Test Final 1

Job ID: Test-Final-1-081425224931 2025-08-14 Completed

Upload Documents

Overall Alignment

89.3%

Excellent Coverage

Controls Aligned

327 / 366

327 out of 366 controls found

Frameworks

NIST CIS

Assessment frameworks applied

Key Controls

168 / 179

Critical controls identified

Overall Alignment

Framework Breakdown

Key Controls Status

Framework Compliance Overview

Framework	Total Controls	Aligned	Gaps	Compliance Progress
CIS	41	40	1	97.56% Excellent
NIST	325	287	38	88.31% Excellent
OVERALL	366	327	39	89.3%

Document Analysis Details

2.0_IS_Acceptable_Use_Policy.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	6	14.63%
NIST	325	88	27.08%

4.0_IS_Organization_of_Information_Security_Policy_1.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	3	7.32%
NIST	325	71	21.85%

7.0_IS_Asset_Management_Policy.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	14	34.15%
NIST	325	87	26.77%

8.0_IS_Access_Control_Identity_Management_Policy_1.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	5	12.2%
NIST	325	70	21.54%

7.2_IS_End_User_Device_Standard.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	9	21.95%
NIST	325	60	18.46%

7.1_IS_Asset_Management_Standard.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	8	19.51%
NIST	325	38	11.69%

19.0_IS_Cloud_Computing_Security_Policy.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	6	14.63%
NIST	325	74	22.77%

2.1_IS_Acceptable_Use_Standard.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	3	7.32%
NIST	325	65	20.0%

6.1_IS_Data_Security_Standards.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	11	26.83%
NIST	325	94	28.92%

5.0_IS_Human_Resource_Security_Policy_1.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	3	7.32%
NIST	325	63	19.38%

16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	2	4.88%
NIST	325	45	13.85%

6.0_IS_Data_Security_Policy_1.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	14	34.15%
NIST	325	106	32.62%

3.0_IS_Information_Security_Policy_2.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	4	9.76%
NIST	325	111	34.15%

26.0_IS_Vulnerability_Management_Policy.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	11	26.83%
NIST	325	53	16.31%

23.0_IS_Network_and_Firewall_Security_Policy.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	8	19.51%
NIST	325	101	31.08%

15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	2	4.88%
NIST	325	44	13.54%

19.1_IS_Cloud_Computing_Security_Standard.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	15	36.59%
NIST	325	121	37.23%

20.0_IS_Risk_Management_Policy_2.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	0	0.0%
NIST	325	59	18.15%

27.0_IS_Lazard_Reference_Timeout_Standard.pdf 2 frameworks

Framework	Total	Aligned	Coverage
CIS	41	3	7.32%
NIST	325	24	7.38%

41 Total Controls

Control ID	Control Name	Status	Evidence Section	Document
1.1	Establish and Maintain Detailed Enterprise Asset Inventory Key Control	Aligned	This policy is applicable to all Lazard employees, contracto...	2.0_IS_Acceptable_Use_Policy.pdf
1.1	Establish and Maintain Detailed Enterprise Asset Inventory Key Control	Aligned	Responsibilities for the protection of individual assets...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
1.1	Establish and Maintain Detailed Enterprise Asset Inventory Key Control	Aligned	Asset inventory should be kept accurate, and it should be re...	7.0_IS_Asset_Management_Policy.pdf
1.1	Establish and Maintain Detailed Enterprise Asset Inventory Key Control	Aligned	All Firm workstations and laptops should be inventoried for ...	7.2_IS_End_User_Device_Standard.pdf
1.1	Establish and Maintain Detailed Enterprise Asset Inventory Key Control	Aligned	Aspects of endpoint device solution that should be evaluated...	7.1_IS_Asset_Management_Standard.pdf
1.1	Establish and Maintain Detailed Enterprise Asset Inventory Key Control	Aligned	Data Protection...	6.0_IS_Data_Security_Policy_1.pdf
1.1	Establish and Maintain Detailed Enterprise Asset Inventory Key Control	Aligned	Asset Management...	3.0_IS_Information_Security_Policy_2.pdf
1.1	Establish and Maintain Detailed Enterprise Asset Inventory Key Control	Aligned	Inventories of all hardware and software installed on the co...	26.0_IS_Vulnerability_Management_Policy.pdf
1.1	Establish and Maintain Detailed Enterprise Asset Inventory Key Control	Aligned	1.2.1 General Network Security...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
1.1	Establish and Maintain Detailed Enterprise Asset Inventory Key Control	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
1.2	Address Unauthorized Assets	Aligned	Inventories of all hardware and software installed on the co...	26.0_IS_Vulnerability_Management_Policy.pdf
1.3	Utilize an Active Discovery Tool	Aligned	c) The Asset inventory should be kept accurate, and it shoul...	7.0_IS_Asset_Management_Policy.pdf
1.3	Utilize an Active Discovery Tool	Aligned	Inventories of all hardware and software installed on the co...	26.0_IS_Vulnerability_Management_Policy.pdf
1.4	Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory	Aligned	Inventories of all hardware and software installed on the co...	26.0_IS_Vulnerability_Management_Policy.pdf
1.5	Use a Passive Asset Discovery Tool	Aligned	Inventories of all hardware and software installed on the co...	26.0_IS_Vulnerability_Management_Policy.pdf
1.5	Use a Passive Asset Discovery Tool	Aligned	Automated vulnerability scans should be used to scan all ide...	26.0_IS_Vulnerability_Management_Policy.pdf
2.1	Establish and Maintain a Software Inventory Key Control	Aligned	Inventory of Assets...	7.0_IS_Asset_Management_Policy.pdf
2.1	Establish and Maintain a Software Inventory Key Control	Aligned	All Firm workstations and laptops should be inventoried for ...	7.2_IS_End_User_Device_Standard.pdf
2.1	Establish and Maintain a Software Inventory Key Control	Aligned	Inventories of all hardware and software installed on the co...	26.0_IS_Vulnerability_Management_Policy.pdf
2.1	Establish and Maintain a Software Inventory Key Control	Aligned	Inventory and Control of Software Assets...	19.1_IS_Cloud_Computing_Security_Standard.pdf
2.2	Ensure Authorized Software is Currently Supported Key Control	Aligned	Software/Applications...	7.0_IS_Asset_Management_Policy.pdf
2.2	Ensure Authorized Software is Currently Supported Key Control	Aligned	EXCEPTION...	19.0_IS_Cloud_Computing_Security_Policy.pdf
2.2	Ensure Authorized Software is Currently Supported Key Control	Aligned	Inventories of all hardware and software installed on the co...	26.0_IS_Vulnerability_Management_Policy.pdf
2.3	Address Unauthorized Software	Aligned	Exceptions to this policy can be requested by submitting a p...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
2.3	Address Unauthorized Software	Aligned	Section regarding emergency exceptions to software policy...	7.1_IS_Asset_Management_Standard.pdf
2.3	Address Unauthorized Software	Aligned	Use only Lazard managed equipment for business-related work;...	6.1_IS_Data_Security_Standards.pdf
2.3	Address Unauthorized Software	Aligned	Section 1.12 - EXCEPTION...	5.0_IS_Human_Resource_Security_Policy_1.pdf
2.3	Address Unauthorized Software	Aligned	Access rights to the Lazard networks and network services...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
2.3	Address Unauthorized Software	Aligned	Policy exceptions process...	26.0_IS_Vulnerability_Management_Policy.pdf
2.3	Address Unauthorized Software	Aligned	Detailed explanation of why the exception is necessary and D...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
2.3	Address Unauthorized Software	Aligned	EXCEPTION...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
2.4	Utilize Automated Software Inventory Tools	Aligned	Inventory of Assets...	7.0_IS_Asset_Management_Policy.pdf
2.4	Utilize Automated Software Inventory Tools	Aligned	Inventories of all hardware and software installed on the co...	26.0_IS_Vulnerability_Management_Policy.pdf
2.7	Allowlist Authorized Scripts	Gap	Use technical controls, such as digital signatures and version control, to ensure that only authoriz...
3.1	Establish and Maintain a Data Management Process Key Control	Aligned	1.4 SECURITY & PROPRIETARY INFORMATION...	2.0_IS_Acceptable_Use_Policy.pdf
3.1	Establish and Maintain a Data Management Process Key Control	Aligned	1.5 MAINTENANCE...	7.0_IS_Asset_Management_Policy.pdf
3.1	Establish and Maintain a Data Management Process Key Control	Aligned	1.4 MAINTAINANCE...	7.1_IS_Asset_Management_Standard.pdf
3.1	Establish and Maintain a Data Management Process Key Control	Aligned	Responsibilities of application owners and collaboration wit...	19.0_IS_Cloud_Computing_Security_Policy.pdf
3.1	Establish and Maintain a Data Management Process Key Control	Aligned	b) Classifying and securing data according to the criteria s...	6.0_IS_Data_Security_Policy_1.pdf
3.1	Establish and Maintain a Data Management Process Key Control	Aligned	Policies and procedures should be established, and supportin...	19.1_IS_Cloud_Computing_Security_Standard.pdf
3.1	Establish and Maintain a Data Management Process Key Control	Aligned	MAINTAINANCE...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
3.2	Establish and Maintain a Data Inventory Key Control	Aligned	c) The Asset inventory should be kept accurate, and it shoul...	7.0_IS_Asset_Management_Policy.pdf
3.2	Establish and Maintain a Data Inventory Key Control	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
3.2	Establish and Maintain a Data Inventory Key Control	Aligned	Policies and procedures should be established, and supportin...	19.1_IS_Cloud_Computing_Security_Standard.pdf
3.3	Configure Data Access Control Lists	Aligned	1.4 SECURITY & PROPRIETARY INFORMATION...	2.0_IS_Acceptable_Use_Policy.pdf
3.3	Configure Data Access Control Lists	Aligned	Access Control \| Policy & Procedures...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
3.3	Configure Data Access Control Lists	Aligned	Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
3.3	Configure Data Access Control Lists	Aligned	Equipment and media containing confidential information shou...	7.2_IS_End_User_Device_Standard.pdf
3.3	Configure Data Access Control Lists	Aligned	Only approved end-user devices may be attached to the LAN (p...	7.2_IS_End_User_Device_Standard.pdf
3.3	Configure Data Access Control Lists	Aligned	In particular, the use of any unauthorized networking device...	7.2_IS_End_User_Device_Standard.pdf
3.3	Configure Data Access Control Lists	Aligned	Network Access Control (NAC) technology is used to monitor c...	7.2_IS_End_User_Device_Standard.pdf
3.3	Configure Data Access Control Lists	Aligned	1.2.1 Access Control...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
3.3	Configure Data Access Control Lists	Aligned	1.2.2 Information Resources...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
3.3	Configure Data Access Control Lists	Aligned	Classifying and securing data according to the criteria stip...	6.0_IS_Data_Security_Policy_1.pdf
3.3	Configure Data Access Control Lists	Aligned	Access privileges of all users, especially those with the ab...	6.0_IS_Data_Security_Policy_1.pdf
3.3	Configure Data Access Control Lists	Aligned	The principle of least privilege should be employed by:...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
3.3	Configure Data Access Control Lists	Aligned	User access policies and procedures should be established...	19.1_IS_Cloud_Computing_Security_Standard.pdf
3.4	Enforce Data Retention Key Control	Aligned	An exit strategy for recovering, transferring, or destroying...	19.0_IS_Cloud_Computing_Security_Policy.pdf
3.4	Enforce Data Retention Key Control	Aligned	Disposal (in accordance with Retention Policy)...	6.1_IS_Data_Security_Standards.pdf
3.4	Enforce Data Retention Key Control	Aligned	Data retention policies are driven by legal and regulatory r...	6.0_IS_Data_Security_Policy_1.pdf
3.4	Enforce Data Retention Key Control	Aligned	Log file retention requirements...	26.0_IS_Vulnerability_Management_Policy.pdf
3.5	Securely Dispose of Data Key Control	Aligned	1.2.2 Asset Disposal & Re-Use...	7.0_IS_Asset_Management_Policy.pdf
3.5	Securely Dispose of Data Key Control	Aligned	IT Asset Retirement and Disposal...	7.1_IS_Asset_Management_Standard.pdf
3.5	Securely Dispose of Data Key Control	Aligned	Exit Strategy for Data Management...	19.0_IS_Cloud_Computing_Security_Policy.pdf
3.5	Securely Dispose of Data Key Control	Aligned	Data Wiping and Removal Procedures...	2.1_IS_Acceptable_Use_Standard.pdf
3.5	Securely Dispose of Data Key Control	Aligned	Disposal (in accordance with Retention Policy)...	6.1_IS_Data_Security_Standards.pdf
3.6	Encrypt Data on End-User Devices	Aligned	Policies and procedures should be established, and supportin...	19.1_IS_Cloud_Computing_Security_Standard.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	DOCUMENT CLASSIFICATION...	2.0_IS_Acceptable_Use_Policy.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	DOCUMENT CLASSIFICATION...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	1.2.2 Asset Disposal & Re-Use...	7.0_IS_Asset_Management_Policy.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	DOCUMENT CLASSIFICATION...	7.1_IS_Asset_Management_Standard.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	DOCUMENT CLASSIFICATION...	19.0_IS_Cloud_Computing_Security_Policy.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	DOCUMENT CLASSIFICATION...	2.1_IS_Acceptable_Use_Standard.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	DOCUMENT CLASSIFICATION...	5.0_IS_Human_Resource_Security_Policy_1.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	1.0 PURPOSE...	6.0_IS_Data_Security_Policy_1.pdf
3.7	Establish and Maintain a Data Classification Scheme	Aligned	Incident Categorization...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
3.8	Document Data Flows Key Control	Aligned	1.2.1 General Network Security...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
3.9	Encrypt Data on Removable Media	Aligned	REMOVEABLE STORAGE DEVICES...	2.0_IS_Acceptable_Use_Policy.pdf
3.9	Encrypt Data on Removable Media	Aligned	Use of Removable Devices and Data Security...	7.2_IS_End_User_Device_Standard.pdf
3.9	Encrypt Data on Removable Media	Aligned	Disposal (in accordance with Retention Policy)...	6.1_IS_Data_Security_Standards.pdf
3.9	Encrypt Data on Removable Media	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
3.11	Encrypt Sensitive Data at Rest Key Control	Aligned	Details on Encryption see section “Encryption requirements” ...	6.1_IS_Data_Security_Standards.pdf
3.11	Encrypt Sensitive Data at Rest Key Control	Aligned	Policies and procedures should be established, and supportin...	19.1_IS_Cloud_Computing_Security_Standard.pdf
3.12	Segment Data Processing and Storage Based on Sensitivity	Aligned	Restricted Data...	6.0_IS_Data_Security_Policy_1.pdf
3.12	Segment Data Processing and Storage Based on Sensitivity	Aligned	Policies and procedures should be established, and supportin...	19.1_IS_Cloud_Computing_Security_Standard.pdf
3.13	Deploy a Data Loss Prevention Solution Key Control	Aligned	Inventory of Assets...	7.0_IS_Asset_Management_Policy.pdf
3.13	Deploy a Data Loss Prevention Solution Key Control	Aligned	Data Loss Prevention Mechanism...	6.0_IS_Data_Security_Policy_1.pdf
3.13	Deploy a Data Loss Prevention Solution Key Control	Aligned	The section discusses DLP and its role in safeguarding perso...	19.1_IS_Cloud_Computing_Security_Standard.pdf
3.14	Log Sensitive Data Access Key Control	Aligned	Asset Disposal & Re-Use...	7.0_IS_Asset_Management_Policy.pdf
3.14	Log Sensitive Data Access Key Control	Aligned	IT Asset (NEW) and other assets Retirement and Disposal...	7.1_IS_Asset_Management_Standard.pdf
3.14	Log Sensitive Data Access Key Control	Aligned	An exit strategy for recovering, transferring, or destroying...	19.0_IS_Cloud_Computing_Security_Policy.pdf
3.14	Log Sensitive Data Access Key Control	Aligned	Disposal (in accordance with Retention Policy)...	6.1_IS_Data_Security_Standards.pdf
3.14	Log Sensitive Data Access Key Control	Aligned	1.7 PROTECTION OF LOG INFORMATION...	6.0_IS_Data_Security_Policy_1.pdf
3.14	Log Sensitive Data Access Key Control	Aligned	Event logs should be produced based on the Lazard Logging St...	26.0_IS_Vulnerability_Management_Policy.pdf
3.14	Log Sensitive Data Access Key Control	Aligned	Lazard should use file integrity monitoring or change detect...	26.0_IS_Vulnerability_Management_Policy.pdf
3.14	Log Sensitive Data Access Key Control	Aligned	Log files should be protected from tampering or unauthorized...	26.0_IS_Vulnerability_Management_Policy.pdf
3.14	Log Sensitive Data Access Key Control	Aligned	Access Control and User Access Policies...	19.1_IS_Cloud_Computing_Security_Standard.pdf
4.1	Establish and Maintain a Secure Configuration Process Key Control	Aligned	Endpoint Security Device Management...	7.1_IS_Asset_Management_Standard.pdf
4.1	Establish and Maintain a Secure Configuration Process Key Control	Aligned	Endpoint Security Device Management...	7.1_IS_Asset_Management_Standard.pdf
4.1	Establish and Maintain a Secure Configuration Process Key Control	Aligned	Across High-Risk Technology Assets...	6.1_IS_Data_Security_Standards.pdf
4.1	Establish and Maintain a Secure Configuration Process Key Control	Aligned	Secure Configuration of Enterprise Assets & Software...	6.0_IS_Data_Security_Policy_1.pdf
4.1	Establish and Maintain a Secure Configuration Process Key Control	Aligned	1.2.1 General Network Security...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
4.2	Establish and Maintain a Secure Configuration Process for Network Infrastructure Key Control	Aligned	IT management should establish, implement, and actively mana...	7.0_IS_Asset_Management_Policy.pdf
4.2	Establish and Maintain a Secure Configuration Process for Network Infrastructure Key Control	Aligned	1.4 MAINTAINANCE...	6.1_IS_Data_Security_Standards.pdf
4.2	Establish and Maintain a Secure Configuration Process for Network Infrastructure Key Control	Aligned	Configuration Management \| Policies & Procedures, Configurat...	3.0_IS_Information_Security_Policy_2.pdf
4.2	Establish and Maintain a Secure Configuration Process for Network Infrastructure Key Control	Aligned	i. Routers and other network devices will be accessed by mea...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
4.2	Establish and Maintain a Secure Configuration Process for Network Infrastructure Key Control	Aligned	Baseline security requirements for applications and infrastr...	19.1_IS_Cloud_Computing_Security_Standard.pdf
4.3	Configure Automatic Session Locking on Enterprise Assets	Aligned	1.1.4 Smartphones, Mobile, and Other Wireless Devices...	7.2_IS_End_User_Device_Standard.pdf
4.3	Configure Automatic Session Locking on Enterprise Assets	Aligned	Working Sessions and INFORMATION SECURITY GOALS...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
4.4	Implement and Manage a Firewall on Servers	Aligned	Network Segregation and Segmentation...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
4.4	Implement and Manage a Firewall on Servers	Aligned	6. Personal firewalls software should be installed and subje...	7.2_IS_End_User_Device_Standard.pdf
4.4	Implement and Manage a Firewall on Servers	Aligned	Network Infrastructure Management and Network Monitoring & D...	6.0_IS_Data_Security_Policy_1.pdf
4.4	Implement and Manage a Firewall on Servers	Aligned	Network and Firewall Security Policy...	3.0_IS_Information_Security_Policy_2.pdf
4.4	Implement and Manage a Firewall on Servers	Aligned	Network Controls...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
4.5	Implement and Manage a Firewall on End-User Devices	Aligned	End-user Device Security Policy...	3.0_IS_Information_Security_Policy_2.pdf
4.5	Implement and Manage a Firewall on End-User Devices	Aligned	Devices that are Internet-facing and outside the Lazard fire...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
4.6	Securely Manage Enterprise Assets and Software Key Control	Aligned	Equipment and media containing confidential information shou...	7.2_IS_End_User_Device_Standard.pdf
4.6	Securely Manage Enterprise Assets and Software Key Control	Aligned	Secure Configuration of Enterprise Assets & Software...	6.0_IS_Data_Security_Policy_1.pdf
4.6	Securely Manage Enterprise Assets and Software Key Control	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
4.7	Manage Default Accounts on Enterprise Assets and Software	Aligned	General User Account...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
4.9	Configure Trusted DNS Servers on Enterprise Assets	Aligned	infrastructure configuration standards including firewall, I...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
4.11	Enforce Remote Wipe Capability on Portable End-User Devices Key Control	Aligned	Section a) and b)...	7.0_IS_Asset_Management_Policy.pdf
4.11	Enforce Remote Wipe Capability on Portable End-User Devices Key Control	Aligned	User agrees that designated staff can, under certain circums...	2.1_IS_Acceptable_Use_Standard.pdf
4.11	Enforce Remote Wipe Capability on Portable End-User Devices Key Control	Aligned	Disposal (in accordance with Retention Policy)...	6.1_IS_Data_Security_Standards.pdf
4.12	Separate Enterprise Workspaces on Mobile End-User Devices Key Control	Aligned	1.2 GENERAL USER RESPONSIBILITIES...	2.0_IS_Acceptable_Use_Policy.pdf
4.12	Separate Enterprise Workspaces on Mobile End-User Devices Key Control	Aligned	Endpoint Security Device Management...	7.1_IS_Asset_Management_Standard.pdf
5.1	Establish and Maintain an Inventory of Accounts Key Control	Aligned	Assets ownership and responsibilities...	7.0_IS_Asset_Management_Policy.pdf
5.1	Establish and Maintain an Inventory of Accounts Key Control	Aligned	1.2.3 Account Management...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
5.1	Establish and Maintain an Inventory of Accounts Key Control	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	5.0_IS_Human_Resource_Security_Policy_1.pdf
1.1.2	Access Control Policy	Aligned	Only approved end-user devices may be attached to the LAN (p...	7.2_IS_End_User_Device_Standard.pdf
1.1.3	Network Access Control	Aligned	Network Access Control (NAC) technology is used to monitor c...	7.2_IS_End_User_Device_Standard.pdf
1	Inventory & Control of Enterprise Assets	Aligned	Secure Configuration of Enterprise Assets & Software...	6.0_IS_Data_Security_Policy_1.pdf
1	Inventory & Control of Enterprise Assets	Aligned	Inventory & Control of Enterprise Assets...	6.0_IS_Data_Security_Policy_1.pdf
1	Inventory & Control of Enterprise Assets	Aligned	Inventory & Control of Enterprise Assets...	6.0_IS_Data_Security_Policy_1.pdf
2	Inventory & Control of Software Assets	Aligned	Secure Configuration of Enterprise Assets & Software...	6.0_IS_Data_Security_Policy_1.pdf
2	Inventory & Control of Software Assets	Aligned	Inventory & Control of Software Assets...	6.0_IS_Data_Security_Policy_1.pdf
2	Inventory & Control of Software Assets	Aligned	Inventory & Control of Software Assets...	6.0_IS_Data_Security_Policy_1.pdf
SC-7	Boundary Protection Key Control	Aligned	Network Infrastructure Management and Network Monitoring & D...	6.0_IS_Data_Security_Policy_1.pdf
PR.DS-8	Data Protection	Aligned	Policies and procedures should be established, and supportin...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PR.DS-8	Data Protection	Aligned	Policies and procedures should be established, and supportin...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CM-8	Configuration Management \| System Component Inventory Key Control	Aligned	NIST SP 800-53 Rev 5...	19.1_IS_Cloud_Computing_Security_Standard.pdf

