Artifacts: Information Security

Documented evidence of the user access review outcome for end-users and IT technical personnel, covering role appropriateness, training completion, inactive accounts, and corrective actions taken.

Organizational policy defining information security requirements, controls, and standards to protect information assets and ensure confidentiality, integrity, and availability across Informatics systems.

A Standard Operating Procedure that defines the rules, rationale, and procedures for a specific password escrow use case. Required before any password escrow arrangement can be established.

A curated dictionary of prohibited passwords used to enforce password quality. Passwords must not match entries in this dictionary or appear in publicly available lists of breached passwords, optionally enforced via a Bloom filter.

A formal request for exception from the password requirements defined in the Password Management Standard. Handled through the Roche Information Security Risk Management Issues and Exception Process.