Control Objectives: Uncategorized

Actively manage (inventory, track, and correct) all enterprise assets (end-user devices, including portable and mobile; network devices; non-computing/Internet of Things (IoT) devices; and servers) connected to the infrastructure physically, virtually, remotely, and those within cloud environments,

Prevent or control the installation, spread, and execution of malicious applications, code, or scripts on enterprise assets.

Establish and maintain data recovery practices sufficient to restore in-scope enterprise assets to a pre-incident and trusted state.

Establish, implement, and actively manage (track, report, correct) network devices, in order to prevent attackers from exploiting vulnerable network services and access points.

Operate processes and tooling to establish and maintain comprehensive network monitoring and defense against security threats across the enterprise’s network infrastructure and user base.

Establish and maintain a security awareness program to influence behavior among the workforce to be security conscious and properly skilled to reduce cybersecurity risks to the enterprise.

Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise’s workforce on how to interact with enterprise assets and data in a secure manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, o

Train workforce members to recognize social engineering attacks, such as phishing, pre-texting, and tailgating.

Train workforce members on authentication best practices. Example topics include MFA, password composition, and credential management.

Train workforce members on how to identify and properly store, transfer, archive, and destroy sensitive data. This also includes training workforce members on clear screen and desk best practices, such as locking their screen when they step away from their enterprise asset, erasing physical and virt

Train workforce members to be aware of causes for unintentional data exposure. Example topics include mis-delivery of sensitive data, losing a portable end-user device, or publishing data to unintended audiences.

Train workforce members to be able to recognize a potential incident and be able to report such an incident.

Train workforce to understand how to verify and report out-of-date software patches or any failures in automated processes and tools. Part of this training should include notifying IT personnel of any failures in automated processes and tools.

Train workforce members on the dangers of connecting to, and transmitting data over, insecure networks for enterprise activities. If the enterprise has remote workers, training must include guidance to ensure that all users securely configure their home network infrastructure.

Conduct role-specific security awareness and skills training. Example implementations include secure system administration courses for IT professionals, (OWASP® Top 10 vulnerability awareness and prevention training for web application developers, and advanced social engineering awareness training f

Develop a process to evaluate service providers who hold sensitive data, or are responsible for an enterprise’s critical IT platforms or processes, to ensure these providers are protecting those platforms and data appropriately.

Establish and maintain an inventory of service providers. The inventory is to list all known service providers, include classification(s), and designate an enterprise contact for each service provider. Review and update the inventory annually, or when significant enterprise changes occur that could

Establish and maintain a service provider management policy. Ensure the policy addresses the classification, inventory, assessment, monitoring, and decommissioning of service providers. Review and update the policy annually, or when significant enterprise changes occur that could impact this Safegua

Classify service providers. Classification consideration may include one or more characteristics, such as data sensitivity, data volume, availability requirements, applicable regulations, inherent risk, and mitigated risk. Update and review classifications annually, or when significant enterprise ch

Ensure service provider contracts include security requirements. Example requirements may include minimum security program requirements, security incident and/or data breach notification and response, data encryption requirements, and data disposal commitments. These security requirements must be co

Assess service providers consistent with the enterprise’s service provider management policy. Assessment scope may vary based on classification(s), and may include review of standardized assessment reports, such as Service Organization Control 2 (SOC 2) and Payment Card Industry (PCI) Attestation of

Manage the security life cycle of in-house developed, hosted, or acquired software to prevent, detect, and remediate security weaknesses before they can impact the enterprise.

Establish a program to develop and maintain an incident response capability (e.g., policies, plans, procedures, defined roles, training, and communications) to prepare, detect, and quickly respond to an attack.

