Yes with Not Yes CCW No N/A Tested 12.1 Is a security policy established, published, maintained, and Review the information security disseminated to all relevant personnel? policy 12.1.1 Is the security policy reviewed at least annually and Review the information security updated when the environment changes? policy Interview responsible personnel (a) Is an annual risk assessment process implemented 12.2 Review annual risk assessment that process Identifies critical assets, threats, and Interview personnel vulnerabilities, and Results in a formal, documented analysis of risk? Examples of risk assessment methodologies include but are not limited to OCTAVE, ISO and NIST SP 800-30. (b) Is the risk assessment process performed at least Review risk assessment annually and upon significant changes to the documentation environment (for example, acquisition, merger, Interview responsible personnel relocation, etc.)? 12.3 Are policies for critical technologies developed to define proper use of these technologies and require the following: Note: Examples of critical technologies include, but are not limited to, remote access and wireless technologies, laptops, tablets, removable electronic media, e-mail usage and Internet usage. 12.3.1 Explicit approval by authorized parties to use the Review policies technologies? Interview responsible personnel 12.3.2 Authentication for use of the technology? Review policies Interview responsible personnel 12.3.3 A list of all such devices and personnel with access? Review usage policies Interview responsible personnel
Yes Yes with CCW No N/A Not Tested 12.1 Is a security policy established, published, maintained, and disseminated to all relevant personnel? Review the information security policy 12.1.1 Is the security policy reviewed at least annually and updated when the environment changes? Review the information security policy Interview responsible personnel 12.2 (a) Is an annual risk assessment process implemented that Identifies critical assets, threats, and vulnerabilities, and Results in a formal, documented analysis of risk? Examples of risk assessment methodologies include but are not limited to OCTAVE, ISO and NIST SP 800-30. Review annual risk assessment process Interview personnel (b) Is the risk assessment process performed at least annually and upon significant changes to the environment (for example, acquisition, merger, relocation, etc.)? Review risk assessment documentation Interview responsible personnel 12.3 Are policies for critical technologies developed to define proper use of these technologies and require the following: Note: Examples of critical technologies include, but are not limited to, remote access and wireless technologies, laptops, tablets, removable electronic media, e-mail usage and Internet usage. 12.3.1 Explicit approval by authorized parties to use the technologies? Review policies Interview responsible personnel 12.3.2 Authentication for use of the technology? Review policies Interview responsible personnel 12.3.3 A list of all such devices and personnel with access? Review usage policies Interview responsible personnel
SAQ_D.docx