-the-job training, role based training, onboarding training, general security training (i.e. acceptable use, handling of sensitive data), specialized security training (i.e. for developers: OWASP top 10 Vulnerabilities and Countermeasures), and legal & human resources training (i.e. Insider Trading, Ethics & International Business). Additionally, Employees are required to (re-)complete Security and Awareness Training/Internal Company Training on an annual basis. ACME provides instructor-led classes, in-person, online self-paced, and external training options. ACME does not provide employee training records externally.
Please refer to the Training Policy here: https://community.ACME.com/community?id=community_article&sys_id=051daea5dbd0dbc01dcaf3231f9619fb
Please refer to the Training SOP here: https://community.ACME.com/community?id=community_article&sys_id=aa3deae5dbd0dbc01dcaf3231f961931 | Yes |
| 80 | Datacenter Security
Secure Area Authorization | DCS-07 | DCS-07.1 | MY | Ingress and egress to secure areas shall be constrained and monitored by physical access control mechanisms to ensure that only authorized personnel are allowed access. | Do you allow tenants to specify which of your geographic locations their data is allowed to move into/out of (to address legal jurisdictional considerations based on where data is stored vs. accessed)? | As BCR-06.1 above. | Yes | A3.6.0 | (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. | CC5.5 | F.2 | F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6, F.1.2.8, F.1.2. 9, F.1.2.10, F.1.2.11, F.1.2.12, F.1.2.13, F.1.2.14, F.1.2.15, F.1.2.24, F.1.3, F.1.4.2, F1.4.6, F.1.4.7, F.1.6, F.1.7,F.1.8, F.2.13, F.2.14, F.2.15, F.2.16, F.2.17, F.2.18 | 7 (B) | Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 | FS-04 | DS 12.2, DS 12.3 | APO13.01
APO13.02
DSS05.05 | 312.8 and 312.10 | SRM > Policies and Standards > Information Security Policy (Facility Security Policy) | provider | x | Domain 8 | 6.08. (a)
6.09. (i) | Article 17 | NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-16 | NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-7 (1)
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-18 | 99.31.a.1.ii | 8.2.3 | A.9.1.1
A.9.1.2 | A.11.1.6 | Commandment #1
Commandment #2
Commandment #3
Commandment #5 | CIP-006-3c R1.2 - R1.3 - R1.4 | PE-7
PE-16
PE-18 | 8.2
8.1 | PA4 | BSGP | PCI DSS v2.0 9.1
PCI DSS v2.0 9.1.1
PCI DSS v2.0 9.1.2
PCI DSS v2.0 9.1.3
PCI DSS v2.0 9.2 | 9.1
9.1.1
9.1.3 |
| 81 | Datacenter Security
Unauthorized Persons Entry | DCS-08 | DCS-08.1 | MY | Ingress and egress points such as service areas and other points where unauthorized personnel may enter the premises shall be monitored, controlled and, if possible, isolated from data storage and processing facilities to prevent unauthorized data corruption, compromise, and loss. | Are ingress and egress points, such as service areas and other points where unauthorized personnel may enter the premises, monitored, controlled and isolated from data storage and process? | As DCS-02.1 above. | Yes | A3.6.0 | (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. | CC5.5 | G.21 | F.2.18 | Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 | FS-05 | COBIT 4.1 DS 12.3 | APO13.01
APO13.02
DSS05.05
DSS06.03 | 312.8 and 312.10 | SRM > Policies and Standards > Information Security Policy (Facility Security Policy) | provider | x | Domain 8 | 6.08. (a)
6.09. (j) | Article 17 | NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 PE-16 | NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-2 (1)
NIST SP 800-53 R3 PE-16 | 99.31.a.1.ii | 8.2.5
8.2.6 | A.9.1.6 | A.11.2.5
8.1* (partial) A.12.1.2 | Commandment #6
Commandment #7 | MA-1
MA-2
PE-16 | 8.1
8.2
8.3
8.4 | PA4 | BSGP | 9.1
9.1.1
9.1.2
9.2
9.3
9.4
9.4.1
9.4.2
9.4.3
9.4.4
9.5
9.5.1 |
| 82 | Datacenter Security
User Access | DCS-09 | DCS-09.1 | MY | Physical access to information assets and functions by users and support personnel shall be restricted. | Do you restrict physical access to information assets and functions by users and support personnel?
(FS-02: Pursuant to local laws, regulations, ethics and contractual constraints are all employment candidates, contractors and third parties subject to background verification?) | As DCS-02.1 above. | Yes | A3.6.0 | (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. | CC5.5 | F.2 | F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6, F.1.2.8, F.1.2. 9, F.1.2.10, F.1.2.11, F.1.2.12, F.1.2.13, F.1.2.14, F.1.2.15, F.1.2.24, F.1.3, F.1.4.2, F1.4.6, F.1.4.7, F.1.6, F.1.7,F.1.8, F.2.13, F.2.14, F.2.15, F.2.16, F.2.17, F.2.18 | 7 (B)
10 (B) | Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 | FS-02 | APO13.01
APO13.02
DSS05.04
DSS05.05
DSS06.03 | 312.8 and 312.10 | Infra Services > Facility Security > | Domain 8 | 6.08. (a)
6.09. (i) | Article 17 | NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6 | NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-6 (1)
NIST SP 800-53 R3 PE-18 | 99.31.a.1.ii | 8.2.3 | 45 CFR 164.310(a)(1) (New)
45 CFR 164.310(a)(2)(ii) (New)
45 CFR 164.310(b) (New)
45 CFR 164.310 ( c) (New) | A.9.1.1
A.9.1.2 | A.11.1.1 | Commandment #1
Commandment #2
Commandment #3
Commandment #5 | Chapter II,
Article 19 | CIP-006-3c R1.2 - R1.3 - R1.4 - R1.6 - R1.6.1 - R2 - R2.2 | PE-2
PE-3
PE-6
PE-18 | 8.1
8.2 | PA4
PA13
PA24 | BSGP
SGP
P | PCI DSS v2.0 9.1 | 9.1
9.1.1
9.1.2
9.2
9.3
9.4
9.4.1
9.4.2
9.4.3
9.4.4
9.5
9.5.1 |
| 83 | Encryption & Key Management
Entitlement | EKM-01 | EKM-01.1 | MY | Keys must have identifiable owners (binding keys to identities) and there shall be key management policies. | Do you have key management policies binding keys to identifiable owners? | ACME has a documented Cryptography Standards that provides governance over the design and implementation of cryptographic controls.
The document applies to all resources (e.g., employees, contractors, and vendors) involved in managing or implementing cryptographic controls. These standards apply to all cryptographic mechanisms, including approved algorithms and key strengths and key management, used to protect the confidentiality, authenticity, and integrity of sensitive ACME and customer data in the production datacenter environment.
Procedures are reviewed on a minimum biennial basis as per ACME's formal managed document program.
Please refer to the Cryptography Standards here: https://community.ACME.com/community?id=community_article&sys_id=f21d62e5dbd0dbc01dcaf3231f9619a6 | Yes | APO01.06
APO13.01
DSS05.04
DSS05.06
DSS06.03
DSS06.06 | SRM > Cryptographic Services > Key Management | Annex
A.10.1
A.10.1.1
A.10.1.2 | PA36 | 3.5, 7.1.3
8.1
8.1.1
8.2.2
8.5
8.5.1 |
| 84 | Encryption & Key Management Key Generation
(v1.4: Encryption Key Management) | EKM-02 | EKM-02.1 | MY | Policies and procedures shall be established for the management of cryptographic keys in the service's cryptosystem (e.g., lifecycle management from key generation to revocation and replacement, public key infrastructure, cryptographic protocol design and algorithms used, access controls in place for secure key generation, and exchange and storage including segregation of keys used for encrypted data or sessions). Upon request, provider shall inform the customer (tenant) of changes within the cryptosystem, especially if the customer (tenant) data is used as part of the service, and/or the customer (tenant) has some shared responsibility over implementation of the control. | Do you have a capability to allow creation of unique encryption keys per tenant?
| Customers have full control to and are responsible for the lifecycle of their customer-supplied encryption key; this key is unique to the customer and is managed by the customer. | Yes | (S3.6.0) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks.
(S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.7
CC5.6 | L.6 | 38 (B)
39 (C+) | IS-19 | COBIT 4.1 DS5.8 | APO13.01
APO13.02
APO09.03
BAI06.01
BAI09.01
BAI09.02
BAI09.03 | 312.8 and 312.10 | SRM > Cryptographic Services > Key Management | shared | x | Domain 2 | 6.04.04. (a)
6.04.04. (b)
6.04.04. (c)
6.04.04. (d)
6.04.04. (e)
6.04.05. (d)
6.04.05. (e)
6.04.08.02. (b) | Article 17 | NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-13 | NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-12 (2)
NIST SP 800-53 R3 SC-12 (5)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-17 | 8.1.1
8.2.1
8.2.5 | 45 CFR 164.312 (a)(2)(iv)
45 CFR 164.312(e)(1) (New) | Clause 4.3.3
A.10.7.3
A.12.3.2
A.15.1.6 | Clauses
5.2(c)
5.3(a)
5.3(b)
7.5.3(b)
7.5.3(d)
8.1
8.3
9.2(g)
A.8.2.3
A.10.1.2
A.18.1.5 | Commandment #9
Commandment #10
Commandment #11 | SC-12
SC-13
SC-17
SC-28 | 16.2 | PA36 | PCI-DSS v2.0 3.4.1
PCI-DSS v2.0 3.5
PCI-DSS v2.0 3.5.1
PCI-DSS v2.0 3.5.2
PCI-DSS v2.0 3.6
PCI-DSS v2.0 3.6.1
PCI-DSS v2.0 3.6.2
PCI-DSS v2.0 3.6.3
PCI-DSS v2.0 3.6.4
PCI-DSS v2.0 3.6.5
PCI-DSS v2.0 3.6.6
PCI-DSS v2.0 3.6.7
PCI-DSS v2.0 3.6.8 | 3.4.1
3.5
3.5.1
3.5.2
3.6
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8,
4.1
6.5.3
8.2.1
8.2.2 |
| 85 | IS-19 | EKM-02.2 | MY | Do you have a capability to manage encryption keys on behalf of tenants? | The encryption key is unique to the customer and is managed by the customer. This unique key is stored in the database in encrypted form and this key is encrypted using another key (referred to as the "wrapper" key.) The wrapper key is not unique and is not stored in the database. It is resides in the application server. | Yes | 6.04.05. (a)
6.04.05. (c) | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-13 |
| 86 | IS-19 | EKM-02.3 | MY | Do you maintain key management procedures? | As EKM-01.1 above. | Yes |
| 87 | IS-19 | EKM-02.4 | MY | Do you have documented ownership for each stage of the lifecycle of encryption keys? | As EKM-01.1 above. | Yes |
| 88 | EKM-02.5 | MY | Do you utilize any third party/open source/proprietary frameworks to manage encryption keys? | As EKM-02.1 above. | Yes |
| 89 | Encryption & Key Management
Encryption
(v1.4: Encryption Key Management) | EKM-03 | EKM-03.1 | MY | Policies and procedures shall be established, and supporting business processes and technical measures implemented, for the use of encryption protocols for protection of sensitive data in storage (e.g., file servers, databases, and end-user workstations) and data in transmission (e.g., system interfaces, over public networks, and electronic messaging) as per applicable legal, statutory, and regulatory compliance obligations. | Do you encrypt tenant data at rest (on disk/storage) within your environment?
| As DSI-03.1 above. | Yes | C3.12.0
S3.6.0
S3.4 | (C3.12.0, S3.6.0) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks.
(S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.7
CC5.6 | G.4
G.15
I.3 | G.10.4, G.11.1, G.11.2, G.12.1, G.12.2, G.12.4, G.12.10, G.14.18, G.14.19, G.16.2, G.16.18, G.16.19, G.17.16, G.17.17, G.18.13, G.18.14, G.19.1.1, G.20.14 | 23 (B)
24 (B)
25 (B) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-18 | COBIT 4.1 DS5.8
COBIT 4.1 DS5.10
COBIT 4.1 DS5.11 | APO13.01
DSS05.02
DSS05.03
DSS06.06 | 312.8 and 312.10 | SRM > Data Protection > Cryptographic Services - Data-At-Rest Encryption,
Cryptographic Services - Data-in-Transit Encryption | shared | x | Domain 2 | 6.04.05. (a)
6.04.05. (c) | Article 17 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-13 | NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-23
NIST SP 800-53 R3 SC-28
NIST SP 800-53 R3 SI-8 | 8.1.1
8.2.1
8.2.5 | 45 CFR 164.312 (a)(2)(iv)
45 CFR 164.312 (e)(1)
45 CFR 164.312 (e)(2)(ii) | A.10.6.1
A.10.8.3
A.10.8.4
A.10.9.2
A.10.9.3
A.12.3.1
A.15.1.3
A.15.1.4 | A.13.1.1
A.8.3.3
A.13.2.3
A.14.1.3
A.14.1.2
A.10.1.1
A.18.1.3
A.18.1.4 | Commandment #4
Commandment #5
Commandment #9
Commandment #10
Commandment #11 | CIP-003-3 - R4.2 | AC-18
IA-3
IA-7
SC-7
SC-8
SC-9
SC-13
SC-16
SC-23
SI-8 | 16.1 | PA25 | GP | PCI-DSS v2.0 2.1.1
PCI-DSS v2.0 3.4
PCI-DSS v2.0 3.4.1
PCI-DSS v2.0 4.1
PCI-DSS v2.0 4.1.1
PCI DSS v2.0 4.2 | 2.1.1
2.3
3.3
3.4
3.4.1
4.1
4.1.1
4.2
4.3
6.5.3
6.5.4
8.2.1 |
| 90 | IS-18 | EKM-03.2 | MY | Do you leverage encryption to protect data and virtual machine images during transport across and between networks and hypervisor instances?
| ACME does not use virtual machines. | Not Applicable |
| 91 | EKM-03.3 | MY | Do you support tenant-generated encryption keys or permit tenants to encrypt data to an identity without access to a public key certificate (e.g. identity-based encryption)?
| As DSI-03.1 above. | Yes |
| 92 | EKM-03.4 | MY | Do you have documentation establishing and defining your encryption management policies, procedures and guidelines? | As EKM-01.1 above. | Yes |
| 93 | Encryption & Key Management
Storage and Access | EKM-04 | EKM-04.1 | MY | Platform and data appropriate encryption (e.g., AES-256) in open/validated formats and standard algorithms shall be required. Keys shall not be stored in the cloud (i.e. at the cloud provider in question), but maintained by the cloud consumer or trusted key management provider. Key management and key usage shall be separated duties. | Do you have platform and data appropriate encryption that uses open/validated formats and standard algorithms? | As DSI-03.1 above. | Yes | APO01.06
BAI09.02
BAI09.03 | SRM > Cryptographic Services > Key Management | shared | x | Domain 11 | Annex
A.10.1
A.10.1.1
A.10.1.2 | 3.5.2, 3.5.3
3.6.1, 3.6.3 |
| 94 | EKM-04.2 | MY | Are your encryption keys maintained by the cloud consumer or a trusted key management provider? | As EKM-02.1 and EKM-02.2 above. | Yes |
| 95 | EKM-04.3 | MY | Do you store encryption keys in the cloud? | Not in a format where if they were obtained they could be used directly, per the use of a secondary wrapper key. | Yes |
| 96 | EKM-04.4 | MY | Do you have separate key management and key usage duties? | ACME Security Engineering Team assumes the responsibilities for key management with the cloud infrastructure. | Yes |
| 97 | Governance and Risk Management
Baseline Requirements | GRM-01 | GRM-01.1 | JE | Baseline security requirements shall be established for developed or acquired, organizationally-owned or managed, physical or virtual, applications and infrastructure system and network components that comply with applicable legal, statutory and regulatory compliance obligations. Deviations from standard baseline configurations must be authorized following change management policies and procedures prior to deployment, provisioning, or use. Compliance with security baseline requirements must be reassessed at least annually unless an alternate frequency has been established and established and authorized based on business need. | Do you have documented information security baselines for every component of your infrastructure (e.g., hypervisors, operating systems, routers, DNS servers, etc.)? | ACME has documented System Architecture Server Hardening SOP and Checklist, that requires system provisioning with configurations be based on industry standards, including, but not limited to,
• The US National Security Agency (NSA) Guide to Secure Configuration of RHEL Linux 5:
• The US Government Configuration Baseline (USGCB) [NIST/DoD/RHEL]:
• CIS_RHEL_5.0-‐5.1_Benchmark_v.1.1.2.
System services or functionalities are disabled and/or removed based on the SOP. | Yes | S1.1.0
S1.2.0(a-i) | (S1.1.0) The entity’s security policies are established and periodically reviewed and approved by a designated individual or group.
(S1.2.0(a-i)) The entity's security policies include, but may not be limited to, the following matters: | CC3.2 | L.2 | L.2, L.5, L.7 L.8, L.9, L.10 | 12 (B)
14 (B)
13 (B)
15 (B)
16 (C+, A+)
21 (B) | Schedule 1 (Section 5), 4.7 - Safeguards | IS-04 | COBIT 4.1 AI2.1
COBIT 4.1 AI2.2
COBIT 4.1 AI3.3
COBIT 4.1 DS2.3
COBIT 4.1 DS11.6 | APO01.06
APO03.02
APO13.01
APO13.02
BAI02.01
BAI02.03
BAI02.04
BAI06.01
BAI10.01
BAI10.02
MEA02.01 | 312.8 and 312.10 | SRM > Governance Risk & Compliance > Technical Standards | shared | x | Domain 2 | 6.03.01. (a)
6.03.04. (a)
6.03.04. (b)
6.03.04. (c)
6.03.04. (e)
6.07.01. (o) | Article 17 | NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 SA-4 | NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SC-30 | 1.2.6
8.2.1
8.2.7 | A.12.1.1
A.15.2.2 | A.14.1.1
A.18.2.3 | Commandment #2
Commandment #4
Commandment #5
Commandment #11 | Chapter II, Article 19 and Chapter VI, Section I, Article 39 | CM-2
SA-2
SA-4 | AR-1 Governance and Privacy Program. TR-1 PRIVACY NOTICE. TR-3 DISSEMINATION OF PRIVACY PROGRAM INFORMATION | 4.4
5.1 | PCI DSS v1.2 1.1
PCI DSS v1.2 1.1.1
PCI DSS v1.2 1.1.2
PCI DSS v1.2 1.1.3
PCI DSS v1.2 1.1.4
PCI DSS v1.2 1.1.5
PCI DSS v1.2 1.1.6
PCI DSS v1.2 2.2
PCI DSS v1.2 2.2.1
PCI DSS v1.2 2.2.2
PCI DSS v1.2 2.2.3
PCI DSS v1.2 2.2.4 | 1.1
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4 |
| 98 | IS-04 | GRM-01.2 | JE | Do you have a capability to continuously monitor and report the compliance of your infrastructure against your information security baselines? | ACME uses Puppet as their standard configuration tool. In case the server doesn't have a standard configuration, which includes the antivirus solution, the tool overwrites the system with the standard configuration, alerts are issued and attended to by Security staffs on standard configuration deviations. | Yes | COBIT 4.1 AI2.1
COBIT 4.1 AI2.2
COBIT 4.1 AI3.3
COBIT 4.1 DS2.3
COBIT 4.1 DS11.6 | A.12.1.1
A.15.2.2 | NIST SP800-53 R3 CM-2
NIST SP800-53 R3 SA-2
NIST SP800-53 R3 SA-4 | PCI DSS v1.2 1.1
PCI DSS v1.2 1.1.1
PCI DSS v1.2 1.1.2
PCI DSS v1.2 1.1.3
PCI DSS v1.2 1.1.4
PCI DSS v1.2 1.1.5
PCI DSS v1.2 1.1.6
PCI DSS v1.2 2.2
PCI DSS v1.2 2.2.1
PCI DSS v1.2 2.2.2
PCI DSS v1.2 2.2.3
PCI DSS v1.2 2.2.4 |
| 99 | IS-04 | GRM-01.3 | JE | Do you allow your clients to provide their own trusted virtual machine image to ensure conformance to their own internal standards? | Not Applicable as hypervisor based virtualization is not used. | Not Applicable | COBIT 4.1 AI2.1
COBIT 4.1 AI2.2
COBIT 4.1 AI3.3
COBIT 4.1 DS2.3
COBIT 4.1 DS11.6 | A.12.1.1
A.15.2.2 | NIST SP800-53 R3 CM-2
NIST SP800-53 R3 SA-2
NIST SP800-53 R3 SA-4 | PCI DSS v1.2 1.1
PCI DSS v1.2 1.1.1
PCI DSS v1.2 1.1.2
PCI DSS v1.2 1.1.3
PCI DSS v1.2 1.1.4
PCI DSS v1.2 1.1.5
PCI DSS v1.2 1.1.6
PCI DSS v1.2 2.2
PCI DSS v1.2 2.2.1
PCI DSS v1.2 2.2.2
PCI DSS v1.2 2.2.3
PCI DSS v1.2 2.2.4 |
| 100 | Governance and Risk Management
Risk Assessments | GRM-02 | GRM-02.1 | JE | Risk assessments associated with data governance requirements shall be conducted at planned intervals and shall consider the following:
• Awareness of where sensitive data is stored and transmitted across applications, databases, servers, and network infrastructure
• Compliance with defined retention periods and end-of-life disposal requirements
• Data classification and protection from unauthorized use, access, loss, destruction, and falsification | Do you provide security control health data in order to allow tenants to implement industry standard Continuous Monitoring (which allows continual tenant validation of your physical and logical control status)? | The ACME® Instance Security Dashboard gives ACME customer administrator quick and easy visibility to their instances' current compliance levels based on application security standards. They can remediate those risks fast using the guided recommendations and detailed steps. Additional information can be found on the Instance Security Dashboard website: https://www.ACME.com/products/instance-security-dashboard.html
Additionally, ACME contractually allows customers to pen test their own application instance once per year. These assessments not only provide customers with direct insight into the security of their specific ACME implementation, but it also provides ACME with an extensive source of pen test data.
| Yes | S3.1.0
C3.14.0
S1.2.b-c | (S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats.
(C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies.
(S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to define protection requirements, access rights and access restrictions, and retention and destruction policies.
c. Assessing risks on a periodic basis. | CC3.1
CC3.1
| L.4, L.5, L.6, L.7 | 34 (B) | Schedule 1 (Section 5), 4.7 - Safeguards | DG-08 | COBIT 4.1 PO 9.1, PO 9.2, PO 9.4, DS 5.7 | EDM03.02
APO01.03
APO12.01
APO12.02
APO12.03
APO12.04
BAI09.01 | 312.1 | BOSS > Operational Risk Management > Independent Risk Management | shared | x | Domain 5 | 6.01. (d)
6.04.03. (a) | Article 6, Article 8, Article 17 (1) | NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SI-12 | NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SI-12 | 1.2.4
8.2.1 | 45 CFR 164.308(a)(1)(ii)(A) (New)
45 CFR 164.308(a)(8) (New) | Clause 4.2.1 c) & g)
Clause 4.2.3 d)
Clause 4.3.1 & 4.3.3
Clause 7.2 & 7.3
A.7.2
A.15.1.1
A.15.1.3
A.15.1.4 | Clauses
5.2(c)
5.3(a)
5.3(b)
6.1.2
6.1.2(a)(2)
6.1.3(b)
7.5.3(b)
7.5.3(d)
8.1
8.2
8.3
9.2(g)
A.18.1.1
A.18.1.3
A.18.1.4
A.8.2.2 | EAR 15 CFR §736.2 (b) | Commandment #1
Commandment #2
Commandment #3
Commandment #6
Commandment #7
Commandment #9
Commandment #10
Commandment #11 | CA-3
RA-2
RA-3
MP-8
PM-9
SI-12 | AR-2 Privacy Impact and Risk Assessment | 3.3
4.3
8.4
| PA10
PA18 | BSGP
GP | PCI DSS v2.0 12.1
PCI DSS v2.0 12.1.2 | 12.2 |
| 101 | GRM-02.2 | JE | Do you conduct risk assessments associated with data governance requirements at least once a year? | ACME has a formal Information Security Risk Assessment (ISRA) program to ensure risks are documented in Risk Register and evaluated against impact to business and event likelihood; owners to risks are assigned to provide remediation plans and follow through with risk mitigations. The risk program is run at minimum annually.
The Risk Assessment SOP can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=9b8c6ae1dbd0dbc01dcaf3231f961933
| Yes |
| 102 | Governance and Risk Management
Management Oversight | GRM-03 | GRM-03.1 | JE | Managers are responsible for maintaining awareness of, and complying with, security policies, procedures and standards that are relevant to their area of responsibility. | Are your technical, business, and executive managers responsible for maintaining awareness of and compliance with security policies, procedures, and standards for both themselves and their employees as they pertain to the manager and employees' area of responsibility?
(IS14.1: Are Managers responsible for maintaining awareness of and complying with security policies, procedures and standards that are relevant to their area of responsibility?) | ACME has a formal, multifaceted training program that includes on-the-job training, role based training, onboarding training, general security training (i.e. acceptable use, handling of sensitive data), specialized security training (i.e. for developers: OWASP top 10 Vulnerabilities and Countermeasures), and legal & human resources training (i.e. Insider Trading, Ethics & International Business). Additionally, Employees are required to (re-)complete Security and Awareness Training/Internal Company Training on an annual basis. ACME provides instructor-led classes, in-person, online self-paced, and external training options.
Please refer to the Training Policy here: here:https://community.ACME.com/community?id=community_article&sys_id=051daea5dbd0dbc01dcaf3231f9619fb
Please refer the Training SOP here: https://community.ACME.com/community?id=community_article&sys_id=aa3deae5dbd0dbc01dcaf3231f961931 | Yes | S1.2.f
S2.3.0 | (S1.2.f) f. Assigning responsibility and accountability for system availability, confidentiality, processing integrity and related security.
(S2.3.0) Responsibility and accountability for the entity’s system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them. |
CC3.2 | E.1 | E.4 | 5 (B)
65 (B) | Schedule 1 (Section 5) 4.1 Accountability; 4.7 Safeguards, Sub 4.7.4 | IS-14 | COBIT 4.1 DS5.3
COBIT 4.1 DS5.4
COBIT 4.1 DS5.5 | APO01.03
APO01.04
APO01.08
DSS01.01 | 312.8 and 312.10 | BOSS > Human Resources Security > Roles and Responsibilities | shared | x | Domain 3, 9 | NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7 | NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2) | 1.1.2
8.2.1 | Clause 5.2.2
A.8.2.1
A.8.2.2
A 11.2.4
A.15.2.1 | Clause 7.2(a,b)
A.7.2.1
A.7.2.2
A.9.2.5
A.18.2.2 | Commandment #6
Commandment #7
Commandment #8 | AT-2
AT-3
CA-1
CA-5
CA-6
CA-7
PM-10 | AR-1 Governance and Privacy Program | 3.2 | PCI DSS v2.0 12.6.1
PCI DSS v2.0 12.6.2 | 12.6, 7.3, 8.8, 9.10 |
| 103 | Governance and Risk Management
Management Program | GRM-04 | GRM-04.1 | JE | An Information Security Management Program (ISMP) shall be developed, documented, approved, and implemented that includes administrative, technical, and physical safeguards to protect assets and data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. The security program shall include, but not be limited to, the following areas insofar as they relate to the characteristics of the business:
• Risk management
• Security policy
• Organization of information security
• Asset management
• Human resources security
• Physical and environmental security
• Communications and operations management
• Access control
• Information systems acquisition, development, and maintenance | Do you provide tenants with documentation describing your Information Security Management Program (ISMP)? | ACME CORE (Compliance Operations Readiness Evidence) enables ACME customers to have self-serve access to documentation they need to help support internal audit and assessment requirements, prepare for onsite audits, and address regulatory requirements, including policy and procedure documentation related to ACME's Information Security Management Program. The CORE includes diagrams, penetration test summaries, policies, policies and information about Privacy, procedures, questionnaires, third party attestations, and white papers.
Registration information for the CORE follows. Please note this private Special Interest Group (SIG) is limited to only ACME customers holding a Compliance, Audit or similar role with a business need for access.
The ACME CORE is available on the ACME Community and is provided at no cost to customers.
The Information Security Policy can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0
The Information Security Standards can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=0b1d62e5dbd0dbc01dcaf3231f9619f5
| Yes | x1.2. | (x1.2.) The entity’s system [availability, processing integrity, confidentiality and related] security policies include, but may not be limited to, the following matters: | A.1, B.1 | 2 (B)
3 (B)
5 (B) | Schedule 1 (Section 5), 4.1 - Accountability; 4.7 Safeguards | IS-01 | COBIT 4.1 R2 DS5.2
COBIT 4.1 R2 DS5.5 | APO13.01
APO13.02
APO13.03
| 312.8 and 312.10 | SRM > InfoSec Management > Capabilitiy Mapping | shared | x | Domain 2 | Article 17 | 99.31.(a)(1)(ii) | 8.2.1 | 45 CFR 164.308(a)(1)(i)
45 CFR 164.308(a)(1)(ii)(B)
45 CFR 164.316(b)(1)(i)
45 CFR 164.308(a)(3)(i) (New)
45 CFR 164.306(a) (New) | Clause 4.2
Clause 5
A.6.1.1
A.6.1.2
A.6.1.3
A.6.1.4
A.6.1.5
A.6.1.6
A.6.1.7
A.6.1.8 | All in sections 4, 5, 6, 7, 8, 9, 10.
A.6.1.1
A.13.2.4
A.6.1.3
A.6.1.4
A.18.2.1 | Commandment #1
Commandment #2 | Chapter II, Article 19 | CIP-001-1a - R1 - R2
CIP-003-3 - R1 - R1.1 - R4
CIP-006-3c R1 | PM-1
PM-2
PM-3
PM-4
PM-5
PM-6
PM-7
PM-8
PM-9
PM-10
PM-11 | AR-1 Governance and Privacy Program | 4.1 | PA8 | BSGP | PCI DSS v2.0 12.1
PCI DSS v2.0 12.2 | 12.1
12.2 |
| 104 | GRM-04.2 | JE | Do you review your Information Security Management Program (ISMP) least once a year? | ACME is reviewed on an annual basis by independent third party auditors to maintain ISO 27001 certification, ISO 27018 certification, FedRAMP authorization, and MTCS certification and to obtain SSAE16 SOC 1 Type II and SOC 2 Type II reports. Additionally, ACME undergoes multiple internal audits and customer audits each year. ACME's third party attestations are available on the ACME CORE: https://community.ACME.com/community?id=community_topic&sys_id=6c499e2ddbd897c068c1fb651f961924 | Yes |
| 105 | Governance and Risk Management
Management Support / Involvement | GRM-05 | GRM-05.1 | JE | Executive and line management shall take formal action to support information security through clearly-documented direction and commitment, and shall ensure the action has been assigned. | Do you ensure your providers adhere to your information security and privacy policies?
(IS-02.1: Are policies in place to ensure executive and line management take formal action to support information security through clear documented direction, commitment, explicit assignment and verification of assignment execution? ) | ACME's Vendor Security Risk Assessment (VSRA) Program ensures that vendors have appropriate security controls and business disciplines in place to effectively minimize risks to themselves, to ACME, and to customers of ACME. The VSRA process begins with a pre-assessment that is used to identify the assets that will be involved and to determine the level of assessment to be performed; each assessment is tailored for the type of service and assets that will be involved. The Compliance team works with the vendor and internal business owner to gather information to address the controls identified for the assessment. The output of this assessment is reflected in a Vendor Risk Assessment Report, which is used as an input to contract language. On an annual basis, active existing vendors will be reviewed for change in scope and status of security controls to ensure no new risks have been introduced and all existing risks are addressed.