Designate one key person, and at least one backup, who will manage the enterprise’s incident handling process. Management personnel are responsible for the coordination and documentation of incident response and recovery efforts and can consist of employees internal to the enterprise, third-party ve

Establish and maintain contact information for parties that need to be informed of security incidents. Contacts may include internal staff, third-party vendors, law enforcement, cyber insurance providers, relevant government agencies, Information Sharing and Analysis Center (ISAC) partners, or other

Establish and maintain an enterprise process for the workforce to report security incidents. The process includes reporting timeframe, personnel to report to, mechanism for reporting, and the minimum information to be reported. Ensure the process is publicly available to all of the workforce. Review

Establish and maintain an incident response process that addresses roles and responsibilities, compliance requirements, and a communication plan. Review annually, or when significant enterprise changes occur that could impact this Safeguard.

Assign key roles and responsibilities for incident response, including staff from legal, IT, information security, facilities, public relations, human resources, incident responders, and analysts, as applicable. Review annually, or when significant enterprise changes occur that could impact this Saf

Determine which primary and secondary mechanisms will be used to communicate and report during a security incident. Mechanisms can include phone calls, emails, or letters. Keep in mind that certain mechanisms, such as emails, can be affected during a security incident. Review annually, or when signi

Plan and conduct routine incident response exercises and scenarios for key personnel involved in the incident response process to prepare for responding to real-world incidents. Exercises need to test communication channels, decision making, and workflows. Conduct testing on an annual basis, at a mi

Conduct post-incident reviews. Post-incident reviews help prevent incident recurrence through identifying lessons learned and follow-up action.

Establish and maintain security incident thresholds, including, at a minimum, differentiating between an incident and an event. Examples can include: abnormal activity, security vulnerability, security weakness, data breach, privacy incident, etc. Review annually, or when significant enterprise chan

Test the effectiveness and resiliency of enterprise assets through identifying and exploiting weaknesses in controls (people, processes, and technology), and simulating the objectives and actions of an attacker.

Establish and maintain a penetration testing program appropriate to the size, complexity, and maturity of the enterprise. Penetration testing program characteristics include scope, such as network, web application, Application Programming Interface (API), hosted services, and physical premise contro

Perform periodic internal penetration tests based on program requirements, no less than annually. The testing may be clear box or opaque box.

Actively manage (inventory, track, and correct) all software (operating systems and applications) on the network so that only authorized software is installed and can execute, and that unauthorized and unmanaged software is found and prevented from installation or execution.

Develop processes and technical controls to identify, classify, securely handle, retain, and dispose of data.

Establish and maintain the secure configuration of enterprise assets (end-user devices, including portable and mobile; network devices; non-computing/IoT devices; and servers) and software (operating systems and applications).

Use processes and tools to assign and manage authorization to credentials for user accounts, including administrator accounts, as well as service accounts, to enterprise assets and software.

Use processes and tools to create, assign, manage, and revoke access credentials and privileges for user, administrator, and service accounts for enterprise assets and software.

Develop a plan to continuously assess and track vulnerabilities on all enterprise assets within the enterprise’s infrastructure, in order to remediate, and minimize, the window of opportunity for attackers. Monitor public and private industry sources for new threat and vulnerability information.

Collect, alert, review, and retain audit logs of events that could help detect, understand, or recover from an attack.

Improve protections and detections of threats from email and web vectors, as these are opportunities for attackers to manipulate human behavior through direct engagement.

Establish, document, approve, communicate, apply, evaluate and maintain audit and assurance policies and procedures and standards. Review and update the policies and procedures at least annually.

Conduct independent audit and assurance assessments according to relevant standards at least annually.

Perform independent audit and assurance assessments according to risk-based plans and policies.

Verify compliance with all relevant standards, regulations, legal/contractual, and statutory requirements applicable to the audit.

Define and implement an Audit Management process to support audit planning, risk analysis, security control assessment, conclusion, remediation schedules, report generation, and review of past reports and supporting evidence.

Establish, document, approve, communicate, apply, evaluate and maintain a risk-based corrective action plan to remediate audit findings, review and report remediation status to relevant stakeholders.

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for application security to provide guidance to the appropriate planning, delivery and support of the organization's application security capabilities. Review and update the policies and procedures at lea

Establish, document and maintain baseline requirements for securing different applications.

Define and implement technical and operational metrics in alignment with business objectives, security requirements, and compliance obligations.