325 Total Controls

Control ID	Control Name	Status	Evidence Section	Document
AC-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy...	6.1_IS_Data_Security_Standards.pdf
AC-1	Policy and Procedures Key Control	Aligned	1.5 EXCEPTION...	2.1_IS_Acceptable_Use_Standard.pdf
AC-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
AC-1	Policy and Procedures Key Control	Aligned	1.4 SECURITY & PROPRIETARY INFORMATION...	2.0_IS_Acceptable_Use_Policy.pdf
AC-1	Policy and Procedures Key Control	Aligned	Access Control Compliance...	19.0_IS_Cloud_Computing_Security_Policy.pdf
AC-1	Policy and Procedures Key Control	Aligned	User access policies and procedures should be established...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AC-1	Policy and Procedures Key Control	Aligned	User access policies and procedures should be established...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AC-1	Policy and Procedures Key Control	Aligned	Policy statement requiring the exception....	6.0_IS_Data_Security_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	b) Classifying and securing data according to the criteria s...	6.0_IS_Data_Security_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	Approving access to the data in accordance with Access contr...	6.0_IS_Data_Security_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	Access Control \| Policy & Procedures...	6.0_IS_Data_Security_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	Mobile Device Policy, Teleworking, Security of Kit and Asset...	6.0_IS_Data_Security_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	Access Control Policy...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	Policy Exceptions...	7.1_IS_Asset_Management_Standard.pdf
AC-1	Policy and Procedures Key Control	Aligned	Access Control Policy and Procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	Scope & Applicability...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	Scope & Applicability...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	Scope & Applicability...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	Scope & Applicability...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	vi. Authorization process is developed and implemented to en...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	Access Control Policy...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	7.2_IS_End_User_Device_Standard.pdf
AC-1	Policy and Procedures Key Control	Aligned	Access Control Policy and Procedures...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-1	Policy and Procedures Key Control	Aligned	Access control policy and procedures...	3.0_IS_Information_Security_Policy_2.pdf
AC-1	Policy and Procedures Key Control	Aligned	The practice of protecting information and information syste...	3.0_IS_Information_Security_Policy_2.pdf
AC-1	Policy and Procedures Key Control	Aligned	Acceptable Use – Establishes the acceptable use of informati...	3.0_IS_Information_Security_Policy_2.pdf
AC-1	Policy and Procedures Key Control	Aligned	XI. Access should be restricted to the information assets in...	3.0_IS_Information_Security_Policy_2.pdf
AC-1	Policy and Procedures Key Control	Aligned	Access Control...	3.0_IS_Information_Security_Policy_2.pdf
AC-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY and 1.2 APPLICABILITY...	20.0_IS_Risk_Management_Policy_2.pdf
AC-1	Policy and Procedures Key Control	Aligned	Policy Exceptions and Implementation...	7.0_IS_Asset_Management_Policy.pdf
AC-1	Policy and Procedures Key Control	Aligned	ix. Defining and periodically reviewing access restrictions ...	7.0_IS_Asset_Management_Policy.pdf
AC-1	Policy and Procedures Key Control	Aligned	ix. Defining and periodically reviewing access restrictions ...	7.0_IS_Asset_Management_Policy.pdf
AC-1	Policy and Procedures Key Control	Aligned	EXCEPTION...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
AC-1	Policy and Procedures Key Control	Aligned	EXCEPTION...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
AC-1	Policy and Procedures Key Control	Aligned	1.2 REQUIREMENTS...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	Access Control Policy and Procedures...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-10	Concurrent Session Control	Aligned	Access Control \| Use of External Systems...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-11	Device Lock Key Control	Aligned	Endpoint Security Device Management...	7.1_IS_Asset_Management_Standard.pdf
AC-11	Device Lock Key Control	Aligned	Section 10 and 1.1.4...	7.2_IS_End_User_Device_Standard.pdf
AC-11	Device Lock Key Control	Aligned	End-user Device Security Policy...	3.0_IS_Information_Security_Policy_2.pdf
AC-11	Device Lock Key Control	Aligned	Working Sessions and INFORMATION SECURITY GOALS...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
AC-12	Session Termination	Aligned	1.9 LEAVING LAZARD...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-12	Session Termination	Aligned	Use case #4...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
AC-14	Permitted Actions Without Identification or Authentication Key Control	Aligned	v. Users are provided access only to those services that the...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-14	Permitted Actions Without Identification or Authentication Key Control	Aligned	Access Control \| Policy & Procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-14	Permitted Actions Without Identification or Authentication Key Control	Aligned	Only approved end-user devices may be attached to the LAN (p...	7.2_IS_End_User_Device_Standard.pdf
AC-14	Permitted Actions Without Identification or Authentication Key Control	Aligned	Access Control Procedures...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-14	Permitted Actions Without Identification or Authentication Key Control	Aligned	accessing federal systems may be required to protect federal...	7.0_IS_Asset_Management_Policy.pdf
AC-16	Security and Privacy Attributes Key Control	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
AC-16	Security and Privacy Attributes Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
AC-16	Security and Privacy Attributes Key Control	Aligned	The section discusses attributes of an identity and their ro...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AC-16	Security and Privacy Attributes Key Control	Aligned	Shareholders personal information such as Social Security Nu...	6.0_IS_Data_Security_Policy_1.pdf
AC-16	Security and Privacy Attributes Key Control	Aligned	All data classified as production, including all customer in...	6.0_IS_Data_Security_Policy_1.pdf
AC-16	Security and Privacy Attributes Key Control	Aligned	Internal and external audit reports....	6.0_IS_Data_Security_Policy_1.pdf
AC-16	Security and Privacy Attributes Key Control	Aligned	Regulatory agency reports, unless specified by the regulator...	6.0_IS_Data_Security_Policy_1.pdf
AC-16	Security and Privacy Attributes Key Control	Aligned	Reports produced by Information Security Data (e.g., vulnera...	6.0_IS_Data_Security_Policy_1.pdf
AC-16	Security and Privacy Attributes Key Control	Aligned	Data such as balance sheet and profit and loss figures, Laza...	6.0_IS_Data_Security_Policy_1.pdf
AC-16	Security and Privacy Attributes Key Control	Aligned	All personal data that is not required solely for identifica...	6.0_IS_Data_Security_Policy_1.pdf
AC-16	Security and Privacy Attributes Key Control	Aligned	Lazard should define, document, implement, and maintain poli...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-16	Security and Privacy Attributes Key Control	Aligned	Access Control \| Policy & Procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-16	Security and Privacy Attributes Key Control	Aligned	Data Security – Establishes controls and framework for class...	3.0_IS_Information_Security_Policy_2.pdf
AC-16	Security and Privacy Attributes Key Control	Aligned	1.2.2 Asset Disposal & Re-Use...	7.0_IS_Asset_Management_Policy.pdf
AC-17	Remote Access Key Control	Aligned	1.7 CLOUD SYSTEMS...	19.0_IS_Cloud_Computing_Security_Policy.pdf
AC-17	Remote Access Key Control	Aligned	Access Control \| Remote Access...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AC-17	Remote Access Key Control	Aligned	g) It is essential for Lazard to use VPN (Virtual Private Ne...	6.0_IS_Data_Security_Policy_1.pdf
AC-17	Remote Access Key Control	Aligned	Teleworking...	6.0_IS_Data_Security_Policy_1.pdf
AC-17	Remote Access Key Control	Aligned	Teleworking...	6.0_IS_Data_Security_Policy_1.pdf
AC-17	Remote Access Key Control	Aligned	Access Control \| Remote Access...	6.0_IS_Data_Security_Policy_1.pdf
AC-17	Remote Access Key Control	Aligned	Endpoint Security Device Management...	7.1_IS_Asset_Management_Standard.pdf
AC-17	Remote Access Key Control	Aligned	Remote Access Security...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-17	Remote Access Key Control	Aligned	v. All external connections to Lazard networks or Informatio...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-17	Remote Access Key Control	Aligned	Ensure that the security controls are in place while using m...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-17	Remote Access Key Control	Aligned	Ensure that the security controls are in place while using m...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-17	Remote Access Key Control	Aligned	Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-17	Remote Access Key Control	Aligned	Section 1.2.2 Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-17	Remote Access Key Control	Aligned	Monitoring devices are typically employed at the managed int...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-17	Remote Access Key Control	Aligned	Remote access is a type of network access that involves comm...	7.2_IS_End_User_Device_Standard.pdf
AC-17	Remote Access Key Control	Aligned	Section 10: Only approved end-user devices may be attached t...	7.2_IS_End_User_Device_Standard.pdf
AC-17	Remote Access Key Control	Aligned	In particular, the use of any unauthorized networking device...	7.2_IS_End_User_Device_Standard.pdf
AC-17	Remote Access Key Control	Aligned	Section 10 regarding approved devices and network access con...	7.2_IS_End_User_Device_Standard.pdf
AC-17	Remote Access Key Control	Aligned	Section 1.2.5 Wired Public Internet Connections...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-17	Remote Access Key Control	Aligned	Password Management for Access...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-17	Remote Access Key Control	Aligned	The practice of protecting information and information syste...	3.0_IS_Information_Security_Policy_2.pdf
AC-17	Remote Access Key Control	Aligned	Remote Access...	7.0_IS_Asset_Management_Policy.pdf
AC-17	Remote Access Key Control	Aligned	Access rights to the Lazard networks and network services...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
AC-18	Wireless Access	Aligned	Access Control \| Wireless Access...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AC-18	Wireless Access	Aligned	Wireless technologies and their security aspects...	6.0_IS_Data_Security_Policy_1.pdf
AC-18	Wireless Access	Aligned	Access Control \| Wireless Access...	6.0_IS_Data_Security_Policy_1.pdf
AC-18	Wireless Access	Aligned	Wireless technologies and authentication protocols...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	High-Risk Technology Assets...	6.1_IS_Data_Security_Standards.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Lost Devices...	2.1_IS_Acceptable_Use_Standard.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Rules and Standards for managing security for BYOD...	2.0_IS_Acceptable_Use_Policy.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	deviations from standard security baseline configurations...	19.0_IS_Cloud_Computing_Security_Policy.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Mobile Device Policy...	6.0_IS_Data_Security_Policy_1.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Access Control \| Access Control for Mobile Devices...	6.0_IS_Data_Security_Policy_1.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Mobile Device Policy...	6.0_IS_Data_Security_Policy_1.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Endpoint Security Device Management...	7.1_IS_Asset_Management_Standard.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Mobile Device Security...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	1.2.2 Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Ensure that the security controls are in place while using m...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Ensure that the security controls are in place while using m...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Overview and Scope & Applicability...	7.2_IS_End_User_Device_Standard.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Section 7: Configuration of remote access security....	7.2_IS_End_User_Device_Standard.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Only approved end-user devices may be attached to the LAN (p...	7.2_IS_End_User_Device_Standard.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Protection and control of mobile devices...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Procedures for the network service usage to restrict access ...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	End-user Device Security Policy...	3.0_IS_Information_Security_Policy_2.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	End-user Device Security Policy...	3.0_IS_Information_Security_Policy_2.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	1.2. Hardware, Software, Applications and Data - Inventory o...	7.0_IS_Asset_Management_Policy.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	Configuration Management \| System Component Inventory...	7.0_IS_Asset_Management_Policy.pdf
AC-19	Access Control for Mobile Devices Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	1.6 ENFORCEMENT/COMPLIANCE...	2.1_IS_Acceptable_Use_Standard.pdf
AC-2	Account Management Key Control	Aligned	1.11 USER ID & PASSWORD SECURITY...	2.0_IS_Acceptable_Use_Policy.pdf
AC-2	Account Management Key Control	Aligned	USER ID & PASSWORD SECURITY...	2.0_IS_Acceptable_Use_Policy.pdf
AC-2	Account Management Key Control	Aligned	1.11 USER ID & PASSWORD SECURITY...	2.0_IS_Acceptable_Use_Policy.pdf
AC-2	Account Management Key Control	Aligned	User access policies and procedures should be established, a...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AC-2	Account Management Key Control	Aligned	User access policies and procedures should be established...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AC-2	Account Management Key Control	Aligned	Responsibilities of Data Custodians...	6.0_IS_Data_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	f) Access privileges of all users, especially those with the...	6.0_IS_Data_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	ID management responsibilities...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Application Security Administrators (Systems Administrators)...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	User Access Management...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Definition of User, Privileged User, User Account, Service A...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Access is based on an employee/contractor’s role and should ...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	vi. Authorization process is developed and implemented to en...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Scope & Applicability...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Access is based on an employee/contractor’s role and should ...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Access is based on an employee/contractor’s role and should ...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Access Control Policy...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Access is based on an employee/contractor’s role and should ...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Access is based on an employee/contractor’s role and should ...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Access to Information Resources should be controlled through...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Scope & Applicability...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Segregate access control roles between access request, acces...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	vi. Authorization process is developed and implemented to en...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Scope & Applicability...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	v. Users are provided access only to those services that the...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Access Control Policy...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	v. Users are provided access only to those services that the...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	The reference to account management activities of AC-2 using...	7.2_IS_End_User_Device_Standard.pdf
AC-2	Account Management Key Control	Aligned	Section v. Remote Management and the principle of least priv...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-2	Account Management Key Control	Aligned	controls for applications and systems that contain, process,...	3.0_IS_Information_Security_Policy_2.pdf
AC-2	Account Management Key Control	Aligned	Access Control...	3.0_IS_Information_Security_Policy_2.pdf
AC-2	Account Management Key Control	Aligned	vi. Authorizing and periodically reviewing access entitlemen...	7.0_IS_Asset_Management_Policy.pdf
AC-2	Account Management Key Control	Aligned	ix. Defining and periodically reviewing access restrictions ...	7.0_IS_Asset_Management_Policy.pdf
AC-2	Account Management Key Control	Aligned	1.2.2 Information Resources...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Access rights to the Lazard networks and network services...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Access to Enterprise Servers...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
