Category: Third Party Supply Chain Risk

SOC & Threat Management

SOC & Threat Management 24/7 Managed Detection & Response (SOC / SIEM) A managed detection and response (MDR) capability provides continuous, around-the-clock monitoring, threat hunting, and escalation. Security telemetry from firewalls, intrusion detection/prevention, endpoints, and cloud is aggregated and correlated centrally (SIEM). Logs and critical files are protected from tampering and retained per policy. Framework [...]

Data Protection & Privacy

Data Protection & Privacy Backup, Recovery & Resilience Critical systems and data are backed up with cross-region replication and immutable, encrypted storage. Recovery procedures are documented and tested, including periodic recovery testing. A disaster recovery plan defines priority applications and recovery objectives (RTO/RPO) and is independently reviewed. Framework Alignment: NIST CSF RC.RP, PR.IR; CIS Control [...]

Application & Integration Security

Application & Integration Security Application Access Governance Access to business and financial applications is provisioned through ticketed requests with documented approvals. Periodic user-access recertification reviews confirm access remains appropriate. Application change activity is tracked and evidenced for audit. Framework Alignment: NIST CSF PR.AA; CIS Control 6; CMMC Level 1 (AC); SOC 1 Type II; GDPR [...]

Endpoint & Device Security

Endpoint & Device Security Asset Management & Lifecycle A centralized IT asset management system tracks hardware and software inventory across devices, with lifecycle management and check-in/check-out, extended to printers, IoT, and infrastructure. Software installation is controlled — local administrative rights are restricted and new installations are routed through the Help Desk — with software assets [...]

Network Security

Network Security Cloud & Platform Security Production infrastructure runs in a contracted, access-controlled colocation data center. Systems are maintained on supported operating-system versions, with end-of-life systems remediated. Infrastructure is monitored centrally with alerting, health dashboards, and aggregated logging. Framework Alignment: NIST CSF PR.IR, ID.AM; CIS Control 1; GDPR Art. 32(1)(b); ISO 27001:2022 A.8.14, A.8.6 Network [...]

Cloud & Platform Security

Cloud & Platform Security Asset Management & Lifecycle A centralized IT asset management system tracks hardware and software inventory across devices, with lifecycle management and check-in/check-out, extended to printers, IoT, and infrastructure. Software installation is controlled — local administrative rights are restricted and new installations are routed through the Help Desk — with software assets [...]

Identity & Access Management

Identity & Access Management Search Entries: Least-Privilege & Role-Based Access Control System access is governed by access-management and least-privilege policies enforcing least privilege and role-based access control. Administrative privileges require documented justification with manager and security approval. Access rights are reviewed and recertified periodically, including annual access reviews for in-scope systems. Framework Alignment: NIST CSF [...]

Governance, Risk & Compliance

Governance, Risk & Compliance Search Entries: AI Governance & Acceptable Use Use of artificial intelligence is governed by an AI governance and acceptable-use policy, with organizational guidance covering acceptable use and the handling of sensitive data. Generative-AI access is provided through a managed enterprise account, and any new AI tool or product is evaluated and [...]

Third Party & Supply Chain Risk

Third Party & Supply Chain Risk Governed Contractor & External-Workforce Access A defined external-workforce lifecycle framework governs contractor access. Remote and third-party access is restricted to compliant devices through Zero Trust and conditional-access controls. Third-party IT service delivery is consolidated into a single, tiered model with service-level agreements for consistent security enforcement. Framework Alignment: NIST [...]