Define and implement a SDLC process for application design, development, deployment, and operation in accordance with security requirements defined by the organization.

Implement a testing strategy, including criteria for acceptance of new information systems, upgrades and new versions, which provides application security assurance and maintains compliance while enabling organizational speed of delivery goals. Automate when applicable and possible.

Establish and implement strategies and capabilities for secure, standardized, and compliant application deployment. Automate where possible.

Define and implement a process to remediate application security vulnerabilities, automating remediation when possible.

Establish, document, approve, communicate, apply, evaluate and maintain business continuity management and operational resilience policies and procedures. Review and update the policies and procedures at least annually.

Determine the impact of business disruptions and risks to establish criteria for developing business continuity and operational resilience strategies and capabilities.

Establish strategies to reduce the impact of, withstand, and recover from business disruptions within risk appetite.

Establish, document, approve, communicate, apply, evaluate and maintain a business continuity plan based on the results of the operational resilience strategies and capabilities.

Develop, identify, and acquire documentation that is relevant to support the business continuity and operational resilience programs. Make the documentation available to authorized stakeholders and review periodically.

Exercise and test business continuity and operational resilience plans at least annually or upon significant changes.

Establish communication with stakeholders and participants in the course of business continuity and resilience procedures.

Periodically backup data stored in the cloud. Ensure the confidentiality, integrity and availability of the backup, and verify data restoration from backup for resiliency.

Establish, document, approve, communicate, apply, evaluate and maintain a disaster response plan to recover from natural and man-made disasters. Update the plan at least annually or upon significant changes.

Exercise the disaster response plan annually or upon significant changes, including if possible local emergency authorities.

Supplement business-critical equipment with redundant equipment independently located at a reasonable minimum distance in accordance with applicable industry standards.

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for managing the risks associated with applying changes to organization assets, including application, systems, infrastructure, configuration, etc., regardless of whether the assets are managed internally

Follow a defined quality change control, approval and testing process with established baselines, testing, and release standards.

Manage the risks associated with applying changes to organization assets, including application, systems, infrastructure, configuration, etc., regardless of whether the assets are managed internally or externally (i.e., outsourced).

Restrict the unauthorized addition, removal, update, and management of organization assets.

Include provisions limiting changes directly impacting CSCs owned environments/tenants to explicitly authorized requests within service level agreements between CSPs and CSCs.

Establish change management baselines for all relevant authorized changes on organization assets.

Implement detection measures with proactive notification in case of changes deviating from the established baseline.

Implement a procedure for the management of exceptions, including emergencies, in the change and configuration process. Align the procedure with the requirements of GRC-04: Policy Exception Process.'

Define and implement a process to proactively roll back changes to a previous known good state in case of errors or security concerns.

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for Cryptography, Encryption and Key Management. Review and update the policies and procedures at least annually.

Define and implement cryptographic, encryption and key management roles and responsibilities.

Provide cryptographic protection to data at-rest and in-transit, using cryptographic libraries certified to approved standards.

Use encryption algorithms that are appropriate for data protection, considering the classification of data, associated risks, and usability of the encryption technology.

Establish a standard change management procedure, to accommodate changes from internal and external sources, for review, approval, implementation and communication of cryptographic, encryption and key management technology changes.

Manage and adopt changes to cryptography-, encryption-, and key management-related systems (including policies and procedures) that fully account for downstream effects of proposed changes, including residual risk, cost, and benefits analysis.

Establish and maintain an encryption and key management risk program that includes provisions for risk assessment, risk treatment, risk context, monitoring, and feedback.

CSPs must provide the capability for CSCs to manage their own data encryption keys.

Audit encryption and key management systems, policies, and processes with a frequency that is proportional to the risk exposure of the system with audit occurring preferably continuously but at least annually and after any security event(s).

Generate Cryptographic keys using industry accepted cryptographic libraries specifying the algorithm strength and the random number generator used.

Manage cryptographic secret and private keys that are provisioned for a unique purpose.

Rotate cryptographic keys in accordance with the calculated cryptoperiod, which includes provisions for considering the risk of information disclosure and legal and regulatory requirements.