AC-2	Account Management Key Control	Aligned	Information Security Policies for Supplier Relationships...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-20	Use of External Systems Key Control	Aligned	Lost Devices...	2.1_IS_Acceptable_Use_Standard.pdf
AC-20	Use of External Systems Key Control	Aligned	User Consent and Monitoring Policy...	2.0_IS_Acceptable_Use_Policy.pdf
AC-20	Use of External Systems Key Control	Aligned	External entities using Lazard cloud services...	19.0_IS_Cloud_Computing_Security_Policy.pdf
AC-20	Use of External Systems Key Control	Aligned	Access Control \| Use of External Systems...	6.0_IS_Data_Security_Policy_1.pdf
AC-20	Use of External Systems Key Control	Aligned	1.2.2 Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-20	Use of External Systems Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-20	Use of External Systems Key Control	Aligned	Adequate security for mobile devices...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-20	Use of External Systems Key Control	Aligned	External System Access Principles...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-21	Information Sharing Key Control	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
AC-21	Information Sharing Key Control	Aligned	Disseminating information about employees or lists of Lazard...	2.1_IS_Acceptable_Use_Standard.pdf
AC-21	Information Sharing Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
AC-21	Information Sharing Key Control	Aligned	DOCUMENT CLASSIFICATION...	19.0_IS_Cloud_Computing_Security_Policy.pdf
AC-21	Information Sharing Key Control	Aligned	Data Privacy and Data Governance...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AC-21	Information Sharing Key Control	Aligned	DOCUMENT CLASSIFICATION...	26.0_IS_Vulnerability_Management_Policy.pdf
AC-21	Information Sharing Key Control	Aligned	Confidential Data...	6.0_IS_Data_Security_Policy_1.pdf
AC-21	Information Sharing Key Control	Aligned	Access Control...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-21	Information Sharing Key Control	Aligned	Access to nonpublic personal, restricted, confidential, or p...	7.2_IS_End_User_Device_Standard.pdf
AC-21	Information Sharing Key Control	Aligned	PURPOSE...	20.0_IS_Risk_Management_Policy_2.pdf
AC-21	Information Sharing Key Control	Aligned	Defining and periodically reviewing access restrictions and ...	7.0_IS_Asset_Management_Policy.pdf
AC-21	Information Sharing Key Control	Aligned	1.2.1 Access Control...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
AC-22	Publicly Accessible Content Key Control	Aligned	Access Control Procedures...	6.1_IS_Data_Security_Standards.pdf
AC-22	Publicly Accessible Content Key Control	Aligned	Disseminating internal or confidential organization document...	2.1_IS_Acceptable_Use_Standard.pdf
AC-22	Publicly Accessible Content Key Control	Aligned	Making unprofessional comments about Lazard in public forums...	2.1_IS_Acceptable_Use_Standard.pdf
AC-22	Publicly Accessible Content Key Control	Aligned	Public Data and Internal Use Only Data...	6.0_IS_Data_Security_Policy_1.pdf
AC-22	Publicly Accessible Content Key Control	Aligned	DOCUMENT CLASSIFICATION...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-22	Publicly Accessible Content Key Control	Aligned	8.0 Access Control & Identity Management Policy...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-22	Publicly Accessible Content Key Control	Aligned	PURPOSE...	20.0_IS_Risk_Management_Policy_2.pdf
AC-22	Publicly Accessible Content Key Control	Aligned	DOCUMENT CLASSIFICATION...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
AC-23	Data Mining Protection	Aligned	The protection of data against unintentional, unlawful, or u...	3.0_IS_Information_Security_Policy_2.pdf
AC-24	Access Control Decisions	Aligned	User Consent and Monitoring Policy...	2.0_IS_Acceptable_Use_Policy.pdf
AC-24	Access Control Decisions	Aligned	User access policies and procedures should be established...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AC-24	Access Control Decisions	Aligned	Access Control Policy...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-24	Access Control Decisions	Aligned	Segregate access control roles between access request, acces...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-24	Access Control Decisions	Aligned	Access Control Procedures...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-24	Access Control Decisions	Aligned	Access Control...	3.0_IS_Information_Security_Policy_2.pdf
AC-24	Access Control Decisions	Aligned	vi. Authorizing and periodically reviewing access entitlemen...	7.0_IS_Asset_Management_Policy.pdf
AC-24	Access Control Decisions	Aligned	ix. Defining and periodically reviewing access restrictions ...	7.0_IS_Asset_Management_Policy.pdf
AC-25	Reference Monitor Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
AC-25	Reference Monitor Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-25	Reference Monitor Key Control	Aligned	Overview and Scope & Applicability...	7.2_IS_End_User_Device_Standard.pdf
AC-25	Reference Monitor Key Control	Aligned	The protection of data against unintentional, unlawful, or u...	3.0_IS_Information_Security_Policy_2.pdf
AC-25	Reference Monitor Key Control	Aligned	vi. Authorizing and periodically reviewing access entitlemen...	7.0_IS_Asset_Management_Policy.pdf
AC-25	Reference Monitor Key Control	Aligned	ix. Defining and periodically reviewing access restrictions ...	7.0_IS_Asset_Management_Policy.pdf
AC-25	Reference Monitor Key Control	Aligned	Responsibilities for reviewing and authorizing access during...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control \| Information Flow Enforcement...	6.1_IS_Data_Security_Standards.pdf
AC-3	Access Enforcement Key Control	Aligned	1.6 ENFORCEMENT/COMPLIANCE...	2.1_IS_Acceptable_Use_Standard.pdf
AC-3	Access Enforcement Key Control	Aligned	User Consent and Monitoring Policy...	2.0_IS_Acceptable_Use_Policy.pdf
AC-3	Access Enforcement Key Control	Aligned	1.7 CLOUD SYSTEMS...	19.0_IS_Cloud_Computing_Security_Policy.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control Policies...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AC-3	Access Enforcement Key Control	Aligned	segregated and access restricted to prevent inappropriate di...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AC-3	Access Enforcement Key Control	Aligned	User access policies and procedures...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AC-3	Access Enforcement Key Control	Aligned	Endpoint Protection (Anti-Virus & Malware)...	26.0_IS_Vulnerability_Management_Policy.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control Policy...	6.0_IS_Data_Security_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Control: SC-3...	6.0_IS_Data_Security_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control Policy...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Applicability...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Section 1.6 - EXCEPTION...	7.1_IS_Asset_Management_Standard.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Enforcement...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	vii. Controls such as file access limitation, time limit for...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	iv. Control over User access to information services is enfo...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Scope & Applicability...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	1.2.2 Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control \| Policy & Procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Identification & Authentication \| Authenticator Management...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control Policy...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Prevent unauthorized access to information systems, network ...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control \| Policy & Procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access is based on an employee/contractor’s role and should ...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Prevent unauthorized access to information systems, network ...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	iv. Control over User access to information services is enfo...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	iv. Control over User access to information services is enfo...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control Policy...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	iv. Control over User access to information services is enfo...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control Policies and Device Management...	7.2_IS_End_User_Device_Standard.pdf
AC-3	Access Enforcement Key Control	Aligned	Section 12 regarding Network Access Control (NAC)...	7.2_IS_End_User_Device_Standard.pdf
AC-3	Access Enforcement Key Control	Aligned	Section 12 regarding Network Access Control technology....	7.2_IS_End_User_Device_Standard.pdf
AC-3	Access Enforcement Key Control	Aligned	Section 1.2.5 Wired Public Internet Connections...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control \| Use of External Systems...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control Policy...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-3	Access Enforcement Key Control	Aligned	End-user Device Security Policy, Internet Security & Usage P...	3.0_IS_Information_Security_Policy_2.pdf
AC-3	Access Enforcement Key Control	Aligned	Section 1.8 - Exceptions to the policy...	20.0_IS_Risk_Management_Policy_2.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Enforcement...	7.0_IS_Asset_Management_Policy.pdf
AC-3	Access Enforcement Key Control	Aligned	ix. Defining and periodically reviewing access restrictions ...	7.0_IS_Asset_Management_Policy.pdf
AC-3	Access Enforcement Key Control	Aligned	vi. Authorizing and periodically reviewing access entitlemen...	7.0_IS_Asset_Management_Policy.pdf
AC-3	Access Enforcement Key Control	Aligned	EXCEPTION...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
AC-3	Access Enforcement Key Control	Aligned	Requests for the granting of access to Lazard enterprise ser...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access rights to the Lazard enterprise servers should be rev...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access rights to the Lazard enterprise servers should be rev...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
AC-3	Access Enforcement Key Control	Aligned	Access Control \| Access Enforcement...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	Confidential data is personal identifiable information (PII)...	6.1_IS_Data_Security_Standards.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	Access Control \| Information Flow Enforcement...	6.1_IS_Data_Security_Standards.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	Equipment Siting & Protection...	6.1_IS_Data_Security_Standards.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	Section 6-10 regarding dissemination of information and unau...	2.1_IS_Acceptable_Use_Standard.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	AC-4...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	6.0 Data Security Policy and 8.0 Access Control Policy...	6.0_IS_Data_Security_Policy_1.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	Access Control Management...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	Access Control \| Use of External Systems...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	1.2.1 General Network Security...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	Network Infrastructure Management...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	Access Control \| Use of External Systems...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	Access Control \| Use of External Systems...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	Access Control \| Use of External Systems...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	Access Control \| Use of External Systems...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	controls for applications and systems that contain, process,...	3.0_IS_Information_Security_Policy_2.pdf
AC-4	Information Flow Enforcement Key Control	Aligned	1.2.1 Access Control...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Use of Privileged Utility Programs...	6.1_IS_Data_Security_Standards.pdf
AC-5	Separation of Duties Key Control	Aligned	USER ID & PASSWORD SECURITY...	2.0_IS_Acceptable_Use_Policy.pdf
AC-5	Separation of Duties Key Control	Aligned	1.12 GOVERNANCE...	19.0_IS_Cloud_Computing_Security_Policy.pdf
AC-5	Separation of Duties Key Control	Aligned	User access policies and procedures should be established...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AC-5	Separation of Duties Key Control	Aligned	Segregation of Duties...	6.0_IS_Data_Security_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Segregation of Duties...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Segregation of Duties...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Segregation of Duties...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Access Control \| Account Management...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Access Control Policy...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Access Control \| Account Management...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Access Control \| Use of External Systems...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-5	Separation of Duties Key Control	Aligned	vi. Authorizing and periodically reviewing access entitlemen...	7.0_IS_Asset_Management_Policy.pdf
AC-5	Separation of Duties Key Control	Aligned	Responsibilities during a BC/DR event...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	1.3 SEGREGATION OF DUTIES...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-5	Separation of Duties Key Control	Aligned	Segregation of Duties Principle...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-6	Least Privilege	Aligned	Access Control to Program Source Code...	6.1_IS_Data_Security_Standards.pdf
AC-6	Least Privilege	Aligned	Roles and Responsibilities for Cloud Security Program Govern...	19.0_IS_Cloud_Computing_Security_Policy.pdf
AC-6	Least Privilege	Aligned	Data Custodians responsibilities...	6.0_IS_Data_Security_Policy_1.pdf
AC-6	Least Privilege	Aligned	security responsibilities by employees under their supervisi...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AC-6	Least Privilege	Aligned	Privileged (Application Administration) Account...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-6	Least Privilege	Aligned	Access Control \| Policy & Procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-6	Least Privilege	Aligned	Access Control Policy...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-6	Least Privilege	Aligned	Privileged users should understand their roles and responsib...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-6	Least Privilege	Aligned	Access Control \| Account Management...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-6	Least Privilege	Aligned	Privileged users should understand their roles and responsib...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-6	Least Privilege	Aligned	Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-6	Least Privilege	Aligned	Section v. Remote Management and the principle of least priv...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-6	Least Privilege	Aligned	Section v. Remote Management and subsection f) The principle...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-6	Least Privilege	Aligned	vi. Authorizing and periodically reviewing access entitlemen...	7.0_IS_Asset_Management_Policy.pdf
AC-6	Least Privilege	Aligned	Actions can be taken to safeguard individual authenticators,...	7.0_IS_Asset_Management_Policy.pdf
AC-6	Least Privilege	Aligned	Access rights to the Lazard networks and network services...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
AC-6	Least Privilege	Aligned	1.3 SEGREGATION OF DUTIES...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-6	Least Privilege	Aligned	Access Control \| Least Privilege...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-7	Unsuccessful Logon Attempts	Aligned	Multi-Factor Authentication (MFA) is required to access the ...	2.1_IS_Acceptable_Use_Standard.pdf
AC-7	Unsuccessful Logon Attempts	Aligned	Account Management...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AC-7	Unsuccessful Logon Attempts	Aligned	End-user Device Security Policy...	3.0_IS_Information_Security_Policy_2.pdf
AC-7	Unsuccessful Logon Attempts	Aligned	Use case #4...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
AC-8	System Use Notification	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
AC-8	System Use Notification	Aligned	1.2 SYSTEM USE NOTIFICATION...	2.1_IS_Acceptable_Use_Standard.pdf
AC-8	System Use Notification	Aligned	Upon use of Lazard’s Systems...	2.0_IS_Acceptable_Use_Policy.pdf
AC-8	System Use Notification	Aligned	Roles & Responsibilities...	2.0_IS_Acceptable_Use_Policy.pdf
AC-8	System Use Notification	Aligned	Rules of behavior for organizational and non-organizational ...	7.1_IS_Asset_Management_Standard.pdf
AC-8	System Use Notification	Aligned	Section t) A login/warning banner should be displayed on all...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AC-8	System Use Notification	Aligned	1.2.2 Information Resources...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
AC-9	Previous Logon Notification	Aligned	t) A login/warning banner should be displayed on all system ...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AT-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
AT-1	Policy and Procedures Key Control	Aligned	Security Awareness Training Responsibilities...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AT-1	Policy and Procedures Key Control	Aligned	VII. Lazard adopts the NIST CSF and ISO 27001 standards as t...	3.0_IS_Information_Security_Policy_2.pdf
