Employees are required to complete security awareness training within 30 days of being hired and at least once a year thereafter.

The organization conducts regular reviews to ensure compliance with its information security policy, topic-specific policies, rules, and standards.

The company mandates that contractor agreements either include a code of conduct or refer to the company’s own code of conduct.

The board of directors meets at least once a year and keeps formal minutes of its meetings. It includes members who are independent of the company.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company conducts background screenings for all new hires.

Managers are required to conduct performance evaluations for their direct reports at least once a year.

Employees are required to acknowledge the code of conduct upon hiring. Any violations may result in disciplinary action as outlined in the company’s disciplinary policy.

Senior management briefs the board of directors, or an appropriate subcommittee, at least once a year on the company’s cybersecurity and privacy risk posture. The board offers guidance and feedback to management as necessary.

The company notifies authorized internal users of system changes.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company informs customers of critical system changes that could impact their processing.

Employees are required to acknowledge the code of conduct upon hiring. Any violations may result in disciplinary action as outlined in the company’s disciplinary policy.

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

The company uses an infrastructure monitoring tool to track systems, infrastructure, and performance, generating alerts when predefined thresholds are reached.

The organization conducts regular reviews to ensure compliance with its information security policy, topic-specific policies, rules, and standards.

The company defines its objectives to support the identification and assessment of risks associated with achieving them.

The company performs the risk assessment process at least annually and whenever significant changes occur in the environment, such as acquisitions, mergers, or relocations.

The company maintains a documented risk management program that provides guidance on identifying potential threats, assessing the significance of associated risks, and implementing mitigation strategies.

The company performs risk assessments at least annually. This process includes identifying threats and changes (environmental, regulatory, and technological) that may affect service commitments, formally assessing the related risks, and considering how potential fraud could impact the achievement of objectives.

The company requires changes to software and infrastructure components to be authorized, documented, tested, reviewed, and approved before being implemented in the production environment.

When a nonconformity is identified, the organization: 1. Responds to the issue by: a) Taking action to control and correct it b) Addressing any resulting consequences 2. Assesses the need for action to prevent recurrence or occurrence elsewhere by: a) Reviewing the nonconformity b) Identifying its root causes c) Determining whether similar issues exist or could potentially arise 3. Implements necessary corrective actions 4. Evaluates the effectiveness of those actions 5. Updates the information security management system as needed Corrective actions are proportionate to the impact of the nonconformities. Documented information is retained to demonstrate: 1. The nature of the nonconformities and the actions taken 2. The results of any corrective actions

Senior management briefs the board of directors, or an appropriate subcommittee, at least once a year on the company’s cybersecurity and privacy risk posture. The board offers guidance and feedback to management as necessary.

System documentation shall be subject to revision and change control procedures that maintain an audit trail documenting time-sequenced development and modifications.

Operational system checks shall be used, as appropriate, to enforce permitted sequencing of steps and events.

The organization conducts regular reviews to ensure compliance with its information security policy, topic-specific policies, rules, and standards.

The company maintains a documented risk management program that provides guidance on identifying potential threats, assessing the significance of associated risks, and implementing mitigation strategies.

The company has a formal systems development life cycle (SDLC) methodology that governs the development, acquisition, implementation, maintenance, and changes (including emergency changes) of information systems and related technology requirements.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company uses firewalls configured to block unauthorized access.

The company has processes for granting, modifying, and revoking physical access to data centers based on authorization from control owners.

The company uses secure transmission protocols to encrypt confidential and sensitive data when it is transmitted over public networks.

The company uses an intrusion detection system to continuously monitor its network and detect potential security breaches early.

System access shall be restricted to authorized individuals.

The company validates deletion requests, and once confirmed, flags and deletes the requested information in accordance with applicable laws and regulations.

The company requires passwords for in-scope system components to be configured in accordance with its policy.

Authority checks shall restrict system use, electronic signing, access to operations or system input/output devices, record alteration, and performance of the operation at hand to authorized individuals.