Define, implement and evaluate processes, procedures and technical measures to revoke and remove cryptographic keys prior to the end of its established cryptoperiod, when a key is compromised, or an entity is no longer part of the organization, which include provisions for legal and regulatory requi

Define, implement and evaluate processes, procedures and technical measures to destroy keys stored outside a secure environment and revoke keys stored in Hardware Security Modules (HSMs) when they are no longer needed, which include provisions for legal and regulatory requirements.

Define, implement and evaluate processes, procedures and technical measures to create keys in a pre-activated state when they have been generated but not authorized for use, which include provisions for legal and regulatory requirements.

Define, implement and evaluate processes, procedures and technical measures to monitor, review and approve key transitions from any state to/from suspension, which include provisions for legal and regulatory requirements.

Define, implement and evaluate processes, procedures and technical measures to deactivate keys at the time of their expiration date, which include provisions for legal and regulatory requirements.

Define, implement and evaluate processes, procedures and technical measures to manage archived keys in a secure repository requiring least privilege access, which include provisions for legal and regulatory requirements.

Define, implement and evaluate processes, procedures and technical measures to use compromised keys to encrypt information only in controlled circumstance, and thereafter exclusively for decrypting data and never for encrypting data, which include provisions for legal and regulatory requirements.

Define, implement and evaluate processes, procedures and technical measures to assess the risk to operational continuity versus the risk of the keying material and the information it protects being exposed if control of the keying material is lost, which include provisions for legal and regulatory r

Define, implement and evaluate processes, procedures and technical measures in order for the key management system to track and report all cryptographic materials and changes in status, which include provisions for legal and regulatory requirements.

All Services must adhere to Roche Global Change Management Process

Computerised Systems Validation (CSV) ensures that new and existing GxP relevant computerized systems consistently fulfill their intended use and produce accurate and reliable results that ensure regulatory compliance, product quality and patient safety. Action: For systems delivered by Informatics

If "Consent" is selected as a legal basis, confirm the following requirements are covered: -Consent is presented in an intelligible and easily accessible form, using clear and plain language adapted to the target user. -Consent is freely given. -Consent clearly describes the purpose for collecting

In the event personal data is transferred to another country, the data transfers must be mapped in the RoPA Questionnaire and you must ensure compliance with the obligations regarding cross border data transfers.

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for the secure disposal of equipment used outside the organization's premises. If the equipment is not physically destroyed a data destruction procedure that renders recovery of information impossible mus

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for the relocation or transfer of hardware, software, or data/information to an offsite or alternate location. The relocation or transfer request requires the written or cryptographically verifiable autho

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for maintaining a safe and secure working environment in offices, rooms, and facilities. Review and update the policies and procedures at least annually.

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for the secure transportation of physical media. Review and update the policies and procedures at least annually.

Classify and document the physical, and logical assets (e.g., applications) based on the organizational business risk.

Catalogue and track all relevant physical and logical assets located at all of the CSP's sites within a secured system.

Implement physical security perimeters to safeguard personnel, data, and information systems. Establish physical security perimeters between the administrative and business areas and the data storage and processing facilities areas.

Use equipment identification as a method for connection authentication.

Allow only authorized personnel access to secure areas, with all ingress and egress points restricted, documented, and monitored by physical access control mechanisms. Retain access control records on a periodic basis as deemed appropriate by the organization.

Implement, maintain, and operate datacenter surveillance systems at the external perimeter and at all the ingress and egress points to detect unauthorized ingress and egress attempts.

Train datacenter personnel to respond to unauthorized ingress or egress attempts.

Define, implement and evaluate processes, procedures and technical measures that ensure a risk-based protection of power and telecommunication cables from a threat of interception, interference or damage at all facilities, offices and rooms.

Implement and maintain data center environmental control systems that monitor, maintain and test for continual effectiveness the temperature and humidity conditions within accepted industry standards.

Secure, monitor, maintain, and test utilities services for continual effectiveness at planned intervals.

Keep business-critical equipment away from locations subject to high probability for environmental risk events.

