Checks / Obligations / Keep it secure
Obligation · 74 controls · 13 laws
Keep it secure
Systems and data must be protected: access control, encryption, patching, secure build and monitoring for attacks.
What to put in place
Evidence access control, encryption, patching and security monitoring for every system.
Policy wording you can use
[your organisation] controls access to its systems on a need-to-know basis with multi-factor authentication, encrypts data in transit and at rest, patches known vulnerabilities promptly and monitors for attacks.
Prove it once
Describe or link the evidence that this is in place: the policy, the page, the document reference. It is sealed once and applied to all 74 controls here that take a yes or a document (the rest need their own number or date and are listed after).
Every control that asks for this
ISO/IEC 27001
- ISO 27001 A.5.1 - information security policy
- ISO 27001 A.5.10 - acceptable use of assets
- ISO 27001 A.5.15 - access control policy
- ISO 27001 A.5.23 - cloud services security
- ISO 27001 A.6.3 - security awareness training
- ISO 27001 A.8.1 - user endpoint devices secured
- ISO 27001 A.8.2 - privileged access managed
- ISO 27001 A.8.5 - secure authentication (MFA)
- ISO 27001 A.8.8 - vulnerability management
- ISO 27001 A.8.12 - data leakage prevention
- ISO 27001 A.8.24 - use of cryptography
- ISO 27001 A.8.25 - secure development lifecycle
- ISO 27001 A.8.28 - secure coding
- ISO 27001 A.5.19 - supplier relationships security
- ISO 27001 A.5.34 - privacy & PII protection
- ISO 27001 A.8.9 - configuration management
- ISO 27001 A.8.20 - network security
- ISO 27001 A.8.23 - web filtering
PCI DSS
- PCI DSS Req.1 - network security controls
- PCI DSS Req.2 - no vendor default passwords
- PCI DSS Req.3 - cryptographic key management
- PCI DSS Req.4 - encrypt transmission over open nets
- PCI DSS Req.5 - anti-malware protection
- PCI DSS Req.6 - secure systems & software
- PCI DSS Req.6 - security patching current
- PCI DSS Req.7 - access on need-to-know
- PCI DSS Req.8 - unique user IDs
- PCI DSS Req.8 - MFA for access
- PCI DSS Req.9 - physical access restricted
- PCI DSS Req.11 - vulnerability scanning
- PCI DSS Req.12 - information security policy
HIPAA
- HIPAA 164.308 - security management process
- HIPAA 164.308 - workforce access authorisation
- HIPAA 164.308 - security awareness training
- HIPAA 164.310 - facility access controls
- HIPAA 164.312 - unique user identification
- HIPAA 164.312 - automatic logoff
- HIPAA 164.312 - transmission security
- HIPAA 164.524 - patient right of access
SOC 2
- SOC 2 CC6.1 - logical access controls
- SOC 2 CC6.6 - boundary protection
- SOC 2 CC6.7 - data transmission encrypted
- SOC 2 CC7.1 - vulnerability detection
- SOC 2 CC7.2 - security incident monitoring
- SOC 2 C1.1 - confidential data identified
- SOC 2 C1.2 - confidential data disposal
NIS2
- NIS2 Art.21 - supply-chain security
- NIS2 Art.21 - vulnerability handling
- NIS2 Art.21 - cryptography policy
- NIS2 Art.21 - access control
- NIS2 Art.21 - multi-factor authentication
- NIS2 Art.20 - security training
- NIS2 Art.21 - network & systems security
EU Cyber Resilience Act
- EU CRA - secure by design
- EU CRA - no known exploitable vulns at release
- EU CRA - security updates provided
- EU CRA - active-exploitation notification
- EU CRA - secure default configuration
- EU CRA - authentication mechanism
GDPR (UK and EU)
- GDPR Art.15 - right of access supported
- GDPR Art.32 - encryption in place
- GDPR Art.32 - access controls in place
DORA
- DORA Art.9 - protection & prevention controls
- DORA Art.10 - anomaly detection in place
- DORA Art.25 - vulnerability assessments
Agent output: compliance gates
- EU AI Act Art.15 - cybersecurity controls noted
- GDPR Art.15 - right of access supported
- GDPR Art.32 - encryption in place