Does the system come with a comprehensive, enterprise-wide, disaster recovery / business continuity program (DR/BCP)?
If yes, does the DR/BCP contain:
a.
Defined roles & responsibilities?
b.
Written recovery procedures?
c.
Business impact analysis?
d.
Offsite storage provisions?
e.
Testing requirements, including documentation of lessons learned from DR/BCP tests?
Does the system support incident response plans?
If yes, does the plan provide for:
a.
Assessing the nature & scope of the incident, including documenting any systems containing customer information that may have been compromised?
b.
Containing & controlling the incident to prevent further compromise?
c.
Contacting appropriate law enforcement and regulatory representatives?
d.
Preserving records and other evidence?
e.
Customer notification?
f.
Periodic employee awareness training?
Does the system implement an internal audit program?
If yes, does the scope of the internal audit program include
a.
Network security?
b.
General IT-related controls?
c.
Penetration testing?
d.
Application development policies & procedures?
e.
Disaster recovery / business continuity planning?
f.
Information security program?
g.
Compliance with applicable safeguarding customer information regulations?
Does the system have provision to implement an information security program (ISP) to protect non-public information?
If yes, does the ISP include:
a.
Written policies & procedures?
b.
Employee training?
c.
Monitoring?
d.
Security at both the applicant and, if applicable, significant service providers?
e.
Logical & physical security considerations?
f.
Provisions for testing the effectiveness of key
g.
controls through some type of audit, test, review, etc.?
h.
Provisions for adjusting the program?
Does system implements an ISP with respect to its application server infrastructure and controls ?
If yes, does the ISP include:
a.
Security check of any internal application servers which contain customer information or critical data is stored, processed, or transmitted?
b.
Does the security check test for internal application servers’ vulnerabilities?
c.
Does the security check test for internal application servers validating appropriate access controls?
d.
Does the security check test for internal application servers provide for penetration testing?
Does system have provision to implement an ISP with respect to its customers website and associated web application security?
If yes, does the ISP include:
a.
Written policies & procedures?
b.
Monitoring?
c.
Provisions for adjusting the program?
d.
Security evaluation of the public facing website and web applications on which customer information is kept, processed, or transmitted?
e.
Is security tested for vulnerabilities?
f.
Is security tested for access controls?
g.
Does security testing include penetration testing?
More Questions