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for the classification, protection and handling of data throughout its lifecycle, and according to all applicable laws and regulations, standards, and risk level. Review and update the policies and proced

Apply industry accepted methods for the secure disposal of data from storage media such that data is not recoverable by any forensic means.

Create and maintain a data inventory, at least for any sensitive data and personal data.

Classify data according to its type and sensitivity level.

Create data flow documentation to identify what data is processed, stored or transmitted where. Review data flow documentation at defined intervals, at least annually, and after any change.

Document ownership and stewardship of all relevant documented personal and sensitive data. Perform review at least annually.

Develop systems, products, and business practices based upon a principle of security by design and industry best practices.

Develop systems, products, and business practices based upon a principle of privacy by design and industry best practices. Ensure that systems' privacy settings are configured by default, according to all applicable laws and regulations.

Conduct a Data Protection Impact Assessment (DPIA) to evaluate the origin, nature, particularity and severity of the risks upon the processing of personal data, according to any applicable laws, regulations and industry best practices.

Define, implement and evaluate processes, procedures and technical measures that ensure any transfer of personal or sensitive data is protected from unauthorized access and only processed within scope as permitted by the respective laws and regulations.

Define and implement, processes, procedures and technical measures to enable data subjects to request access to, modification, or deletion of their personal data, according to any applicable laws and regulations.

Define, implement and evaluate processes, procedures and technical measures to ensure that personal data is processed according to any applicable laws and regulations and for the purposes declared to the data subject.

Define, implement and evaluate processes, procedures and technical measures for the transfer and sub-processing of personal data within the service supply chain, according to any applicable laws and regulations.

Define, implement and evaluate processes, procedures and technical measures to disclose the details of any personal or sensitive data access by sub-processors to the data owner prior to initiation of that processing.

Obtain authorization from data owners, and manage associated risk before replicating or using production data in non-production environments.

Data retention, archiving and deletion is managed in accordance with business requirements, applicable laws and regulations.

Define and implement, processes, procedures and technical measures to protect sensitive data throughout it's lifecycle.

The CSP must have in place, and describe to CSCs the procedure to manage and respond to requests for disclosure of Personal Data by Law Enforcement Authorities according to applicable laws and regulations. The CSP must give special attention to the notification procedure to interested CSCs, unless o

Define and implement, processes, procedures and technical measures to specify and document the physical locations of data, including any locations in which data is processed or backed up.

Personal data must be accurate and kept up-to-date. Describe the processes you have in place to ensure that personal information is attributed to the correct individual and is accurate, complete, and up-to-date.

Data security breaches must be detected, reported, and managed. Describe how do you detect, report and manage data security breaches.

Data Minimization requires that personal data shall be adequate, relevant, and limited to what is necessary for the purposes of processing. Define the minimization controls.

Personal Data needs to be erased, corrected, retrievable and/or access restricted or blocked upon request. Describe how do you ensure execution of data subject rights.

Documenting Operating Procedures and working instructions is in place to ensure effective operation of all services and shall be documented and made available to personnel who need them

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for an information governance program, which is sponsored by the leadership of the organization. Review and update the policies and procedures at least annually.

Establish a formal, documented, and leadership-sponsored Enterprise Risk Management (ERM) program that includes policies and procedures for identification, evaluation, ownership, treatment, and acceptance of cloud security and privacy risks.

Review all relevant organizational policies and associated procedures at least annually or when a substantial change occurs within the organization.

Establish and follow an approved exception process as mandated by the governance program whenever a deviation from an established policy occurs.

Develop and implement an Information Security Program, which includes programs for all the relevant domains of the CCM.

Define and document roles and responsibilities for planning, implementing, operating, assessing, and improving governance programs.

Identify and document all relevant standards, regulations, legal/contractual, and statutory requirements, which are applicable to your organization.

Establish and maintain contact with cloud-related special interest groups and other relevant entities in line with business context.

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for background verification of all new employees (including but not limited to remote employees, contractors, and third parties) according to local laws, regulations, ethics, and contractual constraints a

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for defining allowances and conditions for the acceptable use of organizationally-owned or managed assets. Review and update the policies and procedures at least annually.