ACME does not enforce its internal security policies and procedures on its third party vendors; where appropriate, ACME reviews independent, third party attestations and/or certifications (e.g. ISO 27001, SOC 1, SOC 2) to ensure that the vendor's information security program is operating effectively.
The Vendor Security Risk Assessment SOP can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=ebfca6a5dbd0dbc01dcaf3231f961993 | Yes | S1.3.0 | (S1.3.0) Responsibility and accountability for developing and maintaining the entity’s system security policies, and changes and updates to those policies, are assigned.
The entity has prepared an objective description of the system and its boundaries and communicated such description to authorized users
The security obligations of users and the entity’s security commitments to users are communicated to authorized users. | CC1.2 | C.1 | 5 (B) | Schedule 1 (Section 5), 4.1 Safeguards, Subsec. 4.1.1 | IS-02 | COBIT 4.1 DS5.1 | APO01.02
APO01.03
APO01.04
APO01.08
APO13.01
APO13.02
APO13.03 | 312.8 and 312.10 | SRM > Governance Risk & Compliance > Compliance Management | shared | x | Domain 2 | Article 17 | NIST SP 800-53 R3 CM-1 | NIST SP 800-53 R3 CM-1 | 8.2.1 | 45 CFR 164.316 (b)(2)(ii)
45 CFR 164.316 (b)(2)(iii) | Clause 5
A.6.1.1 | All in section 5 plus clauses
4.4
4.2(b)
6.1.2(a)(1)
6.2
6.2(a)
6.2(d)
7.1
7.4
9.3
10.2
7.2(a)
7.2(b)
7.2(c)
7.2(d)
7.3(b)
7.3(c) | Commandment #3
Commandment #6 | Chapter VI, Section I, Article 39 | CIP-003-3 - R1 - R1.1 | CM-1
PM-1
PM-11 | 4.1 | PCI DSS v2.0 12.5 | 12.4 |
| 106 | Governance and Risk Management
Policy | GRM-06 | GRM-06.1 | JE | Information security policies and procedures shall be established and made readily available for review by all impacted personnel and external business relationships. Information security policies must be authorized by the organization's business leadership (or other accountable business role or function) and supported by a strategic business plan and an information security management program inclusive of defined information security roles and responsibilities for business leadership. | Do your information security and privacy policies align with industry standards (ISO-27001, ISO-22307, CoBIT, etc.)? | ACME's information security program is based on NIST 800-53 and ISO 27001. ACME has chosen the ISO 27001 certification to provide internal and external stakeholders with a high level of assurance that our information security policy and processes are robust and a strong control environment exists around our software-as-a-service (SaaS) instance. Therefore, ACME does not attest compliance with any customer policies, standards, and/or controls.
ACME is reviewed on an annual basis by independent third party auditors to maintain ISO 27001 certification, ISO 27018 certification, FedRAMP authorization, and MTCS certification and to obtain SSAE16 SOC 1 Type II and SOC 2 Type II reports. Additionally, ACME undergoes multiple internal audits and customer audits each year. ACME's third party attestations are available on the ACME CORE: https://community.ACME.com/community?id=community_article&sys_id=ebfca6a5dbd0dbc01dcaf3231f961993
As publicly traded company, ACME is required to comply with U.S. Securities and Exchange Commission (SEC) public reporting requirements and the Sarbanes-Oxley Act of 2002 (SOX). ACME's SEC filings are available on our public website: https://www.ACME.com/company/investor-relations/sec-filings.html. | Yes | S1.1.0
S1.3.0
S2.3.0 | (S1.1.0) The entity's security policies are established and periodically reviewed and approved by a designated individual or group.
(S1.3.0) Responsibility and accountability for developing and maintaining the entity’s system security policies, and changes and updates to those policies, are assigned.
(S2.3.0) Responsibility and accountability for the entity's system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them. | CC3.2
CC1.2
CC2.3 | B.1 | Schedule 1 (Section 5) 4.1 Accountability, Subsec 4.1.4 | IS-03 | COBIT 4.1 DS5.2 | APO01.03
APO01.04
APO13.01
APO13.02 | 312.8 and 312.10 | SRM > Policies and Standards > Information Security Policies | shared | x | Domain 2 | 6.02. (e) | Article 17 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1 | 8.1.0
8.1.1 | 45 CFR 164.316 (a)
45 CFR 164.316 (b)(1)(i)
45 CFR 164.316 (b)(2)(ii)
45 CFR 164.308(a)(2) (New) | Clause 4.2.1
Clause 5
A.5.1.1
A.8.2.2 | Clause 4.3
Clause 5
4.4
4.2(b)
6.1.2(a)(1)
6.2
6.2(a)
6.2(d)
7.1
7.4
9.3
10.2
7.2(a)
7.2(b)
7.2(c)
7.2(d)
7.3(b)
7.3(c)
A5.1.1
A.7.2.2 | Commandment #1
Commandment #2
Commandment #3 | Chapter VI, Section I, Article 39 | CIP-003-3 - R1 -R1.1 - R1.2 - R2 - R2.1 - R2.2 - R2.3 | AC-1
AT-1
AU-1
CA-1
CM-1
IA-1
IR-1
MA-1
MP-1
MP-1
PE-1
PL-1
PS-1
SA-1
SC-1
SI-1 | 4.2
4.3
4.4
4.5 | PA30 | BSGP | PCI DSS v2.0 12.1
PCI DSS v2.0 12.2 | 7.3, 8.8, 9.10, 12.1
12.2 |
| 107 | GRM-06.2 | JE | Do you have agreements to ensure your providers adhere to your information security and privacy policies? | ACME does not grant third party vendors with logical access to ACME infrastructure or customer data. ACME does not enforce its internal security policies and procedures on its third party vendors; where appropriate, ACME reviews independent, third party attestations and/or certifications (e.g. ISO 27001, SOC 1, SOC 2) to ensure that the vendor's information security program is operating effectively. The Vendor Security Risk Assessment SOP can be viewed on the ACME CORE: https://community.ACME.com/community?id=community_article&sys_id=ebfca6a5dbd0dbc01dcaf3231f961993
Third party vendors are also required to sign a non-disclosure agreement. | Yes |
| 108 | GRM-06.3 | JE | Can you provide evidence of due diligence mapping of your controls, architecture and processes to regulations and/or standards?
| The Governance, Risk and Compliance (GRC) define policies, and requirements for standards, processes, procedures, baselines, guidelines and risk assessments, monitor compliance with Information Security policies through internal and external audit, ensure compliance with government, regulatory and contractual information system security related requirements, coordinate customer audits, audit response, and audit mitigation, perform internal and external audits and report results to Security Management Council, perform risk assessments in support of identifying and managing risks related to the operation of the ISMS.
ACME's information security program is based on NIST 800-53 and ISO 27001. ACME has chosen the ISO 27001 certification to provide internal and external stakeholders with a high level of assurance that our information security policy and processes are robust and a strong control environment exists around our software-as-a-service (SaaS) instance. Therefore, ACME does not attest compliance with any customer policies, standards, and/or controls.
ACME is reviewed on an annual basis by independent third party auditors to maintain ISO 27001 certification, ISO 27018 certification, FedRAMP authorization, and MTCS certification and to obtain SSAE16 SOC 1 Type II and SOC 2 Type II reports. Additionally, ACME undergoes multiple internal audits and customer audits each year. ACME's third party attestations are available on the ACME CORE: https://community.ACME.com/community/special-interest-groups/core/content?filterID=contentstatus%5Bpublished%5D~category%5Bthird-party-attestations-ACME%5D.
Note: ACME does not share its ISO 27001 Statement of Applicability (SOA) externally. The SOA details how controls are achieved and which controls are not applicable; therefore, the document could highlight to unauthorized users the areas where ACME is vulnerable.
ACME's support methodology is aligned with the Information Technology Infrastructure Library (ITIL) framework. The ACME product is verified by Pink Elephant's PinkVerify2011 for 11 ITIL Processes: https://www.pinkelephant.com/en-US/PinkVERIFY/PinkVERIFYToolsets.
As publicly traded company, ACME is required to comply with U.S. Securities and Exchange Commission (SEC) public reporting requirements and the Sarbanes-Oxley Act of 2002 (SOX). ACME's SEC filings are available on our public website: https://www.ACME.com/company/investor-relations/sec-filings.html.
A SOC 3 reports on the same information as a SOC 2 report. The main difference between the reports is that a SOC 3 is intended for a general audience; therefore, these reports are shorter and do not include the same details as a SOC 2 report. Due to their more general nature, SOC 3 reports can be shared openly and posted on a company's website with a seal indicating their compliance. ACME constantly evaluates its certification posture for relevant expansion. At this point, we have no plans to obtain the SOC 3 certification.
ACME provides a software-as-a-service (SaaS) solution to our enterprise customers whose regulatory requirements scope, in many cases, extends to include ACME's application and business processes. Customers are responsible for determining the regulatory requirements for the data in their instances and are able to customize the solution to meet their internal and regulatory requirements. | Yes |
| 109 | GRM-06.4 | JE | Do you disclose which controls, standards, certifications and/or regulations you comply with? | See GRM-06.3 | Yes |
| 110 | Governance and Risk Management
Policy Enforcement | GRM-07 | GRM-07.1 | JE | A formal disciplinary or sanction policy shall be established for employees who have violated security policies and procedures. Employees shall be made aware of what action might be taken in the event of a violation, and disciplinary measures must be stated in the policies and procedures. | Is a formal disciplinary or sanction policy established for employees who have violated security policies and procedures? | If ACME determines that an employee is responsible for a violation of conduct and ethical standards, he or she will be subject to disciplinary action, up to and including, termination of employment and, in appropriate cases, civil action or referral for criminal prosecution. Appropriate action may also be taken to deter any future violation. The Acceptable Use Policy can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=11bcaa25dbd0dbc01dcaf3231f961967 | Yes | S3.9
S2.4.0 | (S3.9) Procedures exist to provide that issues of noncompliance with security policies are promptly addressed and that corrective measures are taken on a timely basis.
(S2.4.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users. | CC6.2
CC2.5 | B.1.5 | Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4 | IS-06 | COBIT 4.1 PO 7.7 | APO01.03
APO01.08
APO07.04 | 312.8 and 312.10 | SRM > Governance Risk & Compliance > | shared | x | Domain 2 | Article 17 | NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-8 | NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-8 | 99.31(a)(i)(ii) | 10.2.4 | 45 CFR 164.308 (a)(1)(ii)(C) | A.8.2.3 | A7.2.3 | Commandment #6
Commandment #7 | Chapter X, Article 64 | PL-4
PS-1
PS-8 |
| 111 | IS-06 | GRM-07.2 | JE | Are employees made aware of what actions could be taken in the event of a violation via their policies and procedures? | See GRM-07.1 | Yes | COBIT 4.1 PO 7.7 | 45 CFR 164.308 (a)(1)(ii)(C) | A.8.2.3 | NIST SP800-53 R3 PL-4
NIST SP800-53 R3 PS-1
NIST SP800-53 R3 PS-8 |
| 112 | Governance and Risk Management
Business / Policy Change Impacts | GRM-08 | GRM-08.1 | JE | Risk assessment results shall include updates to security policies, procedures, standards, and controls to ensure that they remain relevant and effective. | Do risk assessment results include updates to security policies, procedures, standards and controls to ensure they remain relevant and effective?
| ACME has a formal Information Security Risk Assessment program to ensure risks are documented in Risk Register and evaluated against impact to business and event likelihood; owners to risks are assigned to provide remediation plans and follow through with risk mitigations. The risk program is run annually. The Information Security Risk Assessment SOP can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=9b8c6ae1dbd0dbc01dcaf3231f961933 | Yes | B.2
G.21
L.2 | B.1.1, B.1.2, B.1.6, B.1.7.2, G.2, L.9, L.10 | Schedule 1 (Section 5), 4.7 - Safeguards | RI-04 | COBIT 4.1 PO 9.6 | APO12
APO13.01
APO13.03 | 312.8 and 312.10 | BOSS > Operational Risk Management > Risk Management Framework | shared | x | Domain 2, 4 | 6.03. (a) | Article 17 (1), (2) | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1 | Clause 4.2.3
Clause 4.2.4
Clause 4.3.1
Clause 5
Clause 7
A.5.1.2
A.10.1.2
A.10.2.3
A.14.1.2
A.15.2.1
A.15.2.2 | Clause
4.2.1 a,
4.2(b)
4.3 c,
4.3(a&b)
4.4
5.1(c)
5.1(d)
5.1(e)
5.1(f)
5.1(g)
5.1(h)
5.2
5.2 e,
5.2(f)
5.3
6.1.1(e)(2),
6.1.2(a)(1)
6.2
6.2(a)
6.2(d)
6.2 e,
6.12 (a) (2),
7.1
7.2(a),
7.2(b)
7.2(c)
7.2(d)
7.3(b),
7.3(c)
7.4
7.5.1 (a)
8.1*, partial
8.2
9.1
9.1 e,
9.2,
9.3
9.3(a)
9.3(b&f)
9.3(c),
9.3(c)(1)
9.3(c)(2),
9.3(c)(3)
9.3(d)
9.3(e)
10.1(c)
10.2,
A.5.1.2
A.12.1.2
A.15.2.2
A.17.1.1
A.18.2.2
A.18.2.3 | CIP-009-3 - R2 | CP-2
RA-2
RA-3 | AR-2 Privacy Impact and Risk Assessment | 4.3 | PCI DSS v2.0 12.1.3 | 12.2 |
| 113 | Governance and Risk Management
Policy Reviews | GRM-09 | GRM-09.1 | JE | The organization's business leadership (or other accountable business role or function) shall review the information security policy at planned intervals or as a result of changes to the organization to ensure its continuing alignment with the security strategy, effectiveness, accuracy, relevance, and applicability to legal, statutory, or regulatory compliance obligations. | Do you notify your tenants when you make material changes to your information security and/or privacy policies?
| ACME CORE is a self-service portal for ACME customers to access key ACME collateral, including compliance documentation and industry specific support information. Please note this private Special Interest Group (SIG) is limited to only ACME customers holding a Compliance, Audit or similar role with a business need for access. Customers can request to receive notifications when updates are made to documentation in the CORE. The Information Security Policy can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0 | Yes | S1.1.0 | (S1.1.0) The entity’s security policies are established and periodically reviewed and approved by a designated individual or group. | CC3.2 | B.2 | B.1.33. B.1.34, | IS-05 | COBIT 4.1 DS 5.2
DS 5.4 | APO12
APO13.01
APO13.03
MEA03.01
MEA03.02 | 312.8 and 312.10 | SRM > Governance Risk & Compliance > Policy Management | shared | x | Domain 2 | Article 17 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1 | 1.2.1
8.2.7
10.2.3 | 45 CFR 164.316 (b)(2)(iii)
45 CFE 164.306(e) (New) | Clause 4.2.3 f)
A.5.1.2 | Clause 8.1
A.5.1.2 | Commandment #1
Commandment #2
Commandment #3 | CIP-003-3 - R3.2 - R3.3 - R1.3
R3 - R3.1 - R3.2 - R3.3 | AC-1
AT-1
AU-1
CA-1
CM-1
CP-1
IA-1
IA-5
IR-1
MA-1
MP-1
PE-1
PL-1
PM-1
PS-1
RA-1
SA-1
SC-1
SI-1 | 4.1
6.1 | PCI DSS v2.0 12.1.3 | 12.1.1 |
| 114 | GRM-09.2 | JE | Do you perform, at minimum, annual reviews to your privacy and security policies? | ACME reviews and updates our Information Security Policy annually with inputs from SME’s with various departments, including but not limited to, Security, Compliance, Legal and HR, who have deep knowledge to both internal and external environments. They are also reviewed during ACME's annual ISO 27001 certification, which can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=ab2c2661dbd0dbc01dcaf3231f961939
ACME reviews our Privacy Policy annually. Please refer to the Privacy Policy here: https://community.ACME.com/community?id=community_article&sys_id=455c66a1dbd0dbc01dcaf3231f961993 | Yes |
| 115 | Governance and Risk Management
Assessments | GRM-10 | GRM-10.1 | JE | Aligned with the enterprise-wide framework, formal risk assessments shall be performed at least annually or at planned intervals, (and in conjunction with any changes to information systems) to determine the likelihood and impact of all identified risks using qualitative and quantitative methods. The likelihood and impact associated with inherent and residual risk shall be determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance). | Are formal risk assessments aligned with the enterprise-wide framework and performed at least annually, or at planned intervals, determining the likelihood and impact of all identified risks, using qualitative and quantitative methods?
| ACME has a formal Information Security Risk Assessment (ISRA) program to ensure risks are documented in Risk Register and evaluated against impact to business and event likelihood; owners to risks are assigned to provide remediation plans and follow through with risk mitigations. The risk program is run at least annually. The Risk Assessment SOP can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=9b8c6ae1dbd0dbc01dcaf3231f961933 | Yes | S3.1
x3.1.0
S4.3.0 | (S3.1) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats.
(x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system [availability, processing integrity, confidenitality] commitments and (2) assess the risks associated with the identified threats.
(S4.3.0) Environmental, regulatory, and technological changes are monitored, and their effect on system availability, confidentiality of data, processing integrity, and system security is assessed on a timely basis; policies are updated for that assessment. | CC3.1
CC3.3 | I.1
I.4 | C.2.1, I.4.1, I.5, G.15.1.3, I.3 | 46 (B)
74 (B) | Schedule 1 (Section 5), 4.7 - Safeguards | RI-02 | COBIT 4.1 PO 9.4 | APO12 | 312.8 and 312.10 | BOSS > Operational Risk Management > Risk Management Framework | shared | x | Domain 2, 4 | 6.03. (a)
6.08. (a) | Article 17 (1), (2) | NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3 | NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-30 | 1.2.4
1.2.5 | 45 CFR 164.308 (a)(1)(ii)(A) | Clause 4.2.1 c) through g)
Clause 4.2.3 d)
Clause 5.1 f)
Clause 7.2 & 7.3
A.6.2.1
A.12.5.2
A.12.6.1
A.14.1.2
A.15.1.1
A.15.2.1
A.15.2.2 | Clause
4.2(b),
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.17.1.1
A.18.1.1
A.18.2.2
A.18.2.3 | CIP-002-3 - R1.1 - R1.2
CIP-005-3a - R1 - R1.2
CIP-009-3 - R.1.1 | PL-5
RA-2
RA-3 | 1.1
3.3
5.1
5.2
5.3
5.4
7.1
12.2
17.7
18.1
18.3
| PA2
PA15 | BSGP
SGP | PCI DSS v2.0 12.1.2 | 12.2 |
| 116 | RI-02 | GRM-10.2 | JE | Is the likelihood and impact associated with inherent and residual risk determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance)? | See GRM-10.1. | Yes | COBIT 4.1 PO 9.4 | 45 CFR 164.308 (a)(1)(ii)(A) | Clause 4.2.1 c) through g)
Clause 4.2.3 d)
Clause 5.1 f)
Clause 7.2 & 7.3
A.6.2.1
A.12.5.2
A.12.6.1
A.14.1.2
A.15.1.1
A.15.2.1
A.15.2.2 | NIST SP800-53 R3 PL-5
NIST SP800-53 R3 RA-2
NIST SP800-53 R3 RA-3 | PCI DSS v2.0 12.1.2 |
| 117 | Governance and Risk Management
Program | GRM-11 | GRM-11.1 | JE | Organizations shall develop and maintain an enterprise risk management framework to mitigate risk to an acceptable level. | Do you have a documented, organization-wide program in place to manage risk?
(RI-01.1: Is your organization insured by a 3rd party for losses?) | See GRM-10.1.
ACME maintains Computer Security and Privacy Liability (cyber) insurance covering actual or alleged acts, errors or omissions committed by ACME, its agents or employees. The policy shall expressly provide, but not be limited to, coverage for the following:
i. unauthorized use/access of a computer system
ii. defense of any regulatory action involving a breach of privacy
iii. failure to protect confidential information (personal and commercial information) from disclosure
iv. notification costs, whether or not required by statute.
In addition, ACME maintains general business liability insurance. | Yes | S3.1
x3.1.0 | (S3.1) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats.
(x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system [availability, processing integrity, confidenitality] commitments and (2) assess the risks associated with the identified threats. | CC3.1 | L.2 | A.1, L.1 | Schedule 1 (Section 5), 4.7 - Safeguards | RI-01 | COBIT 4.1 PO 9.1 | EDM03.02
APO01.03
APO12 | 312.8 and 312.10 | BOSS > Operational Risk Management > Risk Management Framework | shared | x | Domain 2, 4 | Article 17 (1), (2) | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 CM-1 | 1.2.4 | 45 CFR 164.308 (a)(8)
45 CFR 164.308(a)(1)(ii)(B) (New) | Clause 4.2.1 c) through g)
Clause 4.2.2 b)
Clause 5.1 f)
Clause 7.2 & 7.3
A.6.2.1
A.12.6.1
A.14.1.2
A.15.2.1
A.15.2.2 | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.12.6.1
A.17.1.1
A.18.2.2
A.18.2.3 | Chapter II
Article 19 | CIP-009-3 - R4 | AC-4
CA-2
CA-6
PM-9
RA-1 | AR-2 Privacy Impact and Risk Assessment | 3.2 (responsibility)
3.3
3.4
4.1
4.3
5.2 (residual Risk) | PCI DSS v2.0 12.1.2 | 12.2 |
| 118 | RI-01 | GRM-11.2 | JE | Do you make available documentation of your organization-wide risk management program?
(RI-01.2: Do your organization's service level agreements provide tenant remuneration for losses they may incur due to outages or losses experienced within your infrastructure?) | See GRM-10.1.
RI-01.2 - Remuneration details if applicable are documented in the individual customer's contract. | Yes | COBIT 4.1 PO 9.1 | 45 CFR 164.308 (a)(8)
45 CFR 164.308(a)(1)(ii)(B) (New) | Clause 4.2.1 c) through g)
Clause 4.2.2 b)
Clause 5.1 f)
Clause 7.2 & 7.3
A.6.2.1
A.12.6.1
A.14.1.2
A.15.2.1
A.15.2.2 | NIST SP800-53 R3 AC-4
NIST SP800-53 R3 CA-2
NIST SP800-53 R3 CA-6
NIST SP800-53 R3 PM-9
NIST SP800-53 R3 RA-1 | PCI DSS v2.0 12.1.2 |
| 119 | Human Resources
Asset Returns | HRS-01 | HRS-01.1 | JE | Upon termination of workforce personnel and/or expiration of external business relationships, all organizationally-owned assets shall be returned within an established period. | Are systems in place to monitor for privacy breaches and notify tenants expeditiously if a privacy event may have impacted their data? | ACME has a formal documented Security Incident Response policy, process and workflow. Our Incident Response process includes documented event discovery, triage, escalation, notification (including customer notification) remediation, and post-mortem review.
ACME reports both incidents and security incidents in accordance with the Incident Management process and Security Incident Response Plan. If a customer environment or data is impacted, the customer will be notified via their normal support contacts as required by their SLA.
The Security Incident Response SOP can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=a75c6aa1dbd0dbc01dcaf3231f961958 | Yes | S3.4 | (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.6 | D.1 | E.6.4 | Schedule 1 (Section 5) 4.5 Limiting Use, Disclosure and Retention; 4.7 Safeguards, Subs. 4.7.5 | IS-27 | APO01.08
APO07.06
APO13.01
BAI09.03
| 312.3, 312.8 and 312.10 | BOSS > Human Resources Security > Employee Termination | provider | x | Domain 2 | Article 17 | NIST SP 800-53 R3 PS-4 | NIST SP 800-53 R3 PS-4 | 5.2.3
7.2.2
8.2.1
8.2.6 | 45 CFR 164.308 (a)(3)(ii)(C) | A.7.1.1
A.7.1.2
A.8.3.2 | A.8.1.1
A.8.1.2
A.8.1.4 | PS-4 | 2.2 | 9.3 |
| 120 | IS-27 | HRS-01.2 | JE | Is your Privacy Policy aligned with industry standards? | In light of the European Court of Justice invalidated the Safe Harbor Agreement, EU and U.S. officials announced an agreement, "in principle," on a revised Safe Harbor accord, known as Privacy Shield; the European Commission deemed the Privacy Shield Framework adequate to enable data transfers under EU law.
ACME is Privacy Shield certificated and complies with the EU-U.S. Privacy Shield Framework set forth by the United States Department of Commerce with respect to the collection, use and retention of Personal Data transferred from the European Economic Area to the United States.
ACME is committed to being GDPR‑compliant across our cloud services when enforcement begins on May 25, 2018.
ACME has established Privacy Shield Policy which outlines its commitment to the Privacy Shield Principles and its practices for implementing the Principles. The Privacy Shield Policy and certification is available through ACME CORE here:
ACME's privacy statement can be viewed here: https://community.ACME.com/community?id=community_article&sys_id=3acca265dbd0dbc01dcaf3231f96198b | Yes | 45 CFR 164.308 (a)(3)(ii)(C) | A.7.1.1
A.7.1.2
A.8.3.2 | NIST SP800-53 R3 PS-4 |
| 121 | Human Resources
Background Screening | HRS-02 | HRS-02.1 | JE | Pursuant to local laws, regulations, ethics, and contractual constraints, all employment candidates, contractors, and third parties shall be subject to background verification proportional to the data classification to be accessed, the business requirements, and acceptable risk. | Pursuant to local laws, regulations, ethics and contractual constraints, are all employment candidates, contractors and involved third parties subject to background verification? | ACME performs background screening on all employees and internal contractors prior to employment. The elements of the background screening vary according to local law, but generally include employment checks, criminal/court checks, and global sanctions and enforcement checks. ACME has the right to re-screen backgrounds for cause. If adverse information is found during the course of the re-screening, continued employment will be at the discretion of the Director of Staffing based on what is permissible by law.
The following background screening SOPs can be viewed on the ACME CORE:
- Background Screening US SOP: https://community.ACME.com/community?id=community_article&sys_id=e12d66e5dbd0dbc01dcaf3231f96193b
- Background Screening Canada SOP: https://community.ACME.com/community?id=community_article&sys_id=375d2a29dbd0dbc01dcaf3231f96197d
- Background Screening EMEA and APAC SOP: https://community.ACME.com/community?id=community_article&sys_id=686caaa1dbd0dbc01dcaf3231f9619d2
- Background Screening LATAM SOP: https://community.ACME.com/community?id=community_article&sys_id=63bc6e25dbd0dbc01dcaf3231f9619d0 | Yes | S3.11.0 | (S3.11.0) Procedures exist to help ensure that personnel responsible for the design, development, implementation, and operation of systems affecting confidentiality and security have the qualifications and resources to fulfill their responsibilities. | CC1.3
CC1.4 | E.2 | E.2 | 63 (B) HR-01 | Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 | COBIT 4.1 PO 7.6 | APO07.01
APO07.05
APO07.06 | 312.8 and 312.10 | BOSS > Human Resources Security > Background Screening | shared | x | None | 6.01. (a) | Article 17 | NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-3 | NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-3 | 1.2.9 | A.8.1.2 | A.7.1.1 | ITAR 22 CFR § 120.17
EAR 15 CFR §736.2 (b) | Commandment #2
Commandment #3
Commandment #6
Commandment #9 | CIP-004-3 - R2.2 | PS-2
PS-3 | 9.29 | PA27 | BSGP | PCI DSS v2.0 12.7
PCI DSS v2.0 12.8.3 | 12.7
12.8.3 |
| 122 | Human Resources
Employment Agreements | HRS-03 | HRS-03.1 | JE | Employment agreements shall incorporate provisions and/or terms for adherence to established information governance and security policies and must be signed by newly hired or on-boarded workforce personnel (e.g., full or part-time employee or contingent staff) prior to granting workforce personnel user access to corporate facilities, resources, and assets. | Do you specifically train your employees regarding their specific role and the information security controls they must fulfill?
(HR-02.1: Do you specifically train your employees regarding their role vs. the tenant's role in providing information security controls?) | Refer to GRM-03.1. | Yes | S2.2.0 | (S2.2.0) The security obligations of users and the entity's security commitments to users are communicated to authorized users | CC2.2
CC2.3 | C.1 | E.3.5 | 66 (B) | Schedule 1 (Section 5) 4.7 Safeguards, Subsec. 4.7.4 | HR-02 | COBIT DS 2.1 | APO01.03
APO13.01
APO07.06
APO09.03
APO10.01
| 312.3, 312.8 and 312.10 | BOSS > Human Resources Security > Employee Code of Conduct | shared | x | None | Article 17 | NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7 | NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7 | 1.2.9
8.2.6 | 45 CFR 164.310(a)(1) (New)
45 CFR 164.308(a)(4)(i) (New) | A.6.1.5
A.8.1.3 | A.13.2.4
A.7.1.2 | ITAR 22 CFR § 120.17
EAR 15 CFR §736.2 (b) | Commandment #6
Commandment #7 | PL-4
PS-6
PS-7 | 9.2 | PA27 | BSGP | PCI DSS v2.0 12.4
PCI DSS v2.0 12.8.2 |
| 123 | HR-02 | HRS-03.2 | JE | Do you document employee acknowledgment of training they have completed? | Refer to GRM-03.1. | Yes |
| 124 | HRS-03.3 | JE | Are all personnel required to sign NDA or Confidentiality Agreements as a condition of employment to protect customer/tenant information? | ACME requires all new hires sign non-disclosure agreements as well as review and acknowledge the Code of Conduct and Acceptable Use Policy at time of hire. ACME provides all employees (new and existing) with security awareness training using web-based tools on an annual basis. ACME also distributes the Acceptable Use Policy and Information Security Policy and Standards to its employees annually. The HR Onboarding SOP can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=3e1d62e5dbd0dbc01dcaf3231f9619a1 | Yes |
| 125 | HRS-03.4 | JE | Is successful and timed completion of the training program considered a prerequisite for acquiring and maintaining access to sensitive systems? | Refer to GRM-03.1. | Yes |
| 126 | HRS-03.5 | JE | Are personnel trained and provided with awareness programs at least once a year? | Refer to GRM-03.1. | Yes |
| 127 | Human Resources
Employment Termination | HRS-04 | HRS-04.1 | JE | Roles and responsibilities for performing employment termination or change in employment procedures shall be assigned, documented, and communicated. | Are documented policies, procedures and guidelines in place to govern change in employment and/or termination?
(HR-03.1: Are Roles and responsibilities for following performing employment termination or change in employment procedures assigned, documented and communicated?) | ACME has formal HR and IT On-boarding and Off-boarding SOP's which governs granting, termination and transfer of access. These can be viewed on the ACME CORE.
HR On-boarding: https://community.ACME.com/community?id=community_article&sys_id=3e1d62e5dbd0dbc01dcaf3231f9619a1
HR Off-boarding: https://community.ACME.com/community?id=community_article&sys_id=4dcc2265dbd0dbc01dcaf3231f961909
IT On-boarding: https://community.ACME.com/community?id=community_article&sys_id=6efc66a5dbd0dbc01dcaf3231f961957
IT Off-boarding: https://community.ACME.com/community?id=community_article&sys_id=6c4c6e61dbd0dbc01dcaf3231f961948
All provisioning and de-provisioning of employees is initiated via HR. HR sends notification to IT Support who executes the On-boarding or Off-boarding process for users accounts and resources, contacting other departments as necessary.