AT-1	Policy and Procedures Key Control	Aligned	Human Resource Security - Establishes controls to reduce the...	3.0_IS_Information_Security_Policy_2.pdf
AT-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY and 1.2 APPLICABILITY...	20.0_IS_Risk_Management_Policy_2.pdf
AT-2	Literacy Training and Awareness Key Control	Aligned	CLOUD SECURITY TRAINING & AWARENESS...	19.0_IS_Cloud_Computing_Security_Policy.pdf
AT-2	Literacy Training and Awareness Key Control	Aligned	Security Awareness and Skills Training...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AT-2	Literacy Training and Awareness Key Control	Aligned	Security Awareness and Skills Training...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AT-2	Literacy Training and Awareness Key Control	Aligned	Security Awareness and Skills Training...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AT-2	Literacy Training and Awareness Key Control	Aligned	1.7 INFORMATION SECURITY EDUCATION & TRAINING...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AT-2	Literacy Training and Awareness Key Control	Aligned	Security Roles and Responsibilities...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AT-2	Literacy Training and Awareness Key Control	Aligned	Security Awareness Training responsibilities...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AT-2	Literacy Training and Awareness Key Control	Aligned	Security responsibilities by employees under their supervisi...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AT-2	Literacy Training and Awareness Key Control	Aligned	Access Control \| Concurrent Session Control...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AT-2	Literacy Training and Awareness Key Control	Aligned	Information Security Awareness, Education & Training...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AT-2	Literacy Training and Awareness Key Control	Aligned	Security Awareness & Skills Training...	3.0_IS_Information_Security_Policy_2.pdf
AT-2	Literacy Training and Awareness Key Control	Aligned	Awareness and Training...	7.0_IS_Asset_Management_Policy.pdf
AT-2	Literacy Training and Awareness Key Control	Aligned	Security Awareness & Skills Training...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Role-Based Training Requirements...	6.1_IS_Data_Security_Standards.pdf
AT-3	Role-based Training Key Control	Aligned	1.12 GOVERNANCE...	19.0_IS_Cloud_Computing_Security_Policy.pdf
AT-3	Role-based Training Key Control	Aligned	Security Awareness and Skills Training...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AT-3	Role-based Training Key Control	Aligned	Role-Based Training...	6.0_IS_Data_Security_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Security Awareness Training Responsibilities...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Awareness & Training \| Role-based Training...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Access Control \| Concurrent Session Control...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Awareness & Training \| Role-based Training...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Information Security Awareness, Education & Training...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AT-3	Role-based Training Key Control	Aligned	Information Security Awareness, Education & Training...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AT-3	Role-based Training Key Control	Aligned	Information Security Awareness, Education & Training...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AT-3	Role-based Training Key Control	Aligned	Information Security Awareness, Education and Training...	3.0_IS_Information_Security_Policy_2.pdf
AT-3	Role-based Training Key Control	Aligned	Awareness & Training \| Role-based Training...	3.0_IS_Information_Security_Policy_2.pdf
AT-3	Role-based Training Key Control	Aligned	Awareness & Training \| Role-based Training...	3.0_IS_Information_Security_Policy_2.pdf
AT-3	Role-based Training Key Control	Aligned	Awareness & Training \| Role-based Training...	3.0_IS_Information_Security_Policy_2.pdf
AT-3	Role-based Training Key Control	Aligned	Awareness & Training \| Role-based Training...	3.0_IS_Information_Security_Policy_2.pdf
AT-3	Role-based Training Key Control	Aligned	Awareness & Training \| Role-based Training...	3.0_IS_Information_Security_Policy_2.pdf
AT-3	Role-based Training Key Control	Aligned	Personnel Security \| Policy & Procedures...	7.0_IS_Asset_Management_Policy.pdf
AT-3	Role-based Training Key Control	Aligned	Role-Based Training Responsibilities...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Security Awareness & Skills Training...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Access Control \| Policy & Procedures...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Security Awareness & Skills Training...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Security Awareness & Skills Training...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AT-3	Role-based Training Key Control	Aligned	Security Awareness & Skills Training...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AT-4	Training Records Key Control	Aligned	1.9 ROLES & RESPONSIBILITIES...	6.0_IS_Data_Security_Policy_1.pdf
AT-6	Training Feedback	Aligned	Security Awareness & Skills Training...	3.0_IS_Information_Security_Policy_2.pdf
AU-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	6.1_IS_Data_Security_Standards.pdf
AU-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.1_IS_Acceptable_Use_Standard.pdf
AU-1	Policy and Procedures Key Control	Aligned	1.2 SYSTEM USE NOTIFICATION...	2.1_IS_Acceptable_Use_Standard.pdf
AU-1	Policy and Procedures Key Control	Aligned	1.2 SYSTEM USE NOTIFICATION...	2.1_IS_Acceptable_Use_Standard.pdf
AU-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
AU-1	Policy and Procedures Key Control	Aligned	The Information Security Team should oversee the Cloud Secur...	19.0_IS_Cloud_Computing_Security_Policy.pdf
AU-1	Policy and Procedures Key Control	Aligned	Audit and accountability policy and procedures...	26.0_IS_Vulnerability_Management_Policy.pdf
AU-1	Policy and Procedures Key Control	Aligned	Policy statement requiring the exception....	6.0_IS_Data_Security_Policy_1.pdf
AU-1	Policy and Procedures Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AU-1	Policy and Procedures Key Control	Aligned	Policy exception process...	7.1_IS_Asset_Management_Standard.pdf
AU-1	Policy and Procedures Key Control	Aligned	Audit and accountability policy and procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AU-1	Policy and Procedures Key Control	Aligned	Section 1.5 - Exceptions to the policy...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AU-1	Policy and Procedures Key Control	Aligned	Review of any impacting legal changes to ensure Lazard compl...	3.0_IS_Information_Security_Policy_2.pdf
AU-1	Policy and Procedures Key Control	Aligned	Audit and Accountability Policy and Procedures...	20.0_IS_Risk_Management_Policy_2.pdf
AU-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	7.0_IS_Asset_Management_Policy.pdf
AU-1	Policy and Procedures Key Control	Aligned	EXCEPTION...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
AU-1	Policy and Procedures Key Control	Aligned	Audit and accountability policy and procedures...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
AU-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
AU-1	Policy and Procedures Key Control	Aligned	Responsibilities for information security risk management ac...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AU-10	Non-repudiation	Aligned	Individual who has approved management responsibility for an...	6.0_IS_Data_Security_Policy_1.pdf
AU-11	Audit Record Retention Key Control	Aligned	Section b to h regarding log files and their management....	26.0_IS_Vulnerability_Management_Policy.pdf
AU-11	Audit Record Retention Key Control	Aligned	Data retention policies are driven by legal and regulatory r...	6.0_IS_Data_Security_Policy_1.pdf
AU-12	Audit Record Generation	Aligned	Secure data disposal should follow the Data Security Policy ...	19.0_IS_Cloud_Computing_Security_Policy.pdf
AU-12	Audit Record Generation	Aligned	Audit & Accountability \| Audit Record Generation...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AU-13	Monitoring for Information Disclosure Key Control	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
AU-13	Monitoring for Information Disclosure Key Control	Aligned	6. Disseminating information about employees or lists of Laz...	2.1_IS_Acceptable_Use_Standard.pdf
AU-13	Monitoring for Information Disclosure Key Control	Aligned	DOCUMENT CLASSIFICATION...	19.0_IS_Cloud_Computing_Security_Policy.pdf
AU-13	Monitoring for Information Disclosure Key Control	Aligned	d. Automated vulnerability scans should be used to scan all ...	26.0_IS_Vulnerability_Management_Policy.pdf
AU-13	Monitoring for Information Disclosure Key Control	Aligned	Restricted Data...	6.0_IS_Data_Security_Policy_1.pdf
AU-13	Monitoring for Information Disclosure Key Control	Aligned	A.14.1.3 Protecting Application Services Transactions...	6.0_IS_Data_Security_Policy_1.pdf
AU-13	Monitoring for Information Disclosure Key Control	Aligned	DOCUMENT CLASSIFICATION...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AU-13	Monitoring for Information Disclosure Key Control	Aligned	DOCUMENT CLASSIFICATION...	7.2_IS_End_User_Device_Standard.pdf
AU-13	Monitoring for Information Disclosure Key Control	Aligned	1.2.1 General Network Security...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AU-13	Monitoring for Information Disclosure Key Control	Aligned	The practice of protecting information and information syste...	3.0_IS_Information_Security_Policy_2.pdf
AU-13	Monitoring for Information Disclosure Key Control	Aligned	DOCUMENT CLASSIFICATION...	3.0_IS_Information_Security_Policy_2.pdf
AU-13	Monitoring for Information Disclosure Key Control	Aligned	DOCUMENT CLASSIFICATION...	20.0_IS_Risk_Management_Policy_2.pdf
AU-13	Monitoring for Information Disclosure Key Control	Aligned	1.2.2 Asset Disposal & Re-Use...	7.0_IS_Asset_Management_Policy.pdf
AU-13	Monitoring for Information Disclosure Key Control	Aligned	DOCUMENT CLASSIFICATION...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
AU-13	Monitoring for Information Disclosure Key Control	Aligned	DOCUMENT CLASSIFICATION...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
AU-14	Session Audit Key Control	Aligned	1.2 SYSTEM USE NOTIFICATION...	2.1_IS_Acceptable_Use_Standard.pdf
AU-14	Session Audit Key Control	Aligned	User Consent and Monitoring Policy...	2.0_IS_Acceptable_Use_Policy.pdf
AU-14	Session Audit Key Control	Aligned	User Consent and Monitoring Policy...	2.0_IS_Acceptable_Use_Policy.pdf
AU-14	Session Audit Key Control	Aligned	f) Appropriate logging and monitoring should be applied to e...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AU-16	Cross-organizational Audit Logging Key Control	Aligned	User Consent and Monitoring Policy...	2.0_IS_Acceptable_Use_Policy.pdf
AU-16	Cross-organizational Audit Logging Key Control	Aligned	Event Logging and Log Management...	26.0_IS_Vulnerability_Management_Policy.pdf
AU-16	Cross-organizational Audit Logging Key Control	Aligned	1.7 PROTECTION OF LOG INFORMATION...	6.0_IS_Data_Security_Policy_1.pdf
AU-16	Cross-organizational Audit Logging Key Control	Aligned	f) Appropriate logging and monitoring should be applied to e...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AU-16	Cross-organizational Audit Logging Key Control	Aligned	i) Network services provided by third parties are assumed to...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AU-2	Event Logging Key Control	Aligned	1.2 SYSTEM USE NOTIFICATION...	2.1_IS_Acceptable_Use_Standard.pdf
AU-2	Event Logging Key Control	Aligned	Upon use of Lazard’s Systems, be it directly or indirectly, ...	2.0_IS_Acceptable_Use_Policy.pdf
AU-2	Event Logging Key Control	Aligned	Lazard reserves the right to audit networks and systems on a...	2.0_IS_Acceptable_Use_Policy.pdf
AU-2	Event Logging Key Control	Aligned	Event Logging and Review Procedures...	26.0_IS_Vulnerability_Management_Policy.pdf
AU-2	Event Logging Key Control	Aligned	1.7 PROTECTION OF LOG INFORMATION...	6.0_IS_Data_Security_Policy_1.pdf
AU-2	Event Logging Key Control	Aligned	f) Appropriate logging and monitoring should be applied to e...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AU-2	Event Logging Key Control	Aligned	Incident Verification...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
AU-3	Content of Audit Records Key Control	Aligned	Audit & Accountability \| Content of Audit Records...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AU-3	Content of Audit Records Key Control	Aligned	Event logs should be produced based on the Lazard Logging St...	26.0_IS_Vulnerability_Management_Policy.pdf
AU-3	Content of Audit Records Key Control	Aligned	Lazard should use file integrity monitoring or change detect...	26.0_IS_Vulnerability_Management_Policy.pdf
AU-3	Content of Audit Records Key Control	Aligned	Log files should be protected from tampering or unauthorized...	26.0_IS_Vulnerability_Management_Policy.pdf
AU-3	Content of Audit Records Key Control	Aligned	All servers and network equipment should retrieve time infor...	26.0_IS_Vulnerability_Management_Policy.pdf
AU-3	Content of Audit Records Key Control	Aligned	All log files should be maintained for at least 6 months....	26.0_IS_Vulnerability_Management_Policy.pdf
AU-3	Content of Audit Records Key Control	Aligned	1.7 PROTECTION OF LOG INFORMATION...	6.0_IS_Data_Security_Policy_1.pdf
AU-3	Content of Audit Records Key Control	Aligned	ii. Shareholders personal information such as Social Securit...	6.0_IS_Data_Security_Policy_1.pdf
AU-3	Content of Audit Records Key Control	Aligned	iv. Internal and external audit reports....	6.0_IS_Data_Security_Policy_1.pdf
AU-3	Content of Audit Records Key Control	Aligned	vi. Reports produced by Information Security Data (e.g., vul...	6.0_IS_Data_Security_Policy_1.pdf
AU-3	Content of Audit Records Key Control	Aligned	viii. All personal data that is not required solely for iden...	6.0_IS_Data_Security_Policy_1.pdf
AU-3	Content of Audit Records Key Control	Aligned	Evidence Gathering and Documentation...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
AU-4	Audit Log Storage Capacity Key Control	Aligned	Audit & Accountability \| Policy & Procedures...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AU-4	Audit Log Storage Capacity Key Control	Aligned	Audit & Accountability \| Audit Record Generation...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AU-4	Audit Log Storage Capacity Key Control	Aligned	b. Event logs should be produced based on the Lazard Logging...	26.0_IS_Vulnerability_Management_Policy.pdf
AU-4	Audit Log Storage Capacity Key Control	Aligned	h. All log files should be maintained for at least 6 months....	26.0_IS_Vulnerability_Management_Policy.pdf
AU-4	Audit Log Storage Capacity Key Control	Aligned	1.7 PROTECTION OF LOG INFORMATION...	6.0_IS_Data_Security_Policy_1.pdf
AU-5	Response to Audit Logging Process Failures Key Control	Aligned	Audit & Accountability \| Event Logging...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AU-5	Response to Audit Logging Process Failures Key Control	Aligned	Event logs and log file management procedures...	26.0_IS_Vulnerability_Management_Policy.pdf
AU-5	Response to Audit Logging Process Failures Key Control	Aligned	1.7 PROTECTION OF LOG INFORMATION...	6.0_IS_Data_Security_Policy_1.pdf
AU-5	Response to Audit Logging Process Failures Key Control	Aligned	f) Appropriate logging and monitoring should be applied to e...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AU-6	Audit Record Review, Analysis, and Reporting Key Control	Aligned	1.2 SYSTEM USE NOTIFICATION...	2.1_IS_Acceptable_Use_Standard.pdf
AU-6	Audit Record Review, Analysis, and Reporting Key Control	Aligned	User Consent and Monitoring Policy...	2.0_IS_Acceptable_Use_Policy.pdf
AU-6	Audit Record Review, Analysis, and Reporting Key Control	Aligned	b. Event logs should be produced based on the Lazard Logging...	26.0_IS_Vulnerability_Management_Policy.pdf
AU-6	Audit Record Review, Analysis, and Reporting Key Control	Aligned	1.7 PROTECTION OF LOG INFORMATION...	6.0_IS_Data_Security_Policy_1.pdf
AU-6	Audit Record Review, Analysis, and Reporting Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AU-6	Audit Record Review, Analysis, and Reporting Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AU-6	Audit Record Review, Analysis, and Reporting Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
AU-6	Audit Record Review, Analysis, and Reporting Key Control	Aligned	Role Responsibility...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
AU-6	Audit Record Review, Analysis, and Reporting Key Control	Aligned	Voice Communications Equipment protection and Maintenance...	7.2_IS_End_User_Device_Standard.pdf
AU-6	Audit Record Review, Analysis, and Reporting Key Control	Aligned	f) Appropriate logging and monitoring should be applied to e...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AU-6	Audit Record Review, Analysis, and Reporting Key Control	Aligned	IV. Lazard′s Information Security Policies should be periodi...	3.0_IS_Information_Security_Policy_2.pdf
AU-6	Audit Record Review, Analysis, and Reporting Key Control	Aligned	Information Security incidents that are investigated and ana...	20.0_IS_Risk_Management_Policy_2.pdf
AU-7	Audit Record Reduction and Report Generation Key Control	Aligned	Audit & Accountability \| Audit Record Reduction & Report Gen...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AU-7	Audit Record Reduction and Report Generation Key Control	Aligned	Event logs production and log file reviews...	26.0_IS_Vulnerability_Management_Policy.pdf
AU-8	Time Stamps	Gap	Time stamps generated by the system include date and time. Time is commonly expressed in Coordinated...
AU-9	Protection of Audit Information Key Control	Aligned	Audit & Accountability \| Policy & Procedures, Event Logging,...	19.1_IS_Cloud_Computing_Security_Standard.pdf