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures that require unattended workspaces to not have openly visible confidential data. Review and update the policies and procedures at least annually.

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures to protect information accessed, processed or stored at remote sites and locations. Review and update the policies and procedures at least annually.

Establish and document procedures for the return of organization-owned assets by terminated employees.

Establish, document, and communicate to all personnel the procedures outlining the roles and responsibilities concerning changes in employment.

Employees sign the employee agreement prior to being granted access to organizational information systems, resources and assets.

The organization includes within the employment agreements provisions and/or terms for adherence to established information governance and security policies.

Document and communicate roles and responsibilities of employees, as they relate to information assets and security.

Identify, document, and review, at planned intervals, requirements for non-disclosure/confidentiality agreements reflecting the organization's needs for the protection of data and operational details.

Establish, document, approve, communicate, apply, evaluate and maintain a security awareness training program for all employees of the organization and provide regular training updates.

Provide all employees with access to sensitive organizational and personal data with appropriate security awareness training and regular updates in organizational procedures, processes, and policies relating to their professional function relative to the organization.

Make employees aware of their roles and responsibilities for maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations.

Establish, document, approve, communicate, implement, apply, evaluate and maintain policies and procedures for identity and access management. Review and update the policies and procedures at least annually.

Establish, document, approve, communicate, implement, apply, evaluate and maintain strong password policies and procedures. Review and update the policies and procedures at least annually.

Manage, store, and review the information of system identities, and level of access.

Employ the separation of duties principle when implementing information system access.

Employ the least privilege principle when implementing information system access.

Define and implement a user access provisioning process which authorizes, records, and communicates access changes to data and assets.

De-provision or respectively modify access of movers / leavers or system identity changes in a timely manner in order to effectively adopt and communicate identity and access management policies.

Review and revalidate user access for least privilege and separation of duties with a frequency that is commensurate with organizational risk tolerance.

Define, implement and evaluate processes, procedures and technical measures for the segregation of privileged access roles such that administrative access to data, encryption and key management capabilities and logging capabilities are distinct and separated.

Define and implement an access process to ensure privileged access roles and rights are granted for a time limited period, and implement procedures to prevent the culmination of segregated privileged access.

Define, implement and evaluate processes and procedures for customers to participate, where applicable, in the granting of access for agreed, high risk (as defined by the organizational risk assessment) privileged access roles.

Define, implement and evaluate processes, procedures and technical measures to ensure the logging infrastructure is read-only for all with write access, including privileged access roles, and that the ability to disable it is controlled through a procedure that ensures the segregation of duties and

Define, implement and evaluate processes, procedures and technical measures that ensure users are identifiable through unique IDs or which can associate individuals to the usage of user IDs.

Define, implement and evaluate processes, procedures and technical measures for authenticating access to systems, application and data assets, including multifactor authentication for at least privileged user and sensitive data access. Adopt digital certificates or alternatives which achieve an equi

Define, implement and evaluate processes, procedures and technical measures for the secure management of passwords.

Define, implement and evaluate processes, procedures and technical measures to verify access to data and system functions is authorized.

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for interoperability and portability including requirements for: a. Communications between application interfaces b. Information processing interoperability c. Application development portability d. Infor

Provide application interface(s) to CSCs so that they programmatically retrieve their data to enable interoperability and portability.

Implement cryptographically secure and standardized network protocols for the management, import and export of data.

Agreements must include provisions specifying CSCs access to data upon contract termination and will include: a. Data format b. Length of time the data will be stored c. Scope of the data retained and made available to the CSCs d. Data deletion policy

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for infrastructure and virtualization security. Review and update the policies and procedures at least annually.

Plan and monitor the availability, quality, and adequate capacity of resources in order to deliver the required system performance as determined by the business.

Monitor, encrypt and restrict communications between environments to only authenticated and authorized connections, as justified by the business. Review these configurations at least annually, and support them by a documented justification of all allowed services, protocols, ports, and compensating

Harden host and guest OS, hypervisor or infrastructure control plane according to their respective best practices, and supported by technical controls, as part of a security baseline.

