System Guides

Supply Chain Security Policy: Documentation of a comprehensive supply chain security policy that outlines the organization's approach to managing information security risks related to ICT suppliers and service providers.

Supplier Selection Criteria: Evidence of established criteria and processes for evaluating and selecting ICT suppliers based on their information security capabilities, compliance with security standards, and track record.

Supplier Contracts and Agreements: Copies of contracts or agreements with ICT suppliers that include specific information security requirements, responsibilities, and obligations.

Information Security Requirements: Documentation of the information security requirements communicated to ICT suppliers, such as security standards, data protection requirements, incident reporting procedures, and access controls.

Supplier Security Assessments: Records of security assessments or audits conducted on ICT suppliers to evaluate their information security practices and identify potential risks.

Incident Management with Suppliers: Evidence of procedures in place for reporting and managing security incidents involving ICT suppliers, including incident response and communication protocols.

Supply Chain Risk Assessment: Documentation of risk assessments conducted to identify and assess potential information security risks associated with the ICT supply chain.

Third-Party Security Assessments: Evidence of third-party assessments or certifications obtained from independent organizations that evaluate the security posture of ICT suppliers.

Continuous Monitoring: Records of ongoing monitoring and evaluation of ICT suppliers' information security practices and performance.

Incident and Issue Tracking: Logs or records of incidents, breaches, or issues related to ICT suppliers and the organization's response and resolution actions.

Training and Awareness: Evidence of training and awareness programs for employees involved in managing the ICT supply chain, emphasizing information security best practices and risk management.

Compliance Documentation: Evidence of compliance with relevant industry regulations, legal requirements, and standards related to information security in the ICT supply chain.

Deletion Policy: Documentation of a formal information deletion policy that outlines the organization's approach to securely and permanently deleting data when it is no longer needed.

Data Retention Schedule: A schedule or plan indicating the retention periods for different types of data and when data should be deleted after it has met its retention requirements.

Deletion Procedures: Detailed procedures and guidelines on how data deletion is carried out, ensuring that data is securely erased from storage media and systems.

Data Deletion Tools and Technologies: Documentation of the data deletion tools and technologies used by the organization to implement secure data erasure, including information about their configuration and integration with relevant systems.

Data Deletion Implementation: Evidence of the successful implementation of data deletion techniques on databases, file systems, and other storage media, including logs or records of data deletion activities.

Verification of Deletion: Processes or mechanisms in place to verify that data has been securely and permanently deleted and cannot be recovered.

Compliance Documentation: Evidence of compliance with data protection regulations and legal requirements related to data deletion and data privacy.

Access Controls: Evidence of access controls and permissions granted to users who have the authority to delete data, ensuring that only authorized individuals can perform data deletion activities.

Training and Awareness: Evidence of training and awareness programs for employees involved in data deletion processes, ensuring they understand the importance of securely deleting data and the potential risks of improper data disposal.

Data Deletion Audit Logs: Logs or records of data deletion activities, changes, and access, as well as any incidents or anomalies related to data deletion.