AU-9	Protection of Audit Information Key Control	Aligned	1.2.4 Logging & Alerting...	26.0_IS_Vulnerability_Management_Policy.pdf
AU-9	Protection of Audit Information Key Control	Aligned	1.7 PROTECTION OF LOG INFORMATION...	6.0_IS_Data_Security_Policy_1.pdf
AU-9	Protection of Audit Information Key Control	Aligned	f) Appropriate logging and monitoring should be applied to e...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
CA-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	6.1_IS_Data_Security_Standards.pdf
CA-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.1_IS_Acceptable_Use_Standard.pdf
CA-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
CA-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	7.1_IS_Asset_Management_Standard.pdf
CA-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	7.2_IS_End_User_Device_Standard.pdf
CA-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
CA-1	Policy and Procedures Key Control	Aligned	Lazard′s Information Security Policies should be periodicall...	3.0_IS_Information_Security_Policy_2.pdf
CA-1	Policy and Procedures Key Control	Aligned	Roles & Responsibilities...	20.0_IS_Risk_Management_Policy_2.pdf
CA-1	Policy and Procedures Key Control	Aligned	Divisions & Functions Policy Implementation...	7.0_IS_Asset_Management_Policy.pdf
CA-1	Policy and Procedures Key Control	Aligned	EXCEPTION...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
CA-1	Policy and Procedures Key Control	Aligned	EXCEPTION...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
CA-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
CA-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CA-2	Control Assessments Key Control	Aligned	Assessment, Authorization & Monitoring \| Control Assessments...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CA-2	Control Assessments Key Control	Aligned	c. Inventories of all hardware and software installed on the...	26.0_IS_Vulnerability_Management_Policy.pdf
CA-2	Control Assessments Key Control	Aligned	d. Automated vulnerability scans should be used to scan all ...	26.0_IS_Vulnerability_Management_Policy.pdf
CA-2	Control Assessments Key Control	Aligned	f. All vulnerabilities and their remediation progress should...	26.0_IS_Vulnerability_Management_Policy.pdf
CA-2	Control Assessments Key Control	Aligned	Assessment, Authorization & Monitoring...	6.0_IS_Data_Security_Policy_1.pdf
CA-2	Control Assessments Key Control	Aligned	Configuration Management \| Policies & Procedures...	3.0_IS_Information_Security_Policy_2.pdf
CA-3	Information Exchange Key Control	Aligned	1.7 CLOUD SYSTEMS...	19.0_IS_Cloud_Computing_Security_Policy.pdf
CA-3	Information Exchange Key Control	Aligned	16.0 Information Security Aspects of Business Continuity Man...	6.0_IS_Data_Security_Policy_1.pdf
CA-3	Information Exchange Key Control	Aligned	Control References and Policies related to Data Security and...	6.0_IS_Data_Security_Policy_1.pdf
CA-3	Information Exchange Key Control	Aligned	i. Appropriate interfaces are created to segregate Lazard’s ...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
CA-3	Information Exchange Key Control	Aligned	Security mechanisms, service levels and management requireme...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
CA-3	Information Exchange Key Control	Aligned	Control: CA-3: System information exchange requirements appl...	7.0_IS_Asset_Management_Policy.pdf
CA-3	Information Exchange Key Control	Aligned	System information exchange requirements...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CA-5	Plan of Action and Milestones	Aligned	Assessment, Authorization & Monitoring \| Plan of Action & Mi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CA-5	Plan of Action and Milestones	Aligned	Risk Mitigator/Responder...	20.0_IS_Risk_Management_Policy_2.pdf
CA-5	Plan of Action and Milestones	Aligned	Incident Response Recovery and Post Incident Activity...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
CA-5	Plan of Action and Milestones	Aligned	Conflicting duties and areas of responsibility should be seg...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CA-6	Authorization Key Control	Aligned	Baseline security requirements should be established for dev...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CA-6	Authorization Key Control	Aligned	Scope & Applicability...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
CA-6	Authorization Key Control	Aligned	1.3 MANAGEMENT DIRECTION FOR INFORMATION SECURITY...	3.0_IS_Information_Security_Policy_2.pdf
CA-6	Authorization Key Control	Aligned	vi. Authorizing and periodically reviewing access entitlemen...	7.0_IS_Asset_Management_Policy.pdf
CA-6	Authorization Key Control	Aligned	Detailed explanation of why the exception is necessary....	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
CA-6	Authorization Key Control	Aligned	Responsibilities for reviewing and authorizing access during...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
CA-6	Authorization Key Control	Aligned	Authorization levels should be defined and documented....	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CA-7	Continuous Monitoring Key Control	Aligned	Access Control \| Information Flow Enforcement, Access Contro...	6.1_IS_Data_Security_Standards.pdf
CA-7	Continuous Monitoring Key Control	Aligned	Access Control \| Information Flow Enforcement, Access Contro...	6.1_IS_Data_Security_Standards.pdf
CA-7	Continuous Monitoring Key Control	Aligned	1.2 SYSTEM USE NOTIFICATION...	2.1_IS_Acceptable_Use_Standard.pdf
CA-7	Continuous Monitoring Key Control	Aligned	Assessment, Authorization & Monitoring \| Continuous Monitori...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CA-7	Continuous Monitoring Key Control	Aligned	c. Inventories of all hardware and software installed on the...	26.0_IS_Vulnerability_Management_Policy.pdf
CA-7	Continuous Monitoring Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
CA-7	Continuous Monitoring Key Control	Aligned	1.2.1 General Network Security...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
CA-7	Continuous Monitoring Key Control	Aligned	1.2.1 General Network Security...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
CA-7	Continuous Monitoring Key Control	Aligned	Configuration Management \| Policies & Procedures...	3.0_IS_Information_Security_Policy_2.pdf
CA-7	Continuous Monitoring Key Control	Aligned	Maintaining processes to track cybersecurity related risk ac...	20.0_IS_Risk_Management_Policy_2.pdf
CA-7	Continuous Monitoring Key Control	Aligned	Responsible for conducting technology and cyber risk assessm...	20.0_IS_Risk_Management_Policy_2.pdf
CA-8	Penetration Testing	Aligned	Assessment, Authorization & Monitoring \| Penetration Testing...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CA-8	Penetration Testing	Aligned	1.2.6 Penetration Testing...	26.0_IS_Vulnerability_Management_Policy.pdf
CA-8	Penetration Testing	Aligned	Control: CA-8...	3.0_IS_Information_Security_Policy_2.pdf
CA-8	Penetration Testing	Aligned	Configuration Management \| Policies & Procedures...	3.0_IS_Information_Security_Policy_2.pdf
CA-9	Internal System Connections Key Control	Aligned	This policy is applicable to all Lazard employees, contracto...	2.0_IS_Acceptable_Use_Policy.pdf
CA-9	Internal System Connections Key Control	Aligned	Overview...	7.2_IS_End_User_Device_Standard.pdf
CA-9	Internal System Connections Key Control	Aligned	controls for applications and systems that contain, process,...	3.0_IS_Information_Security_Policy_2.pdf
CA-9	Internal System Connections Key Control	Aligned	1.2. Hardware, Software, Applications and Data - Inventory o...	7.0_IS_Asset_Management_Policy.pdf
CM-1	Policy and Procedures	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	6.1_IS_Data_Security_Standards.pdf
CM-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	2.1_IS_Acceptable_Use_Standard.pdf
CM-1	Policy and Procedures	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
CM-1	Policy and Procedures	Aligned	1.1 SCOPE & APPLICABILITY...	19.0_IS_Cloud_Computing_Security_Policy.pdf
CM-1	Policy and Procedures	Aligned	Configuration Management Policy and Procedures...	26.0_IS_Vulnerability_Management_Policy.pdf
CM-1	Policy and Procedures	Aligned	Chunk: 1.12 EXCEPTION...	6.0_IS_Data_Security_Policy_1.pdf
CM-1	Policy and Procedures	Aligned	Configuration Management Policy and Procedures...	5.0_IS_Human_Resource_Security_Policy_1.pdf
CM-1	Policy and Procedures	Aligned	Policy Exception Process...	7.1_IS_Asset_Management_Standard.pdf
CM-1	Policy and Procedures	Aligned	Configuration Management Policy and Procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
CM-1	Policy and Procedures	Aligned	Chunk: 1.5...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
CM-1	Policy and Procedures	Aligned	Information Security Incident Management and Information Sec...	3.0_IS_Information_Security_Policy_2.pdf
CM-1	Policy and Procedures	Aligned	As part of the control selection processes, organizations de...	3.0_IS_Information_Security_Policy_2.pdf
CM-1	Policy and Procedures	Aligned	1.1 SCOPE & APPLICABILITY...	20.0_IS_Risk_Management_Policy_2.pdf
CM-1	Policy and Procedures	Aligned	Divisions & Functions are free to define and implement stron...	7.0_IS_Asset_Management_Policy.pdf
CM-1	Policy and Procedures	Aligned	EXCEPTION...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
CM-1	Policy and Procedures	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
CM-1	Policy and Procedures	Aligned	Configuration Management Policy and Procedures...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CM-10	Software Usage Restrictions Key Control	Aligned	Configuration Management \| Configuration Change Control...	3.0_IS_Information_Security_Policy_2.pdf
CM-10	Software Usage Restrictions Key Control	Aligned	1.2. Hardware, Software, Applications and Data - Inventory o...	7.0_IS_Asset_Management_Policy.pdf
CM-11	User-installed Software Key Control	Aligned	Software/Applications...	7.0_IS_Asset_Management_Policy.pdf
CM-12	Information Location Key Control	Aligned	Highly confidential business or personal information....	6.1_IS_Data_Security_Standards.pdf
CM-12	Information Location Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
CM-12	Information Location Key Control	Aligned	Scope and Applicability...	6.0_IS_Data_Security_Policy_1.pdf
CM-12	Information Location Key Control	Aligned	Information Location...	7.0_IS_Asset_Management_Policy.pdf
CM-12	Information Location Key Control	Aligned	1.2.2 Information Resources...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
CM-13	Data Action Mapping Key Control	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
CM-13	Data Action Mapping Key Control	Aligned	User Data Management and Monitoring...	2.1_IS_Acceptable_Use_Standard.pdf
CM-13	Data Action Mapping Key Control	Aligned	Data destruction procedures and handling of data throughout ...	19.0_IS_Cloud_Computing_Security_Policy.pdf
CM-13	Data Action Mapping Key Control	Aligned	Data Governance and Data Privacy...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CM-13	Data Action Mapping Key Control	Aligned	Applicability...	5.0_IS_Human_Resource_Security_Policy_1.pdf
CM-13	Data Action Mapping Key Control	Aligned	1.2.1 General Network Security...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
CM-13	Data Action Mapping Key Control	Aligned	Data Security...	3.0_IS_Information_Security_Policy_2.pdf
CM-13	Data Action Mapping Key Control	Aligned	Configuration Management \| Configuration Management Plan...	3.0_IS_Information_Security_Policy_2.pdf
CM-14	Signed Components	Aligned	Discussion on digital certificates and their role in verifyi...	6.0_IS_Data_Security_Policy_1.pdf
CM-14	Signed Components	Aligned	Software/Applications...	7.0_IS_Asset_Management_Policy.pdf
CM-2	Baseline Configuration	Aligned	Baseline security control requirements should be established...	19.0_IS_Cloud_Computing_Security_Policy.pdf
CM-2	Baseline Configuration	Aligned	Change management and Installation of software on operationa...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CM-2	Baseline Configuration	Aligned	Change management...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CM-2	Baseline Configuration	Aligned	Endpoint Security Device Management...	7.1_IS_Asset_Management_Standard.pdf
CM-2	Baseline Configuration	Aligned	Configuration Management \| Baseline Configuration...	3.0_IS_Information_Security_Policy_2.pdf
CM-2	Baseline Configuration	Aligned	Exceptions to replacing unsupported system components includ...	3.0_IS_Information_Security_Policy_2.pdf
CM-2	Baseline Configuration	Aligned	Baseline configurations for systems and system components...	7.0_IS_Asset_Management_Policy.pdf
CM-3	Configuration Change Control Key Control	Aligned	Baseline security control requirements should be established...	19.0_IS_Cloud_Computing_Security_Policy.pdf
CM-3	Configuration Change Control Key Control	Aligned	System change control procedures...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CM-3	Configuration Change Control Key Control	Aligned	Change management...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CM-3	Configuration Change Control Key Control	Aligned	Technical review of applications after operating platform ch...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CM-3	Configuration Change Control Key Control	Aligned	Secure Configuration of Enterprise Assets and Software...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CM-3	Configuration Change Control Key Control	Aligned	Configuration Management Processes...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CM-3	Configuration Change Control Key Control	Aligned	p) Telephone lines that could enable remote access into the ...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
CM-3	Configuration Change Control Key Control	Aligned	q) Only firewalls approved by Information Security will be u...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
CM-3	Configuration Change Control Key Control	Aligned	r) Network devices (Routers, switches, WIFI access points, e...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
CM-3	Configuration Change Control Key Control	Aligned	Configuration Management \| Configuration Change Control...	3.0_IS_Information_Security_Policy_2.pdf
CM-3	Configuration Change Control Key Control	Aligned	In such cases, the control can be treated as a hybrid contro...	3.0_IS_Information_Security_Policy_2.pdf
CM-3	Configuration Change Control Key Control	Aligned	Configuration Change Control...	7.0_IS_Asset_Management_Policy.pdf
CM-4	Impact Analyses Key Control	Aligned	Impact Analyses...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CM-4	Impact Analyses Key Control	Aligned	Secure Configuration of Enterprise Assets and Software...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CM-4	Impact Analyses Key Control	Aligned	Testing Decisions for Flaw Remediation...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CM-4	Impact Analyses Key Control	Aligned	Section 1.2.5 (a)...	26.0_IS_Vulnerability_Management_Policy.pdf
CM-4	Impact Analyses Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
CM-4	Impact Analyses Key Control	Aligned	Review of any impacting legal changes to ensure Lazard compl...	3.0_IS_Information_Security_Policy_2.pdf
CM-4	Impact Analyses Key Control	Aligned	Configuration control throughout the system development life...	3.0_IS_Information_Security_Policy_2.pdf
CM-4	Impact Analyses Key Control	Aligned	Definition...	20.0_IS_Risk_Management_Policy_2.pdf
CM-4	Impact Analyses Key Control	Aligned	Impact assessment(s) related to the incident....	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
CM-4	Impact Analyses Key Control	Aligned	Job Description (JD) and Management Responsibilities...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CM-5	Access Restrictions for Change Key Control	Aligned	Changes to cloud security systems and procedures...	19.0_IS_Cloud_Computing_Security_Policy.pdf
CM-5	Access Restrictions for Change Key Control	Aligned	segregated and access restricted to prevent inappropriate di...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CM-5	Access Restrictions for Change Key Control	Aligned	Restrictions on software installation...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CM-5	Access Restrictions for Change Key Control	Aligned	System administrators responsibilities regarding application...	26.0_IS_Vulnerability_Management_Policy.pdf
CM-5	Access Restrictions for Change Key Control	Aligned	Applicability...	5.0_IS_Human_Resource_Security_Policy_1.pdf
CM-5	Access Restrictions for Change Key Control	Aligned	Section 10 and 11 regarding approved end-user devices and un...	7.2_IS_End_User_Device_Standard.pdf
CM-5	Access Restrictions for Change Key Control	Aligned	Access Control Policy...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
CM-5	Access Restrictions for Change Key Control	Aligned	Access rights to the Lazard enterprise servers should be rev...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
CM-6	Configuration Settings	Aligned	Baseline security control requirements...	19.0_IS_Cloud_Computing_Security_Policy.pdf
CM-6	Configuration Settings	Aligned	Restrictions on software installation...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CM-6	Configuration Settings	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CM-6	Configuration Settings	Aligned	Section 4: Configuration of security measures and software....	7.2_IS_End_User_Device_Standard.pdf
CM-6	Configuration Settings	Aligned	Security mechanisms, service levels and management requireme...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
CM-6	Configuration Settings	Aligned	End-user Device Security Policy, Internet Security & Usage P...	3.0_IS_Information_Security_Policy_2.pdf
CM-6	Configuration Settings	Aligned	Configuration Management \| System Component Inventory...	7.0_IS_Asset_Management_Policy.pdf
CM-7	Least Functionality	Aligned	c. Inventories of all hardware and software installed on the...	26.0_IS_Vulnerability_Management_Policy.pdf
