System Guides

A.5.19 Information Security in Supplier Relationships would include:

1. Supplier Assessment Process: Documentation outlining the process of assessing potential suppliers' information security practices before entering into a business relationship.

2. Supplier Selection Criteria: Records indicating the criteria used to evaluate and select suppliers based on their information security capabilities and practices.

3. Contracts and Agreements: Copies of contracts, agreements, or terms and conditions that include clauses related to information security requirements, responsibilities, and expectations for suppliers.

4. Due Diligence Documentation: Evidence of due diligence activities performed to verify suppliers' information security practices, such as security audits, questionnaires, or site visits.

5. Risk Assessment: Documentation of risk assessments conducted to identify and evaluate the potential information security risks associated with each supplier and the steps taken to mitigate those risks.

6. Information Sharing Agreements: Records of agreements specifying how sensitive information will be shared, protected, and managed between the organization and its suppliers.

7. Security Controls in Supplier Agreements: Documentation of security controls required from suppliers to ensure the protection of the organization's data and information assets.

8. Incident Response Plans: Proof that suppliers are required to have incident response plans in place to address and report security incidents promptly.

9. Monitoring and Reporting: Evidence of mechanisms in place to monitor the information security practices of suppliers and mechanisms for reporting any breaches or incidents.

10. Supplier Compliance Audits: Records of audits or assessments conducted to verify supplier compliance with the agreed-upon information security requirements.

11. Supplier Training and Awareness: Documentation of initiatives to train and raise awareness among suppliers about the organization's information security policies and expectations.

12. Business Continuity and Disaster Recovery: Documentation of supplier plans and capabilities to ensure business continuity and disaster recovery in case of disruptions.

13. Termination and Transition Plans: Evidence of plans outlining how information security will be managed during the termination or transition of supplier relationships.

14. Incident Sharing and Collaboration: Proof of mechanisms to collaborate with suppliers on information security incidents and vulnerabilities for timely mitigation.

15. Third-Party Security Assessments: Records of third-party assessments conducted by independent auditors to verify the security practices of critical suppliers.

By reviewing these pieces of evidence, an auditor can assess whether the organization has established effective processes, controls, and agreements to ensure that its suppliers adhere to information security requirements and contribute to a secure business environment.

A.5.18 Access Rights would include:

1. Access Control Policy: Documentation of an access control policy that outlines the principles and guidelines for granting and managing access rights to information assets and resources.

2. User Roles and Responsibilities: Documentation of defined user roles and their corresponding responsibilities, including permissions, privileges, and restrictions associated with each role.

3. User Access Requests: Records of user access requests, including the process followed for requesting access, approval workflows, and documentation of authorized access.

4. Access Provisioning and De-provisioning: Evidence of processes and procedures for provisioning new users with appropriate access rights and promptly de-provisioning access when employees change roles, leave the organization, or no longer require access.

5. Least Privilege Principle: Documentation of the implementation of the least privilege principle, ensuring that users are granted the minimum necessary access required to perform their job tasks.

6. Separation of Duties: Documentation of how access rights are allocated to prevent conflicts of interest and fraud, ensuring that no single user has excessive access to critical functions.

7. Access Reviews and Audits: Records of periodic access reviews and audits conducted to ensure that access rights remain appropriate and aligned with job roles and responsibilities.

8. Access Control Mechanisms: Documentation of technical controls used to enforce access rights, such as access control lists (ACLs), role-based access control (RBAC), and attribute-based access control (ABAC) mechanisms.

9. User Account Management: Proof of mechanisms to manage user accounts, including account creation, modification, suspension, reactivation, and account termination.

10. User Authentication: Evidence of authentication mechanisms used to verify the identity of users before granting access, ensuring only authorized users gain entry.

11. Monitoring and Logging: Documentation of monitoring and logging mechanisms that track access activities, failed and successful access attempts, and user actions within the systems.

12. Incident Response Plans: Documentation of plans outlining how the organization responds to unauthorized access incidents or breaches of access rights.

13. Privileged Access Management: Information about controls in place to manage and monitor privileged access to critical systems and resources.

14. Access Control Testing: Records of assessments or tests conducted to evaluate the effectiveness of access controls, identify vulnerabilities, and ensure compliance.

15. Training and Awareness: Documentation of training and awareness programs provided to employees regarding access rights, privileges, and security practices.

By examining these pieces of evidence, an auditor can assess whether the organization has implemented effective access control mechanisms, policies, and procedures to ensure that users have appropriate access to information assets while preventing unauthorized access and maintaining data confidentiality, integrity, and availability.