The company limits privileged access to the firewall to authorized users who have a valid business need.

The company encrypts datastores containing sensitive customer data at rest.

The company’s network is segmented to block unauthorized access to customer data.

The company installs critical security patches within one month of their release, as determined by the risk ranking process defined in VPM-4.

The organization securely disposes of data in accordance with the documented data management process, ensuring that disposal methods are appropriate for the sensitivity of the data.

The company purges or removes customer data containing confidential information from the application environment in accordance with best practices when customers discontinue the service.

The company requires visitors to sign in, wear a visitor badge, and be escorted by an authorized employee when accessing the data center or other secure areas.

The company performs access reviews at least quarterly for in-scope system components to ensure access is appropriately restricted. Required changes are tracked to completion.

The company restricts remote access to production systems to authorized employees using an approved encrypted connection.

The company ensures electronic media containing confidential information is purged or destroyed following best practices, with certificates of destruction issued for each device.

The company reviews data center access at least once a year.

The company’s access control policy outlines requirements for the following access control functions: 1. Adding new users 2. Modifying users 3. Removing user access

The company has implemented procedures to guard against, detect, and report malicious software.

The company uses an intrusion detection system to continuously monitor its network and detect potential security breaches early.

The company uses an infrastructure monitoring tool to track systems, infrastructure, and performance, generating alerts when predefined thresholds are reached.

The company tests its incident response plan at least once a year.

The company has documented security and privacy incident response policies and procedures, which are communicated to authorized users.

The company’s formal policies define requirements for the following IT and engineering functions: 1. Vulnerability management 2. System monitoring

The company’s security and privacy incidents are logged, tracked, resolved, and communicated to affected or relevant parties by management in accordance with its security incident response policy and procedures.

The company has a documented Business Continuity and Disaster Recovery (BC/DR) plan, which is tested at least once a year.

Host-based vulnerability scans are conducted at least quarterly on all externally facing systems, with critical and high-risk vulnerabilities tracked through to remediation.

The company uses a log management tool to detect events that could potentially affect its ability to meet security objectives.

System documentation shall be subject to revision and change control procedures that maintain an audit trail documenting time-sequenced development and modifications.

The company restricts production change migrations to authorized personnel only.

The company has a formal systems development life cycle (SDLC) methodology that governs the development, acquisition, implementation, maintenance, and changes (including emergency changes) of information systems and related technology requirements.

The company requires changes to software and infrastructure components to be authorized, documented, tested, reviewed, and approved before being implemented in the production environment.

The company has a vendor management program in place that includes: 1. Critical third-party vendor inventory 2. Vendor security and privacy requirements 3. Review of critical third-party vendors at least annually

The company has a documented Business Continuity and Disaster Recovery (BC/DR) plan, which is tested at least once a year.

The company maintains a documented risk management program that provides guidance on identifying potential threats, assessing the significance of associated risks, and implementing mitigation strategies.

The company performs risk assessments at least annually. This process includes identifying threats and changes (environmental, regulatory, and technological) that may affect service commitments, formally assessing the related risks, and considering how potential fraud could impact the achievement of objectives.

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

The company performs periodic backups of production data, storing the backups in a separate location from the production environment.

The company uses an infrastructure monitoring tool to track systems, infrastructure, and performance, generating alerts when predefined thresholds are reached.

The company tests its incident response plan at least once a year.

The company employs a multi-location strategy for production environments to enable operations to resume at alternate data centers if a facility becomes unavailable.

The company’s databases are replicated in real time to a secondary data center, with alerts set up to notify administrators of any replication failures.

The company has a documented Business Continuity and Disaster Recovery (BC/DR) plan, which is tested at least once a year.

The company uses environmental monitoring devices configured to automatically alert management in the event of environmental incidents.

The company validates deletion requests, and once confirmed, flags and deletes the requested information in accordance with applicable laws and regulations.

