System Guides

Authorization and Approval: Evidence that the acquisition and use of supporting utilities are authorized and approved by appropriate personnel, and that any changes or updates to these utilities follow the organization's change management process.

Vendor Security Assessments: Records of security assessments conducted on supporting utility vendors to ensure they meet the organization's security requirements and standards.

Vulnerability Management: Evidence of procedures for identifying and addressing vulnerabilities in supporting utilities, such as regular patching and updates to mitigate security risks.

Secure Configuration: Documentation of secure configuration standards for supporting utilities to prevent unauthorized access and ensure they operate in a secure manner.

Access Controls: Proof that access to supporting utilities is restricted to authorized personnel based on the principle of least privilege, and that access rights are regularly reviewed and updated.

Logging and Monitoring: Records of logging and monitoring practices for supporting utilities to detect and respond to any suspicious or malicious activities.

Secure Deployment: Evidence that supporting utilities are deployed securely, following established security guidelines, and that the deployment process is regularly reviewed for security risks.

Encryption and Data Protection: Documentation of encryption or other protective measures implemented to safeguard sensitive data processed or transmitted by supporting utilities.

Data Privacy Compliance: Assurance that supporting utilities comply with data privacy regulations and do not compromise the confidentiality and privacy of personal or sensitive information.

Disaster Recovery and Business Continuity: Proof of disaster recovery and business continuity plans that include provisions for supporting utilities to ensure their availability and functionality during disruptions or emergencies.

Testing and Verification: Evidence of testing and verification processes to ensure the reliability, integrity, and accuracy of supporting utilities.

Secure Data Storage Facilities: Proof of secure storage facilities, such as data centers, server rooms, or physical filing cabinets, with controlled access, environmental controls, and appropriate security measures.

Data Classification and Access Controls: Evidence of data classification practices and access controls that define who can access and modify data stored on different storage media based on the sensitivity and criticality of the information.

Data Encryption: Records of data encryption practices, particularly for data stored on portable storage media like USB drives or external hard disks, to protect against unauthorized access in case of loss or theft.

Media Handling Procedures: Documentation of procedures for the proper handling, transportation, and disposal of storage media to prevent data breaches or accidental exposure of sensitive information.

Media Sanitization and Destruction: Evidence of procedures for securely sanitizing or destroying data stored on storage media that are no longer in use or have reached the end of their lifecycle.

Data Backup and Recovery: Proof of data backup and recovery mechanisms to ensure that critical information is regularly backed up and can be restored in case of data loss or hardware failure

Physical Security Controls: Documentation of physical security controls in place to protect storage media from unauthorized access, theft, or damage, such as locked cabinets, access control systems, and surveillance.

Inventory Management: Records of inventory management practices to keep track of all storage media, including their location, status, and purpose.

Compliance with Regulations: Assurance that the organization's storage media practices comply with relevant legal and regulatory requirements related to data protection and privacy.

Employee Training and Awareness: Evidence of training and awareness programs provided to employees on data storage best practices and the importance of securely handling storage media.