When an employee is hired or terminated, the IT department or the system owner is notified by HR. user access to company servers, systems and accounts are enabled or disabled, this includes the user's access badge that controls access to the building and physical areas. | Yes | S3.2.d
S3.8.e | (S3.2.d) Procedures exist to restrict logical access to the system and information resources maintained in the system including, but not limited to, the following matters:
d. The process to make changes and updates to user profiles
(S3.8.e) e. Procedures to prevent customers, groups of individuals, or other entities from accessing confidential information other than their own | CC5.4
| E.6 | HR-03 | COBIT 4.1 PO 7.8 | APO01.02
APO07.05
APO07.06 | 312.8 and 312.10 | BOSS > Human Resources Security > Roles and Responsibilities | shared | x | None | Article 17 | NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-8 | NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-8 | 8.2.2
10.2.5 | 45 CFR 164.308 (a)(3)(ii)(C) | A.8.3.1 | A.7.3.1 | Commandment #6
Commandment #7 | PS-4
PS-5 | PA27 | BSGP |
| 128 | HRS-04.2 | JE | Do the above procedures and guidelines account for timely revocation of access and return of assets? | See HRS-04.1. | Yes |
| 129 | Human Resources
Portable / Mobile Devices | HRS-05 | HRS-05.1 | JE | Policies and procedures shall be established, and supporting business processes and technical measures implemented, to manage business risks associated with permitting mobile device access to corporate resources and may require the implementation of higher assurance compensating controls and acceptable-use policies and procedures (e.g., mandated security training, stronger identity, entitlement and access controls, and device monitoring). | Are policies and procedures established and measures implemented to strictly limit access to your sensitive data and tenant data from portable and mobile devices (such as) (e.g. laptops, cell phones and personal digital assistants (PDAs)), which are generally higher-risk than non-portable devices (e.g., desktop computers at the provider organization’s facilities)? | ACME instances can be accessed by mobile devices. The customer can determine if they do not allow this based on the customers own internal policies. ACME support employees are not able to access support infrastructure via mobile devices. ACME requires all remote production access connect through Cisco Client-to-site VPN with RSA two- factor authentication and is only accessible to authorized personnel with appropriate credentials. VPN can only be installed on company-issued laptops. | Yes | S3.4 | (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.6 | G.11, G12, G.20.13, G.20.14 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-32 | COBIT 4.1 DS5.11
COBIT 4.1 DS5.5 | APO01.08
APO13.01
APO13.02
DSS05.01
DSS05.02
DSS05.03
DSS05.07
DSS06.03
DSS06.06 | 312.8 and 312.10 | Presentation Services > Presentation Platform > Endpoints - Mobile Devices - Mobile Device Management | shared | x | Domain 2 | Article 17 | NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-19
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-6 | NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-17 (1)
NIST SP 800-53 R3 AC-17 (2)
NIST SP 800-53 R3 AC-17 (3)
NIST SP 800-53 R3 AC-17 (4)
NIST SP 800-53 R3 AC-17 (5)
NIST SP 800-53 R3 AC-17 (7)
NIST SP 800-53 R3 AC-17 (8)
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 AC-19
NIST SP 800-53 R3 AC-19 (1)
NIST SP 800-53 R3 AC-19 (2)
NIST SP 800-53 R3 AC-19 (3)
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-2 (1)
NIST SP 800-53 R3 MP-4
NIST SP 800-53 R3 MP-4 (1)
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 MP-6 (4) | 1.2.6
3.2.4
8.2.6 | 45 CFR 164.310 (d)(1) | A.7.2.1
A.10.7.1
A.10.7.2
A.10.8.3
A.11.7.1
A.11.7.2
A.15.1.4 | A.8.2.1
A.8.3.1
A.8.3.2
A.8.3.3
A.6.2.1
A.6.2.2
A.18.1.4 | ITAR 22 CFR § 120.17
EAR 15 CFR §736.2 (b) | All | CIP-007-3 - R7.1 | AC-17
AC-18
AC-19
MP-2
MP-4
MP-6 | 19.1
19.2
19.3 | PA33
PA34 | SGP
SGP | PCI DSS v2.0 9.7
PCI DSS v2.0 9.7.2
PCI DSS v2.0 9.8
PCI DSS v2.0 9.9
PCI DSS v2.0 11.1
PCI DSS v2.0 12.3 | 11.1
12.3 |
| 130 | Human Resources
Nondisclosure Agreements | HRS-06 | HRS-06.1 | JE | Requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details shall be identified, documented, and reviewed at planned intervals. | Are requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details identified, documented and reviewed at planned intervals?
| The non-disclosure or confidentiality agreements are reviewed during the contracting process. | Yes | S4.1.0 | (S4.1.0) The entity’s system availability, confidentiality, processing integrity and security performance is periodically reviewed and compared with the defined system availability and related security policies. | CC4.1 | C.2.5 | Schedule 1 (Section 5), 4.7 - Safeguards | LG-01 | APO01.02
APO01.03
APO01.08
APO07.06
APO09.03
APO10.04
APO13.01
APO13.03 | 312.8 and 312.10 | BOSS > Compliance > Intellectual Property Protection | shared | x | Domain 3 | Article 16 | NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-9 | NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1) | 1.2.5 | ISO/IEC 27001:2005
Annex A.6.1.5 | A.13.2.4 | ITAR 22 CFR § 120.17
EAR 15 CFR §736.2 (b) | Commandment #6
Commandment #7
Commandment #8
Commandment #9 | PL-4
PS-6
SA-9 | DI-2 DATA INTEGRITY AND DATA INTEGRITY BOARD
a. Documents processes to ensure the integrity of personally identifiable information (PII) through existing security controls; and
b. Establishes a Data Integrity Board when appropriate to oversee organizational Computer Matching Agreements123 and to ensure that those agreements comply with the computer matching provisions of the Privacy Act.
IP-1 CONSENT
a. Provides means, where feasible and appropriate, for individuals to authorize the collection, use, maintaining, and sharing of personally identifiable information (PII) prior to its collection;
b. Provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the collection, use, dissemination, and retention of PII;
c. Obtains consent, where feasible and appropriate, from individuals prior to any new uses or disclosure of previously collected PII; and
d. Ensures that individuals are aware of and, where feasible, consent to all uses of PII not initially described in the public notice that was in effect at the time the organization collected the PII. | PA7 | BSGP | PCI DSS v2.0 12.8.2
PCI DSS v2.0 12.8.3
PCI DSS v2.0 12.8.4 |
| 131 | Human Resources
Roles / Responsibilities | HRS-07 | HRS-07.1 | JE | Roles and responsibilities of contractors, employees, and third-party users shall be documented as they relate to information assets and security. | Do you provide tenants with a role definition document clarifying your administrative responsibilities versus those of the tenant? | ACME clarifies these roles in the legal contract. While ACME provides and supports the application and supporting infrastructure, customers are responsible for application administration. | Yes | S1.2.f | (S1.2.f) f. Assigning responsibility and accountability for system availability, confidentiality, processing integrity and related security. | B.1 | B.1.5, D.1.1,D.1.3.3, E.1, F.1.1, H.1.1, K.1.2 | 5 (B) | Schedule 1 (Section 5) 4.1 Accountability | IS-13 | COBIT 4.1 DS5.1 | APO01.02
APO01.03
APO01.08
APO07.06
APO09.03
APO10.04
APO13.01
APO13.03 | 312.3, 312.8 and 312.10 | BOSS > Human Resources Security > Roles and Responsibilities | shared | x | Domain 2 | Article 17 | NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7 | NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7 | 99.31(a)(1)(ii) | 1.2.9
8.2.1 | Clause 5.1 c)
A.6.1.2
A.6.1.3
A.8.1.1 | Clause 5.3
A.6.1.1
A.6.1.1 | Commandment #6
Commandment #7
Commandment #8 | AT-3
PL-4
PM-10
PS-1
PS-6
PS-7 | AR-1 GOVERNANCE AND PRIVACY PROGRAM
Control: The organization:
Supplemental Guidance: The development and implementation of a comprehensive governance and privacy program demonstrates organizational accountability for and commitment to the protection of individual privacy. Accountability begins with the appointment of an SAOP/CPO with the authority, mission, resources, and responsibility to develop and implement a multifaceted privacy program. The SAOP/CPO, in consultation with legal counsel, information security officials, and others as appropriate: (i) ensures the development, implementation, and enforcement of privacy policies and procedures; (ii) defines roles and responsibilities for protecting PII; (iii) determines the level of information sensitivity with regard to PII holdings; (iv) identifies the laws, regulations, and internal policies that apply to the PII; (v) monitors privacy best practices; and (vi) monitors/audits compliance with identified privacy controls.
AR-3 PRIVACY REQUIREMENTS FOR CONTRACTORS AND SERVICE PROVIDERS
Control: The organization:
a. Establishes privacy roles, responsibilities, and access requirements for contractors and service providers; and
b. Includes privacy requirements in contracts and other acquisition-related documents. | 2.2 | PA9
PA24 | BSGP | 12.8.5 |
| 132 | Human Resources
Acceptable Use | HRS-08 | HRS-08.1 | JE | Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining allowances and conditions for permitting usage of organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. Additionally, defining allowances and conditions to permit usage of personal mobile devices and associated applications with access to corporate resources (i.e., BYOD) shall be considered and incorporated as appropriate. | Do you provide documentation regarding how you may or access tenant data and metadata? | ACME employees responsible for the management and support of both customer and internal ACME instances may require access to the instances. The hopping (HOP) functionality generates credentials to grant such access. HOP functionality provides an employee with the ability to access and make changes to data within any instance without having a pre-defined and approved account on that instance. When hopping into a customer instance, the ACME employee must document the justification for hopping, for example, by including explicit comments in the INT/CHG work notes. | Yes | S1.2
S3.9 | (S1.2) The entity’s security policies include, but may not be limited to, the following matters:
(S3.9) Procedures exist to provide that issues of noncompliance with security policies are promptly addressed and that corrective measures are taken on a timely basis. | CC3.2
CC6.2 | B.3 | B.1.7, D.1.3.3, E.3.2, E.3.5.1, E.3.5.2 | Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4 | IS-26 | COBIT 4.1 DS 5.3 | APO01.03
APO01.08
APO13.01
APO13.02
DSS05.04
DSS06.06 | 312.4, 312.8 and 312.10 | SRM > Policies and Standards > Information Security Policies | shared | x | Domain 2 | Article 5, Article 6
Article 7 | NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-8
NIST SP 800-53 R3 AC-20
NIST SP 800-53 R3 PL-4 | NIST SP 800-53 R3 AC-8
NIST SP 800-53 R3 AC-20
NIST SP 800-53 R3 AC-20 (1)
NIST SP 800-53 R3 AC-20 (2)
NIST SP 800-53 R3 PL-4 | 8.1.0 | 45 CFR 164.310 (b) | A.7.1.3 | A.8.1.3 | Commandment #1
Commandment #2
Commandment #3 | AC-8
AC-20
PL-4 | 2.2
5.2
4.2 | PCI-DSS v2.0 12.3.5 | 12.3 |
| 133 | IS-26 | HRS-08.2 | JE | Do you collect or create metadata about tenant data usage through inspection technologies (search engines, etc.)? | ACME does not access any data stored by customers beyond what is required to provide services to its customer, except with customer's permission. ACME collects metadata about tentant data usage. | Yes | COBIT 4.1 DS 5.3 | 45 CFR 164.310 (b) | A.7.1.3 | NIST SP800-53 R3 AC-8
NIST SP800-53 R3 AC-20
NIST SP800-53 R3 PL-4 | PCI-DSS v2.0 12.3.5 |
| 134 | IS-26 | HRS-08.3 | JE | Do you allow tenants to opt out of having their data/metadata accessed via inspection technologies? | See HRS-08.2. | Not Applicable | COBIT 4.1 DS 5.3 | 45 CFR 164.310 (b) | A.7.1.3 | NIST SP800-53 R3 AC-8
NIST SP800-53 R3 AC-20
NIST SP800-53 R3 PL-4 | PCI-DSS v2.0 12.3.5 |
| 135 | Human Resources
Training / Awareness | HRS-09 | HRS-09.1 | JE | A security awareness training program shall be established for all contractors, third-party users, and employees of the organization and mandated when appropriate. All individuals with access to organizational data shall receive appropriate awareness training and regular updates in organizational procedures, processes, and policies relating to their professional function relative to the organization. | Do you provide a formal, role-based, security awareness training program for cloud-related access and data management issues (e.g., multi-tenancy, nationality, cloud delivery model segregation of duties implications and conflicts of interest) for all persons with access to tenant data? | ACME has a formal, multifaceted training program that includes on-the-job training, role based training, onboarding training, general security training (i.e. acceptable use, handling of sensitive data), specialized security training (i.e. for developers: OWASP top 10 Vulnerabilities and Countermeasures), and legal & human resources training (i.e. Insider Trading, Ethics & International Business). Additionally, Employees are required to (re-)complete Security and Awareness Training/Internal Company Training on an annual basis. ACME provides instructor-led classes, in-person, online self-paced, and external training options. The Training Policy and Training SOP can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=051daea5dbd0dbc01dcaf3231f9619fb | Yes | S1.2.k
S2.2.0 | (S1.2.k) The entity's security policies include, but may not be limited to, the following matters:
k. Providing for training and other resources to support its system security policies
(S2.2.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users. |
CC2.2
CC2.3 | E.1 | E.4 | 65 (B) | Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4; 4.7 Safeguards, Subs. 4.7.4 | IS-11 | COBIT 4.1 PO 7.4 | APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03 | 312.8 and 312.10 | SRM > GRC > | shared | x | Domain 2 | 6.01. (c)
6.02. (e) | NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4 | NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4 | 99.31(a)(1)(ii) | 1.2.10
8.2.1 | 45 CFR 164.308 (a)(5)(i)
45 CFR 164.308 (a)(5)(ii)(A) | Clause 5.2.2
A.8.2.2 | Clause 7.2(a), 7.2(b)
A.7.2.2 | Commandment #3
Commandment #6 | Chapter VI, Section I, Article 39 and Chapyer VI, Section II, Article 41 | CIP-004-3 - R1 - R2 - R2.1 | AT-1
AT-2
AT-3
AT-4 | AR-5 PRIVACY AWARENESS AND TRAINING
Control: The organization:
a. Develops, implements, and updates a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures;
b. Administers basic privacy training [Assignment: organization-defined frequency, at least annually] and targeted, role-based privacy training for personnel having responsibility for personally identifiable information (PII) or for activities that involve PII [Assignment: organization-defined frequency, at least annually]; and
c. Ensures that personnel certify (manually or electronically) acceptance of responsibilities for privacy requirements [Assignment: organization-defined frequency, at least annually]. | 9.1 | PA28 | BSGP | PCI DSS v2.0 12.6
PCI DSS v2.0 12.6.1
PCI DSS v2.0 12.6.2 | 12.6 |
| 136 | IS-11 | HRS-09.2 | JE | Are administrators and data stewards properly educated on their legal responsibilities with regard to security and data integrity? | See HRS-09.1. | Yes | COBIT 4.1 PO 7.4 | 45 CFR 164.308 (a)(5)(i)
45 CFR 164.308 (a)(5)(ii)(A) | Clause 5.2.2
A.8.2.2 | NIST SP800-53 R3 AT-1
NIST SP800-53 R3 AT-2
NIST SP800-53 R3 AT-3
NIST SP800-53 R3 AT-4 | PCI DSS v2.0 12.6
PCI DSS v2.0 12.6.1
PCI DSS v2.0 12.6.2 |
| 137 | Human Resources
User Responsibility | HRS-10 | HRS-10.1 | JE | All personnel shall be made aware of their roles and responsibilities for:
• Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations.
• Maintaining a safe and secure working environment | Are users made aware of their responsibilities for maintaining awareness and compliance with published security policies, procedures, standards and applicable regulatory requirements? | ACME has a formally documented Acceptable Use Policy. ACME requires that all new hires sign NDAs as well as review and acknowledge receiving and reading relevant policies, including the Information Security Policies and Standards (ISPS), Acceptable Use Policy, and Code of Conduct. | Yes | S2.3.0 | (S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality, processing integrity and security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them. | CC3.2 | E.1 | E.4 | 65 (B)
66 (B) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.4 | IS-16 | COBIT 4.1 PO 4.6 | APO01.02
APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03 | 312.8 and 312.10 | BOSS > Human Resources Security > Employee Awareness | shared | x | Domain 2 | Article 17 | NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 PL-4 | NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 PL-4 | 1.2.10
8.2.1 | 45 CFR 164.308 (a)(5)(ii)(D) | Clause 5.2.2
A.8.2.2
A.11.3.1
A.11.3.2 | Clause 7.2(a), 7.2(b)
A.7.2.2
A.9.3.1
A.11.2.8 | Commandment #5 Commandment #6
Commandment #7 | Chapter VI, Section I, Article 39 and Chapter VI, Section II, Article 41 | AT-2
AT-3
AT-4
PL-4 | UL-1 INTERNAL USE
Control: The organization uses personally identifiable information (PII) internally only for the authorized purpose(s) identified in the Privacy Act and/or in public notices. | 9.1 | PCI DSS v2.0 8.5.7
PCI DSS v2.0 12.6.1 | 12.4 |
| 138 | IS-16 | HRS-10.2 | JE | Are users made aware of their responsibilities for maintaining a safe and secure working environment? | See HRS-10.1 and See HRS-09.1. | Yes | COBIT 4.1 PO 4.6 | 45 CFR 164.308 (a)(5)(ii)(D) | Clause 5.2.2
A.8.2.2
A.11.3.1
A.11.3.2 | NIST SP800-53 R3 AT-2
NIST SP800-53 R3 AT-3
NIST SP800-53 R3 AT-4
NIST SP800-53 R3 PL-4 | PCI DSS v2.0 8.5.7
PCI DSS v2.0 12.6.1 |
| 139 | IS-16 | HRS-10.3 | JE | Are users made aware of their responsibilities for leaving unattended equipment in a secure manner? | See HRS-10.1 and See HRS-09.1. | Yes | COBIT 4.1 PO 4.6 | 45 CFR 164.308 (a)(5)(ii)(D) | Clause 5.2.2
A.8.2.2
A.11.3.1
A.11.3.2 | NIST SP800-53 R3 AT-2
NIST SP800-53 R3 AT-3
NIST SP800-53 R3 AT-4
NIST SP800-53 R3 PL-4 | PCI DSS v2.0 8.5.7
PCI DSS v2.0 12.6.1 |
| 140 | Human Resources
Workspace | HRS-11 | HRS-11.1 | JE | Policies and procedures shall be established to require that unattended workspaces do not have openly visible (e.g., on a desktop) sensitive documents and user computing sessions had been disabled after an established period of inactivity. | Do your data management policies and procedures address tenant and service level conflicts of interests?
| ACME has a documented Capacity planning model which is used to determine sizing requirements and scaling options. As a SaaS provider, the need to address capacity and horizontal system scaling is in the background, transparent to our customers. This planing process eliminates any potential issues reegarding service levels. | Not Applicable | S3.3.0
S3.4.0 | (S3.3.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers.
(S3.4.0) Procedures exist to protect against unauthorized access to system resources. | CC5.5
CC5.6 | E.1 | E.4 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-17 | APO01.02
APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
DSS05.03
DSS06.06 | 312.8 and 312.10 | BOSS > Data Governance > Clear Desk Policy | shared | x | Domain 2 | NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-2 | NIST SP 800-53 R3 AC-11
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-2 (1)
NIST SP 800-53 R3 MP-3
NIST SP 800-53 R3 MP-4
NIST SP 800-53 R3 MP-4 (1) | 8.2.3 | Clause 5.2.2
A.8.2.2
A.9.1.5
A.11.3.1
A.11.3.2
A.11.3.3 | Clause 7.2(a), 7.2(b)
A.7.2.2
A.11.1.5
A.9.3.1
A.11.2.8
A.11.2.9 | ITAR 22 CFR § 120.17
EAR 15 CFR §736.2 (b) | Commandment #5 Commandment #6
Commandment #7
Commandment #11 | AC-11
MP-2
MP-3
MP-4 | 8.1 | 8.1.8 |
| 141 | IS-16 | HRS-11.2 | JE | Do your data management policies and procedures include a tamper audit or software integrity function for unauthorized access to tenant data?
| ACME's application logging includes verbose transaction logs, these logs are retained within the instance for 30 days. Event logs are stored for seven days and audit histories are retained indefinitely in the instance.
Transaction logs represent every click, view, and system event that occurs in an instance and as a result, will grow very large, quickly. They provide a level of detail that is frequently used for troubleshooting issues with an instance. They can also provide detailed intelligence on the behaviors within an instance. These logs can be downloaded to customers' environments, if they need to be retained for longer than 30 days.
The event logs on the other hand are less granular; they will include the creation of an incident, or deletion of problem, or any one of the 250 standard events. They may also contain customer created events. There are a number of security events as well, including successful login, failed login, security privilege escalation, and viewing of a table. These events can either be monitored manually, generate an Incident based on a parameter or when metric is reached; such as failed logins per minute.
The final aspect of logging is the audit history. Audit history may be turned on for any particular table or field. The audit log table then maintains a record of who made changes when to a table or field and what they changed.
Please refer to the following link for details on how to view and download various types of log files:
https://docs.ACME.com/bundle/jakarta-platform-administration/page/administer/system-logs/concept/system-logs.html | Yes | Clause 5.2.2
A.8.2.2
A.9.1.5
A.11.3.1
A.11.3.2
A.11.3.3 | NIST SP800-53 R3 AC-11
NIST SP800-53 R3 MP-2
NIST SP800-53 R3 MP-3
NIST SP800-53 R3 MP-4 |
| 142 | IS-16 | HRS-11.3 | JE | Does the virtual machine management infrastructure include a tamper audit or software integrity function to detect changes to the build/configuration of the virtual machine? | ACME does not use virtual machine infrastructure in the customer environment. | Not Applicable | Clause 5.2.2
A.8.2.2
A.9.1.5
A.11.3.1
A.11.3.2
A.11.3.3 | NIST SP800-53 R3 AC-11
NIST SP800-53 R3 MP-2
NIST SP800-53 R3 MP-3
NIST SP800-53 R3 MP-4 |
| 143 | Identity & Access Management
Audit Tools Access | IAM-01 | IAM-01.1 | JE | Access to, and use of, audit tools that interact with the organization's information systems shall be appropriately segmented and restricted to prevent compromise and misuse of log data. | Do you restrict, log and monitor access to your information security management systems? (E.g., hypervisors, firewalls, vulnerability scanners, network sniffers, APIs, etc.)
| Internally, ACME utilizes Splunk to centralize audit logs and to support the audit review process. Access to these logs is restricted to security personnel with a need to know.
**Regarding support:
Management of access to the customer's instance is the responsibility of the customer administration team.
ACME does not access any data stored by customers beyond what is required to provide support to its customer, except with customer's permission. Additionally, ACME controls remote access to its sensitive resources and the production systems and network. Remote access is controlled through Cisco VPN and SecurID, which prevent users from gaining access to these resources. ACME utilizes RSA SecurID for multi-factor authentication for network access to privileged (including administrative access) accounts for production. Access is governed by internal policy.
ACME provides at no additional cost a plugin called the 'SNC Access Control Plugin'. Customers may use this plugin to restrict instance level access to named ACME support personal and can specify who from ACME can access the instance and when. This can also be configured to prevent any ACME support access to the instance unless this is explicitly updated to allow access.
**With regard to logs:
The ACME application writes detailed log information that is stored in tables within a customer's instance. As this is customer data in a customer's instance, ACME does not attempt to monitor or view this data unless specifically requested by a customer. As a result the customer is responsible for monitoring the contents of these logs files. The log data is protected in the same manner as all other customer data. Event logs can also be configured to feed into a customer's environment via ACME's Syslog probe allowing the logs to be stored within the customer's environment in a syslog repository or SIEM and retained according to the customer's requirements.
ACME's application logging includes verbose transaction logs, these logs are retained within the instance for 30 days. Event logs are stored for seven days and audit histories are retained indefinitely in the instance.
Transaction logs represent every click, view, and system event that occurs in an instance and as a result, will grow very large, quickly. They provide a level of detail that is frequently used for troubleshooting issues with an instance. They can also provide detailed intelligence on the behaviors within an instance. These logs can be downloaded to customers' environments, if they need to be retained for longer than 30 days.
The event logs on the other hand are less granular; they will include the creation of an incident, or deletion of problem, or any one of the 250 standard events. They may also contain customer created events. There are a number of security events as well, including successful login, failed login, security privilege escalation, and viewing of a table. These events can either be monitored manually, generate an Incident based on a parameter or when metric is reached; such as failed logins per minute.
The final aspect of logging is the audit history. Audit history may be turned on for any particular table or field. The audit log table then maintains a record of who made changes when to a table or field and what they changed.
For audit logs that are generated and monitored by the customer for activities within their instance - It is customer's responsibility to ensure access controls are applied to such logs.
Internally, ACME utilizes Splunk to centralize audit logs and to support the audit review process. As part of the purpose and design for this system, audit reviews occur daily for events that are considered lower risk. High risk issues, such as intrusion detection events trigger real-time alerts which are emailed to the Security Incident Response Team. ACME has established a Scheduled Security Operations Checklist which includes procedures for performing daily reviews of Linux, Windows, Network Device, IDS, and identified issue logs.
Please refer to the following link for details on how to view and download various types of log files:
https://docs.ACME.com/bundle/jakarta-platform-administration/page/administer/system-logs/concept/system-logs.html
**Regarding archives:
ACME does not archive or require customers to delete data. It is up to the customer to determine the data retention period for data stored within their instance.
| Yes | S3.2.g | (S3.2.g) g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls). | CC5.1 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-29 | COBIT 4.1 DS 5.7 | APO01.03
APO01.08
APO13.01
APO13.02
DSS05.03
DSS05.05 | 312.8 and 312.10 | SRM > Privilege Management Infrastructure > Privilege Usage Management | shared | x | Domain 2 | 6.03. (i)
6.03. (j) | NIST SP 800-53 R3 AU-9 | NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-9 (2) | 8.2.1 | A.15.3.2 | Commandment #2
Commandment #5
Commandment #11 | CIP-003-3 - R5.2 | AU-9
AU-11
AU-14 | 15.4 | PCI DSS v2.0 10.5.5 | 10.5
7.1.2
7.1.4
7.2
8.1
8.1.5
8.5 |
| 144 | IAM-01.2 | JE | Do you monitor and log privileged access (administrator level) to information security management systems? | See IAM-01.1. | Yes |
| 145 | Identity & Access Management
User Access Policy | IAM-02 | IAM-02.1 | JE | User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and customer (tenant) users with access to data and organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and measures must incorporate the following:
• Procedures and supporting roles and responsibilities for provisioning and de-provisioning user account entitlements following the rule of least privilege based on job function (e.g., internal employee and contingent staff personnel changes, customer-controlled access, suppliers' business relationships, or other third-party business relationships)
• Business case considerations for higher levels of assurance and multi-factor authentication secrets (e.g., management interfaces, key generation, remote access, segregation of duties, emergency access, large-scale provisioning or geographically-distributed deployments, and personnel redundancy for critical systems)
• Access segmentation to sessions and data in multi-tenant architectures by any third party (e.g., provider and/or other customer (tenant))
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or re-use when feasible
• Authentication, authorization, and accounting (AAA) rules for access to data and sessions (e.g., encryption and strong/multi-factor, expireable, non-shared authentication secrets)
• Permissions and supporting capabilities for customer (tenant) controls over authentication, authorization, and accounting (AAA) rules for access to data and sessions
• Adherence to applicable legal, statutory, or regulatory compliance requirements | Do you have controls in place ensuring timely removal of systems access that is no longer required for business purposes? | ACME has formal HR and IT Off-boarding SOPs which govern granting, termination and transfer of access.
All de-provisioning of employees is initiated via HR. HR sends notification to IT Support who executes theOff-boarding process for users accounts and resources, contacting other departments as necessary.
When an employee is terminated, the IT department or the system owner is notified by HR. User access to company servers, and systems and accounts are disabled. This includes the user's access badge that controls access to the building and physical areas.
The HR Offboarding SOP and IT Support Offboarding SOP can be viewed on the ACME CORE here:
HR Off-boarding: https://community.ACME.com/community?id=community_article&sys_id=4dcc2265dbd0dbc01dcaf3231f961909
IT Off-boarding: https://community.ACME.com/community?id=community_article&sys_id=6c4c6e61dbd0dbc01dcaf3231f961948
Management of access to the customer's instance is the responsibility of the customer administration team.
| Yes | S3.2.0 | (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls). | B.1 | B.1.8, B.1.21, B.1.28, E.6.2, H.1.1, K.1.4.5, | 8 (B)
40 (B)
41 (B)
42 (B)
43 (B)
44 (C+) | Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4; 4.7 Safeguards, Subs. 4.7.4 | IS-07 | COBIT 4.1 DS 5.4 | APO01.02
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.04
DSS05.05
DSS05.06
DSS06.03
DSS06.06 | 312.8 and 312.10 | SRM > Policies and Standards > | shared | x | Domain 2 | 6.01. (b)
6.01. (d)
6.02. (e)
6.03. (b)
6.03.04. (b)
6.03.04. (c)
6.03.05. (b)
6.03.05. (d)
6.03.06. (b)
6.04.01. (c)
6.04.01. (f)
6.04.02. (a)
6.04.02. (b)
6.04.02. (c)
6.04.03. (b)
6.04.06. (a)
6.04.08. (a)
6.04.08. (b)
6.04.08. (c)
6.04.08.03. (a)
6.04.08.03. (b) | Article 17 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-7
NIST SP 800-53 R3 AC-14
NIST SP 800-53 R3 IA-1 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-7
NIST SP 800-53 R3 AC-10
NIST SP 800-53 R3 AC-14
NIST SP 800-53 R3 IA-1 | 8.1.0 | 45 CFR 164.308 (a)(3)(i)
45 CFR 164.312 (a)(1)
45 CFR 164.312 (a)(2)(ii)
45 CFR 164.308(a)(4)(ii)(B) (New)
45 CFR 164.308(a)(4)(ii)(c ) (New) | A.11.1.1
A.11.2.1
A.11.2.4
A.11.4.1
A.11.5.2
A.11.6.1 | A.9.1.1
A.9.2.1,
A.9.2.2
A.9.2.5
A.9.1.2
A.9.4.1 | S3.2.g | Commandment #6
Commandment #7
Commandment #8 | CIP-007-3 - R5.1 - R5.1.2 | AC-1
IA-1 | 15.1
15.2 | PCI DSS v2.0 3.5.1
PCI DSS v2.0 8.5.1
PCI DSS v2.0 12.5.4 | 3.5.1, 7.0
8.0
12.5.4 |
| 146 | IS-07 | IAM-02.2 | JE | Do you provide metrics to track the speed with which you are able to remove systems access that is no longer required for business purposes? | Access that is no longer needed is removed within 24 hours. Access removal is documented in ACME's internal ACME instance. | Yes | COBIT 4.1 DS 5.4 | 45 CFR 164.308 (a)(3)(i)
45 CFR 164.312 (a)(1)
45 CFR 164.312 (a)(2)(ii)
45 CFR 164.308(a)(4)(ii)(B) (New)
45 CFR 164.308(a)(4)(ii)(c ) (New) | A.11.1.1
A.11.2.1
A.11.2.4
A.11.4.1
A.11.5.2
A.11.6.1 | NIST SP800-53 R3 AC-1
NIST SP800-53 R3 IA-1 | PCI DSS v2.0 3.5.1
PCI DSS v2.0 8.5.1
PCI DSS v2.0 12.5.4 |
| 147 | Identity & Access Management
Diagnostic / Configuration Ports Access | IAM-03 | IAM-03.1 | JE | User access to diagnostic and configuration ports shall be restricted to authorized individuals and applications.
