1. Information Security and AI Governance
- Assignment of defined roles and responsibilities for information security and AI governance within the organization.
- Documented information security, privacy, and AI management policies, supported by standards, procedures, and guidelines applicable to employees and relevant third parties.
- Periodic risk assessments addressing information security risks, including risks related to data processing, AI model behavior, misuse, robustness, and unintended outcomes.
- Security and AI awareness training provided to personnel commensurate with their roles.
- Processes to identify, classify, and manage information assets and AI systems throughout their lifecycle.
2. Identity and Access Management
- Procedures for the creation, modification, review, and revocation of user, privileged, service, application, and temporary accounts.
- Role-based access controls aligned with the principles of least privilege and need-to-know.
- Periodic reviews of access rights and prompt revocation of access when no longer required.
- Authentication mechanisms consistent with generally accepted industry standards.
- Multi-factor authentication for privileged access and remote access to sensitive systems, where technically feasible.
3. Systems Security and Hardening
- Secure configuration baselines for operating systems, applications, and infrastructure.
- Timely application of security updates and patches, consistent with risk.
- Deployment of malware protection controls on applicable systems.
- Email and messaging security controls designed to detect and mitigate malicious content.
- Limitation or removal of unnecessary services, ports, and protocols.
4. Information Protection Security
- Restrictions on the use of removable media, where appropriate.
- Encryption of sensitive information in transit and at rest using industry-accepted cryptographic standards.
- Protection of credentials, secrets, and cryptographic material from unauthorized access.
- Measures designed to preserve data integrity and availability.
5. Physical Security
- Access controls for offices and restricted areas.
- Authorization mechanisms for personnel access.
- Physical monitoring measures, where appropriate.
6. Business Continuity Management and Disaster Recovery
- Business continuity and disaster recovery planning appropriate to the nature of the services provided.
- Data backup procedures and periodic testing of restoration capabilities.
- Redundancy and availability controls commensurate with operational risk.
- Reasonable assurance that critical third-party service providers maintain appropriate continuity measures.
7. Security and AI Incident Management
- Documented incident response process addressing detection, containment, remediation, and recovery.
- Defined internal escalation and communication procedures.
- Post-incident review activities designed to identify corrective actions and improvements.
8. Network Security
- Secure configuration of network infrastructure.
- Network segmentation, including separation of untrusted or guest networks.
- Firewall and routing controls governing communications between trusted and untrusted environments.
- Secure wireless network configurations aligned with industry standards.
- Monitoring mechanisms designed to detect anomalous or unauthorized activity, where appropriate.
9. Cloud and Cryptographic Security
- Cloud security practices aligned with generally accepted industry standards.
- Encryption key management practices designed to protect cryptographic material.
- Use of encryption mechanisms compliant with applicable regulatory or contractual requirements, where required.
- Secure storage of credentials and secrets using protected key management solutions.