CM-7	Least Functionality	Aligned	d. Automated vulnerability scans should be used to scan all ...	26.0_IS_Vulnerability_Management_Policy.pdf
CM-7	Least Functionality	Aligned	Data Protection...	6.0_IS_Data_Security_Policy_1.pdf
CM-7	Least Functionality	Aligned	Section 4: All PCs and laptops should be equipped with up-to...	7.2_IS_End_User_Device_Standard.pdf
CM-7	Least Functionality	Aligned	Access Control \| Use of External Systems...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
CM-7	Least Functionality	Aligned	Network and Firewall Security Policy...	3.0_IS_Information_Security_Policy_2.pdf
CM-8	System Component Inventory Key Control	Aligned	Access Control \| Information Flow Enforcement...	6.1_IS_Data_Security_Standards.pdf
CM-8	System Component Inventory Key Control	Aligned	1.2 GENERAL USER RESPONSIBILITIES...	2.0_IS_Acceptable_Use_Policy.pdf
CM-8	System Component Inventory Key Control	Aligned	Inventory and Control of Enterprise Assets...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CM-8	System Component Inventory Key Control	Aligned	NIST SP 800-53 Rev 5...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CM-8	System Component Inventory Key Control	Aligned	Inventories of all hardware and software installed on the co...	26.0_IS_Vulnerability_Management_Policy.pdf
CM-8	System Component Inventory Key Control	Aligned	IT Asset Procurement...	7.1_IS_Asset_Management_Standard.pdf
CM-8	System Component Inventory Key Control	Aligned	Section 2: All Firm workstations and laptops should be inven...	7.2_IS_End_User_Device_Standard.pdf
CM-8	System Component Inventory Key Control	Aligned	System Component Inventory...	3.0_IS_Information_Security_Policy_2.pdf
CM-8	System Component Inventory Key Control	Aligned	Security categorization processes facilitate the development...	3.0_IS_Information_Security_Policy_2.pdf
CM-8	System Component Inventory Key Control	Aligned	1.2. Hardware, Software, Applications and Data - Inventory o...	7.0_IS_Asset_Management_Policy.pdf
CM-8	System Component Inventory Key Control	Aligned	Inventory & Control of Enterprise Assets...	7.0_IS_Asset_Management_Policy.pdf
CM-9	Configuration Management Plan Key Control	Aligned	Configuration Management Plan...	3.0_IS_Information_Security_Policy_2.pdf
CM-9	Configuration Management Plan Key Control	Aligned	Configuration Management \| Policies & Procedures...	3.0_IS_Information_Security_Policy_2.pdf
CP-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	6.1_IS_Data_Security_Standards.pdf
CP-1	Policy and Procedures Key Control	Aligned	Policy statement requiring the exception....	2.1_IS_Acceptable_Use_Standard.pdf
CP-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
CP-1	Policy and Procedures Key Control	Aligned	Contingency Planning \| Policy & Procedures...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CP-1	Policy and Procedures Key Control	Aligned	Contingency Planning Policy and Procedures...	6.0_IS_Data_Security_Policy_1.pdf
CP-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	7.1_IS_Asset_Management_Standard.pdf
CP-1	Policy and Procedures Key Control	Aligned	Contingency Planning Policy and Procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
CP-1	Policy and Procedures Key Control	Aligned	Policy Exceptions Process...	7.2_IS_End_User_Device_Standard.pdf
CP-1	Policy and Procedures Key Control	Aligned	Contingency Planning Policy and Procedures...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
CP-1	Policy and Procedures Key Control	Aligned	Information Security Aspects of Business Continuity Manageme...	3.0_IS_Information_Security_Policy_2.pdf
CP-1	Policy and Procedures Key Control	Aligned	Information Security Aspects of Business Continuity Manageme...	3.0_IS_Information_Security_Policy_2.pdf
CP-1	Policy and Procedures Key Control	Aligned	Information Security Aspects of Business Continuity Manageme...	3.0_IS_Information_Security_Policy_2.pdf
CP-1	Policy and Procedures Key Control	Aligned	Information Security Aspects of Business Continuity Manageme...	3.0_IS_Information_Security_Policy_2.pdf
CP-1	Policy and Procedures Key Control	Aligned	Information Security Aspects of Business Continuity Manageme...	3.0_IS_Information_Security_Policy_2.pdf
CP-1	Policy and Procedures Key Control	Aligned	Information Security Aspects of Business Continuity Manageme...	3.0_IS_Information_Security_Policy_2.pdf
CP-1	Policy and Procedures Key Control	Aligned	Information Security Aspects of Business Continuity Manageme...	3.0_IS_Information_Security_Policy_2.pdf
CP-1	Policy and Procedures Key Control	Aligned	Information Security Aspects of Business Continuity Manageme...	3.0_IS_Information_Security_Policy_2.pdf
CP-1	Policy and Procedures Key Control	Aligned	Information Security Aspects of Business Continuity Manageme...	3.0_IS_Information_Security_Policy_2.pdf
CP-1	Policy and Procedures Key Control	Aligned	Contingency Planning Policy and Procedures...	7.0_IS_Asset_Management_Policy.pdf
CP-1	Policy and Procedures Key Control	Aligned	EXCEPTION...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
CP-1	Policy and Procedures Key Control	Aligned	Containment Phase of Incident Response...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
CP-1	Policy and Procedures Key Control	Aligned	Contingency Planning Policy and Procedures...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CP-10	System Recovery and Reconstitution	Aligned	Section 7: All applications and systems utilizing a Cloud Se...	19.0_IS_Cloud_Computing_Security_Policy.pdf
CP-10	System Recovery and Reconstitution	Aligned	Data Recovery...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CP-10	System Recovery and Reconstitution	Aligned	Recovery...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
CP-10	System Recovery and Reconstitution	Aligned	Glossary - Business continuity and disaster recovery (BCDR o...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
CP-11	Alternate Communications Protocols	Aligned	Contingency Planning \| Contingency Plan...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CP-12	Safe Mode Key Control	Gap	For systems that support critical mission and business functionsâ€šÃ„Ã®including military operations... Critical Gap - Key Control Missing
CP-13	Alternative Security Mechanisms Key Control	Aligned	8.0 Access Control Policy...	2.0_IS_Acceptable_Use_Policy.pdf
CP-13	Alternative Security Mechanisms Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
CP-13	Alternative Security Mechanisms Key Control	Aligned	Maintain business continuity to counteract interruptions to ...	3.0_IS_Information_Security_Policy_2.pdf
CP-13	Alternative Security Mechanisms Key Control	Aligned	Use case #4...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
CP-2	Contingency Plan Key Control	Aligned	Data Recovery...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CP-2	Contingency Plan Key Control	Aligned	Contingency Planning...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CP-2	Contingency Plan Key Control	Aligned	Contingency Planning \| Contingency Plan...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CP-2	Contingency Plan Key Control	Aligned	Contingency Planning \| Contingency Plan...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CP-2	Contingency Plan Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
CP-2	Contingency Plan Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
CP-2	Contingency Plan Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
CP-2	Contingency Plan Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
CP-2	Contingency Plan Key Control	Aligned	Information Security Aspects of Business Continuity Manageme...	3.0_IS_Information_Security_Policy_2.pdf
CP-2	Contingency Plan Key Control	Aligned	Section (f) regarding maintaining business continuity and pr...	3.0_IS_Information_Security_Policy_2.pdf
CP-2	Contingency Plan Key Control	Aligned	Contingency Planning for Systems...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
CP-2	Contingency Plan Key Control	Aligned	Contingency planning for systems...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
CP-2	Contingency Plan Key Control	Aligned	NIST SP 800-53 Rev 5...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CP-3	Contingency Training Key Control	Aligned	Contingency Planning \| Policy & Procedures...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CP-3	Contingency Training Key Control	Aligned	Contingency Training...	3.0_IS_Information_Security_Policy_2.pdf
CP-3	Contingency Training Key Control	Aligned	Preparation...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
CP-3	Contingency Training Key Control	Aligned	Responsibilities during a BC/DR event, test, or execution....	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
CP-3	Contingency Training Key Control	Aligned	Control: CP-3...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CP-4	Contingency Plan Testing	Aligned	Contingency Planning \| Policy & Procedures...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CP-4	Contingency Plan Testing	Aligned	Contingency Plan Testing...	3.0_IS_Information_Security_Policy_2.pdf
CP-4	Contingency Plan Testing	Aligned	Preparation...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
CP-6	Alternate Storage Site Key Control	Aligned	Section 7: All applications and systems utilizing a Cloud Se...	19.0_IS_Cloud_Computing_Security_Policy.pdf
CP-6	Alternate Storage Site Key Control	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CP-6	Alternate Storage Site Key Control	Aligned	Business continuity plans should include provisions for veri...	6.0_IS_Data_Security_Policy_1.pdf
CP-7	Alternate Processing Site Key Control	Aligned	Section 7: All applications and systems utilizing a Cloud Se...	19.0_IS_Cloud_Computing_Security_Policy.pdf
CP-7	Alternate Processing Site Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
CP-8	Telecommunications Services Key Control	Aligned	Contingency Planning \| Telecommunications Services...	19.1_IS_Cloud_Computing_Security_Standard.pdf
CP-8	Telecommunications Services Key Control	Aligned	Security mechanisms, service levels and management requireme...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
CP-8	Telecommunications Services Key Control	Aligned	Section d) and e)...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
CP-9	System Backup Key Control	Aligned	Highly confidential business or personal information....	6.1_IS_Data_Security_Standards.pdf
CP-9	System Backup Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
CP-9	System Backup Key Control	Aligned	Exit Strategy for Data Management...	19.0_IS_Cloud_Computing_Security_Policy.pdf
CP-9	System Backup Key Control	Aligned	1.3 DATA OWNER RESPONSIBILITIES...	6.0_IS_Data_Security_Policy_1.pdf
IA-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	6.1_IS_Data_Security_Standards.pdf
IA-1	Policy and Procedures Key Control	Aligned	1.5 EXCEPTION...	2.1_IS_Acceptable_Use_Standard.pdf
IA-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
IA-1	Policy and Procedures Key Control	Aligned	User registration and de-registration, Management of secret ...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IA-1	Policy and Procedures Key Control	Aligned	Identification and Authentication \| Identification and Authe...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IA-1	Policy and Procedures Key Control	Aligned	User registration and de-registration, Management of secret ...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IA-1	Policy and Procedures Key Control	Aligned	Identification and Authentication Policy and Procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-1	Policy and Procedures Key Control	Aligned	Identification and authentication policy and procedures...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
IA-1	Policy and Procedures Key Control	Aligned	Identification and authentication policy and procedures...	3.0_IS_Information_Security_Policy_2.pdf
IA-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IA-10	Adaptive Authentication	Aligned	Multi-Factor Authentication (MFA) is required to access the ...	2.1_IS_Acceptable_Use_Standard.pdf
IA-10	Adaptive Authentication	Aligned	1.11 USER ID & PASSWORD SECURITY...	2.0_IS_Acceptable_Use_Policy.pdf
IA-10	Adaptive Authentication	Aligned	f) The use of multifactor authentication should be enforced....	6.0_IS_Data_Security_Policy_1.pdf
IA-10	Adaptive Authentication	Aligned	Account Management, Access Control Management, Audit Log Man...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-11	Re-authentication Key Control	Aligned	1.11 USER ID & PASSWORD SECURITY...	2.0_IS_Acceptable_Use_Policy.pdf
IA-11	Re-authentication Key Control	Aligned	1.2 Endpoint Security Device Management...	7.1_IS_Asset_Management_Standard.pdf
IA-11	Re-authentication Key Control	Aligned	1.1.4 Smartphones, Mobile, and Other Wireless Devices...	7.2_IS_End_User_Device_Standard.pdf
IA-11	Re-authentication Key Control	Aligned	Use case #4...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
IA-12	Identity Proofing Key Control	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	5.0_IS_Human_Resource_Security_Policy_1.pdf
IA-12	Identity Proofing Key Control	Aligned	Account Management, User Registration & De-Registration...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	Authentication Mechanism...	6.1_IS_Data_Security_Standards.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	Multi-Factor Authentication (MFA) is required to access the ...	2.1_IS_Acceptable_Use_Standard.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	Multi-Factor Authentication (MFA) is required to access the ...	2.1_IS_Acceptable_Use_Standard.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	1.11 USER ID & PASSWORD SECURITY...	2.0_IS_Acceptable_Use_Policy.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	The Information Security Team should enforce compliance with...	19.0_IS_Cloud_Computing_Security_Policy.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	User registration and de-registration, Management of secret ...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	Identification and Authentication \| Identification and Authe...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	Identification and Authentication \| Identification and Authe...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	User registration and de-registration, Management of secret ...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	User registration and de-registration, Management of secret ...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	5.0_IS_Human_Resource_Security_Policy_1.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	Endpoint Security Device Management...	7.1_IS_Asset_Management_Standard.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	Endpoint Security Device Management...	7.1_IS_Asset_Management_Standard.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	iii. Appropriate authentication mechanisms are applied for U...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	Identification and authentication requirements for non-organ...	7.2_IS_End_User_Device_Standard.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	Identification and authentication requirements...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	h) A current network architecture must be maintained that in...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	Identification and Authentication Requirements...	7.0_IS_Asset_Management_Policy.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	INFORMATION SECURITY GOALS...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
IA-2	Identification and Authentication (Organizational Users) Key Control	Aligned	Access rights to the Lazard networks and network services...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
IA-3	Device Identification and Authentication Key Control	Aligned	V. Bring Your Own Device...	2.1_IS_Acceptable_Use_Standard.pdf
IA-3	Device Identification and Authentication Key Control	Aligned	Identification and Authentication \| Device Identification an...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IA-3	Device Identification and Authentication Key Control	Aligned	Identification and Authentication \| Device Identification an...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IA-3	Device Identification and Authentication Key Control	Aligned	Device Identification and Authentication...	6.0_IS_Data_Security_Policy_1.pdf
IA-3	Device Identification and Authentication Key Control	Aligned	Endpoint Security Device Management...	7.1_IS_Asset_Management_Standard.pdf
IA-3	Device Identification and Authentication Key Control	Aligned	Identification & Authentication \| Device Identification & Au...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-3	Device Identification and Authentication Key Control	Aligned	Section 10 and 12...	7.2_IS_End_User_Device_Standard.pdf
IA-3	Device Identification and Authentication Key Control	Aligned	Section discussing approved devices and restrictions on pers...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
IA-3	Device Identification and Authentication Key Control	Aligned	End-user Device Security Policy...	3.0_IS_Information_Security_Policy_2.pdf
IA-3	Device Identification and Authentication Key Control	Aligned	A.13.1.1 Network Controls...	7.0_IS_Asset_Management_Policy.pdf
IA-4	Identifier Management Key Control	Aligned	1.11 USER ID & PASSWORD SECURITY...	2.0_IS_Acceptable_Use_Policy.pdf
IA-4	Identifier Management Key Control	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	5.0_IS_Human_Resource_Security_Policy_1.pdf
IA-4	Identifier Management Key Control	Aligned	Privileged User Accounts and Application Administration Acco...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-4	Identifier Management Key Control	Aligned	Section 10 and 11 regarding approved end-user devices and ne...	7.2_IS_End_User_Device_Standard.pdf
IA-5	Authenticator Management Key Control	Aligned	Authentication Mechanism such as credentials, Access Keys/To...	6.1_IS_Data_Security_Standards.pdf