(IS-30.1: Do you utilize dedicated secure networks to provide management access to your cloud service infrastructure?) | Do you use dedicated secure networks to provide management access to your cloud service infrastructure? | ACME’s infrastructure environment is divided into two separate networks, one corporate network and one data center network with the data center network providing all customer services. Access from the corporate network to the data center network is treated as remote access and requires a two factor authenticated VPN connection. Once in the data center network, a data center LDAP directory controls access within the data center to the various systems present. | Yes | S3.2.g | (S3.2.g) g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls). | CC5.1 | H1.1, H1.2, G.9.15 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-30 | COBIT 4.1 DS5.7 | APO13.01
DSS05.02
DSS05.03
DSS05.05
DSS06.06 | 312.8 and 312.10 | SRM > Privilege Management Infrastructure > Privilege Usage Management - Resource Protection | provider | x | Domain 2 | NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-5 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6) | 8.2.2 | A.10.6.1
A.11.1.1
A.11.4.4
A.11.5.4 | A.13.1.1
A.9.1.1
A.9.4.4 | Commandment #3
Commandment #4
Commandment #5
Commandment #6
Commandment #7
Commandment #8 | CIP-007-3 - R2 | CM-7
MA-3
MA-4
MA-5 | 15.4 | PCI-DSS v2.0 9.1.2 | 1.2.2
7.1
7.1.2
7.1.3
7.2
7.2.3
9.1.2
9.1.3 |
| 148 | Identity & Access Management
Policies and Procedures | IAM-04 | IAM-04.1 | JE | Policies and procedures shall be established to store and manage identity information about every person who accesses IT infrastructure and to determine their level of access. Policies shall also be developed to control access to network resources based on user identity. | Do you manage and store the identity of all personnel who have access to the IT infrastructure, including their level of access? | ACME uses an identity and access management tool to manage the provisioning of user accounts based on role. | Yes | APO01.03
APO01.08
APO13.01
APO13.02
DSS05.02
DSS05.04
DSS06.06 | SRM > Policies and Standards > Information Security Policies | Domain 12 | Annex
A.9.2
A.9.2.1
A.9.2.2
A.9.2.3,
A.9.2.4,
A.9.2.5,
A.9.2.6 | 7.3
8.8
9.10 |
| 149 | IAM-04.2 | JE | Do you manage and store the user identity of all personnel who have network access, including their level of access? | See IAM-04.1 | Yes |
| 150 | Identity & Access Management
Segregation of Duties | IAM-05 | IAM-05.1 | JE | User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for restricting user access as per defined segregation of duties to address business risks associated with a user-role conflict of interest. | Do you provide tenants with documentation on how you maintain segregation of duties within your cloud service offering? | Roles and responsibilities are formally documented in the Information Security Policy and Information Security Standards documents.
Please refer to the Information Security Policy here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0
Please refer to the Information Security Standards here: https://community.ACME.com/community?id=community_article&sys_id=0b1d62e5dbd0dbc01dcaf3231f9619f5
| Yes | S3.2.a | (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public. | CC5.1 | Schedule 1 (Section 5) 4.7 Safeguards, Subs. 4.7.3(b) | IS-15 | COBIT 4.1 DS 5.4 | APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03 | 312.8 and 312.10 | ITOS > Resource Management > Segregation of Duties | shared | x | Domain 2 | 6.04.01. (d)
6.04.08.02. (a) | Article 17 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-6 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6) | 99.31(a)(1)(ii) | 8.2.2 | 45 CFR 164.308 (a)(1)(ii)(D)
45 CFR 164.308 (a)(3)(ii)(A)
45 CFR 164.308(a)(4)(ii)(A) (New)
45 CFR 164.308 (a)(5)(ii)(C)
45 CFR 164.312 (b) | A.10.1.3 | A.6.1.2 | Commandment #6
Commandment #7
Commandment #8
Commandment #10 | CIP-007-3 R5.1.1 | AC-1
AC-2
AC-5
AC-6
AU-1
AU-6
SI-1
SI-4 | 3.0
3.1
3.2
3.3
3.4
3.5 | PA24 | P | PCI DSS v2.0 6.4.2 | 6.4.2, 7.3
8.8
9.10 |
| 151 | Identity & Access Management
Source Code Access Restriction | IAM-06 | IAM-06.1 | JE | Access to the organization's own developed applications, program, or object source code, or any other form of intellectual property (IP), and use of proprietary software shall be appropriately restricted following the rule of least privilege based on job function as per established user access policies and procedures. | Are controls in place to prevent unauthorized access to your application, program or object source code, and assure it is restricted to authorized personnel only?
| ACME limits access to source code via code version tools to only authorized users. Full source code control processes and check-out/check-in with audit traceability is maintained. Agile software development best practices are extensively utilized. The Code Control SOP can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=88ac6225dbd0dbc01dcaf3231f961902
| Yes | S3.13.0 | (S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system. | CC7.4 | I.2.7.2, I.2.9, I.2.10, I.2.15 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-33 | APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03 | ITOS > Service Support > Release Management - Source Code Management | shared | x | Domain 2 | Article 17 | NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5) | 1.2.6
6.2.1 | Clause 4.3.3
A.12.4.3
A.15.1.3 | Clause
5.2(c)
5.3(a),
5.3(b),
7.5.3(b)
7.5.3(d)
8.1,
8.3
9.2(g)
A.9.4.5
A.18.1.3 | ITAR 22 CFR § 120.17
EAR 15 CFR §736.2 (b) | Commandment #6
Commandment #7
Commandment #9
Commandment #10 | CM-5
CM-6 | 9.4
14.1
14.2
19.1
| PCI-DSS v2.0 6.4.1
PCI-DSS v2.0 6.4.2 | 6.4.1
6.4.2, 7.1
7.1.1
7.1.2
7.1.3
7.1.4
7.2
7.2.2
7.3 |
| 152 | IS-33 | IAM-06.2 | JE | Are controls in place to prevent unauthorized access to tenant application, program or object source code, and assure it is restricted to authorized personnel only? | ACME enforces least privileged access concepts when granting user access rights and a small subset of users have the ability to access customer data. ACME conducts entitlement reviews on a quarterly basis to review ACLs to critical systems and accounts for accuracy and appropriateness.
ACME does not access any data stored by customers beyond what is required to provide services to its customer, except with customer's permission. | Yes | Clause 4.3.3
A.12.4.3
A.15.1.3 | NIST SP800-53 R3 CM-5
NIST SP800-53 R3 CM-6 | PCI-DSS v2.0 6.4.1
PCI-DSS v2.0 6.4.2 |
| 153 | Identity & Access Management
Third Party Access | IAM-07 | IAM-07.1 | JE | The identification, assessment, and prioritization of risks posed by business processes requiring third-party access to the organization's information systems and data shall be followed by coordinated application of resources to minimize, monitor, and measure likelihood and impact of unauthorized or inappropriate access. Compensating controls derived from the risk analysis shall be implemented prior to provisioning access. | Do you provide multi-failure disaster recovery capability? | ACME has a formally documented Information System Contingency Plan (ISCP) which describes the recovery resources, procedures, and priorities necessary to provide seamless customer access in the event a disaster takes place that impacts customer data at the data center(s). The ISCP is dependent on ACME's Advanced High Availability (AHA) data center architecture which provides replication and redundancy. ACME's data centers are arranged in pairs. All customer production data is stored in both data centers in a pair and kept in sync using asynchronous database replication. Subproduction instances are only located in a single data center and are not replicated between data centers. Both data centers in a pair are active at all times and have identical processing capabilities; each data center has the ability to support the combined production load of the pair. Each data center has multiple ISPs coming into every data center cage, redundant network paths throughout the network, redundant disks in RAID arrays, redundant power suppliers, and many other hardware and configurations designed to remove single points of failure from the architecture. In the event of a disaster, ACME activates a failover process that transfers customer operations to the alternate data center in the pair. From this perspective, ACME is providing customers with business continuity as opposed to disaster recovery.
The ISCP is tested annually to validate and improve the ISCP. Additionally, the failover process is informally tested on a daily basis as ACME uses failover to reduce the impact of maintenance on its service. ACME's ISCP controls are validated on an annual basis during its ISO 27001 assessment.
ACME's ISCP is reviewed at least annually by senior management and is available electronically to all employees. The ISCP is replicated between both data centers in the pair. Key ACME personnel have been trained in their emergency response and recovery roles. The executive sponsor of the ISCP is the Chief Product Officer.
The ISCP is based on National Institute of Standards and Technology (NIST) Special Publication 800-34 "Contingency Planning Guide for Information Technology (IT) Systems" which provides instructions, recommendations, and considerations for government IT contingency planning.
Refer to the Information System Contingency Plan and Information System Contingency Plan Test Report on the ACME CORE here:
ISCP: https://community.ACME.com/community?id=community_article&sys_id=aa4c22a1dbd0dbc01dcaf3231f9619a2
ISCP Test Report: https://community.ACME.com/community?id=community_article&sys_id=e7fca6a5dbd0dbc01dcaf3231f961992 | Yes | S3.1
x3.1.0 | (S3.1) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats.
(x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system [availability, processing integrity, confidenitality] commitments and (2) assess the risks associated with the identified threats. | CC3.1 | B.1
H.2 | B.1.1, B.1.2, D.1.1, E.1, F.1.1, H.1.1, K.1.1, E.6.2, E.6.3 | Schedule 1 (Section 5), 4.7 - Safeguards | RI-05 | COBIT 4.1 DS 2.3 | APO01.03
APO01.08
APO07.06
APO10.04
APO13.02
DSS05.04
DSS05.07
DSS06.03
DSS06.06 | 312.8 and 312.10 | SRM > Governance Risk & Compliance > Vendor Management | shared | x | Domain 2, 4 | 6.02. (a)
6.02. (b)
6.03. (a) | Article 17 (1), (2) | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1 | 7.1.1
7.1.2
7.2.1
7.2.2
7.2.3
7.2.4 | A.6.2.1
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.4 | A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.5 | CA-3
MA-4
RA-3 | "FTC Fair Information Principles
Integrity/Security
Security involves both managerial and technical measures to protect against loss and the unauthorized access, destruction, use, or disclosure of the data.(49) Managerial measures include internal organizational measures that limit access to data and ensure that those individuals with access do not utilize the data for unauthorized purposes. Technical security measures to prevent unauthorized access include encryption in the transmission and storage of data; limits on access through use of passwords; and the storage of data on secure servers or computers . - http://www.ftc.gov/reports/privacy3/fairinfo.shtm". UL-2 INFORMATION SHARING WITH THIRD PARTIES | 2.2
4.3 | PCI DSS v2.0 12.8.1
PCI DSS v2.0 12.8.2
PCI DSS v2.0 12.8.3
PCI DSS v2.0 12.8.4 | 12.8
12.2 |
| 154 | RI-05 | IAM-07.2 | JE | Do you monitor service continuity with upstream providers in the event of provider failure? | ACME’s production environment is monitored 365x7x24 (everyday of the year) for network, infrastructure, performance and availability with alerts attended to by our SRE team, events are addressed and escalated based on the SLAs defined in the customer contract. | Yes | COBIT 4.1 DS 2.3 | A.6.2.1
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.4 | NIST SP800-53 R3 CA-3
NIST SP800-53 R3 MA-4
NIST SP800-53 R3 RA-3 | PCI DSS v2.0 12.8.1
PCI DSS v2.0 12.8.2
PCI DSS v2.0 12.8.3
PCI DSS v2.0 12.8.4 |
| 155 | RI-05 | IAM-07.3 | JE | Do you have more than one provider for each service you depend on? | See IAM-07.1. | Yes | COBIT 4.1 DS 2.3 | A.6.2.1
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.4 | NIST SP800-53 R3 CA-3
NIST SP800-53 R3 MA-4
NIST SP800-53 R3 RA-3 | PCI DSS v2.0 12.8.1
PCI DSS v2.0 12.8.2
PCI DSS v2.0 12.8.3
PCI DSS v2.0 12.8.4 |
| 156 | RI-05 | IAM-07.4 | JE | Do you provide access to operational redundancy and continuity summaries,(which) including the services you depend on?
| See IAM-07.1. | Yes | COBIT 4.1 DS 2.3 | A.6.2.1
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.4 | NIST SP800-53 R3 CA-3
NIST SP800-53 R3 MA-4
NIST SP800-53 R3 RA-3 | PCI DSS v2.0 12.8.1
PCI DSS v2.0 12.8.2
PCI DSS v2.0 12.8.3
PCI DSS v2.0 12.8.4 |
| 157 | RI-05 | IAM-07.5 | JE | Do you provide the tenant the ability to declare a disaster? | Customers would first contact ACME's Customer Support team. The Customer Support will transfer (including potential) security issues to the Security team for handling. Customers may interact with ACME via their Account Representative, Customer Support, the Customer Portal, or their SAM (if purchased). These may include quarterly reviews of performance and SLAs, incident reviews, real-time reviews of availability (he Customer Portal), or other metrics.
ACME has customer support offices located around the globe to provide 24/7, follow-the-sun support for ACME's customers. Major support locations are San Diego, CA; Orlando, FL; London, United Kingdom; Amsterdam, Netherlands; Sydney, Australia. Incidents and problems reported by customers, are recorded and tracked in HI, ACME's customer facing internal instance of our product.
ACME has a formal documented Security Incident Response policy, process and workflow. Our Incident Response process includes documented event discovery, triage, escalation, notification (including customer notification) remediation, and post-mortem review.
ACME reports both incidents and security incidents in accordance with the Incident Management process and Security Incident Response Plan. If a customer environment or data is impacted, the customer will be notified via their normal support contacts as required by their SLA.
The Security Incident Response SOP can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=a75c6aa1dbd0dbc01dcaf3231f961958 | Yes | COBIT 4.1 DS 2.3 | A.6.2.1
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.4 | NIST SP800-53 R3 CA-3
NIST SP800-53 R3 MA-4
NIST SP800-53 R3 RA-3 | PCI DSS v2.0 12.8.1
PCI DSS v2.0 12.8.2
PCI DSS v2.0 12.8.3
PCI DSS v2.0 12.8.4 |
| 158 | RI-05 | IAM-07.6 | JE | Do you provide a tenant-triggered failover option? | Customers can request a failover/transfer or restore from backup of their specific instance via a CHG ticket assigned to the Ops - Site Reliability team. | Yes | COBIT 4.1 DS 2.3 | A.6.2.1
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.4 | NIST SP800-53 R3 CA-3
NIST SP800-53 R3 MA-4
NIST SP800-53 R3 RA-3 | PCI DSS v2.0 12.8.1
PCI DSS v2.0 12.8.2
PCI DSS v2.0 12.8.3
PCI DSS v2.0 12.8.4 |
| 159 | RI-05 | IAM-07.7 | JE | Do you share your business continuity and redundancy plans with your tenants? | Customers can access the Information System Contingency Plan on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=aa4c22a1dbd0dbc01dcaf3231f9619a2 | Yes | COBIT 4.1 DS 2.3 | A.6.2.1
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.4 | NIST SP800-53 R3 CA-3
NIST SP800-53 R3 MA-4
NIST SP800-53 R3 RA-3 | PCI DSS v2.0 12.8.1
PCI DSS v2.0 12.8.2
PCI DSS v2.0 12.8.3
PCI DSS v2.0 12.8.4 |
| 160 | Identity & Access Management
User Access Restriction / Authorization | IAM-08 | IAM-08.1 | JE | Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business necessary. | Do you document how you grant and approve access to tenant data? | ACME does not access any data stored by customers beyond what is required to provide services to its customer, except with customer's permission.
ACME provides at no additional cost a plugin called the 'SNC Access Control Plugin'. Customers may use this plugin to restrict instance level access to named ACME support personal and can specify who from ACME can access the instance and when. This can also be configured to prevent any ACME support access to the instance unless this is explicitly updated to allow access.
ACME enforces least privileged access concepts when granting user access rights and a small subset of users have the ability to access customer data.
ACME has formal HR and IT On-boarding and Off-boarding SOP's which governs granting, termination and transfer of access. These can be viewed on the ACME CORE here:
All provisioning and de-provisioning of employees is initiated via HR. HR sends notification to IT Support who executes the On-boarding or Off-boarding process for users accounts and resources, contacting other departments as necessary.
ACME employees responsible for the management and support of both customer and internal ACME instances may require access to the instances. The HOP functionality provides an employee with the ability to access and make changes to data within any instance without having a pre-defined and approved account on that instance. When hopping into a customer instance, the ACME employee must document the justification for hopping, for example, by including explicit comments in the INT/CHG work notes.
| Yes | S3.2.0
S4.3.0 | (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).
(S4.3.0) Environmental, regulatory, and technological changes are monitored, and their effect on system availability, confidentiality, processing integrity and security is assessed on a timely basis; policies are updated for that assessment. |
CC3.3 | IS-08
IS-12 | COBIT 4.1 DS5.4 | APO01.03
APO01.08
APO10.04
APO13.02
DSS05.04
DSS06.03
DSS06.06 | 312.8 and 312.10 | Information Services > User Directory Services > Active Directory Services,
LDAP Repositories,
X.500 Repositories,
DBMS Repositories,
Meta Directory Services,
Virtual Directory Services | shared | x | Domain 12 | 45 CFR 164.308 (a)(3)(i)
45 CFR 164.308 (a)(3)(ii)(A)
45 CFR 164.308 (a)(4)(i)
45 CFR 164.308 (a)(4)(ii)(B)
45 CFR 164.308 (a)(4)(ii)(C)
45 CFR 164.312 (a)(1) | A.11.2.1
A.11.2.2
A.11.4.1
A 11.4.2
A.11.6.1 | Annex
A.9.2,
A.9.2.1,
A.9.2.2,
A.9.2.3,
A.9.2.4,
A.9.2.5,
A.9.2.6,
A.9.3.1,
A.9.4.1,
A.9.4.2,
A.9.4.3,
A.9.4.5 | NIST SP800-53 R3 AC-3
NIST SP800-53 R3 AC-5
NIST SP800-53 R3 AC-6
NIST SP800-53 R3 IA-2
NIST SP800-53 R3 IA-4
NIST SP800-53 R3 IA-5
NIST SP800-53 R3 IA-8
NIST SP800-53 R3 MA-5
NIST SP800-53 R3 PS-6
NIST SP800-53 R3 SA-7
NIST SP800-53 R3 SI-9 | "FTC Fair Information Principles
Integrity/Security
Security involves both managerial and technical measures to protect against loss and the unauthorized access, destruction, use, or disclosure of the data.(49) Managerial measures include internal organizational measures that limit access to data and ensure that those individuals with access do not utilize the data for unauthorized purposes. Technical security measures to prevent unauthorized access include encryption in the transmission and storage of data; limits on access through use of passwords; and the storage of data on secure servers or computers . - http://www.ftc.gov/reports/privacy3/fairinfo.shtm" | 3.2
9.2
15.2 | PCI DSS v2.0 7.1
PCI DSS v2.0 7.1.1
PCI DSS v2.0 7.1.2
PCI DSS v2.0 7.1.3
PCI DSS v2.0 7.2.1
PCI DSS v2.0 7.2.2
PCI DSS v2.0 8.5.1
PCI DSS v2.0 12.5.4 | 7.1
7.1.1
7.1.2
7.1.3
7.1.4
7.2 |
| 161 | IS-08 | IAM-08.2 | JE | Do you have a method of aligning provider and tenant data classification methodologies for access control purposes? | This is not applicable as ACME does not inspect data that customer stores on their instance to determine its data classification. Data classification is determined by the information owner (customer). ACME treats all customer data with the same level of controls and classifies it as “Customer Confidential”. | Not Applicable | COBIT 4.1 DS5.4 | 45 CFR 164.308 (a)(3)(i)
45 CFR 164.308 (a)(3)(ii)(A)
45 CFR 164.308 (a)(4)(i)
45 CFR 164.308 (a)(4)(ii)(B)
45 CFR 164.308 (a)(4)(ii)(C)
45 CFR 164.312 (a)(1) | A.11.2.1
A.11.2.2
A.11.4.1
A 11.4.2
A.11.6.1 | NIST SP800-53 R3 AC-3
NIST SP800-53 R3 AC-5
NIST SP800-53 R3 AC-6
NIST SP800-53 R3 IA-2
NIST SP800-53 R3 IA-4
NIST SP800-53 R3 IA-5
NIST SP800-53 R3 IA-8
NIST SP800-53 R3 MA-5
NIST SP800-53 R3 PS-6
NIST SP800-53 R3 SA-7
NIST SP800-53 R3 SI-9 | PCI DSS v2.0 7.1
PCI DSS v2.0 7.1.1
PCI DSS v2.0 7.1.2
PCI DSS v2.0 7.1.3
PCI DSS v2.0 7.2.1
PCI DSS v2.0 7.2.2
PCI DSS v2.0 8.5.1
PCI DSS v2.0 12.5.4 |
| 162 | Identity & Access Management
User Access Authorization | IAM-09 | IAM-09.1 | JE | Provisioning user access (e.g., employees, contractors, customers (tenants), business partners and/or supplier relationships) to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components shall be authorized by the organization's management prior to access being granted and appropriately restricted as per established policies and procedures. Upon request, provider shall inform customer (tenant) of this user access, especially if customer (tenant) data is used as part of the service and/or customer (tenant) has some shared responsibility over implementation of control. | Does your management provision the authorization and restrictions for user access (e.g. employees, contractors, customers (tenants), business partners and/or suppliers) prior to their access to data and any owned or managed (physical and virtual) applications, infrastructure systems and network components? | See IAM-08.1.
ACME uses third party vendors for data center colocation, Smart Hands technical support services in the data centers, and on-site media destruction in the data centers. ACME does not grant third party vendors logical access to ACME infrastructure or customer data.
The Vendor Security Risk Assessment SOP can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=ebfca6a5dbd0dbc01dcaf3231f961993 | Yes | S3.2.0 | (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls). | H.2.4, H.2.5, | 35 (B)
40 (B)
41 (B)
42 (B)
44 (C+) | Schedule 1 (Section 5) Safeguards, Subs. 4.7.2 and 4.7.3 | IS-08 | DS5.4 | APO01.03
APO01.08
APO07.06
APO10.04
APO13.02
DSS05.04
DSS06.03
DSS06.06 | 312.8 and 312.10 | SRM > Privilege Management Infrastructure > Identity Management - Identity Provisioning | shared | x | Domain 2 | 6.03.04. (b)
6.03.04. (c)
6.03.05. (d)
6.03.06. (a)
6.03.06. (b)
6.04.01. (a)
6.04.01. (b)
6.04.01. (d)
6.04.01. (e)
6.04.01. (g)
6.04.03. (c)
6.04.08.02. (a) | Article 17 | NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-7 | NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AC-3 (3)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-2 (2)
NIST SP 800-53 R3 IA-2 (3)
NIST SP 800-53 R3 IA-2 (8)
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-4 (4)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-9 | 8.2.2 | 45 CFR 164.308 (a)(3)(i)
45 CFR 164.308 (a)(3)(ii)(A)
45 CFR 164.308 (a)(4)(i)
45 CFR 164.308 (a)(4)(ii)(B)
45 CFR 164.308 (a)(4)(ii)(C)
45 CFR 164.312 (a)(1) | A.11.2.1
A.11.2.2
A.11.4.1
A 11.4.2
A.11.6.1 | A.9.2.1, A.9.2.2
A.9.2.3
A.9.1.2
A.9.4.1 | CIP-003-3 - R5.1.1 - R5.3
CIP-004-3 R2.3
CIP-007-3 R5.1 - R5.1.2 | AC-3
AC-5
AC-6
IA-2
IA-4
IA-5
IA-8
MA-5
PS-6
SA-7
SI-9 | AP-1 The organization determines and documents the legal authority that permits the collection, use, maintenance, and sharing of personally identifiable information (PII), either generally or in support of a specific program or information system need. | 9.2
15.2 | PA24 | GP | 7.1
7.1.1
7.1.2
7.1.3
7.2.1
7.2.2
8.5.1
12.5.4 | 7.1
7.1.1
7.1.2
7.1.3
7.1.4
12.5.4 |
| 163 | IAM-09.2 | JE | Do your provide upon request user access (e.g. employees, contractors, customers (tenants), business partners and/or suppliers) to data and any owned or managed (physical and virtual) applications, infrastructure systems and network components? | See IAM-08.1.
ACME uses third party vendors for data center colocation, Smart Hands technical support services in the data centers, and on-site media destruction in the data centers. ACME does not grant third party vendors logical access to ACME infrastructure or customer data.
The Vendor Security Risk Assessment SOP can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=ebfca6a5dbd0dbc01dcaf3231f961993 | Yes |
| 164 | Identity & Access Management
User Access Reviews | IAM-10 | IAM-10.1 | JE | User access shall be authorized and revalidated for entitlement appropriateness, at planned intervals, by the organization's business leadership or other accountable business role or function supported by evidence to demonstrate the organization is adhering to the rule of least privilege based on job function. For identified access violations, remediation must follow established user access policies and procedures. | Do you require at least annual certification of entitlements for all system users and administrators (exclusive of users maintained by your tenants)? | ACME performs account and privilege access entitlement review on a quarterly basis. The Entitlement Review SOP can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=ce1d22e5dbd0dbc01dcaf3231f961997 | Yes | S3.2.0 | (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls). | H.2.6, H.2.7, H.2.9, | 41 (B) | Schedule 1 (Section 5), 4.7 - Safeguards | IS-10 | COBIT 4.1 DS5.3
COBIT 4.1 DS5.4 | APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03 | 312.8 and 312.10 | SRM > Privilege Management Infrastructure > Authorization Services - Entitlement Review | shared | x | Domain 2 | Article 17 | NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7 | NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7 | 99.31(a)(1)(ii) | 8.2.1
8.2.7 | 45 CFR 164.308 (a)(3)(ii)(B)
45 CFR 164.308 (a)(4)(ii)(C) | A.11.2.4 | A.9.2.5 | ITAR 22 CFR § 120.17
EAR 15 CFR §736.2 (b) | Commandment #6
Commandment #7
Commandment #8
Commandment #10 | CIP-004-3 R2.2.2
CIP-007-3 - R5 - R.1.3 | AC-2
AU-6
PM-10
PS-6
PS-7 | 9.2 | 8.1.4 |
| 165 | IS-10 | IAM-10.2 | JE | If users are found to have inappropriate entitlements, are all remediation and certification actions recorded? | Inappropriate entitlements are documented in a ticket and removed per the ACME observation process, which is detailed in the Observation SOP on the ACME CORE here:
The Entitlement Review SOP can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=ce1d22e5dbd0dbc01dcaf3231f961997 | Yes | COBIT 4.1 DS5.3
COBIT 4.1 DS5.4 | 45 CFR 164.308 (a)(3)(ii)(B)
45 CFR 164.308 (a)(4)(ii)(C) | A.11.2.4 | NIST SP800-53 R3 AC-2
NIST SP800-53 R3 AU-6
NIST SP800-53 R3 PM-10
NIST SP800-53 R3 PS-6
NIST SP800-53 R3 PS-7 |
| 166 | IS-10 | IAM-10.3 | JE | Will you share user entitlement remediation and certification reports with your tenants, if inappropriate access may have been allowed to tenant data? | Entitlement review report results are company confidential and are not shared externally.
**Regarding support:
Management of access to the customer's instance is the responsibility of the customer administration team.
ACME does not access any data stored by customers beyond what is required to provide support to its customer, except with customer's permission. Additionally, ACME controls remote access to its sensitive resources and the production systems and network. Remote access is controlled through Cisco VPN and SecurID, which prevent users from gaining access to these resources. ACME utilizes RSA SecurID for multi-factor authentication for network access to privileged (including administrative access) accounts for production. Access is governed by internal policy.
ACME provides at no additional cost a plugin called the 'SNC Access Control Plugin'. Customers may use this plugin to restrict instance level access to named ACME support personal and can specify who from ACME can access the instance and when. This can also be configured to prevent any ACME support access to the instance unless this is explicitly updated to allow access.
**With regard to logs:
The ACME application writes detailed log information that is stored in tables within a customer's instance. As this is customer data in a customer's instance, ACME does not attempt to monitor or view this data unless specifically requested by a customer. As a result the customer is responsible for monitoring the contents of these logs files. The log data is protected in the same manner as all other customer data. Event logs can also be configured to feed into a customer's environment via ACME's Syslog probe allowing the logs to be stored within the customer's environment in a syslog repository or SIEM and retained according to the customer's requirements.
ACME's application logging includes verbose transaction logs, these logs are retained within the instance for 30 days. Event logs are stored for seven days and audit histories are retained indefinitely in the instance.
Transaction logs represent every click, view, and system event that occurs in an instance and as a result, will grow very large, quickly. They provide a level of detail that is frequently used for troubleshooting issues with an instance. They can also provide detailed intelligence on the behaviors within an instance. These logs can be downloaded to customers' environments, if they need to be retained for longer than 30 days.
The event logs on the other hand are less granular; they will include the creation of an incident, or deletion of problem, or any one of the 250 standard events. They may also contain customer created events. There are a number of security events as well, including successful login, failed login, security privilege escalation, and viewing of a table. These events can either be monitored manually, generate an Incident based on a parameter or when metric is reached; such as failed logins per minute.
The final aspect of logging is the audit history. Audit history may be turned on for any particular table or field. The audit log table then maintains a record of who made changes when to a table or field and what they changed.
Please refer to the following link for details on how to view and download various types of log files:
http://wiki.ACME.com/index.php?title=Viewing_System_Logs
**Regarding archives:
ACME does not archive or require customers to delete data. It is up to the customer to determine the data retention period for data stored within their instance.
ACME retains customer data at the completion of a contract for 45 days. A customer can request a complete copy of their data during this period and ACME will provide it. But this is completely separate from backups. After this period is over data is destroyed based on formal data destruction methodologies. | No | COBIT 4.1 DS5.3
COBIT 4.1 DS5.4 | 45 CFR 164.308 (a)(3)(ii)(B)
45 CFR 164.308 (a)(4)(ii)(C) | A.11.2.4 | NIST SP800-53 R3 AC-2
NIST SP800-53 R3 AU-6
NIST SP800-53 R3 PM-10
NIST SP800-53 R3 PS-6
NIST SP800-53 R3 PS-7 |
| 167 | Identity & Access Management
User Access Revocation | IAM-11 | IAM-11.1 | JE | Timely de-provisioning (revocation or modification) of user access to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components, shall be implemented as per established policies and procedures and based on user's change in status (e.g., termination of employment or other business relationship, job change or transfer). Upon request, provider shall inform customer (tenant) of these changes, especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control. | Is timely deprovisioning, revocation or modification of user access to the organizations systems, information assets and data implemented upon any change in status of employees, contractors, customers, business partners or involved third parties? | Logical access within a customer instance is controlled by the customer via the user account management, password management and role based access control and can be configured to meet customer policies.
ACME has formal HR and IT On-boarding and Off-boarding SOP's which governs granting, termination and transfer of access. These can be viewed on the ACME CORE:
HR On-boarding: https://community.ACME.com/community?id=community_article&sys_id=3e1d62e5dbd0dbc01dcaf3231f9619a1
HR Off-boarding: https://community.ACME.com/community?id=community_article&sys_id=4dcc2265dbd0dbc01dcaf3231f961909
IT On-boarding: https://community.ACME.com/community?id=community_article&sys_id=6efc66a5dbd0dbc01dcaf3231f961957
IT Off-boarding: https://community.ACME.com/community?id=community_article&sys_id=6c4c6e61dbd0dbc01dcaf3231f961948
All provisioning and de-provisioning of employees is initiated via HR. HR sends notification to IT Support who executes the On-boarding or Off-boarding process for users accounts and resources, contacting other departments as necessary.