Separate production and non-production environments.

Design, develop, deploy and configure applications and infrastructures such that CSP and CSC (tenant) user access and intra-tenant access is appropriately segmented and segregated, monitored and restricted from other tenants.

Use secure and encrypted communication channels when migrating servers, services, applications, or data to cloud environments. Such channels must include only up-to-date and approved protocols.

Identify and document high-risk environments.

Define, implement and evaluate processes, procedures and defense-in-depth techniques for protection, detection, and timely response to network-based attacks.

Information Security is integrated into Project Management

All Services including supporting components must be registered in the CMDB

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for logging and monitoring. Review and update the policies and procedures at least annually.

Define, implement and evaluate processes, procedures and technical measures to ensure the security and retention of audit logs.

Identify and monitor security-related events within applications and the underlying infrastructure. Define and implement a system to generate alerts to responsible stakeholders based on such events and corresponding metrics.

Restrict audit logs access to authorized personnel and maintain records that provide unique access accountability.

Monitor security audit logs to detect activity outside of typical or expected patterns. Establish and follow a defined process to review and take appropriate and timely actions on detected anomalies.

Use a reliable time source across all relevant information processing systems.

Establish, document and implement which information meta/data system events should be logged. Review and update the scope at least annually or whenever there is a change in the threat environment.

Generate audit records containing relevant security information.

The information system protects audit records from unauthorized access, modification, and deletion.

Establish and maintain a monitoring and internal reporting capability over the operations of cryptographic, encryption and key management policies, processes, procedures, and controls.

Log and monitor key lifecycle management events to enable auditing and reporting on usage of cryptographic keys.

Monitor and log physical access using an auditable access control system.

Define, implement and evaluate processes, procedures and technical measures for the reporting of anomalies and failures of the monitoring system and provide immediate notification to the accountable party.

Personal data processing must have a legal basis.

Review the Legitimate Interest Assessment conducted in the PIA. If your processing activity is covered, ensure compliance with such LIA. If your processing activity is not convered, a new LIA must be conducted.

All Services should adhere to Roche Information Security Policies / Standard / Processes

Data subjects need to be informed about the processing of their personal data and regarding their data subject rights. Explain how the privacy notice will be provided to the data subject and add the link to the privacy notice if available.

Personal data must be collected for specified, explicit, and legitimate purposes: ensure the personal data is collected for a specific purpose and clearly define the purposes for which the personal data will be processed within the solution.

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for Security Incident Management, E-Discovery, and Cloud Forensics. Review and update the policies and procedures at least annually.

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for the timely management of security incidents. Review and update the policies and procedures at least annually.

Establish, document, approve, communicate, apply, evaluate and maintain a security incident response plan, which includes but is not limited to: relevant internal departments, impacted CSCs, and other business critical relationships (such as supply-chain) that may be impacted.'

Test and update as necessary incident response plans at planned intervals or upon significant organizational or environmental changes for effectiveness.

Establish and monitor information security incident metrics.

Define, implement and evaluate processes, procedures and technical measures supporting business processes to triage security-related events.

Define and implement, processes, procedures and technical measures for security breach notifications. Report security breaches and assumed security breaches including any relevant supply chain breaches, as per applicable SLAs, laws and regulations.

Maintain points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities.

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for the application of the Shared Security Responsibility Model (SSRM) within the organization. Review and update the policies and procedures at least annually.

Apply, document, implement and manage the SSRM throughout the supply chain for the cloud service offering.

Provide SSRM Guidance to the CSC detailing information about the SSRM applicability throughout the supply chain.

Delineate the shared ownership and applicability of all CSA CCM controls according to the SSRM for the cloud service offering.

Review and validate SSRM documentation for all cloud services offerings the organization uses.

Implement, operate, and audit or assess the portions of the SSRM which the organization is responsible for.

Develop and maintain an inventory of all supply chain relationships.

CSPs periodically review risk factors associated with all organizations within their supply chain.