IA-5	Authenticator Management Key Control	Aligned	Password Management and Multi-Factor Authentication...	2.1_IS_Acceptable_Use_Standard.pdf
IA-5	Authenticator Management Key Control	Aligned	1.11 USER ID & PASSWORD SECURITY...	2.0_IS_Acceptable_Use_Policy.pdf
IA-5	Authenticator Management Key Control	Aligned	User registration and de-registration, Management of secret ...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IA-5	Authenticator Management Key Control	Aligned	User registration and de-registration, Management of secret ...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IA-5	Authenticator Management Key Control	Aligned	Management of secret authentication information of users, Pa...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IA-5	Authenticator Management Key Control	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	5.0_IS_Human_Resource_Security_Policy_1.pdf
IA-5	Authenticator Management Key Control	Aligned	Endpoint Security Device Management...	7.1_IS_Asset_Management_Standard.pdf
IA-5	Authenticator Management Key Control	Aligned	Identification & Authentication \| Authenticator Management...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-5	Authenticator Management Key Control	Aligned	Section 4: Password and Authentication Management...	7.2_IS_End_User_Device_Standard.pdf
IA-5	Authenticator Management Key Control	Aligned	Section 7: Remote Access Configuration...	7.2_IS_End_User_Device_Standard.pdf
IA-5	Authenticator Management Key Control	Aligned	i. Routers and other network devices will be accessed by mea...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
IA-5	Authenticator Management Key Control	Aligned	iii. Passwords should be changed at a minimum of every 90 da...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
IA-5	Authenticator Management Key Control	Aligned	Authenticator management includes issuing and revoking authe...	7.0_IS_Asset_Management_Policy.pdf
IA-5	Authenticator Management Key Control	Aligned	Access Control \| Policy & Procedures...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IA-6	Authentication Feedback	Gap	Authentication feedback from systems does not provide information that would allow unauthorized indi...
IA-7	Cryptographic Module Authentication Key Control	Aligned	Authentication Mechanism...	6.1_IS_Data_Security_Standards.pdf
IA-7	Cryptographic Module Authentication Key Control	Aligned	Multi-Factor Authentication (MFA) is required to access the ...	2.1_IS_Acceptable_Use_Standard.pdf
IA-7	Cryptographic Module Authentication Key Control	Aligned	USER ID & PASSWORD SECURITY...	2.0_IS_Acceptable_Use_Policy.pdf
IA-7	Cryptographic Module Authentication Key Control	Aligned	Individual who has approved management responsibility for an...	6.0_IS_Data_Security_Policy_1.pdf
IA-7	Cryptographic Module Authentication Key Control	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	5.0_IS_Human_Resource_Security_Policy_1.pdf
IA-7	Cryptographic Module Authentication Key Control	Aligned	Identification & Authentication \| Cryptographic Module Authe...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-7	Cryptographic Module Authentication Key Control	Aligned	b) Lazard employees should authenticate using their Network ...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
IA-7	Cryptographic Module Authentication Key Control	Aligned	Responsibilities for reviewing and authorizing access...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	Authentication Mechanism...	6.1_IS_Data_Security_Standards.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	Identification and authentication requirements for non-organ...	2.1_IS_Acceptable_Use_Standard.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	Multi-Factor Authentication (MFA) is required to access the ...	2.1_IS_Acceptable_Use_Standard.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	1.11 USER ID & PASSWORD SECURITY...	2.0_IS_Acceptable_Use_Policy.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	Identification and Authentication \| Identification and Authe...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	Identification and Authentication \| Authenticator Management...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	User registration and de-registration, Management of secret ...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	5.0_IS_Human_Resource_Security_Policy_1.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	5.0_IS_Human_Resource_Security_Policy_1.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	Account Management, Access Control Management...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	Section j) Where feasible, an authorized user’s password(s) ...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	Identification and Authentication Requirements for Non-Organ...	7.0_IS_Asset_Management_Policy.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	Identification and authentication of non-organizational user...	7.0_IS_Asset_Management_Policy.pdf
IA-8	Identification and Authentication (Non-organizational Users) Key Control	Aligned	Access rights to the Lazard networks and network services...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
IA-9	Service Identification and Authentication Key Control	Aligned	Authentication Mechanism...	6.1_IS_Data_Security_Standards.pdf
IA-9	Service Identification and Authentication Key Control	Aligned	1.4 NEW HIRE IDS & PASSWORDS...	5.0_IS_Human_Resource_Security_Policy_1.pdf
IA-9	Service Identification and Authentication Key Control	Aligned	Security features of network services include, but are not l...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
IR-1	Policy and Procedures	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	6.1_IS_Data_Security_Standards.pdf
IR-1	Policy and Procedures	Aligned	Policy statement requiring the exception....	2.1_IS_Acceptable_Use_Standard.pdf
IR-1	Policy and Procedures	Aligned	Policy statement requiring the exception....	2.0_IS_Acceptable_Use_Policy.pdf
IR-1	Policy and Procedures	Aligned	Incident Response Policy and Procedures...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IR-1	Policy and Procedures	Aligned	Policy statement requiring the exception....	6.0_IS_Data_Security_Policy_1.pdf
IR-1	Policy and Procedures	Aligned	Policy Exceptions Process...	7.1_IS_Asset_Management_Standard.pdf
IR-1	Policy and Procedures	Aligned	Section 1.5 - Exceptions to the policy...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
IR-1	Policy and Procedures	Aligned	Information Security Incident Management...	3.0_IS_Information_Security_Policy_2.pdf
IR-1	Policy and Procedures	Aligned	Information Security Incident Management...	3.0_IS_Information_Security_Policy_2.pdf
IR-1	Policy and Procedures	Aligned	Information Security Incident Management...	3.0_IS_Information_Security_Policy_2.pdf
IR-1	Policy and Procedures	Aligned	Information Security Incident Management...	3.0_IS_Information_Security_Policy_2.pdf
IR-1	Policy and Procedures	Aligned	Information Security Incident Management...	3.0_IS_Information_Security_Policy_2.pdf
IR-1	Policy and Procedures	Aligned	Information Security Incident Management...	3.0_IS_Information_Security_Policy_2.pdf
IR-1	Policy and Procedures	Aligned	Information Security Incident Management...	3.0_IS_Information_Security_Policy_2.pdf
IR-1	Policy and Procedures	Aligned	Information Security Incident Management...	3.0_IS_Information_Security_Policy_2.pdf
IR-1	Policy and Procedures	Aligned	Information Security Incident Management...	3.0_IS_Information_Security_Policy_2.pdf
IR-1	Policy and Procedures	Aligned	CSIRP Scope...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
IR-2	Incident Response Training	Aligned	CLOUD SECURITY TRAINING & AWARENESS...	19.0_IS_Cloud_Computing_Security_Policy.pdf
IR-2	Incident Response Training	Aligned	Incident Response Training...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IR-2	Incident Response Training	Aligned	Incident Response \| Incident Response Training...	5.0_IS_Human_Resource_Security_Policy_1.pdf
IR-2	Incident Response Training	Aligned	Incident Response \| Incident Response Training...	5.0_IS_Human_Resource_Security_Policy_1.pdf
IR-2	Incident Response Training	Aligned	Incident Response Management...	3.0_IS_Information_Security_Policy_2.pdf
IR-2	Incident Response Training	Aligned	Incident Response Recovery and Post Incident Activity...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
IR-3	Incident Response Testing	Aligned	a. The Information Security Team should enforce, comply, and...	19.0_IS_Cloud_Computing_Security_Policy.pdf
IR-3	Incident Response Testing	Aligned	Data Recovery...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IR-3	Incident Response Testing	Aligned	Incident Response Management...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IR-3	Incident Response Testing	Aligned	Incident Response Testing...	3.0_IS_Information_Security_Policy_2.pdf
IR-3	Incident Response Testing	Aligned	Incident Response Recovery and Post Incident Activity...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
IR-3	Incident Response Testing	Aligned	Incident Response Management...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-4	Incident Handling Key Control	Aligned	a. The Information Security Team should enforce, comply, and...	19.0_IS_Cloud_Computing_Security_Policy.pdf
IR-4	Incident Handling Key Control	Aligned	b. Steps taken when managing a cloud security incident shoul...	19.0_IS_Cloud_Computing_Security_Policy.pdf
IR-4	Incident Handling Key Control	Aligned	Data Recovery...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IR-4	Incident Handling Key Control	Aligned	Incident Response Management...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IR-4	Incident Handling Key Control	Aligned	Incident Handling Procedures...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IR-4	Incident Handling Key Control	Aligned	Incident Handling...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IR-4	Incident Handling Key Control	Aligned	Learning from Information Security Incidents Improvement...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IR-4	Incident Handling Key Control	Aligned	Incident Response \| Incident Monitoring...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IR-4	Incident Handling Key Control	Aligned	Assessment of & Decision on Information Security Events...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IR-4	Incident Handling Key Control	Aligned	d. All exceptions and anomalies identified during the log fi...	26.0_IS_Vulnerability_Management_Policy.pdf
IR-4	Incident Handling Key Control	Aligned	X. All breaches of information security should be reported t...	3.0_IS_Information_Security_Policy_2.pdf
IR-4	Incident Handling Key Control	Aligned	Detection and Analysis...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
IR-4	Incident Handling Key Control	Aligned	Contact with Authorities...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-4	Incident Handling Key Control	Aligned	Incident Response Management...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-4	Incident Handling Key Control	Aligned	1.4 CONTACT WITH AUTHORITIES...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-4	Incident Handling Key Control	Aligned	Incident Response \| Incident Handling...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-5	Incident Monitoring	Aligned	a. The Information Security Team should enforce, comply, and...	19.0_IS_Cloud_Computing_Security_Policy.pdf
IR-5	Incident Monitoring	Aligned	Incident Response \| Incident Handling...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IR-5	Incident Monitoring	Aligned	Learning from Information Security Incidents...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IR-5	Incident Monitoring	Aligned	f. All vulnerabilities and their remediation progress should...	26.0_IS_Vulnerability_Management_Policy.pdf
IR-5	Incident Monitoring	Aligned	b. Event logs should be produced based on the Lazard Logging...	26.0_IS_Vulnerability_Management_Policy.pdf
IR-5	Incident Monitoring	Aligned	Incident Response...	20.0_IS_Risk_Management_Policy_2.pdf
IR-5	Incident Monitoring	Aligned	Information Security incidents that are investigated and ana...	20.0_IS_Risk_Management_Policy_2.pdf
IR-5	Incident Monitoring	Aligned	Incident Classification section...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
IR-5	Incident Monitoring	Aligned	Incident Response Management...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-6	Incident Reporting	Aligned	a. The Information Security Team should enforce, comply, and...	19.0_IS_Cloud_Computing_Security_Policy.pdf
IR-6	Incident Reporting	Aligned	Assessment of & Decision on Information Security Events...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IR-6	Incident Reporting	Aligned	X. All breaches of information security should be reported t...	3.0_IS_Information_Security_Policy_2.pdf
IR-6	Incident Reporting	Aligned	Information Security incidents that are investigated and ana...	20.0_IS_Risk_Management_Policy_2.pdf
IR-6	Incident Reporting	Aligned	Incident Prioritization (Severity)...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
IR-6	Incident Reporting	Aligned	1.4 CONTACT WITH AUTHORITIES...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-7	Incident Response Assistance	Aligned	Incident Response Procedures...	19.0_IS_Cloud_Computing_Security_Policy.pdf
IR-7	Incident Response Assistance	Aligned	Incident Response \| Incident Response Training...	5.0_IS_Human_Resource_Security_Policy_1.pdf
IR-7	Incident Response Assistance	Aligned	Incident Response Recovery and Post Incident Activity...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
IR-7	Incident Response Assistance	Aligned	Incident Response Management...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-8	Incident Response Plan Key Control	Aligned	a. The Information Security Team should enforce, comply, and...	19.0_IS_Cloud_Computing_Security_Policy.pdf
IR-8	Incident Response Plan Key Control	Aligned	Incident Response Management...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IR-8	Incident Response Plan Key Control	Aligned	Incident Response Management...	19.1_IS_Cloud_Computing_Security_Standard.pdf
IR-8	Incident Response Plan Key Control	Aligned	X. All breaches of information security should be reported t...	3.0_IS_Information_Security_Policy_2.pdf
IR-8	Incident Response Plan Key Control	Aligned	Incident Response Recovery and Post Incident Activity...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
IR-8	Incident Response Plan Key Control	Aligned	1.4 CONTACT WITH AUTHORITIES...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
IR-9	Information Spillage Response	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
IR-9	Information Spillage Response	Aligned	1.3 DATA OWNER RESPONSIBILITIES...	6.0_IS_Data_Security_Policy_1.pdf
IR-9	Information Spillage Response	Aligned	Containment Phase...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
MA-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	6.1_IS_Data_Security_Standards.pdf
MA-1	Policy and Procedures Key Control	Aligned	Policy statement requiring the exception....	2.1_IS_Acceptable_Use_Standard.pdf
MA-1	Policy and Procedures Key Control	Aligned	Policy statement requiring the exception....	2.0_IS_Acceptable_Use_Policy.pdf
MA-1	Policy and Procedures Key Control	Aligned	The technical and organizational controls define minimum req...	26.0_IS_Vulnerability_Management_Policy.pdf
MA-1	Policy and Procedures Key Control	Aligned	Policy statement requiring the exception....	6.0_IS_Data_Security_Policy_1.pdf
MA-1	Policy and Procedures Key Control	Aligned	1.0 PURPOSE and 1.2 SCOPE & APPLICABILITY...	5.0_IS_Human_Resource_Security_Policy_1.pdf
MA-1	Policy and Procedures Key Control	Aligned	Maintenance policy and procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
MA-1	Policy and Procedures Key Control	Aligned	Policy exception process...	7.2_IS_End_User_Device_Standard.pdf
MA-1	Policy and Procedures Key Control	Aligned	Chunk: 1.5...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
MA-1	Policy and Procedures Key Control	Aligned	Maintenance policy and procedures...	3.0_IS_Information_Security_Policy_2.pdf
MA-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
MA-2	Controlled Maintenance Key Control	Aligned	MAINTENANCE...	2.0_IS_Acceptable_Use_Policy.pdf
MA-2	Controlled Maintenance Key Control	Aligned	4. Voice Communications Equipment...	7.2_IS_End_User_Device_Standard.pdf
MA-2	Controlled Maintenance Key Control	Aligned	System Maintenance Information...	7.0_IS_Asset_Management_Policy.pdf
MA-3	Maintenance Tools Key Control	Gap	Approving, controlling, monitoring, and reviewing maintenance tools address security-related issues ... Critical Gap - Key Control Missing
MA-4	Nonlocal Maintenance	Aligned	With Lazard IT Department Personnel only, there may be selec...	2.1_IS_Acceptable_Use_Standard.pdf
MA-4	Nonlocal Maintenance	Aligned	h) A current network architecture must be maintained that in...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
MA-4	Nonlocal Maintenance	Aligned	INFORMATION SECURITY GOALS...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
MA-5	Maintenance Personnel Key Control	Aligned	m) Remote maintenance ports for Lazard′s information and com...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
MA-5	Maintenance Personnel Key Control	Aligned	Personnel Security \| Policy & Procedures...	7.0_IS_Asset_Management_Policy.pdf
MA-5	Maintenance Personnel Key Control	Aligned	Is responsible for reviewing and authorizing access to infor...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
MA-6	Timely Maintenance Key Control	Gap	Organizations specify the system components that result in increased risk to organizational operatio... Critical Gap - Key Control Missing
MA-7	Field Maintenance	Gap	Field maintenance is the type of maintenance conducted on a system or system component after the sys...