When an employee is hired or terminated, the IT department or the system owner is notified by HR. user access to company servers, systems and accounts are enabled or disabled, this includes the user's access badge that controls access to the building and physical areas. | Yes | S3.2.0 | (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls). | H.2 | E.6.2, E.6.3 | Schedule 1 (Section 5), 4.7 - Safeguards | IS-09 | COBIT 4.1 DS 5.4 | APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03 | 312.8 and 312.10 | SRM > Privilege Management Infrastructure > Identity Management - Identity Provisioning | shared | x | Domain 2 | 6.03.04. (b)
6.03.04. (c)
6.03.05. (d)
6.03.06. (a)
6.04.02. (b) | Article 17 | NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5 | NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 SC-30 | 99.31(a)(1)(ii) | 8.2.1 | 45 CFR 164.308(a)(3)(ii)(C) | ISO/IEC 27001:2005
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.2 | Annex A
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.3 | ITAR 22 CFR § 120.17
EAR 15 CFR §736.2 (b) | Commandment #6
Commandment #7
Commandment #8 | CIP-004-3 R2.2.3
CIP-007-3 - R5.1.3 -R5.2.1 - R5.2.3 | AC-2
PS-4
PS-5 | "FTC Fair Information Principles
Integrity/Security
Security involves both managerial and technical measures to protect against loss and the unauthorized access, destruction, use, or disclosure of the data.(49) Managerial measures include internal organizational measures that limit access to data and ensure that those individuals with access do not utilize the data for unauthorized purposes. Technical security measures to prevent unauthorized access include encryption in the transmission and storage of data; limits on access through use of passwords; and the storage of data on secure servers or computers . - http://www.ftc.gov/reports/privacy3/fairinfo.shtm" | 9.2 | PCI DSS v2.0 8.5.4
PCI DSS v2.0 8.5.5 | 8.1.3
8.1.4
8.1.5, 12.5.4 |
| 168 | IS-09 | IAM-11.2 | JE | Is any change in user access status intended to include termination of employment, contract or agreement, change of employment or transfer within the organization? | See IAM-11.1 above. | Yes | COBIT 4.1 DS 5.4 | 45 CFR 164.308(a)(3)(ii)(C) | ISO/IEC 27001:2005
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.2 | NIST SP800-53 R3 AC-2
NIST SP800-53 R3 PS-4
NIST SP800-53 R3 PS-5 | PCI DSS v2.0 8.5.4
PCI DSS v2.0 8.5.5 |
| 169 | Identity & Access Management
User ID Credentials | IAM-12 | IAM-12.1 | JE | Internal corporate or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures:
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and Federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or re-use when feasible
• Adherence to industry acceptable and/or regulatory compliant authentication, authorization, and accounting (AAA) rules (e.g., strong/multi-factor, expireable, non-shared authentication secrets) | Do you support use of, or integration with, existing customer-based Single Sign On (SSO) solutions to your service? | Currently, ACME default deployment model supports only local login to the instance with single-factor authentication; however, customers can choose to customize their authentication mechanism after the initial deployment with SSO integration to support multi-factor authentication for details refer to: https://docs.ACME.com/bundle/geneva-ACME-platform/page/integrate/single_sign_on/concept/c_Authentication.html
If the customer is using ACME's local authentication, customization can be made to password strength validation rules, an example of this can be found in the ACME wiki here: https://docs.ACME.com/bundle/helsinki-ACME-platform/page/script/server-scripting/task/t_StrengthenPasswordValidationRules.html | Yes | S3.2.b | (S3.2.b) b. Identification and authentication of users. | CC5.3 | B.1
H.5 | E.6.2, E.6.3, H.1.1, H.1.2, H.2, H.3.2, H.4, H.4.1, H.4.5, H.4.8 | 6 (B) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-02 | COBIT 4.1 DS5.3
COBIT 4.1 DS5.4 | APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03 | 312.8 and 312.10 | SRM > Policies and Standards > Technical Security Standards | shared | x | Domain 10 | 6.03.04. (b)
6.03.04. (c)
6.03.05. (d)
6.04.05. (b) | Article 17 (1), (2) | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-6
NIST SP 800-53 R3 IA-8 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AC-11
NIST SP 800-53 R3 AC-11 (1)
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-2 (3)
NIST SP 800-53 R3 AU-2 (4)
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-2 (2)
NIST SP 800-53 R3 IA-2 (3)
NIST SP 800-53 R3 IA-2 (8)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-6
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 SC-10 | 99.3
99.31(a)(1)(ii) | 45 CFR 164.308(a)(5)(ii)(c) (New)
45 CFR 164.308 (a)(5)(ii)(D)
45 CFR 164.312 (a)(2)(i)
45 CFR 164.312 (a)(2)(iii)
45 CFR 164.312 (d) | A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.3
A.11.2.4
A.11.5.5 | A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.4
A.9.2.5
A.9.4.2 | Commandment #6
Commandment #7
Commandment #8
Commandment #9 | CIP-004-3 R2.2.3
CIP-007-3 - R5.2 - R5.3.1 - R5.3.2 - R5.3.3 | AC-1
AC-2
AC-3
AC-11
AU-2
AU-11
IA-1
IA-2
IA-5
IA-6
IA-8
SC-10 | "FTC Fair Information Principles
Integrity/Security
Security involves both managerial and technical measures to protect against loss and the unauthorized access, destruction, use, or disclosure of the data.(49) Managerial measures include internal organizational measures that limit access to data and ensure that those individuals with access do not utilize the data for unauthorized purposes. Technical security measures to prevent unauthorized access include encryption in the transmission and storage of data; limits on access through use of passwords; and the storage of data on secure servers or computers . - http://www.ftc.gov/reports/privacy3/fairinfo.shtm" | 15.1
15.2 | PA9
PA6
PA24
PA22 | BSGP
BSGP
P
GP | PCI DSS v2.0 8.1
PCI DSS v2.0 8.2,
PCI DSS v2.0 8.3
PCI DSS v2.0 8.4
PCI DSS v2.0 8.5
PCI DSS v2.0 10.1,
PCI DSS v2.0 12.2,
PCI DSS v2.0 12.3.8 | 8.0
10.1,
12.3 |
| 170 | SA-02 | IAM-12.2 | JE | Do you use open standards to delegate authentication capabilities to your tenants? | A ACME instance can support multiple methods for authenticating users, which is configured by the customer and at the customer's discretion which methods will be used.
The ACME instance can support authentication using SAML compliant single sign-on solutions.
Oauth is supported for email authentication only and not currently general authentication.
LDAP and secure LDAP are also available, along with built-in authentication and other authentication methods such as stateless OpenID and digest authentication.
Additional information can be viewed on the ACME Docs site here:
https://docs.ACME.com/bundle/geneva-ACME-platform/page/integrate/saml/concept/c_SAML2.0WebBrowserSSOProfile.html
https://docs.ACME.com/bundle/geneva-ACME-platform/page/administer/security/concept/c_OAuthApplications.html
https://docs.ACME.com/bundle/geneva-ACME-platform/page/integrate/ldap/concept/c_LDAPIntegration.html
| Yes |
| 171 | SA-02 | IAM-12.3 | JE | Do you support identity federation standards (SAML, SPML, WS-Federation, etc.) as a means of authenticating/authorizing users? | See IAM-12.2 | Partial |
| 172 | SA-02 | IAM-12.4 | JE | Do you have a Policy Enforcement Point capability (e.g., XACML) to enforce regional legal and policy constraints on user access? | No, ACME doesn't have a policy enforcement capability outside of that to its endpoint device (e.g. laptops and mobile phones). | No |
| 173 | SA-02 | IAM-12.5 | JE | Do you have an identity management system (enabling classification of data for a tenant) in place to enable both role-based and context-based entitlement to data?
(SA-02.5: Do you have an identity management system in place which enables both role-based and context-based entitlement to data (enables classification of data for a tenant)?) | See IAM-04.1. | Yes |
| 174 | SA-02 | IAM-12.6 | JE | Do you provide tenants with strong (multifactor) authentication options (digital certs, tokens, biometrics, etc.) for user access? | Currently, ACME default deployment model supports only local login to the instance with single-factor authentication; however, customers can choose to customize their authentication mechanism after the initial deployment with SSO integration to support multi-factor authentication for details refer to: https://docs.ACME.com/bundle/geneva-ACME-platform/page/integrate/single_sign_on/concept/c_Authentication.html
If the customer is using ACME's local authentication, customization can be made to password strength validation rules, an example of this can be found in the ACME wiki here: https://docs.ACME.com/bundle/helsinki-ACME-platform/page/script/server-scripting/task/t_StrengthenPasswordValidationRules.html | Yes |
| 175 | SA-02 | IAM-12.7 | JE | Do you allow tenants to use third-party identity assurance services?
| Customer can enable external authentication on their instance. Details can be viewed on the ACME Docs site here: https://docs.ACME.com/bundle/jakarta-platform-administration/page/integrate/single-sign-on/task/t_EnablingExternalAuthentication.html
| Yes |
| 176 | IAM-12.8 | JE | Do you support password (minimum length, age, history, complexity) and account lockout (lockout threshold, lockout duration) policy enforcement? | Customers are responsible for configuring their password requirements. Details can be viewed on the ACME Docs site: https://docs.ACME.com/bundle/jakarta-ACME-platform/page/administer/login/task/t_CreateAPasswordResetProcess.html | Yes |
| 177 | IAM-12.9 | JE | Do you allow tenants/customers to define password and account lockout policies for their accounts? | See IAM-12.8 | Yes |
| 178 | IAM-12.10 | JE | Do you support the ability to force password changes upon first logon? | Customers can manage how initial passwords are distributed to their users; this includes requiring the user to change the password during the first login. Details can be viewed here: https://docs.ACME.com/bundle/jakarta-ACME-platform/page/administer/login/task/t_CreateAPasswordResetProcess.html | Yes |
| 179 | IAM-12.11 | JE | Do you have mechanisms in place for unlocking accounts that have been locked out (e.g., self-service via email, defined challenge questions, manual unlock)? | See IAM-12.8 | Yes |
| 180 | Identity & Access Management
Utility Programs Access | IAM-13 | IAM-13.1 | JE | Utility programs capable of potentially overriding system, object, network, virtual machine, and application controls shall be restricted. | Are utilities that can significantly manage virtualized partitions (e.g., shutdown, clone, etc.) appropriately restricted and monitored?
| Virtual infrastructure is not used in the customer environment. | Not Applicable | S3.2.g | (S3.2.g) g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls). | CC5.1 | H.2.16 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-34 | COBIT 4.1 DS5.7 | APO13.01
APO13.02
DSS05.05 | 312.8 and 312.10 | SRM > Privilege Management Infrastructure > Privilege Usage Management - Resource Protection | shared | x | Domain 2 | NIST SP 800-53 R3 CM-7 | NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1) | A.11.4.1
A 11.4.4
A.11.5.4 | A.9.1.2 Deleted A.9.4.4 | Commandment #1
Commandment #5
Commandment #6
Commandment #7 | CIP-007-3 - R2.1 - R2.2 - R2.3 | AC-5
AC-6
CM-7
SC-3
SC-19 | 12.2
14.2 | PCI DSS v2.0 7.1.2 | 5.0
7.1
7.1.2
7.2 |
| 181 | IS-34 | IAM-13.2 | JE | Do you have a capability to detect attacks that target the virtual infrastructure directly (e.g., shimming, Blue Pill, Hyper jumping, etc.)? | See IAM-13.1 | Not Applicable | COBIT 4.1 DS5.7 | A.11.4.1
A 11.4.4
A.11.5.4 | NIST SP800-53 R3 AC-5
NIST SP800-53 R3 AC-6
NIST SP800-53 R3 CM-7
NIST SP800-53 R3 SC-3
NIST SP800-53 R3 SC-19 | PCI DSS v2.0 7.1.2 |
| 182 | IS-34 | IAM-13.3 | JE | Are attacks that target the virtual infrastructure prevented with technical controls? | See IAM-13.1 | Not Applicable | COBIT 4.1 DS5.7 | A.11.4.1
A 11.4.4
A.11.5.4 | NIST SP800-53 R3 AC-5
NIST SP800-53 R3 AC-6
NIST SP800-53 R3 CM-7
NIST SP800-53 R3 SC-3
NIST SP800-53 R3 SC-19 | PCI DSS v2.0 7.1.2 |
| 183 | Infrastructure & Virtualization Security
Audit Logging / Intrusion Detection | IVS-01 | IVS-01.1 | JE | Higher levels of assurance are required for protection, retention, and lifecyle management of audit logs, adhering to applicable legal, statutory or regulatory compliance obligations and providing unique user access accountability to detect potentially suspicious network behaviors and/or file integrity anomalies, and to support forensic investigative capabilities in the event of a security breach. | Are file integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation by root cause analysis and response to incidents? | ACME has a dedicated Security Operations team. ACME utilizes Splunk to centralize audit logs and to support the audit review process. As part of the purpose and design for this system, audit reviews occur daily for events that are considered lower risk. High-risk issues, such as intrusion detection events trigger real-time alerts that are emailed to the Security Incident Response Team. ACME has established a Scheduled Security Operations Checklist that includes procedures for performing daily reviews of Linux, Windows, Network Device, file integrity monitoring, privilege account usage, IDS, and identified issue logs.
ACME does not deploy HIDS, but does have dedicated IDS on the network.
ACME leverages an enterprise grade IDS to monitor the datacenter environment at real-time. Sensors in our data centers detect malicious traffic (Denial of Service, vulnerability exploits, internet worms). The IDS solution is centrally managed to ensure consistent policies and signature updates.
The Security Operations Checklist can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=ca0deaa5dbd0dbc01dcaf3231f961949 | Yes | S3.7 | (S3.7) Procedures exist to identify, report, and act upon system security breaches and other incidents. | CC6.2 | G.7
G.8
G.9
J.1
L.2 | G.14.7, G.14.8, G.14.9, G.14.10,G.14.11, G.14.12, G.15.5, G.15.7, G.15.8, G.16.8, G.16.9, G.16.10, G.15.9, G.17.5, G.17.7, G.17.8, G.17.6, G.17.9, G.18.2, G.18.3, G.18.5, G.18.6, G.19.2.6, G.19.3.1, G.9.6.2, G.9.6.3, G.9.6.4, G.9.19, H.2.16, H.3.3, J.1, J.2, L.5, L.9, L.10 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-14 | COBIT 4.1 DS5.5
COBIT 4.1 DS5.6
COBIT 4.1 DS9.2 | APO13.01
APO13.02
BAI10.01
BAI10.02
BAI10.03
DSS01.03
DSS02.01
DSS05.07
DSS06.05 | 312.3, 312.8 and 312.10 | BOSS > Security Monitoring Services > SIEM | shared | x | Domain 10 | 6.03. (i)
6.03. (j)
6.03.03. (a)
6.03.03. (d)
6.03.04. (e)
6.04.07. (a)
6.07.01. (a)
6.07.01. (c) | Article 17 | NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-3
NIST SP 800-53 R3 AU-4
NIST SP 800-53 R3 AU-5
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 AU-12
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3 | NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8
NIST SP 800-53 R3 AU-8 (1) | 8.2.1
8.2.2 | 45 CFR 164.308 (a)(1)(ii)(D)
45 CFR 164.312 (b)
45 CFR 164.308(a)(5)(ii)(c) (New) | A.10.10.1
A.10.10.2
A.10.10.3
A.10.10.4
A.10.10.5
A.11.2.2
A.11.5.4
A.11.6.1
A.13.1.1
A.13.2.3
A.15.2.2
A.15.1.3 | A.12.4.1
A.12.4.1
A.12.4.2, A.12.4.3
A.12.4.3
A.12.4.1
A.9.2.3
A.9.4.4
A.9.4.1
A.16.1.2
A.16.1.7
A.18.2.3
A.18.1.3 | Commandment #6
Commandment #7
Commandment #11 | CIP-007-3 - R6.5 | AU-1
AU-2
AU-3
AU-4
AU-5
AU-6
AU-7
AU-9
AU-11
AU-12
AU-14
SI-4 | 17.6 | PA11
PA12
PA13
PA24 | BSGP
SGP
SGP
P | PCI DSS v2.0 10.1 PCI DSS v2.0 10.2
PCI DSS v2.010.3
PCI DSS v2.0 10.5
PCI DSS v2.010.6
PCI DSS v2.0 10.7
PCI DSS v2.0 11.4
PCI DSS v2.0 12.5.2 PCI DSS v2.0 12.9.5 | 10.1
10.2
10.3
10.4
10.5
10.6
10.7, 10.8
11.4, 11.5, 11.6
12.5.2 |
| 184 | SA-14 | IVS-01.2 | JE | Is physical and logical user access to audit logs restricted to authorized personnel? | There are only a very limited number of personnel have access to the logs. ACME uses role-based entitlements and grants entitlements only to roles with explicit need for the level of access. ACME performs account and privilege access Entitlement review on a quarterly basis. The Entitlement SOP can be viewed on the ACME CORE here:
The Log Management SOP can also be viewed on the ACME CORE here:
| Yes |
| 185 | SA-14 | IVS-01.3 | JE | Can you provide evidence that due diligence mapping of regulations and standards to your controls/architecture/processes has been done? | ACME has a dedicated team to manage and drive compliance efforts, including commercial and Federal certifications, regulatory compliance, and legal compliance. Governance, Risk and Compliance (GRC)define policies, and requirements for standards, processes, procedures, baselines, guidelines and risk assessments, monitor compliance with Information Security policies through internal and external audit, ensure compliance with government, regulatory and contractual information system security related requirements, coordinate customer audits, audit response, and audit mitigation, perform internal and external audits and report results to Security Management Council, perform risk assessments in support of identifying and managing risks related to the operation of the ISMS.
ACME's information security program is based on NIST 800-53 and ISO 27001. ACME has chosen the ISO 27001 certification to provide internal and external stakeholders with a high level of assurance that our information security policy and processes are robust and a strong control environment exists around our software-as-a-service (SaaS) instance. Therefore, ACME does not attest compliance with any customer policies, standards, and/or controls.
ACME is reviewed on an annual basis by independent third party auditors to maintain ISO 27001 certification, ISO 27018 certification, FedRAMP authorization, and MTCS certification and to obtain SSAE16 SOC 1 Type II and SOC 2 Type II reports. Additionally, ACME undergoes multiple internal audits and customer audits each year.
ACME's third party attestations are available on the ACME CORE: https://community.ACME.com/community?id=community_topic&sys_id=6c499e2ddbd897c068c1fb651f961924
Note: ACME does not share its ISO 27001 Statement of Applicability (SOA) externally. The SOA details how controls are achieved and which controls are not applicable; therefore, the document could highlight to unauthorized users the areas where ACME is vulnerable.
ACME's support methodology is aligned with the Information Technology Infrastructure Library (ITIL) framework. The ACME product is verified by Pink Elephant's PinkVerify2011 for 11 ITIL Processes: https://www.pinkelephant.com/en-US/PinkVERIFY/PinkVERIFYToolsets.
As publicly traded company, ACME is required to comply with U.S. Securities and Exchange Commission (SEC) public reporting requirements and the Sarbanes-Oxley Act of 2002 (SOX). ACME's SEC filings are available on our public website:
A SOC 3 reports on the same information as a SOC 2 report. The main difference between the reports is that a SOC 3 is intended for a general audience; therefore, these reports are shorter and do not include the same details as a SOC 2 report. Due to their more general nature, SOC 3 reports can be shared openly and posted on a company's website with a seal indicating their compliance. ACME constantly evaluates its certification posture for relevant expansion. At this point, ACME does not plan to obtain the SOC 3 certification.
ACME provides a software-as-a-service (SaaS) solution to our enterprise customers whose regulatory requirements scope, in many cases, extends to include ACME's application and business processes. Customers are responsible for determining the regulatory requirements for the data in their instances and are able to customize the solution to meet their internal and regulatory requirements. | Yes |
| 186 | IVS-01.4 | JE | Are audit logs centrally stored and retained? | ACME utilizes Splunk to centralize audit logs and to support the audit review process. As part of the purpose and design for this system, audit reviews occur daily for events that are considered lower risk. High risk issues, such as intrusion detection events trigger real-time alerts which are emailed to the Security Incident Response Team. ACME has established a Scheduled Security Operations Checklist which includes procedures for performing daily reviews of Linux, Windows, Network Device, IDS, and identified issue logs.
The Log Management SOP can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=e9ec2e65dbd0dbc01dcaf3231f9619ca | Yes |
| 187 | IVS-01.5 | JE | Are audit logs reviewed on a regular basis for security events (e.g., with automated tools)? | See IVS-01.1. | Yes |
| 188 | Infrastructure & Virtualization Security
Change Detection | IVS-02 | IVS-02.1 | JE | The provider shall ensure the integrity of all virtual machine images at all times. Any changes made to virtual machine images must be logged and an alert raised regardless of their running state (e.g. dormant, off, or running). The results of a change or move of an image and the subsequent validation of the image's integrity must be immediately available to customers through electronic methods (e.g. portals or alerts). | Do you log and alert any changes made to virtual machine images regardless of their running state (e.g. dormant, off or running)? | This is not applicable as ACME does not use virtual machines in its customer environment. | Not Applicable | APO08.04
APO13.01
BAI06.01
BAI06.02
BAI10.03
BAI10.04 | SRM > Privilege Management Infrastructure > Privileged Usage Management -> Hypervisor Governance and Compliance | Annex
A.12.1.2
A.12.4,
A.12.4.1,
A.12.4.2,
A.12.4.3,
A.12.6.1,
A.12.6.2,
A.16.1.1,
A.16.1.2,
A.16.1.3,
A.16.1.4,
A.16.1.5,
A.16.1.6,
A.16.1.7 | PA35 | GP | 10.5.5, 12.10.5 |
| 189 | IVS-02.2 | JE | Are changes made to virtual machines, or moving of an image and subsequent validation of the image's integrity, made immediately available to customers through electronic methods (e.g. portals or alerts)? | This is not applicable as ACME does not use virtual machines in its customer environment. | Not Applicable |
| 190 | Infrastructure & Virtualization Security
Clock Synchronization | IVS-03 | IVS-03.1 | JE | A reliable and mutually agreed upon external time source shall be used to synchronize the system clocks of all relevant information processing systems to facilitate tracing and reconstitution of activity timelines. | Do you use a synchronized time-service protocol (e.g., NTP) to ensure all systems have a common time reference? | ACME leverages NTP through DHCP for time synchronization. NTP is monitored and enforced through Puppet, which ACME uses as its standard configuration tool. If the server doesn't have a standard configuration, the tool overwrites the system with the standard configuration. | Yes | S3.7 | (S3.7) Procedures exist to identify, report, and act upon system security breaches and other incidents. | CC6.2 | G.7
G.8 | G.13, G.14.8, G.15.5, G.16.8, G.17.6, G.18.3, G.19.2.6, G.19.3.1 | 20 (B)
28 (B)
30 (B)
35 (B) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-12 | COBIT 4.1 DS5.7 | APO01.08
APO13.01
APO13.02
BAI03.05
DSS01.01 | 312.8 and 312.10 | Infra Services > Network Services > Authoritative Time Source | provider | x | Domain 10 | 6.03. (k) | NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8 | NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8
NIST SP 800-53 R3 AU-8 (1) | A.10.10.1
A.10.10.6 | A.12.4.1
A.12.4.4 | AU-1
AU-8 | PCI DSS v2.0 10.4 | 10.4 |
| 191 | Infrastructure & Virtualization Security
Capacity / Resource Planning | IVS-04 | IVS-04.1 | JE | The availability, quality, and adequate capacity and resources shall be planned, prepared, and measured to deliver the required system performance in accordance with legal, statutory, and regulatory compliance obligations. Projections of future capacity requirements shall be made to mitigate the risk of system overload. | Do you provide documentation regarding what levels of system (network, storage, memory, I/O, etc.) oversubscription you maintain and under what circumstances/scenarios? | ACME uses third party and home- grown tools to monitor and alert on performance and availability events.
ACME provides extensive system metrics from within their ACME instance such as memory utilization, CPU load, and transaction throughput. These are available from the System Diagnostics and System Performance dashboards. | Yes | A3.2.0
A4.1.0 | (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.
(A4.1.0) The entity’s system availability and security performance is periodically reviewed and compared with the defined system availability and related security policies. | A1.1
A1.2
CC4.1 | G.5 | OP-03 | COBIT 4.1 DS 3 | APO01.03
APO01.08
BAI04.01
BAI04.04
BAI04.05
BAI10.01
BAI10.02 | 312.8 and 312.10 | ITOS > Service Delivery > Information Technology Resiliency - Capacity Planning | provider | x | Domain 7, 8 | 6.03.07. (a)
6.03.07. (b)
6.03.07. (c)
6.03.07. (d) | Article 17 (1) | NIST SP 800-53 R3 SA-4 | NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7) | 1.2.4 | A.10.3.1 | A.12.1.3 | Commandment #1
Commandment #2
Commandment #3 | SA-4 | 3.3 | PA16 | SGP |
| 192 | OP-03 | IVS-04.2 | JE | Do you restrict use of the memory oversubscription capabilities present in the hypervisor? | This is not applicable has ACME does not use virtual infrastructure in its customer environment. | Not Applicable |
| 193 | IVS-04.3 | JE | Do your system capacity requirements take into account current, projected and anticipated capacity needs for all systems used to provide services to the tenants? | See IVS-04.1. | Yes |
| 194 | IVS-04.4 | JE | Is system performance monitored and tuned in order to continuously meet regulatory, contractual and business requirements for all the systems used to provide services to the tenants? | See IVS-04.1. | Yes |
| 195 | Infrastructure & Virtualization Security
Management - Vulnerability Management | IVS-05 | IVS-05.1 | JE | Implementers shall ensure that the security vulnerability assessment tools or services accommodate the virtualization technologies used (e.g. virtualization aware). | Do security vulnerability assessment tools or services accommodate the virtualization technologies being used (e.g. virtualization aware)? | This is not applicable as ACME does not use virtualization in its customer environment. | Not Applicable | APO01.08
APO04.02
APO04.03
APO04.04
DSS05.03
DSS06.06 | SRM > Threat and Vulnerability Management > Vulnerability Management | provider | x | Domain 1, 13 | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f) | PA36 | 6.1 |
| 196 | Infrastructure & Virtualization Security
Network Security | IVS-06 | IVS-06.1 | JE | Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections, these configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, and ports, and compensating controls. | For your IaaS offering, do you provide customers with guidance on how to create a layered security architecture equivalence using your virtualized solution? | This is not applicable as ACME does not use virtualization in its customer environment. | Not Applicable | S3.4 | (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.6 | G.2
G.4
G.15
G.16
G.17
G.18
I.3 | G.9.17, G.9.7, G.10, G.9.11, G.14.1, G.15.1, G.9.2, G.9.3, G.9.13 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-08 | APO03.01
APO03.02
APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
DSS05.02
DSS06.06 | 312.8 and 312.10 | SRM > Infrastructure Protection Services > Network | provider | x | Domain 10 | 6.03.03. (a)
6.03.03. (d)
6.03.04. (d)
6.04.07. (a)
6.07.01. (c) | Article 17 | NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-20 (1) | NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-20 (1)
NIST SP 800-53 R3 SC-21
NIST SP 800-53 R3 SC-22
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SC-32 | 8.2.5 | A.10.6.1
A.10.6.2
A.10.9.1
A.10.10.2
A.11.4.1
A.11.4.5
A.11.4.6
A.11.4.7
A.15.1.4 | A.13.1.1
A.13.1.2
A.14.1.2
A.12.4.1
A.9.1.2
A.13.1.3
A.18.1.4 | Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment #10
Commandment #11 | CIP-004-3 R2.2.4 | SC-7 | 17.1
17.2 | PA3
PA5
PA16
PA19
PA18 | BSGP
BSGP
SGP
GP
SGP | PCI DSS v2.0 1.1
PCI DSS v2.0 1.1.2
PCI DSS v2.0 1.1.3
PCI DSS v2.0 1.1.5
PCI DSS v2.0 1.1.6
PCI DSS v2.0 1.2
PCI DSS v2.0 1.2.1
PCI DSS v2.0 2.2.2, PCI DSS v2.0 2.2.3 | 1.1
1.1.2
1.1.3
1.1.5
1.1.6
1.2
1.2.1
1.2.2
1.2.3
1.3
2.2.2
2.2.3
2.2.4
2.5
4.1 |
| 197 | IVS-06.2 | JE | Do you regularly update network architecture diagrams that include data flows between security domains/zones? | The ACME architecture is designed with a boundary between the externally facing customer infrastructure and the internal infrastructure. The external components of the Production network consist of redundant border routers at network entry points, firewalls, load balancers, and intrusion detection devices. ACME's inbound circuits are restricted using an edge router configuration which restricts access to the inner network. ACLs are applied to each managed interface. Inbound network connections come into ACME's environment via the redundant external network facing firewall which is configured to deny all - allow by exception
ACME's architecture diagram can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=938c6ae1dbd0dbc01dcaf3231f961937 | Yes |
| 198 | IVS-06.3 | JE | Do you regularly review for appropriateness the allowed access/connectivity (e.g., firewall rules) between security domains/zones within the network? | Firewall rules are reviewed by Security when changes are made to them. | Yes |
| 199 | IVS-06.4 | JE | Are all firewall access control lists documented with business justification? | Yes, firewall access is provisioned through LDAP groups and access provisioning is documented in ACME's internal ACME instance. | Yes |
| 200 | Infrastructure & Virtualization Security
OS Hardening and Base Conrols | IVS-07 | IVS-07.1 | JE | Each operating system shall be hardened to provide only necessary ports, protocols, and services to meet business needs and have in place supporting technical controls such as: antivirus, file integrity monitoring, and logging as part of their baseline operating build standard or template. | Are operating systems hardened to provide only the necessary ports, protocols and services to meet business needs using technical controls (i.e. antivirus, file integrity monitoring and logging) as part of their baseline build standard or template? | The ACME server hardening checklist describes the approved ACME server configuration. The configuration is based on industry standards, including, but not limited to select content from the following sources for consistency and audit/scoring purposes:
• The US National Security Agency (NSA) Guide to Secure Configuration of RHEL Linux 5:
• The US Government Configuration Baseline (USGCB) [NIST/DoD/RHEL]:
• CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v1.3.0
• The Center for Internet Security (CIS) MySQL Benchmark
Please refer to the System Configuration Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=483c2661dbd0dbc01dcaf3231f9619dd | Yes | APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
DSS05.01
DSS05.03
DSS06.06 | SRM > Policies and Standards > Operational Security Baselines | shared | x | Annex
A.12.1.4
A.12.2.1
A.12.4.1
A.12.6.1 | 2.1
2.2
2.5
5.1 |
| 201 | Infrastructure & Virtualization Security
Production / Nonproduction Environments | IVS-08 | IVS-08.1 | JE | Production and non-production environments shall be separated to prevent unauthorized access or changes to information assets. Separation of the environments may include: tasteful inspection firewalls, domain/realm authentication sources, and clear segregation of duties for personnel accessing these environments as part of their job duties. | For your SaaS or PaaS offering, do you provide tenants with separate environments for production and test processes? | ACME is a logically single-tenant environment. Customers share a hardware platform (no hypervisor virtualization), but access entirely separate individual instances of the ACME platform. Each individual instance connects to a database and database service only accessible by that specific instance. Customers are provided with at least one production and one UAT environment though more are supplied for larger contracts or can be separately acquired. | Yes | S3.4 | (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.6 | B.1 | I.2.7.1, I.2.20, I.2.17, I.2.22.2, I.2.22.4, I.2.22.10-14, H.1.1 | 22 (B) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-06 | COBIT 4.1 DS5.7 | APO03.01
APO03.02
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
| 312.8 and 312.10 | Information Services > Data Governance > Data Segregation | shared | x | Domain 10 | 6.03. (d) | NIST SP 800-53 R3 SC-2 | 1.2.6 | A.10.1.4
A.10.3.2
A.11.1.1
A.12.5.1
A.12.5.2
A.12.5.3 | A.12.1.4
A.14.2.9
A.9.1.1
8.1,partial, A.14.2.2
8.1,partial, A.14.2.3
8.1,partial, A.14.2.4 | Commandment #1
Commandment #10
Commandment #11 | SC-2 | 14.5 | PA3 | BSGP | PCI DSS v2.0 6.4.1
PCI DSS v2.0 6.4.2 | 6.4.1
6.4.2 |
| 202 | SA-06 | IVS-08.2 | JE | For your IaaS offering, do you provide tenants with guidance on how to create suitable production and test environments? | ACME's does not provide an IaaS service to its customers.. | Not Applicable |
| 203 | IVS-08.3 | JE | Do you logically and physically segregate production and non-production environments? | Production and non-production instances have separate databases instances and thus are logically segregated, but may be hosted on the same physical server. ACME offers its customers the option to purchase dedicated hardware for their instances if physical segregation is required. | Yes |
| 204 | Infrastructure & Virtualization Security
Segmentation | IVS-09 | IVS-09.1 | JE | Multi-tenant organizationally-owned or managed (physical and virtual) applications, and infrastructure system and network components, shall be designed, developed, deployed and configured such that provider and customer (tenant) user access is appropriately segmented from other tenant users, based on the following considerations:
• Established policies and procedures
• Isolation of business critical assets and/or sensitive user data and sessions that mandate stronger internal controls and high levels of assurance
• Compliance with legal, statutory and regulatory compliance obligations | Are system and network environments protected by a firewall or virtual firewall to ensure business and customer security requirements? | See IVS-06.2. | Yes | S3.4 | (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.6 | G.17 | G.9.2, G.9.3, G.9.13 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-09 | COBIT 4.1 DS5.10 | APO03.01
APO03.02
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
| 312.8 and 312.10 | SRM > Infrastructure Protection Services > Network - Firewall | provider | x | Domain 10 | 6.03.03. (b)
6.03.05. (a)
6.03.05. (b)
6.04.01. (a)
6.04.01. (g)
6.04.03. (c)
6.04.08.02. (a)
6.04.08.02. (b)
6.05. (c) | Article 17 | NIST SP 800-53 R3 SC-7 | NIST SP 800-53 R3 AC-4
NIST SP 800-53 R3 SC-2
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18) | 45 CFR 164.308 (a)(4)(ii)(A) | A.11.4.5
A.11.6.1
A.11.6.2
A.15.1.4 | A.13.1.3
A.9.4.1
A.18.1.4 | Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment #10
Commandment #11 | CIP-004-3 R3 | AC-4
SC-2
SC-3
SC-7 | 17.6
18.1
18.4 | PA3
PA5
PA16
PA20 | BSGP
BSGP
SGP
GP | PCI DSS v2.0 1.1
PCI DSS v2.0 1.2
PCI DSS v2.0 1.2.1
PCI DSS v2.0 1.3
PCI DSS v2.0 1.4 | 1.1
1.2
1.2.1
1.2.3
1.3
1.4
2.1.1
2.2.3
2.2.4
2.3 |
| 205 | SA-09 | IVS-09.2 | JE | Are system and network environments protected by a firewall or virtual firewall to ensure compliance with legislative, regulatory and contractual requirements? | See IVS-06.2. | Yes | COBIT 4.1 DS5.10 | 45 CFR 164.308 (a)(4)(ii)(A) | A.11.4.5
A.11.6.1
A.11.6.2
A.15.1.4 | NIST SP800-53 R3 AC-4
NIST SP800-53 R3 SC-2
NIST SP800-53 R3 SC-3
NIST SP800-53 R3 SC-7 | PCI DSS v2.0 1.1
PCI DSS v2.0 1.2
PCI DSS v2.0 1.2.1
PCI DSS v2.0 1.3
PCI DSS v2.0 1.4 |
| 206 | SA-09 | IVS-09.3 | JE | Are system and network environments protected by a firewall or virtual firewall to ensure separation of production and non-production environments? | See IVS-06.2. | Yes | COBIT 4.1 DS5.10 | 45 CFR 164.308 (a)(4)(ii)(A) | A.11.4.5
A.11.6.1
A.11.6.2
A.15.1.4 | NIST SP800-53 R3 AC-4
NIST SP800-53 R3 SC-2
NIST SP800-53 R3 SC-3
NIST SP800-53 R3 SC-7 | PCI DSS v2.0 1.1
PCI DSS v2.0 1.2
PCI DSS v2.0 1.2.1
PCI DSS v2.0 1.3
PCI DSS v2.0 1.4 |
| 207 | SA-09 | IVS-09.4 | JE | Are system and network environments protected by a firewall or virtual firewall to ensure protection and isolation of sensitive data? | See IVS-06.2. | Yes | COBIT 4.1 DS5.10 | 45 CFR 164.308 (a)(4)(ii)(A) | A.11.4.5
A.11.6.1
A.11.6.2
A.15.1.4 | NIST SP800-53 R3 AC-4
NIST SP800-53 R3 SC-2
NIST SP800-53 R3 SC-3
NIST SP800-53 R3 SC-7 | PCI DSS v2.0 1.1
PCI DSS v2.0 1.2
PCI DSS v2.0 1.2.1
PCI DSS v2.0 1.3
PCI DSS v2.0 1.4 |
| 208 | Infrastructure & Virtualization Security
VM Security - vMotion Data Protection | IVS-10 | IVS-10.1 | JE | Secured and encrypted communication channels shall be used when migrating physical servers, applications, or data to virtualized servers and, where possible, shall use a network segregated from production-level networks for such migrations. | Are secured and encrypted communication channels used when migrating physical servers, applications or data to virtual servers? | ACME does not use hypervisors or virtual servers in the customer environment. | Not Applicable | APO03.01
APO03.02
APO03.04
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
| SRM > Cryptographic Services > Data-in-transit Encryption | provider | X | Domain 1, 13 | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 | 4.1 |
| 209 | IVS-10.2 | JE | Do you use a network segregated from production-level networks when migrating physical servers, applications or data to virtual servers? | See IVS-10.1 | Not Applicable |
| 210 | Infrastructure & Virtualization Security
VMM Security - Hypervisor Hardening | IVS-11 | IVS-11.1 | JE | Access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems shall be restricted to personnel based upon the principle of least privilege and supported through technical controls (e.g., two-factor authentication, audit trails, IP address filtering, firewalls, and TLS encapsulated communications to the administrative consoles). | Do you restrict personnel access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems based on the principle of least privilege and supported through technical controls (e.g. two-factor authentication, audit trails, IP address filtering, firewalls and TLS-encapsulated communications to the administrative consoles)? | See IVS-10.1 | Not Applicable | APO13.01
APO13.02
DSS05.02
DSS05.04
DSS06.03
DSS06.06 | SRM > Privilege Management Infrastructure > Privilege Use Management - Hypervisor Governance and Compliance | provider | X | Domain 1, 13 | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 | 3.5.1, 3.6.6 |
| 211 | Infrastructure & Virtualization Security
Wireless Security | IVS-12 | IVS-12.1 | JE | Policies and procedures shall be established, and supporting business processes and technical measures implemented, to protect wireless network environments, including the following:
• Perimeter firewalls implemented and configured to restrict unauthorized traffic
• Security settings enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, and SNMP community strings)
• User access to wireless network devices restricted to authorized personnel
• The capability to detect the presence of unauthorized (rogue) wireless network devices for a timely disconnect from the network | Are policies and procedures established and mechanisms configured and implemented to protect the wireless network environment perimeter and to restrict unauthorized wireless traffic? | ACME does not provide or allow direct wireless access (or from the corporate network) into the production network. ACME requires all remote access to production to connect through Cisco Client-to-site VPN with RSA two-factor authentication, to ensure customer data is encrypted in transit and is only accessible to authorized personnel with appropriate credentials. However, ACME does use wireless technology for its corporate offices, which use WPA2 encryption.