Service agreements between CSPs and CSCs (tenants) must incorporate at least the following mutually-agreed upon provisions and/or terms: • Scope, characteristics and location of business relationship and services offered • Information security requirements (including SSRM) • Change management proces

Review supply chain agreements between CSPs and CSCs at least annually.

Define and implement a process for conducting internal assessments to confirm conformance and effectiveness of standards, policies, procedures, and service level agreement activities at least annually.

Implement policies requiring all CSPs throughout the supply chain to comply with information security, confidentiality, access control, privacy, audit, personnel policy and service level requirements and standards.

Periodically review the organization's supply chain partners' IT governance policies and procedures.

Define and implement a process for conducting security assessments periodically for all organizations within the supply chain.

The security design document aims to be audit/inspection ready, being able to demonstrate that key security controls are properly integrated into the system design. The security concept document contains all security relevant information needed to demonstrate the system design is secure and all risk

On a yearly basis the SSC rating is reviewed, in case the rating is below the agreed threshold (B Rating) a new Vendor Security Assessment needs to be executed.

The Security Expert Review (SER) is a specialized control that solution teams can leverage to enhance their information security posture. It involves an in-depth assessment of key security controls' effectiveness in mitigating identified risks within the specific context of a system.

A storage duration must be defined for each type of data and justified by the legal requirements and/or processing needs. Define the data retention period and erasure mechanism at the end of the storage duration.

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures to identify, report and prioritize the remediation of vulnerabilities, in order to protect systems against vulnerability exploitation. Review and update the policies and procedures at least annually.

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures to protect against malware on managed assets. Review and update the policies and procedures at least annually.

Define, implement and evaluate processes, procedures and technical measures to enable both scheduled and emergency responses to vulnerability identifications, based on the identified risk.

Define, implement and evaluate processes, procedures and technical measures to update detection tools, threat signatures, and indicators of compromise on a weekly, or more frequent basis.

Define, implement and evaluate processes, procedures and technical measures to identify updates for applications which use third party or open source libraries according to the organization's vulnerability management policy.

Define, implement and evaluate processes, procedures and technical measures for the periodic performance of penetration testing by independent third parties.

Define, implement and evaluate processes, procedures and technical measures for the detection of vulnerabilities on organizationally managed assets at least monthly.

Use a risk-based model for effective prioritization of vulnerability remediation using an industry recognized framework.

Define and implement a process for tracking and reporting vulnerability identification and remediation activities that includes stakeholder notification.

Establish, monitor and report metrics for vulnerability identification and remediation at defined intervals.

Third Parties are identified and governed by a contract. For data processors, a data processing agreement is executed between the parties and the reference is provided in the RoPA questionnaire.

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for all endpoints. Review and update the policies and procedures at least annually.

Define, document, apply and evaluate a list of approved services, applications and sources of applications (stores) acceptable for use by endpoints when accessing or storing organization-managed data.

Define and implement a process for the validation of the endpoint device's compatibility with operating systems and applications.

Maintain an inventory of all endpoints used to store and access company data.

Define, implement and evaluate processes, procedures and technical measures to enforce policies and controls for all endpoints permitted to access systems and/or store, transmit, or process organizational data.

Configure all relevant interactive-use endpoints to require an automatic lock screen.

Manage changes to endpoint operating systems, patch levels, and/or applications through the company's change management processes.

Protect information from unauthorized disclosure on managed endpoint devices with storage encryption.

Configure managed endpoints with anti-malware detection and prevention technology and services.

Configure managed endpoints with properly configured software firewalls.

Configure managed endpoints with Data Loss Prevention (DLP) technologies and rules in accordance with a risk assessment.

Enable remote geo-location capabilities for all managed mobile endpoints.

Define, implement and evaluate processes, procedures and technical measures to enable the deletion of company data remotely on managed endpoint devices.

Define, implement and evaluate processes, procedures and technical and/or contractual measures to maintain proper security of third-party endpoints with access to organizational assets.

Vendor Quality Assessments are mandatory for GxP systems