The company encrypts datastores containing sensitive customer data at rest.

The company has a data classification policy to ensure confidential data is properly secured and accessible only to authorized personnel.

The organization securely disposes of data in accordance with the documented data management process, ensuring that disposal methods are appropriate for the sensitivity of the data.

The company purges or removes customer data containing confidential information from the application environment in accordance with best practices when customers discontinue the service.

The company ensures electronic media containing confidential information is purged or destroyed following best practices, with certificates of destruction issued for each device.

The company performs periodic backups of production data, storing the backups in a separate location from the production environment.

The organization establishes and maintains a documented data management process that addresses, at a minimum: 1. Data sensitivity 2. Data owner 3. Data handling 4. Data retention limits 5. Data disposal requirements The organization aligns these elements with enterprise sensitivity and retention standards and reviews and updates the documentation annually or upon significant changes that could impact this control.

Operational system checks shall be used, as appropriate, to enforce permitted sequencing of steps and events.

The organization conducts regular reviews to ensure compliance with its information security policy, topic-specific policies, rules, and standards.

The company’s system evaluates data inputs for compliance with input requirements and generates on-screen alerts when issues with transaction inputs or processing are detected.

Persons who use closed systems to create, modify, maintain, or transmit electronic records shall validate those systems for accuracy, reliability, consistent intended performance, and the ability to detect invalid or altered records.

The company retains customer transaction data for the duration of the customer account. Historical transaction data is not purged until the account is deleted.

To establish efficient governance for PII processing.

A controller shall provide consumers with an appropriately accessible, clear, and meaningful privacy notice that includes: 1. The categories of personal data processed by the controller 2. The purpose for processing personal data 3. The methods by which consumers may exercise their rights, including how a consumer may appeal a controller’s decision 4. The categories of personal data, if any, that the controller shares with third parties 5. The categories of third parties, if any, with which the controller shares personal data, and 6. An active electronic mail address or other online mechanism that consumers may use to contact the controller

The purposes for which personal data is collected shall be specified no later than at the time of collection. Subsequent use of the data shall be limited to fulfilling those purposes or to purposes that are compatible and specified whenever a change of purpose occurs.

The organization identifies and documents the specific purposes for which personally identifiable information is processed.

To make data subjects active participants in the decision-making process regarding the processing of their PII, except as otherwise limited by legislation and regulations, through the exercise of meaningful, informed and freely given consent.

The organization establishes a mechanism that enables individuals to modify or withdraw their consent for the processing of their personally identifiable information.

The organization obtains and records consent from personally identifiable information principals in accordance with documented processes.

The organization establishes and documents a process that enables it to demonstrate whether, when, and how consent for the processing of personally identifiable information (PII) was obtained from PII principals.

The company shall, at or before the point of collection, inform the consumer if sensitive personal information will be collected. The company shall disclose the categories of sensitive personal information collected, the purposes for which the categories are collected or used, and whether the information is sold or shared.

To minimize the PII which is processed to what is strictly necessary for the legitimate interest pursued by the PII controller and to limit the disclosure of PII to a minimum number of internal and external parties.

A controller shall limit the collection of personal data to what is necessary for the intended purpose. Personal data shall be obtained only through lawful and fair means and, where appropriate, with the knowledge or consent of the data subject.

The organization obtains and records consent from personally identifiable information principals in accordance with documented processes.

The organization establishes and documents a process that enables it to demonstrate whether, when, and how consent for the processing of personally identifiable information (PII) was obtained from PII principals.

The company validates deletion requests, and once confirmed, flags and deletes the requested information in accordance with applicable laws and regulations.

To retain PII no longer than necessary to fulfill the stated purpose(s) or to abide by applicable laws.

Personal data shall not be disclosed, made available, or otherwise used for purposes other than those specified, except: a) With the consent of the data subject, or b) By the authority of law

The organization securely disposes of data in accordance with the documented data management process, ensuring that disposal methods are appropriate for the sensitivity of the data.