The Cryptography SOP can be viewed on the ACME CORE here: | Yes | S3.4 | (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.6 | D.1
B.3
F.1
G.4
G.15
G.17
G.18 | E.3.1, F.1.2.4, F.1.2.5, F.1.2.6, F.1.2.8, F.1.2. 9, F.1.2.10, F.1.2.11, F.1.2.12, F.1.2.13, F.1.2.14, F.1.2.15, F.1.2.24, F.1.3, F.1.4.2, F1.4.6, F.1.4.7, F.1.6, F.1.7,F.1.8, F.2.13, F.2.14, F.2.15, F.2.16, F.2.17, F.2.18 G.9.17, G.9.7, G.10, G.9.11, G.14.1, G.15.1, G.9.2, G.9.3, G.9.13 | 40 (B)
44 (C+) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-10 | COBIT 4.1 DS5.5
COBIT 4.1 DS5.7
COBIT 4.1 DS5.8
COBIT 4.1 DS5.10 | APO01.08
APO13.01
APO13.02
DSS02.02
DSS05.02
DSS05.03
DSS05.04
DSS05.05
DSS05.07
DSS06.03
DSS06.06 | 312.8 and 312.10 | SRM > Infrastructure Protection Services > Network - Wireless Protection | provider | X | Domain 10 | Article 17 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 SC-7 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 PE-4
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18) | 8.2.5 | 45 CFR 164.312 (e)(1)(2)(ii)
45 CFR 164.308(a)(5)(ii)(D) (New)
45 CFR 164.312(e)(1) (New)
45 CFR 164.312(e)(2)(ii) (New) | A.7.1.1
A.7.1.2
A.7.1.3
A.9.2.1
A.9.2.4
A.10.6.1
A.10.6.2
A.10.8.1
A.10.8.3
A.10.8.5
A.10.10.2
A.11.2.1
A.11.4.3
A.11.4.5
A.11.4.6
A.11.4.7
A.12.3.1
A.12.3.2 | A.8.1.1
A.8.1.2
A.8.1.3
A.11.2.1
A.11.2.4
A.13.1.1
A.13.1.2
A.13.2.1
A.8.3.3
A.12.4.1
A.9.2.1, A.9.2.2
A.13.1.3
A.10.1.1
A.10.1.2 | Commandment #1
Commandment #2
Commandment #3
Commandment #4
Commandment #5
Commandment #9
Commandment #10
Commandment #11 | CIP-004-3 R3
CIP-007-3 - R6.1 | AC-1
AC-18
CM-6
PE-4
SC-3
SC-7 | 11.1
17.3 | PA3
PA6
PA16
PA20
PA25
PA32
PA33 | BSGP
BSGP
SGP
GP
P
BSGP
SGP | PCI DSS v2.0 1.2.3
PCI DSS v2.0 2.1.1
PCI DSS v2.0 4.1
PCI DSS v2.0 4.1.1
PCI DSS v2.011.1
PCI DSS v2.0 9.1.3 | 1.2.3
2.1.1
4.1
4.1.1
11.1, 11.1.a, 11.1.b, 11.1.c, 11.1.d, 11.1.1, 11.1.2
9.1.3 |
| 212 | SA-10 | IVS-12.2 | JE | Are policies and procedures established and mechanisms implemented to ensure wireless security settings are enabled with strong encryption for authentication and transmission, replacing vendor default settings? (e.g., encryption keys, passwords, SNMP community strings) | See IVS-12.1. | Yes | COBIT 4.1 DS5.5
COBIT 4.1 DS5.7
COBIT 4.1 DS5.8
COBIT 4.1 DS5.10 | 45 CFR 164.312 (e)(1)(2)(ii)
45 CFR 164.308(a)(5)(ii)(D) (New)
45 CFR 164.312(e)(1) (New)
45 CFR 164.312(e)(2)(ii) (New) | A.7.1.1
A.7.1.2
A.7.1.3
A.9.2.1
A.9.2.4
A.10.6.1
A.10.6.2
A.10.8.1
A.10.8.3
A.10.8.5
A.10.10.2
A.11.2.1
A.11.4.3
A.11.4.5
A.11.4.6
A.11.4.7
A.12.3.1
A.12.3.2 | NIST SP800-53 R3 AC-1
NIST SP800-53 R3 AC-18
NIST SP800-53 R3 CM-6
NIST SP800-53 R3 PE-4
NIST SP800-53 R3 SC-3
NIST SP800-53 R3 SC-7 | PCI DSS v2.0 1.2.3
PCI DSS v2.0 2.1.1
PCI DSS v2.0 4.1
PCI DSS v2.0 4.1.1
PCI DSS v2.011.1
PCI DSS v2.0 9.1.3 |
| 213 | SA-10 | IVS-12.3 | JE | Are policies and procedures established and mechanisms implemented to protect wireless network environments and detect the presence of unauthorized (rogue) network devices for a timely disconnect from the network? | ACME does not provide or allow direct wireless access (or from the corporate network) into the production network. | Yes | COBIT 4.1 DS5.5
COBIT 4.1 DS5.7
COBIT 4.1 DS5.8
COBIT 4.1 DS5.10 | 45 CFR 164.312 (e)(1)(2)(ii)
45 CFR 164.308(a)(5)(ii)(D) (New)
45 CFR 164.312(e)(1) (New)
45 CFR 164.312(e)(2)(ii) (New) | A.7.1.1
A.7.1.2
A.7.1.3
A.9.2.1
A.9.2.4
A.10.6.1
A.10.6.2
A.10.8.1
A.10.8.3
A.10.8.5
A.10.10.2
A.11.2.1
A.11.4.3
A.11.4.5
A.11.4.6
A.11.4.7
A.12.3.1
A.12.3.2 | NIST SP800-53 R3 AC-1
NIST SP800-53 R3 AC-18
NIST SP800-53 R3 CM-6
NIST SP800-53 R3 PE-4
NIST SP800-53 R3 SC-3
NIST SP800-53 R3 SC-7 | PCI DSS v2.0 1.2.3
PCI DSS v2.0 2.1.1
PCI DSS v2.0 4.1
PCI DSS v2.0 4.1.1
PCI DSS v2.011.1
PCI DSS v2.0 9.1.3 |
| 214 | Infrastructure & Virtualization Security
Network Architecture | IVS-13 | IVS-13.1 | JE | Network architecture diagrams shall clearly identify high-risk environments and data flows that may have legal compliance impacts. Technical measures shall be implemented and shall apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling, and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denial-of-service (DDoS) attacks. | Do your network architecture diagrams clearly identify high-risk environments and data flows that may have legal compliance impacts? | ACME considers it entire data center network as a high risk environment and fully understands the data flows.
ACME's architecture diagram can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=938c6ae1dbd0dbc01dcaf3231f961937 | Yes | S3.4 | (S3.4) Procedures exist to protect against unauthorized access to system resources. | CC5.6 | G.2
G.4
G.15
G.16
G.17
G.18
I.3 | G.9.17, G.9.7, G.10, G.9.11, G.14.1, G.15.1, G.9.2, G.9.3, G.9.13 | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | SA-08 | APO03.01
APO03.02
APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
DSS05.02
DSS06.06 | 312.8 and 312.10 | SRM > Infrastructure Protection Services > Network | provider | x | Domain 10 | 6.03.03. (a)
6.03.03. (d)
6.03.04. (d)
6.04.07. (a)
6.07.01. © | Article 17 | NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-20 (1) | NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-20 (1)
NIST SP 800-53 R3 SC-21
NIST SP 800-53 R3 SC-22
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SC-32 | 8.2.5 | A.10.6.1
A.10.6.2
A.10.9.1
A.10.10.2
A.11.4.1
A.11.4.5
A.11.4.6
A.11.4.7
A.15.1.4 | A.13.1.1
A.13.1.2
A.14.1.2
A.12.4.1
A.9.1.2
A.13.1.3
A.18.1.4 | Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment #10
Commandment #11 | CIP-004-3 R2.2.4 | 17.1
17.2 | PA3
PA5
PA16
PA19
PA18 | BSGP
BSGP
SGP
GP
SGP | 1.1
1.1.2
1.1.3
1.1.5
1.1.6
1.2
1.2.1
2.2.2
2.2.3 | 1.1
1.1.2
1.1.3
1.1.5
1.1.6
1.2
1.2.1
1.2.2
1.2.3
1.3
2.2.2
2.2.3
2.2.4
2.5
4.1 |
| 215 | IVS-13.2 | JE | Do you implement technical measures and apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denial-of-service (DDoS) attacks? | See IVS-01.1. | Yes |
| 216 | Interoperability & Portability
APIs | IPY-01 | IPY-01 | JE | The provider shall use open and published APIs to ensure support for interoperability between components and to facilitate migrating applications. | Do you publish a list of all APIs available in the service and indicate which are standard and which are customized? | ACME integrates with many third party applications and data sources. The most common integrations are with CMDB, Incident Management, Problem Management, Change Management, User Administration, and Single Sign-on. A variety of techniques can be used, most notably Web Services, JDBC, LDAP, Excel, CSV, and Email, as well as any industry standard technologies that use SOAP, REST, or WSDL. Additionally, API and command-line integrations can be done using a MID Server. These can be viewed on the ACME Docs site here: https://docs.ACME.com/bundle/geneva-ACME-platform/page/integrate/inbound_web_services/concept/c_InboundWebServices.html | Yes | - | BAI02.04
BAI03.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05 | Application Services > Programming Interfaces > | provider | X | Domain 6 | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 217 | Interoperability & Portability
Data Request | IPY-02 | IPY-02 | JE | All structured and unstructured data shall be available to the customer and provided to them upon request in an industry-standard format (e.g., .doc, .xls, .pdf, logs, and flat files) | Is unstructured customer data available on request in an industry-standard format (e.g., .doc, .xls, or .pdf)? | Contractually ACME allows for a 45-day grace period from when a customer terminates their contract and ACME coordinates the encryption and transport requirements for return of data to the customer.
The process for the return of data is:
1) ACME exports the entire database in a MySQL format
2) ACME provides the customer a set of instructions on how to import the data on the customer side
3) The customer can FTPs the files from ACME to their site. | Yes | - | APO01.03
APO01.06
APO03.01
APO08.01
APO09.03
DSS04.07 | Information Services > Reporting Services > | provider | Domain 6 | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 218 | Interoperability & Portability
Policy & Legal | IPY-03 | IPY-03.1 | JE | Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage and integrity persistence. | Do you provide policies and procedures (i.e. service level agreements) governing the use of APIs for interoperability between your service and third-party applications? | ACME integrates with many third party applications and data sources. The most common integrations are with CMDB, Incident Management, Problem Management, Change Management, User Administration, and Single Sign-on. A variety of techniques can be used, most notably Web Services, JDBC, LDAP, Excel, CSV, and Email, as well as any industry standard technologies that use SOAP, REST, or WSDL. Additionally, API and command-line integrations can be done using a MID Server.
See ACME wiki pages for details of the various type of APIs: https://docs.ACME.com/bundle/helsinki-ACME-platform/page/integrate/web-services/reference/r_AvailableWebServices.html
All vendors must complete the vendor security risk assessment (VSRA) prior to be on-boarded; all contractors must sign NDA with confidentiality clauses and are subject to ACME security policies and procedures. ACME also performs background screening of contractors prior to they are being granted access to ACME's information systems; contractors must sign NDA with confidentiality clauses and are subject to ACME security policies and procedures. | Yes | - | APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03 | Information Technology Operation Services > Service Delivery > Service Level Management - External SLA's | provider | Domain 3 | 6.04.03. (b)
6.04.08. (a)
6.04.08. (b)
6.06. (a)
6.06. (b)
6.06. (c)
6.06. (d)
6.06. (e)
6.06. (f) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 219 | IPY-03.2 | JE | Do you provide policies and procedures (i.e. service level agreements) governing the migration of application data to and from your service? | As IPY-03.1 above. | Yes |
| 220 | Interoperability & Portability
Standardized Network Protocols | IPY-04 | IPY-04.1 | JE | The provider shall use secure (e.g., non-clear text and authenticated) standardized network protocols for the import and export of data and to manage the service, and shall make available a document to consumers (tenants) detailing the relevant interoperability and portability standards that are involved. | Can data import, data export and service management be conducted over secure (e.g., non-clear text and authenticated), industry accepted standardized network protocols? | ACME customers access their instances over the Internet using forced Transport Layer Security (TLS) encryption (AES128/256) for all user access. The level of encryption is based on the browser and must be configured by the customer as ACME does not modify any browser settings. All attempts to access ACME over HTTP are redirected to HTTPS. ACME administrators connect to the production network using an IPSEC VPN tunnel.
For integrations such as LDAP and Web Services, ACME provides customers with the ability to encrypt traffic. LDAP can be configured to run over SSL; this requires customers to provide a certificate for the specific LDAP server. Certificates may also be stored within an instance to allow encrypted transmission for Web Services integrations. FTPS and SCP can be used as file transfer methods to securely transfer files to ACME.
ACME customers access their instances over the Internet using forced Transport Layer Security (TLS) encryption (AES128/256) for all user access. The level of encryption is based on the browser and must be configured by the customer as ACME does not modify any browser settings. All attempts to access ACME over HTTP are redirected to HTTPS. ACME administrators connect to the production network using an IPSEC VPN tunnel.
For integrations such as LDAP and Web Services, ACME provides customers with the ability to encrypt traffic. LDAP can be configured to run over SSL; this requires customers to provide a certificate for the specific LDAP server. Certificates may also be stored within an instance to allow encrypted transmission for Web Services integrations. FTPS and SCP can be used as file transfer methods to securely transfer files to ACME. | Yes | - | APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03 | SRM > Data Protection > Cryptographic Services - Data-In-Transit Encryption | provider | x | Domain 6 | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 | 4.1 |
| 221 | IPY-04.2 | JE | Do you provide consumers (tenants) with documentation detailing the relevant interoperability and portability network protocol standards that are involved? | ACME integrates with many third party applications and data sources. The most common integrations are with CMDB, Incident Management, Problem Management, Change Management, User Administration, and Single Sign-on. A variety of techniques can be used, most notably Web Services, JDBC, LDAP, Excel, CSV, and Email, as well as any industry standard technologies that use SOAP, REST, or WSDL. Additionally, API and command-line integrations can be done using a MID Server. Additional details can be viewed on the ACME Docs website:
https://docs.ACME.com/bundle/jakarta-platform-administration/page/integrate/concept/c_IntegrationOptions.html | Yes |
| 222 | Interoperability & Portability
Virtualization | IPY-05 | IPY-05.1 | JE | The provider shall use an industry-recognized virtualization platform and standard virtualization formats (e.g., OVF) to help ensure interoperability, and shall have documented custom changes made to any hypervisor in use, and all solution-specific virtualization hooks, available for customer review. | Do you use an industry-recognized virtualization platform and standard virtualization formats (e.g.., OVF) to help ensure interoperability? | Not applicable, as ACME does not use virtualization in the customer environment. | Not Applicable | - | APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03 | Infrastructure Services > Virtual Infrastructure > Server Virtualization | provider | X | Domain 6 | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 223 | IPY-05.2 | JE | Do you have documented custom changes made to any hypervisor in use, and all solution-specific virtualization hooks available for customer review? | Not applicable, as ACME does not use virtualization in the customer environment. | Not Applicable |
| 224 | Mobile Security
Anti-Malware | MOS-01 | MOS-01 | JE | Anti-malware awareness training, specific to mobile devices, shall be included in the provider's information security awareness training. | Do you provide anti-malware training specific to mobile devices as part of your information security awareness training? | ACME employees do not support or access customer environments via their mobile devices. Mobile devices are only used for email.
Specific Malware training for mobile devices is not provided. Phishing awareness is part of the Security Awareness training provided to users.
However, BYO device configurations must prevent malicious software execution.
The Mobile and BYO Device Access SOP can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad | Not Applicable | - | APO01.03
APO13.01
APO07.03
APO07.06
APO09.03
APO10.04 | SRM > Governance Risk & Compliance > Technical Awareness and Training | provider | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 225 | Mobile Security
Application Stores | MOS-02 | MOS-02 | JE | A documented list of approved application stores has been communicated as acceptable for mobile devices accessing or storing provider managed data. | Do you document and make available lists of approved application stores for mobile devices accessing or storing company data and/or company systems? | ACME does not provide a list of mobile stores since customer data is not stored on mobile devices. ACME employees do not support or access customer environments via their mobile devices. Mobile devices are only used for email. Acceptable Use policies denote acceptable user practices. Any mobile device has encryption enabled along with password controls. | Not Applicable | - | APO01.04
APO01.08
APO04.02
APO13.01
APO13.02
APO13.03 | SRM > Policies and Standards > Technical Securitry Standards | provider | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 | 4.1.1 |
| 226 | Mobile Security
Approved Applications | MOS-03 | MOS-03 | JE | The company shall have a documented policy prohibiting the installation of non-approved applications or approved applications not obtained through a pre-identified application store. | Do you have a policy enforcement capability (e.g., XACML) to ensure that only approved applications and those from approved application stores be loaded onto a mobile device? | ACME support employees are not able to access support infrastructure via mobile devices. Mobile device use is limited to corporate email, and access is managed by ACME's MDM solution. | Yes | - | APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
| ITOS > Service Support > Configuration Management - Software Management | provider | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 227 | Mobile Security
Approved Software for BYOD | MOS-04 | MOS-04 | JE | The BYOD policy and supporting awareness training clearly states the approved applications, application stores, and application extensions and plugins that may be used for BYOD usage. | Does your BYOD policy and training clearly state which applications and applications stores are approved for use on BYOD devices? | ACME's Acceptable Use Policy provides guidance on what should and should not be installed onto mobile devices.
The Acceptable Use Policy can be viewed on the ACME CORE here:https://community.ACME.com/community?id=community_article&sys_id=11bcaa25dbd0dbc01dcaf3231f961967
The Mobile and BYO Device Access SOP can also be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad | Yes | - | APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
| SRM > Policies and Standards > Technical Securitry Standards | provider | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 228 | Mobile Security
Awareness and Training | MOS-05 | MOS-05 | JE | The provider shall have a documented mobile device policy that includes a documented definition for mobile devices and the acceptable usage and requirements for all mobile devices. The provider shall post and communicate the policy and requirements through the company's security awareness and training program. | Do you have a documented mobile device policy in your employee training that clearly defines mobile devices and the accepted usage and requirements for mobile devices? | ACME has a formally documented Mobile and BYO Device access SOP which provides governance for managing mobile and “Bring-Your-Own” (BYO) devices. This SOP applies to all ACME resources (e.g., employees, contractors, and vendors) involved in using mobile or BYO information devices and systems containing or interacting with ACME data or operating within the ACME secured network. ACME support employees are not able to access support infrastructure via mobile devices.
The Mobile and BYO Device Access SOP can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad
ACME's Acceptable Use Policy provides guidance on acceptable usage and requirements on mobile devices. The Acceptable Use Policy can be viewed on the ACME CORE here: | Yes | - | APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
| SRM > Policies and Standards > Technical Securitry Standards | provider | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 | 4.3 |
| 229 | Mobile Security
Cloud Based Services | MOS-06 | MOS-06 | JE | All cloud-based services used by the company's mobile devices or BYOD shall be pre-approved for usage and the storage of company business data. | Do you have a documented list of pre-approved cloud based services that are allowed to be used for use and storage of company business data via a mobile device? | See MOS-05. | Yes | - | APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
| SRM > Governance Risk & Compliance > Vendor Management | provider | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 230 | Mobile Security
Compatibility | MOS-07 | MOS-07 | JE | The company shall have a documented application validation process to test for mobile device, operating system, and application compatibility issues. | Do you have a documented application validation process for testing device, operating system and application compatibility issues? | See MOS-03. | Not Applicable | - | APO01.03
APO01.08
APO13.01
APO13.02
BAI03.07
BAI03.08 | ITOS > Service Support > Configuration Management - Software Management | provider | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 231 | Mobile Security
Device Eligibility | MOS-08 | MOS-08 | JE | The BYOD policy shall define the device and eligibility requirements to allow for BYOD usage. | Do you have a BYOD policy that defines the device(s) and eligibility requirements allowed for BYOD usage? | See MOS-05. | Yes | - | APO01.03
APO01.08
APO13.01
APO13.02
BAI02.01
BAI02.04 | SRM > Policies and Standards > Information Security Policies | provider | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 232 | Mobile Security
Device Inventory | MOS-09 | MOS-09 | JE | An inventory of all mobile devices used to store and access company data shall be kept and maintained. All changes to the status of these devices, (i.e., operating system and patch levels, lost or decommissioned status, and to whom the device is assigned or approved for usage (BYOD), will be included for each device in the inventory. | Do you maintain an inventory of all mobile devices storing and accessing company data which includes device status (os system and patch levels, lost or decommissioned, device assignee)? | ACME only supports devices that are connected through the Bitglass Mobile Device Management service, all other devices will be blocked. | Yes | - | BAI06.01
BAI06.02
BAI06.04
BAI10.01
BAI10.02
BAI10.03 | SRM > Infrastructure Protection Services > End Point - Inventory Control | provider | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 233 | Mobile Security
Device Management | MOS-10 | MOS-10 | JE | A centralized, mobile device management solution shall be deployed to all mobile devices permitted to store, transmit, or process customer data. | Do you have a centralized mobile device management solution deployed to all mobile devices that are permitted to store, transmit, or process company data? | ACME only supports devices that are connected through the Bitglass Mobile Device Management service, all other devices will be blocked. | Yes | - | APO03.01
APO03.02
APO04.02
APO13.01
APO13.02
BAI02.01
BAI03.03
BAI03.04
BAI03.10 | Presentation Services > Presentation Platform > End-Points-Mobile Devices-Mobile Device Management | provider | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 234 | Mobile Security
Encryption | MOS-11 | MOS-11 | JE | The mobile device policy shall require the use of encryption either for the entire device or for data identified as sensitive on all mobile devices and shall be enforced through technology controls. | Does your mobile device policy require the use of encryption for either the entire device or for data identified as sensitive enforceable through technology controls for all mobile devices? | Mobile Devices are required to have full disk encryption implemented. Mobile devices are not required to be encrypted, however, ACME support employees are not able to access support infrastructure via mobile devices. | Yes | - | APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
DSS06.06 | SRM > Data Protection > Cryptographic Services - Data-At-Rest Encryption | provider | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 | PA32 | BSGP | 4.1 |
| 235 | Mobile Security
Jailbreaking and Rooting | MOS-12 | MOS-12.1 | JE | The mobile device policy shall prohibit the circumvention of built-in security controls on mobile devices (e.g. jailbreaking or rooting) and is enforced through detective and preventative controls on the device or through a centralized device management system (e.g. mobile device management). | Does your mobile device policy prohibit the circumvention of built-in security controls on mobile devices (e.g., jailbreaking or rooting)? | ACME's Acceptable Use Policy prohibits this type of behavior. The Acceptable Use Policy can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=11bcaa25dbd0dbc01dcaf3231f961967
| Yes | - | APO01.03
APO13.01
APO13.02
DSS05.03
| Presentation Services > Presentation Platform > End-Points-Mobile Devices-Mobile Device Management | provider | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 236 | MOS-12.2 | JE | Do you have detective and preventative controls on the device or via a centralized device management system which prohibit the circumvention of built-in security controls? | ACME only leverages BYO Devices for access to corporate email only. There is no access to the cloud environment or customer data.
ACME only supports devices that are connected through the Bitglass Mobile Device Management service, all other devices will be blocked. Bitglass enforces security controls on mobile devices. ACME has a formally documented Mobile and BYO Device Access SOP which provides governance for managing mobile and “Bring-Your-Own” (BYO) devices. This SOP applies to all ACME resources (e.g., employees, contractors, and vendors) involved in using mobile or BYO information devices and systems. ACME support employees are not able to access support infrastructure via mobile devices. Mobile devices can only be used to access corporate email.
