Do you make security incident information available to all affected customers and providers periodically through electronic methods (e.g., portals)?
Do you make security incident information available to all affected customers and providers periodically through electronic methods (e.g., portals)?
What data monitoring tools are available and is there support for using external monitoring tools?
What data monitoring tools are available and is there support for using external monitoring tools?
Do you use content monitoring and filtering to detect inappropriate data flows?
Do you use content monitoring and filtering to detect inappropriate data flows?
What are the data backup and data archiving procedures? Is it secured?
What are the data backup and data archiving procedures? Is it secured?
Is there a provision for customer definable backup and Retention Periods of data?
Is there a provision for customer definable backup and Retention Periods of data?
Is the data stored in the database and is transit scrambled?
Is the data stored in the database and is transit scrambled?
Is the client data used for testing purposes?
Is the client data used for testing purposes?
In the case of confirmed security incidents targeted at TCCC, do you provide immediate notification to KO-CIRT?
In the case of confirmed security incidents targeted at TCCC, do you provide immediate notification to KO-CIRT?
Do you provide tenants with documentation describing your Information Security Management Program (ISMP)?
Do you provide tenants with documentation describing your Information Security Management Program (ISMP)?
Do you review your Information Security Management Program (ISMP) at least once a year?
Do you review your Information Security Management Program (ISMP) at least once a year?
Please provide your Information Security Policy and Privacy Policy.
Please provide your Information Security Policy and Privacy Policy.
Do you ensure your providers adhere to your information security and privacy policies?
Do you ensure your providers adhere to your information security and privacy policies?
Do you follow OWASP (Open Web Application Security Project) guidelines for application development?
Do you follow OWASP (Open Web Application Security Project) guidelines for application development?
Are all identified security, contractual, and regulatory requirements for customer access contractually addressed and remediated prior to granting customers access to data, assets, and information systems?
Are all identified security, contractual, and regulatory requirements for customer access contractually addressed and remediated prior to granting customers access to data, assets, and information systems?
Is MFA (Multi-Factor Authentication) provided as an option?
Is MFA (Multi-Factor Authentication) provided as an option?
Does the product's architecture support continuous operation during upgrades and maintenance windows?
Does the product's architecture support continuous operation during upgrades and maintenance windows?
Does your security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting?
Does your security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting?
Do you have a documented security incident response plan?
Do you have a documented security incident response plan?
Do you monitor and quantify the types, volumes, and impacts on all information security incidents?
Do you monitor and quantify the types, volumes, and impacts on all information security incidents?
Does your incident response plan comply with industry standards for legally admissible chain-of-custody management processes and controls?
Does your incident response plan comply with industry standards for legally admissible chain-of-custody management processes and controls?
Do you use file integrity (host) and network intrusion detection (IDS) tools for you SaaS solution to help facilitate timely detection, an investigation by root cause analysis, and response to incidents?
Do you use file integrity (host) and network intrusion detection (IDS) tools for you SaaS solution to help facilitate timely detection, an investigation by root cause analysis, and response to incidents?
Do you route entire outbound internet traffic through a centralized proxy server?
Do you route entire outbound internet traffic through a centralized proxy server?
Do you monitor cyber threats internally or have taken services from any third party?
Do you monitor cyber threats internally or have taken services from any third party?
Do you assess identified threat for applicability and exposure to your environment?
Do you assess identified threat for applicability and exposure to your environment?
Do you update your cyber security program based on proactive or reactive threat intelligence feeds?
Do you update your cyber security program based on proactive or reactive threat intelligence feeds?
Does your threat feed rely on input from multiple sources?
Does your threat feed rely on input from multiple sources?
Does your incident response plan comply with industry standards for legally admissible chain-of-custody management processes and controls? (2)
Does your incident response plan comply with industry standards for legally admissible chain-of-custody management processes and controls? (2)