Audit & Assurance
Independent Assessments
A&A-02.1
Are independent audit and assurance assessments conducted according to relevant standards at least annually?
A&A-02.2
Is compliance verified regarding all relevant standards, regulations, legal/contractual, and statutory requirements applicable to the audit?
Application & Interface Security
Application Security Baseline Requirements
AIS-02.1
Are baseline requirements to secure different applications established, documented, and maintained?
Application Vulnerability Remediation
AIS-07.1
Are application security vulnerabilities remediated following defined processes?
Business Continuity Management
Business Continuity Planning
BCR-01.1
Are business continuity management and operational resilience policies and procedures established, documented, approved, communicated, applied, evaluated, and maintained?
Backup and Recovery
BCR-08.1
Is cloud data periodically backed up?
Cryptography & Key Management
Encryption and Key Management
CEK-01.1
Are cryptography, encryption, and key management policies and procedures established, documented, approved, communicated, applied, evaluated, and maintained?
Data Security & Privacy
Data Protection
DSP-07.1
Are systems, products, and business practices based on security principles by design and per industry best practices?