Please refer to the Mobile and BYO Device Access SOP here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad | Yes |
| 237 | Mobile Security
Legal | MOS-13 | MOS-13.1 | JE | The BYOD policy includes clarifying language for the expectation of privacy, requirements for litigation, e-discovery, and legal holds. The BYOD policy shall clearly state the expectations over the loss of non-company data in the case a wipe of the device is required. | Does your BYOD policy clearly define the expectation of privacy, requirements for litigation, e-discovery and legal holds? | As MOS-05 above. | No | - | APO01.03
APO13.01
APO13.02 | SRM > Policies and Standards > Information Security Services | shared | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 238 | MOS-13.2 | JE | Do you have detective and preventative controls on the device or via a centralized device management system which prohibit the circumvention of built-in security controls? | As MOS-12.2 above. | Yes |
| 239 | Mobile Security
Lockout Screen | MOS-14 | MOS-14 | JE | BYOD and/or company owned devices are configured to require an automatic lockout screen, and the requirement shall be enforced through technical controls. | Do you require and enforce via technical controls an automatic lockout screen for BYOD and company owned devices? | As MOS-12.2 above. | Yes | - | DSS05.03
DSS05.05 | Presentation Services > Presentation Platform > End-Points-Mobile Devices-Mobile Device Management | shared | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 240 | Mobile Security
Operating Systems | MOS-15 | MOS-15 | JE | Changes to mobile device operating systems, patch levels, and/or applications shall be managed through the company's change management processes. | Do you manage all changes to mobile device operating systems, patch levels and applications via your company's change management processes? | As MOS-12.2 above. | No | - | APO01.03
APO13.01
APO13.02
BAI06 | ITOS > Service Support -Change Management > Planned Changes | shared | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 241 | Mobile Security
Passwords | MOS-16 | MOS-16.1 | JE | Password policies, applicable to mobile devices, shall be documented and enforced through technical controls on all company devices or devices approved for BYOD usage, and shall prohibit the changing of password/PIN lengths and authentication requirements. | Do you have password policies for enterprise issued mobile devices and/or BYOD mobile devices? | All mobile devices must have a personal identification number (PIN) or passcode. Enterprise issued laptops are subject to the password policy detailed in the Information Security Standards, which can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=0b1d62e5dbd0dbc01dcaf3231f9619f5
The Mobile and BYO Device Access SOP can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad
As MOS-15 above. | Yes | - | APO01.03
APO13.01
APO13.02
DSS05.03 | Presentation Services > Presentation Platform > End-Points-Mobile Devices-Mobile Device Management | shared | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 242 | MOS-16.2 | JE | Are your password policies enforced through technical controls (i.e. MDM)? | ACME has formal Information Security Policy and a formal Information Security Standards (ISP/ISS), that require strong password requirements are implemented, which includes LDAP account password enforcement of, but not limited to, minimum password length, inactive lock out, unsuccessful login lockout, password complexity, password reuse and unique user IDs. Users who do not change passwords in LDAP every 90 days are locked out. For systems (VPN, network devices, etc.) that use RSA for two-factor authentication (PIN & token), users are required to change their PIN every 90 days. Finally access to workstations is governed by active directory, which forces users to change their password every 90 days.
Password policies detailed in the Information Security Standards are enforced via Bitglass, ACME's MDM solution.
Please refer to the Information Security Standards here: https://community.ACME.com/community?id=community_article&sys_id=0b1d62e5dbd0dbc01dcaf3231f9619f5
Please refer to the Information Security Policy here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0
The Mobile and BYO Device Access SOP can be viewed on the ACME CORE here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad | Partial |
| 243 | MOS-16.3 | JE | Do your password policies prohibit the changing of authentication requirements (i.e. password/PIN length) via a mobile device? | As MOS-16.2 above. | Yes |
| 244 | Mobile Security
Policy | MOS-17 | MOS-17.1 | JE | The mobile device policy shall require the BYOD user to perform backups of data, prohibit the usage of unapproved application stores, and require the use of anti-malware software (where supported). | Do you have a policy that requires BYOD users to perform backups of specified corporate data? | ACME users cannot connect to the customer network via BYOD. All access is required to come through a security corporate VPN using two-factor authentication via an RSA token. Mobile and bring your own devices are only used to access corporate email. | No | - | APO01.03
APO13.01
APO13.02
DSS05.01
DSS05.03 | SRM > Policies and Standards > Technical Security Standards | shared | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 245 | MOS-17.2 | JE | Do you have a policy that requires BYOD users to prohibit the usage of unapproved application stores? | See MOS-02. | No |
| 246 | MOS-17.3 | JE | Do you have a policy that requires BYOD users to use anti-malware software (where supported)? | Yes, the Mobile and BYO Device Access SOP requires that a BYO device configuration includes virus protection as appropriate for the device.
Please to the Mobile and BYO Device Access SOP here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad | Yes |
| 247 | Mobile Security
Remote Wipe | MOS-18 | MOS-18.1 | JE | All mobile devices permitted for use through the company BYOD program or a company-assigned mobile device shall allow for remote wipe by the company's corporate IT or shall have all company-provided data wiped by the company's corporate IT. | Does your IT provide remote wipe or corporate data wipe for all company-accepted BYOD devices? | All cellphones that have access to corporate emails, must be encrypted, with remote wipe capability; laptops and workstations are required to have full disk encryption implemented.
Please to the Mobile and BYO Device Access SOP here: https://community.ACME.com/community?id=community_article&sys_id=3c7c22e1dbd0dbc01dcaf3231f9619ad | Yes | APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
DSS05.06 | BOSS > Data Governance > Secure Disposal of Data | shared | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 | PA34 | SGP |
| 248 | MOS-18.2 | JE | Does your IT provide remote wipe or corporate data wipe for all company-assigned mobile devices? | See MOS-18.1. | Yes |
| 249 | Mobile Security
Security Patches | MOS-19 | MOS-19.1 | JE | Mobile devices connecting to corporate networks or storing and accessing company information shall allow for remote software version/patch validation. All mobile devices shall have the latest available security-related patches installed upon general release by the device manufacturer or carrier and authorized IT personnel shall be able to perform these updates remotely. | Do your mobile devices have the latest available security-related patches installed upon general release by the device manufacturer or carrier? | There is no technical enforcement of this. | No | APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
DSS05.06 | SRM > Infrastructure Protection Services->Network > Link Layer Network Security | shared | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 250 | MOS-19.2 | JE | Do your mobile devices allow for remote validation to download the latest security patches by company IT personnel? | Laptops and workstations allow for remote validation to download the latest security patches by company IT personnel, however, mobile devices do not. Mobile and bring your own devices are only used to access corporate email. | Partial |
| 251 | Mobile Security
Users | MOS-20 | MOS-20.1 | JE | The BYOD policy shall clarify the systems and servers allowed for use or access on a BYOD-enabled device. | Does your BYOD policy clarify the systems and servers allowed for use or access on the BYOD-enabled device? | See MOS-03. | Not Applicable | APO01.03
APO13.01
APO13.02 | SRM > Policies and Standards > Technical Security Standards | shared | X | None (Mobile Guidance) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 252 | MOS-20.2 | MY | Does your BYOD policy specify the user roles that are allowed access via a BYOD-enabled device? | ACME does not allow customer data to be put on BYOD. | No |
| 253 | Security Incident Management, E-Discovery & Cloud Forensics
Contact / Authority Maintenance | SEF-01 | SEF-01.1 | MY | Points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities shall be maintained and regularly updated (e.g., change in impacted-scope and/or a change in any compliance obligation) to ensure direct compliance liaisons have been established and to be prepared for a forensic investigation requiring rapid engagement with law enforcement. | Do you maintain liaisons and points of contact with local authorities in accordance with contracts and appropriate regulations? | For the purpose of Computer Emergency Readiness, ACME maintains contact with FBI, Infragard, DHS, IC3, US-CERT, CERT-EU, CERT Australia, NCSC (aka CERT-UK), in-house counsel as well as outside counsel, district attorney of the county of Santa Clara ( Headquarters) , regional police departments. In addition, ACME also has an external breach response firm at call, to handle large scale incidents that may require external help. The Legal team maintains these contacts in conjunction with the Security Incident Response Team. | Yes | CC3.3
| APO01.01
APO01.02
APO01.03
APO01.08
MEA03.01
MEA03.02
MEA03.03 | 312.4 | BOSS > Compliance > Contact/Authority Maintenance | shared | x | A.6.1.6
A.6.1.7 | A.6.1.3
A.6.1.4 | Chapter VI,
Article 44.
Chapter II,
Article 16, part I | 3.2 | 12.5.3
12.10.1 |
| 254 | Security Incident Management, E-Discovery & Cloud Forensics
Incident Management
(v1.4: Incident Management) | SEF-02 | SEF-02.1 | MY | Policies and procedures shall be established, and supporting business processes and technical measures implemented, to triage security-related events and ensure timely and thorough incident management, as per established IT service management policies and procedures. | Do you have a documented security incident response plan? | Please refer to the Security Incident Response SOP here: https://community.ACME.com/community?id=community_article&sys_id=a75c6aa1dbd0dbc01dcaf3231f961958 | Yes | IS3.7.0
S3.9.0 | (IS3.7.0) Procedures exist to identify, report, and act upon system security breaches and other incidents.
(S3.9.0) Procedures exist to provide that issues of noncompliance with system availability, confidentiality of data, processing integrity and related security policies are promptly addressed and that corrective measures are taken on a timely basis. | CC5.5
CC6.2 | J.1 | J.1.1, J.1.2 | 46 (B) | Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4; 4.8 Openness, Subs. 4.8.2 | IS-22 | COBIT 4.1 DS5.6 | APO01.03
APO13.01
APO13.02
DSS01.03
DSS02.01
DSS02.02
DSS02.04
DSS02.05
DSS02.06 | 312.8 and 312.10 | ITOS > Service Support > Security Incident Management | shared | x | Domain 2 | 6.04.07. (b)
6.07.01. (a)
6.07.01. (d)
6.07.01. (e)
6.07.01. (f)
6.07.01. (g)
6.07.01. (h) | Article 17 | NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-7 | NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-3
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-4 (1)
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 IR-8 | 1.2.4
1.2.7
7.1.2
7.2.2
7.2.4
10.2.1
10.2.4 | 45 CFR 164.308 (a)(1)(i)
45 CFR 164.308 (a)(6)(i) | Clause 4.3.3
A.13.1.1
A.13.2.1 | Clause
5.3 (a),
5.3 (b),
7.5.3(b),
5.2 (c),
7.5.3(d),
8.1,
8.3,
9.2(g),
Annex
A.16.1.1
A.16.1.2 | ITAR 22 CFR § 127.12 | Commandment #2
Commandment #6
Commandment #8 | Chapter II, Article 20 | CIP-007-3 - R6.1
CIP-008-3 - R1 | IR-1
IR-2
IR-3
IR-4
IR-5
IR-7
IR-8 | IP-4 COMPLAINT MANAGEMENT. SE-2 PRIVACY INCIDENT RESPONSE | 4.1
4.2
4.6
7.1
| PA8
PA11 | BSGP | PCI-DSS v2.0 12.9
PCI-DSS v2.0 12.9.1
PCI-DSS v2.0 12.9.2
PCI-DSS v2.0 12.9.3
PCI-DSS v2.0 12.9.4
PCI-DSS v2.0 12.9.5
PCI-DSS v2.0 12.9.6 | 12.1 |
| 255 | IS-22 | SEF-02.2 | MY | Do you integrate customized tenant requirements into your security incident response plans?
| ACME has a formal documented Security Incident Response policy, process and workflow. Our Incident Response process includes documented event discovery, triage, escalation, notification (including customer notification) remediation, and post-mortem review.
ACME reports both incidents and security incidents in accordance with the Incident Management process and Security Incident Response Plan. If a customer environment or data is impacted, the customer will be notified via their normal support contacts as required by their SLA.
Customers may generate their own alerts in their ACME instance, or export their application logs to their own SIEM solution or build/implement an integration for alert generation. However, we do not integrate customer requirements into our plans.
Please refer to the Security Incident Response SOP here: https://community.ACME.com/community?id=community_article&sys_id=a75c6aa1dbd0dbc01dcaf3231f961958 | No |
| 256 | IS-22 | SEF-02.3 | MY | Do you publish a roles and responsibilities document specifying what you vs. your tenants are responsible for during security incidents?
| As SEF-02.1 above. | Yes |
| 257 | SEF-02.4 | MY | Have you tested your security incident response plans in the last year? | ACME reports both incidents and security incidents in accordance with the Incident Management process and Security Incident Response Plan. If a customer environment or data is impacted, the customer will be notified via their normal support contacts as required by their SLA. The Security Incident Response Plan is tested annually.
Please refer to the Security Incident Response SOP here: https://community.ACME.com/community?id=community_article&sys_id=a75c6aa1dbd0dbc01dcaf3231f961958 | Yes |
| 258 | Security Incident Management, E-Discovery & Cloud Forensics
Incident Reporting | SEF-03 | SEF-03.1 | MY | Workforce personnel and external business relationships shall be informed of their responsibility and, if required, shall consent and/or contractually agree to report all information security events in a timely manner. Information security events shall be reported through predefined communications channels in a timely manner adhering to applicable legal, statutory, or regulatory compliance obligations. | Does your security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting? | ACME uses a SIEM solution to collect and aggregates its logs.
Customers may export their application logs to their own SIEM solution or build/implement an integration.
Please refer to the Log Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=e9ec2e65dbd0dbc01dcaf3231f9619ca | Yes | A2.3.0
C2.3.0
I2.3.0
S2.3.0
S2.4
C3.6.0 | (A2.3.0, C2.3.0, I2.3.0, S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality of data, processing integrity and related security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.
(S2.4) The process for informing the entity about breaches of the system security and for submitting complaints is communicated to authorized users.
(C3.6.0) The entity has procedures to obtain assurance or representation that the confidentiality policies of third parties to whom information is transferred and upon which the entity relies are in conformity with the entity’s defined system confidentiality and related security policies and that the third party is in compliance with its policies. | CC2.3
CC2.5
C1.4
C1.5 | J.1
E.1 | J.1.1, E.4 | 5 (B)
46 (B)
48 (A+)
49 (B)
50 (B) | Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.3 | IS-23 | COBIT 4.1 DS5.6 | APO01.03
APO07.06
APO07.03
APO13.01
APO13.02
DSS02.01 | 312.3, 312.8 and 312.10 | BOSS > Human Resources Security > Employee Awareness | shared | x | Domain 2 | 6.07.01. (a) | Article 17 | NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 SI-5 | NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-6 (1)
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SI-5 | 99.31(a)(1)(i)
34 CFR 99.32(a) | 1.2.7
1.2.10
7.1.2
7.2.2
7.2.4
10.2.4 | 45 CFR 164.312 (a)(6)(ii)
16 CFR 318.3 (a) (New)
16 CFR 318.5 (a) (New)
45 CFR 160.410 (a)(1) (New) | Clause 4.3.3
Clause 5.2.2
A.6.1.3
A.8.2.1
A.8.2.2
A.13.1.1
A.13.1.2
A.13.2.1 | Clause
5.2 (c),
5.3 (a),
5.3 (b),
7.2(a),
7.2(b),
7.2(c),
7.2(d),
7.3(b),
7.3(c)
7.5.3(b),
7.5.3(d),
8.1,
8.3,
9.2(g)
Annex
A.6.1.1
A.7.2.1,
A.7.2.2,
A.16.1.2,
A.16.1.3,
A.16.1.1 | ITAR 22 CFR § 127.12 | Commandment #2
Commandment #6
Commandment #8 | Chapter II, Article 20 | CIP-003-3 - R4.1
CIP-004-3 R3.3 | IR-2
IR-6
IR-7
SI-4
SI-5 | IP-4 COMPLAINT MANAGEMENT. SE-2 PRIVACY INCIDENT RESPONSE | 7.2 | PA8 | BSGP | PCI-DSS v2.0 12.5.2
PCI-DSS v2.0 12.5.3 | 12.10.1 |
| 259 | IS-23 | SEF-03.2 | MY | Does your logging and monitoring framework allow isolation of an incident to specific tenants? | ACME can filter events to a single customer. | Yes | COBIT 4.1 DS5.6 | 45 CFR 164.312 (a)(6)(ii)
16 CFR 318.3 (a) (New)
16 CFR 318.5 (a) (New)
45 CFR 160.410 (a)(1) (New) | Clause 4.3.3
Clause 5.2.2
A.6.1.3
A.8.2.1
A.8.2.2
A.13.1.1
A.13.1.2
A.13.2.1 | NIST SP800-53 R3 IR-2
NIST SP800-53 R3 IR-6
NIST SP800-53 R3 IR-7
NIST SP800-53 R3 SI-4
NIST SP800-53 R3 SI-5 | PCI-DSS v2.0 12.5.2
PCI-DSS v2.0 12.5.3 |
| 260 | Security Incident Management, E-Discovery & Cloud Forensics
Incident Response Legal Preparation | SEF-04 | SEF-04.1 | MY | Proper forensic procedures, including chain of custody, are required for the presentation of evidence to support potential legal action subject to the relevant jurisdiction after an information security incident. Upon notification, customers and/or other external business partners impacted by a security breach shall be given the opportunity to participate as is legally permissible in the forensic investigation. | Does your incident response plan comply with industry standards for legally admissible chain-of-custody management processes and controls? | ACME has a formal documented Security Incident Response policy, process and workflow. Our Incident Response process includes documented event discovery, triage, escalation, notification (including customer notification) remediation, and post-mortem review.
ACME reports both incidents and security incidents in accordance with the Incident Management process and Security Incident Response Plan. If a customer environment or data is impacted, the customer will be notified via their normal support contacts as required by their SLA.
Please refer to the Security Incident Response SOP here: https://community.ACME.com/community?id=community_article&sys_id=a75c6aa1dbd0dbc01dcaf3231f961958 | Yes | S2.4.0
C3.15.0 | (S2.4.0) The process for informing the entity about system availability issues, confidentiality issues, processing integrity issues, security issues and breaches of the system security and for submitting complaints is communicated to authorized users.
(C3.15.0) Procedures exist to provide that issues of noncompliance with defined confidentiality and related security policies are promptly addressed and that corrective measures are taken on a timely basis. | CC2.5
CC6.2 | J.1
E.1 | J.1.1, J.1.2, E.4 | IS-24 | COBIT 4.1 DS5.6 | APO01.03
APO13.01
APO13.02
DSS01.03
DSS02.01
DSS02.02
DSS02.04
DSS02.05
DSS02.06 | 312.8 and 312.10 | BOSS > Legal Services > Incident Response Legal Preparation | shared | x | Domain 2 | 6.04.07. (b)
6.07.01. (f)
6.07.01. (h) | NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-8 | NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 AU-7
NIST SP 800-53 R3 AU-7 (1)
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-9 (2)
NIST SP 800-53 R3 AU-10
NIST SP 800-53 R3 AU-10 (5)
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 MP-5
NIST SP 800-53 R3 MP-5 (2)
NIST SP 800-53 R3 MP-5 (4) | 1.2.7 | 45 CFR 164.308 (a)(6)(ii) | Clause 4.3.3
Clause 5.2.2
A.8.2.2
A.8.2.3
A.13.2.3
A.15.1.3 | Clause
5.2 (c),
5.3 (a),
5.3 (b),
7.2(a),
7.2(b),
7.2(c),
7.2(d),
7.3(b),
7.3(c)
7.5.3(b),
7.5.3(d),
8.1,
8.3,
9.2(g)
Annex
A.7.2.2,
A.7.2.3,
A.16.1.7,
A.18.1.3 | CIP-004-3 R3.3 | AU-6
AU-7
AU-9
AU-11
IR-5
IR-7
IR-8 | 7.3 | PA11 | BSGP |
| 261 | IS-24 | SEF-04.2 | MY | Does your incident response capability include the use of legally admissible forensic data collection and analysis techniques? | ACME maintains relationship with two vendors to provide forensic services with chain of custody in the event that forensic investigation is required. Further, ACME is capable of cloning a customer instance for evidence preservation. | Yes | COBIT 4.1 DS5.6 | 45 CFR 164.308 (a)(6)(ii) | Clause 4.3.3
Clause 5.2.2
A.8.2.2
A.8.2.3
A.13.2.3
A.15.1.3 | NIST SP800-53 R3 AU-6
NIST SP800-53 R3 AU-7
NIST SP800-53 R3 AU-9
NIST SP800-53 R3 AU-11
NIST SP800-53 R3 IR-5
NIST SP800-53 R3 IR-7
NIST SP800-53 R3 IR-8 |
| 262 | IS-24 | SEF-04.3 | MY | Are you capable of supporting litigation holds (freeze of data from a specific point in time) for a specific tenant without freezing other tenant data? | ACME is a logically single-tenant environment. Customers share a hardware platform, but access entirely separate individual instances of the ACME platform. Each individual instance connects to a database only accessible by that specific instance. ACME does not host customer instances off virtual servers.
ACME's single-tenant architecture consists of three tiers that provide code and data isolation:
1) The proxy layer of the application accepts incoming requests and, based on the DNS name being requested, does a Port Address Translation before passing the requests through to the next layer.
2) The application layer is a Java application that is sandboxed with each instance only listening on a single port and running in its own JVM. This provides code isolation and prevents instances from hearing traffic destined to another instance. This also allows updates to be applied to each instance without affecting other instances.
3) The database layer provides a separate MySQL database for each instance. There is no co-mingling of data or ACLs used to keep customer data separate.
Although the application and database tiers may run on shared hardware, the code and data is isolated for every instance. | Yes | COBIT 4.1 DS5.6 | 45 CFR 164.308 (a)(6)(ii) | Clause 4.3.3
Clause 5.2.2
A.8.2.2
A.8.2.3
A.13.2.3
A.15.1.3 | NIST SP800-53 R3 AU-6
NIST SP800-53 R3 AU-7
NIST SP800-53 R3 AU-9
NIST SP800-53 R3 AU-11
NIST SP800-53 R3 IR-5
NIST SP800-53 R3 IR-7
NIST SP800-53 R3 IR-8 |
| 263 | IS-24 | SEF-04.4 | MY | Do you enforce and attest to tenant data separation when producing data in response to legal subpoenas? | As SEF-04.3 above. | Yes | COBIT 4.1 DS5.6 | 45 CFR 164.308 (a)(6)(ii) | Clause 4.3.3
Clause 5.2.2
A.8.2.2
A.8.2.3
A.13.2.3
A.15.1.3 | NIST SP800-53 R3 AU-6
NIST SP800-53 R3 AU-7
NIST SP800-53 R3 AU-9
NIST SP800-53 R3 AU-11
NIST SP800-53 R3 IR-5
NIST SP800-53 R3 IR-7
NIST SP800-53 R3 IR-8 |
| 264 | Security Incident Management, E-Discovery & Cloud Forensics
Incident Response Metrics | SEF-05 | SEF-05.1 | MY | Mechanisms shall be put in place to monitor and quantify the types, volumes, and costs of information security incidents. | Do you monitor and quantify the types, volumes and impacts on all information security incidents? | ACME reports incidents in accordance with the Incident Response Plan. The document identifies the types of security incidents that should be reported, reporting timeframes, and specific processes for reporting and handling incidents involving customer data.
Internally, ACME utilizes Splunk to centralize audit logs and to support the audit review process. As part of the purpose and design for this system, audit reviews occur daily for events that are considered lower risk. High risk issues, such as intrusion detection events trigger real-time alerts which are emailed to the Security Incident Response Team. ACME has established a Scheduled Security Operations Checklist which includes procedures for performing daily reviews of Linux, Windows, Network Device, IDS, and identified issue logs.
Please refer to the Security Incident Response SOP here: https://community.ACME.com/community?id=community_article&sys_id=a75c6aa1dbd0dbc01dcaf3231f961958 | Yes | S3.9.0
C4.1.0 | (S3.9.0) Procedures exist to provide that issues of noncompliance with security policies are promptly addressed and that corrective measures are taken on a timely basis.
(C4.1.0) The entity’s system security, availability, system integrity, and confidentiality is periodically reviewed and compared with the defined system security, availability, system integrity, and confidentiality policies. | CC6.2
CC4.1 | J.1.2 | 47 (B) | IS-25 | COBIT 4.1 DS 4.9 | DSS04.07 | 312.8 and 312.10 | BOSS > Operational Risk Management > Key Risk Indicators | shared | x | Domain 2 | 6.07.01. (a)
6.07.01. (i) | NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8 | NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-4 (1)
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8 | 1.2.7
1.2.10 | 45 CFR 164.308 (a)(1)(ii)(D) | A.13.2.2 | A.16.1.6 | CIP-008-3 - R1.1 | IR-4
IR-5
IR-8 | 7.2
7.3 | PA11 | BSGP | PCI DSS v2.0 12.9.6 |
| 265 | IS-25 | SEF-05.2 | MY | Will you share statistical information for security incident data with your tenants upon request? | As SEF-05.1 above. | Yes | COBIT 4.1 DS 4.9 | 45 CFR 164.308 (a)(1)(ii)(D) | A.13.2.2 | NIST SP800-53 R3 IR-4
NIST SP800-53 R3 IR-5
NIST SP800-53 R3 IR-8 | PCI DSS v2.0 12.9.6 |
| 266 | Supply Chain Management, Transparency and Accountability
Data Quality and Integrity | STA-01 | STA-01.1 | MY | Providers shall inspect, account for, and work with their cloud supply-chain partners to correct data quality errors and associated risks. Providers shall design and implement controls to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privilege access for all personnel within their supply chain. | Do you inspect and account for data quality errors and associated risks, and work with your cloud supply-chain partners to correct them? | All equipment in the secure data center customer network is owned, operated and managed by ACME. Third party vendors do not have access to the data at any time. | Not Applicable | APO10
APO11
DSS05.04
DSS06.03
DSS06.06 | SRM > Governance Risk & Compliance > Vendor Management | provider | X | Domain 2 | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 |
| 267 | STA-01.2 | MY | Do you design and implement controls to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privileged access for all personnel within your supply chain? | ACME uses role-based entitlements and grant entitlements only to roles with explicit need for the level of access based strictly on a 'least privilege' principle for the cloud infrastructure.
ACME utilizes RSA SecurID for multi-factor authentication for network access to privileged (including administrative access) accounts for production.
For the application, the customer will assume this responsibility as they manage authorization in their application instance and can configure the appropriate access control list.
Please refer to the Information Security Policy here: https://community.ACME.com/community?id=community_article&sys_id=d84c2e61dbd0dbc01dcaf3231f9619e0
Please refer to the Information Security Standars here: https://community.ACME.com/community?id=community_article&sys_id=0b1d62e5dbd0dbc01dcaf3231f9619f5 | Yes |
| 268 | Supply Chain Management, Transparency and Accountability
Incident Reporting | STA-02 | STA-02.1 | MY | The provider shall make security incident information available to all affected customers and providers periodically through electronic methods (e.g. portals). | Do you make security incident information available to all affected customers and providers periodically through electronic methods (e.g. portals)? | ACME reports incidents in accordance with the Incident Response Plan. The document identifies the types of security incidents that should be reported, reporting timeframes, and specific processes for reporting and handling incidents involving customer data. This response plan will be communicated to the customer as appropriate base on the severity of the breach.
Please refer to the Security Incident Response SOP here: here: https://community.ACME.com/community?id=community_article&sys_id=a75c6aa1dbd0dbc01dcaf3231f961958 | Yes | APO09.03
APO09.04
APO10.04
APO10.05
DSS02.07 | ITOS > Service Support -> Incident Management > Cross Cloud Incident Response | provider | Domain 2 | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f) |
| 269 | Supply Chain Management, Transparency and Accountability
Network / Infrastructure Services | STA-03 | STA-03.1 | MY | Business-critical or customer (tenant) impacting (physical and virtual) application and system-system interface (API) designs and configurations, and infrastructure network and systems components, shall be designed, developed, and deployed in accordance with mutually agreed-upon service and capacity-level expectations, as well as IT governance and service management policies and procedures. | Do you collect capacity and use (utilization) data for all relevant components of your cloud service offering?
| ACME has a documented capacity planning model which is used to determine sizing requirements and scaling options. As a SaaS provider, the need to address capacity and horizontal system scaling is in the background, transparent to our customers.
Please refer to Capacity Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=707c22e1dbd0dbc01dcaf3231f96196c | Yes | C2.2.0 | (C2.2.0) The system security, availability, system integrity, and confidentiality and related security obligations of users and the entity’s system security, availability, system integrity, and confidentiality and related security commitments to users are communicated to authorized users. | CC2.2
CC2.3 | C.2 | C.2.6, G.9.9 | 45 (B)
74 (B) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-31 | COBIT 4.1 DS5.10 | APO01.03
APO03.01
APO03.02
APO09.03
BAI02.01
BAI02.04
BAI07.05 | 312.8 and 312.10 | ITOS > Service Delivery > Service Level Management | provider | x | Domain 2 | 6.02. (c)
6.03.07. (a)
6.03.07. (b)
6.03.07. (c)
6.03.07. (d) | Article 17 | NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 SA-9 | NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 CP-6
NIST SP 800-53 R3 CP-6 (1)
NIST SP 800-53 R3 CP-6 (3)
NIST SP 800-53 R3 CP-7
NIST SP 800-53 R3 CP-7 (1)
NIST SP 800-53 R3 CP-7 (2)
NIST SP 800-53 R3 CP-7 (3)
NIST SP 800-53 R3 CP-7 (5)
NIST SP 800-53 R3 CP-8
NIST SP 800-53 R3 CP-8 (1)
NIST SP 800-53 R3 CP-8 (2)
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SC-30 | 8.2.2
8.2.5 | A.6.2.3
A.10.6.2 | A.15.1.2
A.13.1.2 | Commandment #6
Commandment #7
Commandment #8 | SC-20
SC-21
SC-22
SC-23
SC-24 | 17.1 | PA3
PA8
PA16 | BSGP
BSGP
SGP |
| 270 | IS-31 | STA-03.2 | MY | Do you provide tenants with capacity planning and use reports? | As STA-03.1 above. | Yes | COBIT 4.1 DS5.10 | A.6.2.3
A.10.6.2 | NIST SP800-53 R3 SC-20
NIST SP800-53 R3 SC-21
NIST SP800-53 R3 SC-22
NIST SP800-53 R3 SC-23
NIST SP800-53 R3 SC-24 |
| 271 | Supply Chain Management, Transparency and Accountability
Provider Internal Assessments | STA-04 | STA-04.1 | MY | The provider shall perform annual internal assessments of conformance and effectiveness of its policies, procedures, and supporting measures and metrics. | Do you perform annual internal assessments of conformance and effectiveness of your policies, procedures, and supporting measures and metrics? | ACME has a dedicated Governance, Risk and Compliance (GRC) team. Internal audits are perfomed periodically throughout the year. ACME does not provide information regarding audit findings externally. Aditionally, multiple customer audits covering all relevant areas are performed throughout the year.
Please refer to the Internal Compliance Audit SOP here: https://community.ACME.com/community?id=community_article&sys_id=2e7ca2e1dbd0dbc01dcaf3231f9619c5 | Yes | MEA01
MEA02 | SRM > Governance Risk & Compliance > Vendor Management | provider | x | Domain 2 | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
A.18.2.3 | 12.1.1 |
| 272 | Supply Chain Management, Transparency and Accountability
Third Party Agreements | STA-05 | STA-05.1 | MY | Supply chain agreements (e.g., SLAs) between providers and customers (tenants) shall incorporate at least the following mutually-agreed upon provisions and/or terms:
• Scope of business relationship and services offered (e.g., customer (tenant) data acquisition, exchange and usage, feature sets and functionality, personnel and infrastructure network and systems components for service delivery and support, roles and responsibilities of provider and customer (tenant) and any subcontracted or outsourced business relationships, physical geographical location of hosted services, and any known regulatory compliance considerations)
• Information security requirements, provider and customer (tenant) primary points of contact for the duration of the business relationship, and references to detailed supporting and relevant business processes and technical measures implemented to enable effectively governance, risk management, assurance and legal, statutory and regulatory compliance obligations by all impacted business relationships
• Notification and/or pre-authorization of any changes controlled by the provider with customer (tenant) impacts
• Timely notification of a security incident (or confirmed breach) to all customers (tenants) and other business relationships impacted (i.e., up- and down-stream impacted supply chain)
• Assessment and independent verification of compliance with agreement provisions and/or terms (e.g., industry-acceptable certification, attestation audit report, or equivalent forms of assurance) without posing an unacceptable business risk of exposure to the organization being assessed
• Expiration of the business relationship and treatment of customer (tenant) data impacted
• Customer (tenant) service-to-service application (API) and data interoperability and portability requirements for application development and information exchange, usage, and integrity persistence | Do you select and monitor outsourced providers in compliance with laws in the country where the data is processed, stored and transmitted? | ACME does not make use of outsourced providers for the processing and storage of data. ACME's only major outsource providers are its data centers however they only provide physical security, power, air-conditioning and network access. They play no role in the storage or processing of data. | Not Applicable | S2.2.0
A3.6.0
C3.6.0 | (S2.2.0) The availability, confidentiality of data, processing integrity, system security and related security obligations of users and the entity’s availability and related security commitments to users are communicated to authorized users.