To limit the use and disclosure of PII for specific, explicit and legitimate purposes and to fulfill the stated purpose(s) or to abide by applicable laws.

The organization identifies and documents applicable legal, regulatory, and business obligations owed to individuals regarding the processing of their personally identifiable information and establishes measures to fulfill those obligations.

The purposes for which personal data is collected shall be specified no later than at the time of collection. Subsequent use of the data shall be limited to fulfilling those purposes or to purposes that are compatible and specified whenever a change of purpose occurs.

The company retains customer transaction data for the duration of the customer account. Historical transaction data is not purged until the account is deleted.

The organization establishes and documents policies and procedures for receiving, handling, and responding to legitimate requests from individuals regarding the processing of their personally identifiable information.

The organization identifies and documents applicable legal, regulatory, and business obligations owed to individuals regarding the processing of their personally identifiable information and establishes measures to fulfill those obligations.

To give data subjects the ability to access and review their PII and to challenge its accuracy and completeness.

The company’s access control policy outlines requirements for the following access control functions: 1. Adding new users 2. Modifying users 3. Removing user access

The organization provides customers with mechanisms or support necessary to enable them to meet obligations owed to individuals regarding the processing of personally identifiable information.

The company has a vendor management program in place that includes: 1. Critical third-party vendor inventory 2. Vendor security and privacy requirements 3. Review of critical third-party vendors at least annually

The company has documented security and privacy incident response policies and procedures, which are communicated to authorized users.

A data controller shall be accountable for implementing and complying with the measures that give effect to the principles set forth in this framework.

To make data subjects active participants in the decision-making process regarding the processing of their PII, except as otherwise limited by legislation and regulations, through the exercise of meaningful, informed and freely given consent.

The organization establishes and documents policies and procedures for receiving, handling, and responding to legitimate requests from individuals regarding the processing of their personally identifiable information.

To limit the use and disclosure of PII for specific, explicit and legitimate purposes and to fulfill the stated purpose(s) or to abide by applicable laws.

The company provides requested information, after verification, in a timely manner either in a portable electronic format or by mail, in compliance with applicable law.

To give data subjects the ability to access and review their PII and to challenge its accuracy and completeness.

The company informs customers of critical system changes that could impact their processing.

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

The company retains customer transaction data for the duration of the customer account. Historical transaction data is not purged until the account is deleted.

To ensure, through contractual or other means, that third party recipients provide at least equivalent levels of PII protection.

Secure, computer-generated, time-stamped audit trails shall independently capture the date and time of operator entries and actions that create, modify, or delete electronic records, and shall preserve prior information so changes do not obscure earlier entries. Audit trail documentation shall be retained for at least the same period as the associated electronic records and shall be available for FDA review and copying.

The organization establishes and maintains a documented data management process that addresses, at a minimum: 1. Data sensitivity 2. Data owner 3. Data handling 4. Data retention limits 5. Data disposal requirements The organization aligns these elements with enterprise sensitivity and retention standards and reviews and updates the documentation annually or upon significant changes that could impact this control.

When a nonconformity is identified, the organization: 1. Responds to the issue by: a) Taking action to control and correct it b) Addressing any resulting consequences 2. Assesses the need for action to prevent recurrence or occurrence elsewhere by: a) Reviewing the nonconformity b) Identifying its root causes c) Determining whether similar issues exist or could potentially arise 3. Implements necessary corrective actions 4. Evaluates the effectiveness of those actions 5. Updates the information security management system as needed Corrective actions are proportionate to the impact of the nonconformities. Documented information is retained to demonstrate: 1. The nature of the nonconformities and the actions taken 2. The results of any corrective actions

A data controller shall be accountable for implementing and complying with the measures that give effect to the principles set forth in this framework.

The organization establishes and documents policies and procedures for receiving, handling, and responding to legitimate requests from individuals regarding the processing of their personally identifiable information.