Our own controls, in the open.

Production datastores require approved, individual secure credentials or keys.

Only authorised people with a business need receive privileged access to keys.

Systems and applications require individual credentials or approved secure keys.

Production application access is limited to authorised users.

Privileged database access requires authorisation and a business need.

Only authorised users with a business need can change firewall settings.

Privileged operating-system access requires authorisation and a business need.

Privileged access to the production network is limited by role and need.

The production network requires individual credentials or approved secure keys.

Authorised employees use multi-factor authentication for remote production access.

Remote production access uses an approved encrypted connection.

Continuous network monitoring supports early detection of possible breaches.

Security-relevant events are collected and reviewed against security objectives.

Segmentation helps prevent unauthorised access to customer data.

Firewalls are configured to restrict unauthorised traffic.

Documented network and system standards are reviewed at least annually.

A formal record is kept of production system assets.

Protection is used on relevant systems and kept updated and logged.

Employees acknowledge a conduct code at hire; policy governs violations.

Passwords for in-scope systems follow company requirements.

A central system manages mobile devices that support the service.

Contractor agreements include or reference conduct expectations.

Contractors sign a confidentiality agreement when engaged.

At least annual reviews test control operation and lead to corrective action on findings.

Secure protocols protect sensitive data sent over public networks.

Formal engineering policies define vulnerability-management and monitoring requirements.

Datastores holding sensitive customer data are encrypted.

Plans cover communication and security continuity if key people are unavailable.

Only authorised personnel can move changes into production.

A formal process governs system development, acquisition, changes and maintenance.

A documented charter defines the board's internal-control oversight.

The board has security oversight capability and engages outside experts as needed.

Defined management roles oversee security-control design and implementation.

An organisation chart records reporting lines and responsibilities.

Information-security policies and procedures are documented and reviewed at least annually.

In-scope access is reviewed at least quarterly; required changes are tracked to completion.

Security and privacy response procedures are documented and communicated.

Incidents are logged, tracked, resolved and communicated under response procedures.

Products and services are described to relevant internal and external users.

A documented process identifies threats, assesses their significance and selects mitigations.

A formal policy provides an anonymous route to report concerns or suspected fraud.

Formal procedures guide the secure retention and disposal of company and customer data.

A classification policy restricts confidential data to authorised people.