(A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers.
(C3.6.0) The entity has procedures to obtain assurance or representation that the confidentiality policies of third parties to whom information is transferred and upon which the entity relies are in conformity with the entity’s defined system confidentiality and related security policies and that the third party is in compliance with its policies. | CC2.2
CC2.3
CC5.5
C1.4
C1.5 | C.2 | C.2.4, C.2.6, G.4.1, G.16.3 | 74 (B)
75 (C+, A+)
45 (B)
75 (C+, A+)
79 (B)
4 (C+, A+) | Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.3 | LG-02 | COBIT 4.1 DS5.11 | APO09.03
APO09.05
| 312.3, 312.8 and 312.10 | BOSS > Legal Services > Contracts | shared | x | Domain 3 | 6.02. (e)
6.10. (h)
6.10. (i) | Article 17 (3) | NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SA-9 | NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 MP-5
NIST SP 800-53 R3 MP-5 (2)
NIST SP 800-53 R3 MP-5 (4)
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1) | 1.2.5 | A.6.2.3
A10.2.1
A.10.8.2
A.11.4.6
A.11.6.1
A.12.3.1
A.12.5.4 | A.15.1.2,
8.1* partial,
A.13.2.2,
A.9.4.1
A.10.1.1 | ITAR 22 CFR § 120.17
EAR 15 CFR §736.2 (b) | Commandment #1
Commandment #4
Commandment #5
Commandment #6
Commandment #7
Commandment #8 | Chapter II
Article 14. | CA-3
MP-5
PS-7
SA-6
SA-7
SA-9 | 5.2
2.2 | PCI DSS v2.0 2.4
PCI DSS v2.0 12.8.2 | 2.4
12.8.2 |
| 273 | LG-02 | STA-05.2 | MY | Do you select and monitor outsourced providers in compliance with laws in the country where the data originates? | ACME's customers would not typically inform us of the location that data originated, and have no need to do so. | Not Applicable |
| 274 | LG-02 | STA-05.3 | MY | Does legal counsel review all third-party agreements? | ACME's legal team will review all contracts including those from vendors. Internal audit and compliance group is responsible for reviewing ACME procedures for compliance as part of the 3rd party vendor management program. | Yes |
| 275 | STA-05.4 | MY | Do third-party agreements include provision for the security and protection of information and assets? | ACME uses third party datacenter vendors to host its services to customers. ACME uses the 3rd party datacenter for environmental and physical security controls. ACME equipment is stored in bio-metrically locked cages within these datacenters, that only ACME employees have access to, except for the co-location provider for emergency purposes.
ACME does not allow the storing of customer data on unapproved systems and access to customer is limited to those with a business need. The customer is responsible for the management of their customer data within their customer instance.
Please refer to the Data Center Third Party Attestations here: https://community.ACME.com/community?id=community_topic&sys_id=94495e2ddbd897c068c1fb651f9619eb | Yes |
| 276 | STA-05.5 | MY | Do you provide the client with a list and copies of all subprocessing agreements and keep this updated? | ACME does not provide this information to its customers as no sub-processors are used to support the customer environment. However, ACME performs annual tests over high risk vendors such as co-location datacenters to ensure service level agreements are being met. | Not Applicable |
| 277 | Supply Chain Management, Transparency and Accountability
Supply Chain Governance Reviews | STA-06 | STA-06.1 | MY | Providers shall review the risk management and governance processes of their partners so that practices are consistent and aligned to account for risks inherited from other members of that partner's cloud supply chain. | Do you review the risk management and governanced processes of partners to account for risks inherited from other members of that partner's supply chain? | ACME's Vendor Security Risk Assessment (VSRA) Program ensures that vendors have appropriate security controls and business disciplines in place to effectively minimize risks to themselves, to ACME, and to customers of ACME. The VSRA process begins with a pre-assessment that is used to identify the assets that will be involved and to determine the level of assessment to be performed; each assessment is tailored for the type of service and assets that will be involved. The Compliance team works with the vendor and internal business owner to gather information to address the controls identified for the assessment. The output of this assessment is reflected in a Vendor Risk Assessment Report, which is used as an input to contract language. On an annual basis, active existing vendors will be reviewed for change in scope and status of security controls to ensure no new risks have been introduced and all existing risks are addressed.
ACME does not enforce its internal security policies and procedures on its third party vendors; where appropriate, ACME reviews independent, third party attestations and/or certifications (e.g. ISO 27001, SOC 1, SOC 2) to ensure that the vendor's information security program is operating effectively.
Please refer to the VSRA SOP here: https://community.ACME.com/community?id=community_article&sys_id=ebfca6a5dbd0dbc01dcaf3231f961993 | Yes | APO10.04
APO10.05
MEA01 | SRM > Governance Risk & Compliance > Vendor Management | provider | x | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f) | 12.8.4 |
| 278 | Supply Chain Management, Transparency and Accountability
Supply Chain Metrics | STA-07 | STA-07.1 | MY | Policies and procedures shall be implemented to ensure the consistent review of service agreements (e.g., SLAs) between providers and customers (tenants) across the relevant supply chain (upstream/downstream).
Reviews shall performed at least annually and identity non-conformance to established agreements. The reviews should result in actions to address service-level conflicts or inconsistencies resulting from disparate supplier relationships. | Are policies and procedures established, and supporting business processes and technical measures implemented, for maintaining complete, accurate and relevant agreements (e.g., SLAs) between providers and customers (tenants)? | There is no direct connections between ACME's customers and its providers that would be relevant to the SLAs that ACME provides. | Not Applicable | 51 (B) | APO01.03
APO09.03
APO09.04
APO09.05
APO10.01
APO10.03
APO10.04
| ITOS > Service Delivery > Service Level Management - Vendor Management | provider | x | Domain 3 | 6.02. (c)
6.02. (d)
6.07.01. (k) | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f) |
| 279 | STA-07.2 | MY | Do you have the ability to measure and address non-conformance of provisions and/or terms across the entire supply chain (upstream/downstream)? | As STA-06.1 above. | Yes |
| 280 | STA-07.3 | MY | Can you manage service-level conflicts or inconsistencies resulting from disparate supplier relationships? | ACME has process and procedures in places to handle and maintenance procedures activities within our data centers. ACME works with our suppliers to have replacement parts ready if a when need based on contractual SLAs. | Yes |
| 281 | STA-07.4 | MY | Do you review all agreements, policies and processes at least annually? | As STA-06.1 above. | Yes |
| 282 | Supply Chain Management, Transparency and Accountability
Third Party Assessment | STA-08 | STA-08.1 | MY | Providers shall assure reasonable information security across their information supply chain by performing an annual review. The review shall include all partners/third party providers upon which their information supply chain depends on. | Do you assure reasonable information security across your information supply chain by performing an annual review? | As STA-06.1 above. | Yes | APO09.03
MEA01
MEA02 | SRM > Governance Risk & Compliance > Vendor Management | provider | x | Domain 2 | Clause
6.1.1,
6.1.1(e)(2)
6.1.2
6.1.2(a)(1)
6.1.2(a)(2),
6.1.2(b)
6.1.2 (c)
6.1.2(c)(1),
6.1.2(c)(2)
6.1.2(d)
6.1.2(d)(1)
6.1.2(d)(2)
6.1.2(d)(3)
6.1.2(e)
6.1.2(e)(1)
6.1.2(e)(2)
6.1.3,
6.1.3(a)
6.1.3(b)
8.1
8.3
9.3(a),
9.3(b)
9.3(b)(f)
9.3(c)
9.3(c)(1)
9.3(c)(2)
9.3(c)(3)
9.3(d)
9.3(e)
9.3(f) |
| 283 | STA-8.2 | MY | Does your annual review include all partners/third-party providers upon which your information supply chain depends? | As STA-06.1 above. | Yes |
| 284 | Supply Chain Management, Transparency and Accountability
Third Party Audits | STA-09 | STA-09.1 | MY | Third-party service providers shall demonstrate compliance with information security and confidentiality, access control, service definitions, and delivery level agreements included in third-party contracts. Third-party reports, records, and services shall undergo audit and review at least annually to govern and maintain compliance with the service delivery agreements. | Do you permit tenants to perform independent vulnerability assessments? | ACME performs internal network security scans on a weekly basis and external scans on a daily basis. ACME also contracts a third party vendor to perform an annual comprehensive penetration test on the platform and environment to identify risks and remediation that help increase the security posture. The last 3rd party review was performed in Feb 2014. ACME for security reasons does not share any findings or results to our customers.
Customer can request a one-penetration test a year. Please refer to HI KB0538598 for more information.
Please refer to the Vulnerability Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=6dec2e65dbd0dbc01dcaf3231f961918 | Yes | S3.1.0
x3.1.0 | (S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats.
(x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operations that would impair system [availability, processing integrity, confidentiality] commitments and (2) assess the risks associated with the identified threats. | CC2.2
CC2.3
C1.4
C1.5
| L.1, L.2, L.4, L.7, L.9 | 76 (B)
77 (B)
78 (B)
83 (B)
84 (B)
85 (B) | CO-05 | COBIT 4.1 ME 2.6, DS 2.1, DS 2.4 | APO01.08
APO10.05
MEA02.01 | 312.2(a) and 312.3 (Prohibition on Disclosure) | BOSS > Compliance > Third-Party Audits | shared | x | Domain 2, 4 | 6.10. (a)
6.10. (b)
6.10. (c)
6.10. (d)
6.10. (e)
6.10. (f)
6.10. (g)
6.10. (h)
6.10. (i) | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SI-1 | NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-1 | 1.2.2
1.2.4
1.2.6
1.2.11
3.2.4
5.2.1 | 45 CFR 164.308(b)(1) (New)
45 CFR 164.308 (b)(4) | A.6.2.3
A.10.2.1
A.10.2.2
A.10.6.2 | A.15.1.2
8.1* partial,
8.1* partial, A.15.2.1
A.13.1.2 | Commandment #1
Commandment #2
Commandment #3 | Chapter II
Article 14, 21
Chapter III
Article 25
Chapter V
Article 36 | AC-1
AT-1
AU-1
CA-1
CM-1
CP-1
IA-1
IA-7
IR-1
MA-1
MP-1
PE-1
PL-1
PM-1
PS-1
RA-1
RA-2
SA-1
SA-6
SC-1
SC-13
SI-1 | 5.4 | PCI DSS v2.0 2.4
PCI DSS v2.0 12.8.2
PCI DSS v2.0 12.8.3
PCI DSS v2.0 12.8.4
Appendix A | 2.4
12.8.2
12.8.3
12.8.4
Appendix A |
| 285 | STA-09.2 | MY | Do you have external third party services conduct vulnerability scans and periodic penetration tests on your applications and networks? | ACME performs nightly perimeter port scans, daily vulnerability scans, and weekly authenticated scans of all systems within the data center environments.
ACME incorporates integrated application penetration testing into our software development lifecycle. ACME contracts out our 3rd party application penetration testing who performs continuous loop testing on a nightly build instance. This 3rd party uses a combination of manual and automated penetration testing methods using a customized test harness specific to our platform.
ACME has defined process for managing vulnerabilities including patches. Vulnerabilities as and when identified, are categorized based on its criticality, and acted upon appropriately.
Please refer to the Vulnerability Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=6dec2e65dbd0dbc01dcaf3231f961918
Please refer to the Third Party Pen Test Summary Reports here: https://community.ACME.com/community?id=community_topic&sys_id=ec499e2ddbd897c068c1fb651f96192c | Yes | COBIT 4.1 ME 2.6, DS 2.1, DS 2.4 | 45 CFR 164.308(b)(1) (New)
45 CFR 164.308 (b)(4) | A.6.2.3
A.10.2.1
A.10.2.2
A.10.6.2 | NIST SP800-53 R3 CA-3
NIST SP800-53 R3 SA-9
NIST SP800-53 R3 SA-12
NIST SP800-53 R3 SC-7 | PCI DSS v2.0 2.4
PCI DSS v2.0 12.8.2
PCI DSS v2.0 12.8.3
PCI DSS v2.0 12.8.4
Appendix A |
| 286 | Threat and Vulnerbility Management
Antivirus / Malicious Software | TVM-01 | TVM-01.1 | MY | Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of malware on organizationally-owned or managed user end-point devices (i.e., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. | Do you have anti-malware programs that support or connect to your cloud service offerings installed on all of your systems?
(IS-21.1: Do you have anti-malware programs installed on all systems which support your cloud service offerings?) | ACME does not monitor its customer's instances for malware, as ACME maintains a data agnostic stance and neither views its customers data transactions nor attempts to determine legitimate information. As stated, ACME's production servers use an antivirus tool to monitor the servers for malware.
But, ACME does not monitor the customer instance for malware. ACME neither monitors for malware within the customer instance's contents nor specifically prevents the customer for transmitting malware to/from their instance | Yes | S3.5.0 | (S3.5.0) Procedures exist to protect against infection by computer viruses, malicious codes, and unauthorized software. | CC5.8 | G.7 | 17 (B) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-21 | COBIT 4.1 DS5.9 | APO01.03
APO13.01
APO13.02
DSS05.01 | 312.8 and 312.10 | SRM > Infrastructure Protection Services > Anti-Virus | shared | x | Domain 2 | 6.03. (f) | Article 17 | NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-5 | NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)
NIST SP 800-53 R3 SI-8 | 8.2.2 | 45 CFR 164.308 (a)(5)(ii)(B) | A.10.4.1 | A.12.2.1 | Commandment #4
Commandment #5 | CIP-007-3 - R4 - R4.1 - R4.2 | SA-7
SC-5
SI-3
SI-5
SI-7
SI-8 | 14.1
17.6 | PA1 | BSGP | PCI-DSS v2.0 5.1
PCI-DSS v2.0 5.1.1
PCI-DSS v2.0 5.2 | 1.4, 5.0 |
| 287 | IS-21 | TVM-01.2 | MY | Do you ensure that security threat detection systems (which) using signatures, lists or behavioral patterns are updated across all infrastructure components within industry accepted time frames?
| ACME incorporates approved antivirus and anti-malware software on workstations and servers. It is deployed and configured for central policy control by IT operations. Antivirus and anti-malware signatures are updated at least daily.
For production servers located at the secured data center, ACME uses a host-based antivirus solution to prevent virus and malware infections. It is deployed and configured for central policy control by Cloud Operations.
The antivirus client is configured to perform weekly antivirus scans and detection of malicious code, authorize white/black listings of files and directories. The Antivirus event logs are imported in to Splunk for further analysis. The antivirus solution takes remediation actions to quarantine or eradicate malicious code (i.e., virus, worms, and Trojan horses) in response to malicious code detection. | Yes | COBIT 4.1 DS5.9 | 45 CFR 164.308 (a)(5)(ii)(B) | A.10.4.1 | NIST SP800-53 R3 SA-7
NIST SP800-53 R3 SC-5
NIST SP800-53 R3 SI-3
NIST SP800-53 R3 SI-5
NIST SP800-53 R3 SI-7
NIST SP800-53 R3 SI-8 | PCI-DSS v2.0 5.1
PCI-DSS v2.0 5.1.1
PCI-DSS v2.0 5.2 |
| 288 | Threat and Vulnerbility Management
Vulnerability / Patch Management | TVM-02 | TVM-02.1 | MY | Policies and procedures shall be established, and supporting processes and technical measures implemented, for timely detection of vulnerabilities within organizationally-owned or managed applications, infrastructure network and system components (e.g. network vulnerability assessment, penetration testing) to ensure the efficiency of implemented security controls. A risk-based model for prioritizing remediation of identified vulnerabilities shall be used. Changes shall be managed through a change management process for all vendor-supplied patches, configuration changes, or changes to the organization's internally developed software. Upon request, the provider informs customer (tenant) of policies and procedures and identified weaknesses especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control. | Do you conduct network-layer vulnerability scans regularly as prescribed by industry best practices? | As STA-09.1 here. | Yes | S3.10.0 | (S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies to enable authorized access and to prevent unauthorized access. | CC7.1 | I.4 | G.15.2, I.3 | 32 (B)
33 (B) | Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 | IS-20 | COBIT 4.1 AI6.1
COBIT 4.1 AI3.3
COBIT 4.1 DS5.9 | APO01.03
APO13.01
APO13.02
BAI06.01
BAI06.02
BAI06.03
BAI06.04
DSS01.01
DSS01.02
DSS01.03
DSS03.05
DSS05.01
DSS05.03
DSS05.07 | 312.8 and 312.10 | SRM > Threat and Vulnerability Management > Vulnerability Management | shared | x | Domain 2 | 6.03.02. (a)
6.03.02. (b)
6.03.05. (c)
6.07.01. (o) | Article 17 | NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-5 | NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 RA-5 (1)
NIST SP 800-53 R3 RA-5 (2)
NIST SP 800-53 R3 RA-5 (3)
NIST SP 800-53 R3 RA-5 (6)
NIST SP 800-53 R3 RA-5 (9)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-5 | 1.2.6
8.2.7 | 45 CFR 164.308 (a)(1)(i)(ii)(A)
45 CFR 164.308 (a)(1)(i)(ii)(B)
45 CFR 164.308 (a)(5)(i)(ii)(B) | A.12.5.1
A.12.5.2
A.12.6.1 | 8.1*partial, A.14.2.2,
8.1*partial, A.14.2.3
A.12.6.1 | Commandment #4
Commandment #5 | CIP-004-3 R4 - 4.1 - 4.2
CIP-005-3a - R1 - R1.1
CIP-007-3 - R3 - R3.1 - R8.4 | CM-3
CM-4
CP-10
RA-5
SA-7
SI-1
SI-2
SI-5 | 12.4
14.1 | PA2
PA8 | BSGP
| PCI-DSS v2.0 2.2
PCI-DSS v2.0 6.1
PCI-DSS v2.0 6.2
PCI-DSS v2.0 6.3.2
PCI-DSS v2.0 6.4.5
PCI-DSS v2.0 6.5.X
PCI-DSS v2.0 6.6
PCI-DSS v2.0 11.2
PCI-DSS v2.0 11.2.1
PCI-DSS v2.0 11.2.2
PCI-DSS v2.0 11.2.3 | 2.2
6.1
6.2
6.3.2
6.4.5
6.5
6.6
11.2
11.2.1
11.2.2
11.2.3 |
| 289 | IS-20 | TVM-02.2 | MY | Do you conduct application-layer vulnerability scans regularly as prescribed by industry best practices? | ACME's application penetration testing program has four aspects:
1) ACME conducts 3rd party, continuous loop testing on a ACME instance where developers check in their code as it is completed.
2) ACME uses commercially available penetration-testing tool to conduct both formal and informal penetration testing during the SDLC
3) The third and most intensive phase is its major release penetration testing. A third party organization is given an extended period of time and access to the resources necessary to test ACME's security and occurs in two rounds. At the end of the first round of testing any issues discovered are entered into ACME problem resolution process with issues categorized as High or Critical requiring attention. At the end of the development and remediation cycle, a second round of testing is conducted again to confirm the remediation or mitigation of the discovered issues.
4) The final and most important aspect of ACME's penetration testing regime is its customer penetration-testing program. Existing customers, through a documented approval process, are permitted to perform an annual application level penetration test. The testing must be approved and conducted at a time that is agreed upon by ACME to allow ACME to continue to conduct its monitoring activities and be able to determine potential real attacks from authorized customer activities. Customers must upgrade their instances to the latest release and follow ACME's hardening guide before conducting any penetration testing to avoid large scale reporting of previously fixed issues. The customer must share all results with ACME's Application Security team.
Please refer to the Application Vulnerability Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=3ebc6e25dbd0dbc01dcaf3231f961902 | Yes | COBIT 4.1 AI6.1
COBIT 4.1 AI3.3
COBIT 4.1 DS5.9 | 45 CFR 164.308 (a)(1)(i)(ii)(A)
45 CFR 164.308 (a)(1)(i)(ii)(B)
45 CFR 164.308 (a)(5)(i)(ii)(B) | A.12.5.1
A.12.5.2
A.12.6.1 | NIST SP800-53 R3 CM-3
NIST SP800-53 R3 CM-4
NIST SP800-53 R3 CP-10
NIST SP800-53 R3 RA-5
NIST SP800-53 R3 SA-7
NIST SP800-53 R3 SI-1
NIST SP800-53 R3 SI-2
NIST SP800-53 R3 SI-5 | PCI-DSS v2.0 2.2
PCI-DSS v2.0 6.1
PCI-DSS v2.0 6.2
PCI-DSS v2.0 6.3.2
PCI-DSS v2.0 6.4.5
PCI-DSS v2.0 6.5.X
PCI-DSS v2.0 6.6
PCI-DSS v2.0 11.2
PCI-DSS v2.0 11.2.1
PCI-DSS v2.0 11.2.2
PCI-DSS v2.0 11.2.3 |
| 290 | IS-20 | TVM-02.3 | MY | Do you conduct local operating system-layer vulnerability scans regularly as prescribed by industry best practices? | ACME performs internal network security scans on a weekly basis and external scans on a daily basis.
ACME leverages the scanning tool Qualys to perform internal network security scans on a weekly basis and external scans on a daily basis. The Security Engineering team reviews and triages identified vulnerabilities based on their associated risks to the environment. Vulnerabilities are assigned with priorities and sent to the respective Engineering teams for remediation.
Please refer to the Cloud Vulnerability Management SOP here: https://community.ACME.com/community?id=community_article&sys_id=6dec2e65dbd0dbc01dcaf3231f961918 | Yes | COBIT 4.1 AI6.1
COBIT 4.1 AI3.3
COBIT 4.1 DS5.9 | 45 CFR 164.308 (a)(1)(i)(ii)(A)
45 CFR 164.308 (a)(1)(i)(ii)(B)
45 CFR 164.308 (a)(5)(i)(ii)(B) | A.12.5.1
A.12.5.2
A.12.6.1 | NIST SP800-53 R3 CM-3
NIST SP800-53 R3 CM-4
NIST SP800-53 R3 CP-10
NIST SP800-53 R3 RA-5
NIST SP800-53 R3 SA-7
NIST SP800-53 R3 SI-1
NIST SP800-53 R3 SI-2
NIST SP800-53 R3 SI-5 | PCI-DSS v2.0 2.2
PCI-DSS v2.0 6.1
PCI-DSS v2.0 6.2
PCI-DSS v2.0 6.3.2
PCI-DSS v2.0 6.4.5
PCI-DSS v2.0 6.5.X
PCI-DSS v2.0 6.6
PCI-DSS v2.0 11.2
PCI-DSS v2.0 11.2.1
PCI-DSS v2.0 11.2.2
PCI-DSS v2.0 11.2.3 |
| 291 | IS-20 | TVM-02.4 | MY | Will you make the results of vulnerability scans available to tenants at their request? | ACME executes a network penetration test at least once per year. ACME provides executive summaries of its third party pen tests here: https://community.ACME.com/community?id=community_topic&sys_id=ec499e2ddbd897c068c1fb651f96192c | Yes | COBIT 4.1 AI6.1
COBIT 4.1 AI3.3
COBIT 4.1 DS5.9 | 45 CFR 164.308 (a)(1)(i)(ii)(A)
45 CFR 164.308 (a)(1)(i)(ii)(B)
45 CFR 164.308 (a)(5)(i)(ii)(B) | A.12.5.1
A.12.5.2
A.12.6.1 | NIST SP800-53 R3 CM-3
NIST SP800-53 R3 CM-4
NIST SP800-53 R3 CP-10
NIST SP800-53 R3 RA-5
NIST SP800-53 R3 SA-7
NIST SP800-53 R3 SI-1
NIST SP800-53 R3 SI-2
NIST SP800-53 R3 SI-5 | PCI-DSS v2.0 2.2
PCI-DSS v2.0 6.1
PCI-DSS v2.0 6.2
PCI-DSS v2.0 6.3.2
PCI-DSS v2.0 6.4.5
PCI-DSS v2.0 6.5.X
PCI-DSS v2.0 6.6
PCI-DSS v2.0 11.2
PCI-DSS v2.0 11.2.1
PCI-DSS v2.0 11.2.2
PCI-DSS v2.0 11.2.3 |
| 292 | IS-20 | TVM-02.5 | MY | Do you have a capability to rapidly patch vulnerabilities across all of your computing devices, applications and systems? | ACME Application/Platform Patches:
ACME allows customers to chose patches and upgrades from a list of available patches and upgrade. In addition, ACME runs a Quarterly Patching Process to insure that customers are on the latest general customer-facing patch of their release family.
Infrastructure Patches:
ACME’s Infrastructure stack is customized at each layer to specifically support the ACME product, which is the only product residing in the ACME private cloud. With the small footprint of technology required and the limited ports and services enabled, many system and security patches published do not apply to ACME’s cloud. With each published patch, ACME follows a risk-based approach to determine if the patch is to be deployed. Once it is determined that a patch needs to be deployed, the process then follows the Change Management process to identify the assets, the risk and potential impact to the environment, the testing process as well as the timeline for deployment. ACME leverages the Advanced High Availability architecture to transfer customers’ production instances to the other data center when performing maintenance such as patching, thereby minimizing the impact to availability.
Please refer to the Patching Program SOP here: https://community.ACME.com/community?id=community_article&sys_id=009caae1dbd0dbc01dcaf3231f9619e5 | Yes | COBIT 4.1 AI6.1
COBIT 4.1 AI3.3
COBIT 4.1 DS5.9 | 45 CFR 164.308 (a)(1)(i)(ii)(A)
45 CFR 164.308 (a)(1)(i)(ii)(B)
45 CFR 164.308 (a)(5)(i)(ii)(B) | A.12.5.1
A.12.5.2
A.12.6.1 | NIST SP800-53 R3 CM-3
NIST SP800-53 R3 CM-4
NIST SP800-53 R3 CP-10
NIST SP800-53 R3 RA-5
NIST SP800-53 R3 SA-7
NIST SP800-53 R3 SI-1
NIST SP800-53 R3 SI-2
NIST SP800-53 R3 SI-5 | PCI-DSS v2.0 2.2
PCI-DSS v2.0 6.1
PCI-DSS v2.0 6.2
PCI-DSS v2.0 6.3.2
PCI-DSS v2.0 6.4.5
PCI-DSS v2.0 6.5.X
PCI-DSS v2.0 6.6
PCI-DSS v2.0 11.2
PCI-DSS v2.0 11.2.1
PCI-DSS v2.0 11.2.2
PCI-DSS v2.0 11.2.3 |
| 293 | IS-20 | TVM-02.6 | MY | Will you provide your risk-based systems patching time frames to your tenants upon request? | As TVM-02.5 above. | Yes | COBIT 4.1 AI6.1
COBIT 4.1 AI3.3
COBIT 4.1 DS5.9 | 45 CFR 164.308 (a)(1)(i)(ii)(A)
45 CFR 164.308 (a)(1)(i)(ii)(B)
45 CFR 164.308 (a)(5)(i)(ii)(B) | A.12.5.1
A.12.5.2
A.12.6.1 | NIST SP800-53 R3 CM-3
NIST SP800-53 R3 CM-4
NIST SP800-53 R3 CP-10
NIST SP800-53 R3 RA-5
NIST SP800-53 R3 SA-7
NIST SP800-53 R3 SI-1
NIST SP800-53 R3 SI-2
NIST SP800-53 R3 SI-5 | PCI-DSS v2.0 2.2
PCI-DSS v2.0 6.1
PCI-DSS v2.0 6.2
PCI-DSS v2.0 6.3.2
PCI-DSS v2.0 6.4.5
PCI-DSS v2.0 6.5.X
PCI-DSS v2.0 6.6
PCI-DSS v2.0 11.2
PCI-DSS v2.0 11.2.1
PCI-DSS v2.0 11.2.2
PCI-DSS v2.0 11.2.3 |
| 294 | Threat and Vulnerbility Management
Mobile Code | TVM-03 | TVM-03.1 | MY | Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of unauthorized mobile code, defined as software transferred between systems over a trusted or untrusted network and executed on a local system without explicit installation or execution by the recipient, on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. | Is mobile code authorized before its installation and use, and the code configuration checked, to ensure that the authorized mobile code operates according to a clearly defined security policy?
| The ACME platform uses both client and server side JavaScript.
ACME has coding standards for its developers on the creation of mobile code and the organization trains its developers in the use of the proper coding standards. ACME, builds into its platform the technologies to prevent cross - site script forgery and malicious code injection. Code reviews are performed to monitor assess and detect vulnerable code during development. The use of mobile code can be disabled on client browsers.
Additionally, mobile code can be disabled on client browsers.
Please refer to Product Documentation here: http://www.docs.ACME.com | Yes | S3.4.0
S3.10.0 | (S3.4.0) Procedures exist to protect against infection by computer viruses, malicious code, and unauthorized software.
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies to enable authorized access and to prevent unauthorized access. | CC5.6
CC7.1 | G.20.12, I.2.5 | SA-15 | APO01.03
APO13.01
APO13.02
DSS05.01
DSS05.02
DSS05.03
DSS05.04 | 312.8 and 312.10 | SRM > Infrastructure Protection Services > End Point - White Listing | shared | x | Domain 10 | 6.03. (g) | Article 17 | A.10.4.2
A.12.2.2 | A.12.2.1 | Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment #11 | SC-18 | 3
3.1
3.2
3.3
3.4
3.5 |
| 295 | SA-15 | TVM-03.2 | MY | Is all unauthorized mobile code prevented from executing? | The ACME platform uses both client and server side JavaScript.
ACME, Inc. has coding standards for its developers on the creation of mobile code.
The organization trains its developers in the use of the proper coding standards. ACME, Inc. builds into its platform the technologies to prevent cross - site script forgery and malicious code injection. Codes reviews are performed to monitor assess and detect vulnerable code during development. The use of mobile code can be disabled on client browsers. | No | A.10.4.2
A.12.2.2 | NIST SP800-53 R3 SC-18 |
| 296 |
| 297 | © Copyright 2018 Cloud Security Alliance - All rights reserved. You may download, store, display on your computer, view, print, and link to the Cloud Security Alliance “Consensus Assessments Initiative Questionnaire CAIQ Version 3.0.1” at http://www.cloudsecurityalliance.org subject to the following: (a) the Consensus Assessments Initiative Questionnaire v3.0.1 may be used solely for your personal, informational, non-commercial use; (b) the Consensus Assessments Initiative Questionnaire v3.0.1 may not be modified or altered in any way; (c) the Consensus Assessments Initiative Questionnaire v3.0.1 may not be redistributed; and (d) the trademark, copyright or other notices may not be removed. You may quote portions of the Consensus Assessments Initiative Questionnaire v3.0.1 as permitted by the Fair Use provisions of the United States Copyright Act, provided that you attribute the portions to the Cloud Security Alliance Cloud Consensus Assessments Initiative Questionnaire 3.0.1 (2014). If you are interested in obtaining a license to this material for other usages not addresses in the copyright notice, please contact [email protected]. |
ChristianaKorir
CAIQ_ACME_Corp.xlsx