MP-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	6.1_IS_Data_Security_Standards.pdf
MP-1	Policy and Procedures Key Control	Aligned	1.5 EXCEPTION...	2.1_IS_Acceptable_Use_Standard.pdf
MP-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
MP-1	Policy and Procedures Key Control	Aligned	Policy statement requiring the exception....	6.0_IS_Data_Security_Policy_1.pdf
MP-1	Policy and Procedures Key Control	Aligned	Media protection policy and procedures...	5.0_IS_Human_Resource_Security_Policy_1.pdf
MP-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	7.1_IS_Asset_Management_Standard.pdf
MP-1	Policy and Procedures Key Control	Aligned	Media protection policy and procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
MP-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	7.2_IS_End_User_Device_Standard.pdf
MP-1	Policy and Procedures Key Control	Aligned	Media Protection Policy and Procedures...	3.0_IS_Information_Security_Policy_2.pdf
MP-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	20.0_IS_Risk_Management_Policy_2.pdf
MP-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	7.0_IS_Asset_Management_Policy.pdf
MP-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
MP-1	Policy and Procedures Key Control	Aligned	Responsibilities for the protection of individual assets and...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
MP-2	Media Access	Aligned	Handling of Assets \| Management of Removable Media...	6.1_IS_Data_Security_Standards.pdf
MP-2	Media Access	Aligned	1.12 REMOVEABLE STORAGE DEVICES...	2.0_IS_Acceptable_Use_Policy.pdf
MP-2	Media Access	Aligned	Media Protection \| Policy & Procedures, Media Access, Media ...	19.1_IS_Cloud_Computing_Security_Standard.pdf
MP-2	Media Access	Aligned	Handling of Assets...	6.0_IS_Data_Security_Policy_1.pdf
MP-2	Media Access	Aligned	Media Protection \| Media Access...	7.2_IS_End_User_Device_Standard.pdf
MP-2	Media Access	Aligned	Media Protection \| Media Access...	7.2_IS_End_User_Device_Standard.pdf
MP-2	Media Access	Aligned	Media Protection \| Media Access...	7.2_IS_End_User_Device_Standard.pdf
MP-2	Media Access	Aligned	Media Protection \| Media Access...	7.2_IS_End_User_Device_Standard.pdf
MP-3	Media Marking	Aligned	Label information with 'Internal', 'Confidential' or 'Restri...	6.1_IS_Data_Security_Standards.pdf
MP-3	Media Marking	Aligned	Handling of Assets \| Management of Removable Media...	6.1_IS_Data_Security_Standards.pdf
MP-3	Media Marking	Aligned	DOCUMENT CLASSIFICATION...	2.1_IS_Acceptable_Use_Standard.pdf
MP-3	Media Marking	Aligned	DOCUMENT CLASSIFICATION...	19.0_IS_Cloud_Computing_Security_Policy.pdf
MP-3	Media Marking	Aligned	Media Protection \| Media Marking...	6.0_IS_Data_Security_Policy_1.pdf
MP-3	Media Marking	Aligned	Media Protection \| Media Marking...	7.2_IS_End_User_Device_Standard.pdf
MP-3	Media Marking	Aligned	Media Protection \| Media Marking...	7.2_IS_End_User_Device_Standard.pdf
MP-3	Media Marking	Aligned	DOCUMENT CLASSIFICATION...	20.0_IS_Risk_Management_Policy_2.pdf
MP-3	Media Marking	Aligned	Personnel Security \| Policy & Procedures...	7.0_IS_Asset_Management_Policy.pdf
MP-3	Media Marking	Aligned	DOCUMENT CLASSIFICATION...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
MP-4	Media Storage Key Control	Aligned	Handling of Assets \| Management of Removable Media \| Physica...	6.1_IS_Data_Security_Standards.pdf
MP-4	Media Storage Key Control	Aligned	Data processing using Lazard-authorized encrypted removable ...	2.1_IS_Acceptable_Use_Standard.pdf
MP-4	Media Storage Key Control	Aligned	1.12 REMOVEABLE STORAGE DEVICES...	2.0_IS_Acceptable_Use_Policy.pdf
MP-4	Media Storage Key Control	Aligned	Media Protection \| Policy & Procedures...	19.1_IS_Cloud_Computing_Security_Standard.pdf
MP-4	Media Storage Key Control	Aligned	Access Control \| Information Flow Enforcement...	6.0_IS_Data_Security_Policy_1.pdf
MP-4	Media Storage Key Control	Aligned	Media Protection \| Media Storage...	7.2_IS_End_User_Device_Standard.pdf
MP-4	Media Storage Key Control	Aligned	Media Protection \| Media Storage...	7.2_IS_End_User_Device_Standard.pdf
MP-5	Media Transport Key Control	Aligned	Handling of Assets \| Management of Removable Media \| Physica...	6.1_IS_Data_Security_Standards.pdf
MP-5	Media Transport Key Control	Aligned	1.12 REMOVEABLE STORAGE DEVICES...	2.0_IS_Acceptable_Use_Policy.pdf
MP-5	Media Transport Key Control	Aligned	Data Protection...	6.0_IS_Data_Security_Policy_1.pdf
MP-5	Media Transport Key Control	Aligned	Media Protection \| Media Transport...	7.2_IS_End_User_Device_Standard.pdf
MP-5	Media Transport Key Control	Aligned	Media Protection \| Media Transport...	7.2_IS_End_User_Device_Standard.pdf
MP-6	Media Sanitization	Aligned	Disposal (in accordance with Retention Policy)...	6.1_IS_Data_Security_Standards.pdf
MP-6	Media Sanitization	Aligned	1.12 REMOVEABLE STORAGE DEVICES...	2.0_IS_Acceptable_Use_Policy.pdf
MP-6	Media Sanitization	Aligned	Data destruction procedures for cloud service providers...	19.0_IS_Cloud_Computing_Security_Policy.pdf
MP-6	Media Sanitization	Aligned	Media Protection \| Media Sanitization...	6.0_IS_Data_Security_Policy_1.pdf
MP-6	Media Sanitization	Aligned	Media Protection \| Media Sanitization...	6.0_IS_Data_Security_Policy_1.pdf
MP-6	Media Sanitization	Aligned	Media Protection \| Media Access...	6.0_IS_Data_Security_Policy_1.pdf
MP-6	Media Sanitization	Aligned	Secure Disposal or Re-Use of Equipment...	6.0_IS_Data_Security_Policy_1.pdf
MP-6	Media Sanitization	Aligned	Media Protection \| Media Sanitization...	6.0_IS_Data_Security_Policy_1.pdf
MP-6	Media Sanitization	Aligned	IT Asset (NEW) and other assets Retirement and Disposal...	7.1_IS_Asset_Management_Standard.pdf
MP-6	Media Sanitization	Aligned	Media Protection \| Media Sanitization...	7.2_IS_End_User_Device_Standard.pdf
MP-6	Media Sanitization	Aligned	Media Protection \| Media Sanitization...	7.2_IS_End_User_Device_Standard.pdf
MP-6	Media Sanitization	Aligned	Media sanitization applies to all digital and non-digital sy...	20.0_IS_Risk_Management_Policy_2.pdf
MP-6	Media Sanitization	Aligned	1.2.2 Asset Disposal & Re-Use...	7.0_IS_Asset_Management_Policy.pdf
MP-7	Media Use Key Control	Aligned	Management of Removable Media...	6.1_IS_Data_Security_Standards.pdf
MP-7	Media Use Key Control	Aligned	Data processing using Lazard-authorized encrypted removable ...	2.1_IS_Acceptable_Use_Standard.pdf
MP-7	Media Use Key Control	Aligned	1.12 REMOVEABLE STORAGE DEVICES...	2.0_IS_Acceptable_Use_Policy.pdf
MP-7	Media Use Key Control	Aligned	Media Protection \| Media Use...	6.0_IS_Data_Security_Policy_1.pdf
MP-7	Media Use Key Control	Aligned	Media Protection \| Media Use...	7.2_IS_End_User_Device_Standard.pdf
MP-7	Media Use Key Control	Aligned	Protection of network devices and approved devices...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
MP-7	Media Use Key Control	Aligned	End-user Device Security Policy...	3.0_IS_Information_Security_Policy_2.pdf
MP-8	Media Downgrading	Aligned	Handling of Assets \| Management of Removable Media...	6.1_IS_Data_Security_Standards.pdf
MP-8	Media Downgrading	Aligned	1.12 REMOVEABLE STORAGE DEVICES...	2.0_IS_Acceptable_Use_Policy.pdf
MP-8	Media Downgrading	Aligned	Data Destruction Procedures...	19.0_IS_Cloud_Computing_Security_Policy.pdf
MP-8	Media Downgrading	Aligned	Media Protection \| Media Downgrading...	19.1_IS_Cloud_Computing_Security_Standard.pdf
MP-8	Media Downgrading	Aligned	Media Protection \| Media Downgrading...	7.2_IS_End_User_Device_Standard.pdf
MP-8	Media Downgrading	Aligned	Media Protection \| Media Downgrading...	7.0_IS_Asset_Management_Policy.pdf
PE-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	6.1_IS_Data_Security_Standards.pdf
PE-1	Policy and Procedures Key Control	Aligned	1.5 EXCEPTION...	2.1_IS_Acceptable_Use_Standard.pdf
PE-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
PE-1	Policy and Procedures Key Control	Aligned	Policy statement requiring the exception....	6.0_IS_Data_Security_Policy_1.pdf
PE-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	7.1_IS_Asset_Management_Standard.pdf
PE-1	Policy and Procedures Key Control	Aligned	Physical and Environmental Protection Policy and Procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	7.2_IS_End_User_Device_Standard.pdf
PE-1	Policy and Procedures Key Control	Aligned	Section 1.5 - Policy Exceptions...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
PE-1	Policy and Procedures Key Control	Aligned	Physical and Environmental Protection Policy and Procedures...	3.0_IS_Information_Security_Policy_2.pdf
PE-1	Policy and Procedures Key Control	Aligned	Physical and Environmental Protection Policy and Procedures...	20.0_IS_Risk_Management_Policy_2.pdf
PE-1	Policy and Procedures Key Control	Aligned	Divisions & Functions are free to define and implement stron...	7.0_IS_Asset_Management_Policy.pdf
PE-1	Policy and Procedures Key Control	Aligned	EXCEPTION...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
PE-1	Policy and Procedures Key Control	Aligned	Policy statement requiring the exception....	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PE-10	Emergency Shutoff	Gap	Emergency power shutoff primarily applies to organizational facilities that contain concentrations o...
PE-11	Emergency Power	Gap	An uninterruptible power supply (UPS) is an electrical system or mechanism that provides emergency p...
PE-12	Emergency Lighting Key Control	Gap	The provision of emergency lighting applies primarily to organizational facilities that contain conc... Critical Gap - Key Control Missing
PE-13	Fire Protection	Gap	The provision of fire detection and suppression systems applies primarily to organizational faciliti...
PE-14	Environmental Controls Key Control	Aligned	Physical & Environmental Protection \| Delivery & Removal...	7.0_IS_Asset_Management_Policy.pdf
PE-15	Water Damage Protection	Gap	The provision of water damage protection primarily applies to organizational facilities that contain...
PE-16	Delivery and Removal Key Control	Aligned	Access Restrictions and User Access Policies...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PE-16	Delivery and Removal Key Control	Aligned	Physical Access Management...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-16	Delivery and Removal Key Control	Aligned	Section p) and r)...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
PE-16	Delivery and Removal Key Control	Aligned	vi. Authorizing and periodically reviewing access entitlemen...	7.0_IS_Asset_Management_Policy.pdf
PE-16	Delivery and Removal Key Control	Aligned	1.2.6 Physical Security Perimeter and Entry Controls...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
PE-17	Alternate Work Site Key Control	Aligned	Contingency Planning \| Alternate Processing Site...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PE-18	Location of System Components Key Control	Aligned	Section 9: Equipment and media containing confidential infor...	7.2_IS_End_User_Device_Standard.pdf
PE-19	Information Leakage	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
PE-19	Information Leakage	Aligned	d) A data loss prevention (DLP) mechanism should be implemen...	6.0_IS_Data_Security_Policy_1.pdf
PE-19	Information Leakage	Aligned	1.1 SCOPE & APPLICABILITY...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PE-2	Physical Access Authorizations Key Control	Aligned	Physical & Environmental Protection \| Physical Access Author...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PE-2	Physical Access Authorizations Key Control	Aligned	h. Should ensure that physical access to assets is managed a...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-2	Physical Access Authorizations Key Control	Aligned	m) Remote maintenance ports for Lazard′s information and com...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
PE-2	Physical Access Authorizations Key Control	Aligned	Physical and Environmental Security...	3.0_IS_Information_Security_Policy_2.pdf
PE-2	Physical Access Authorizations Key Control	Aligned	Personnel Security \| Policy & Procedures...	7.0_IS_Asset_Management_Policy.pdf
PE-2	Physical Access Authorizations Key Control	Aligned	Security Personnel...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
PE-20	Asset Monitoring and Tracking Key Control	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PE-20	Asset Monitoring and Tracking Key Control	Aligned	c) The Asset inventory should be kept accurate, and it shoul...	7.0_IS_Asset_Management_Policy.pdf
PE-20	Asset Monitoring and Tracking Key Control	Aligned	Section 1.3 ROLES & RESPONSIBILITIES...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
PE-21	Electromagnetic Pulse Protection	Gap	An electromagnetic pulse (EMP) is a short burst of electromagnetic energy that is spread over a rang...
PE-22	Component Marking Key Control	Aligned	Physical & Environmental Protection \| Information Leakage...	6.1_IS_Data_Security_Standards.pdf
PE-22	Component Marking Key Control	Aligned	Access Control \| Use of External Systems...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
PE-23	Facility Location	Gap	Physical and environmental hazards include floods, fires, tornadoes, earthquakes, hurricanes, terror...
PE-3	Physical Access Control Key Control	Aligned	Access Control \| Information Flow Enforcement...	6.1_IS_Data_Security_Standards.pdf
PE-3	Physical Access Control Key Control	Aligned	Access Control Policies and Procedures...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PE-3	Physical Access Control Key Control	Aligned	Physical access control applies to employees and visitors....	6.0_IS_Data_Security_Policy_1.pdf
PE-3	Physical Access Control Key Control	Aligned	h. Should ensure that physical access to assets is managed a...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-3	Physical Access Control Key Control	Aligned	h. Should ensure that physical access to assets is managed a...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-3	Physical Access Control Key Control	Aligned	It is paramount that the established security perimeter and ...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
PE-3	Physical Access Control Key Control	Aligned	1.2.6 Physical Security Perimeter and Entry Controls...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
PE-4	Access Control for Transmission	Aligned	Equipment Siting & Protection...	6.1_IS_Data_Security_Standards.pdf
PE-4	Access Control for Transmission	Aligned	Cabling security...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PE-4	Access Control for Transmission	Aligned	Equipment and media containing confidential information shou...	7.2_IS_End_User_Device_Standard.pdf
PE-4	Access Control for Transmission	Aligned	Section p) Telephone lines that could enable remote access i...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
PE-4	Access Control for Transmission	Aligned	Physical & Environmental Protection \| Delivery & Removal...	7.0_IS_Asset_Management_Policy.pdf
PE-5	Access Control for Output Devices Key Control	Aligned	Access Control \| Information Flow Enforcement...	6.1_IS_Data_Security_Standards.pdf
PE-5	Access Control for Output Devices Key Control	Aligned	Personnel Security \| Monitoring Physical Access...	6.1_IS_Data_Security_Standards.pdf
PE-5	Access Control for Output Devices Key Control	Aligned	h. Should ensure that physical access to assets is managed a...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-6	Monitoring Physical Access Key Control	Aligned	Access Control \| Information Flow Enforcement...	6.1_IS_Data_Security_Standards.pdf
PE-6	Monitoring Physical Access Key Control	Aligned	Upon use of Lazard’s Systems, be it directly or indirectly, ...	2.0_IS_Acceptable_Use_Policy.pdf
PE-6	Monitoring Physical Access Key Control	Aligned	Physical and Environmental Security...	3.0_IS_Information_Security_Policy_2.pdf
PE-6	Monitoring Physical Access Key Control	Aligned	Responsibilities related to reviewing and authorizing access...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
PE-8	Visitor Access Records Key Control	Aligned	Access Control Policy...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PE-9	Power Equipment and Cabling	Aligned	Physical & Environmental Protection \| Power Equipment & Cabl...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PE-9	Power Equipment and Cabling	Aligned	Equipment Siting & Protection...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PL-1	Policy and Procedures	Aligned	Exceptions to the policy...	6.1_IS_Data_Security_Standards.pdf
PL-1	Policy and Procedures	Aligned	1.5 EXCEPTION...	2.1_IS_Acceptable_Use_Standard.pdf
PL-1	Policy and Procedures	Aligned	1.17 EXCEPTION...	2.0_IS_Acceptable_Use_Policy.pdf
PL-1	Policy and Procedures	Aligned	Policy statement requiring the exception....	6.0_IS_Data_Security_Policy_1.pdf
PL-1	Policy and Procedures	Aligned	1.0 PURPOSE and 1.2 SCOPE & APPLICABILITY...	5.0_IS_Human_Resource_Security_Policy_1.pdf
PL-1	Policy and Procedures	Aligned	Policy exception process...	7.1_IS_Asset_Management_Standard.pdf
PL-1	Policy and Procedures	Aligned	Planning policy and procedures for the controls in the PL fa...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PL-1	Policy and Procedures	Aligned	Policy Exception Process...	7.2_IS_End_User_Device_Standard.pdf
PL-1	Policy and Procedures	Aligned	Exceptions to the policy...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
PL-1	Policy and Procedures	Aligned	Compliance...	3.0_IS_Information_Security_Policy_2.pdf
PL-1	Policy and Procedures	Aligned	Compliance...	3.0_IS_Information_Security_Policy_2.pdf
PL-1	Policy and Procedures	Aligned	Information Security Policy – Communicates management direct...	3.0_IS_Information_Security_Policy_2.pdf
PL-1	Policy and Procedures	Aligned	Compliance...	3.0_IS_Information_Security_Policy_2.pdf
PL-1	Policy and Procedures	Aligned	Compliance...	3.0_IS_Information_Security_Policy_2.pdf
PL-1	Policy and Procedures	Aligned	Compliance and Risk Policy...	3.0_IS_Information_Security_Policy_2.pdf
PL-1	Policy and Procedures	Aligned	Compliance and Risk Policy...	3.0_IS_Information_Security_Policy_2.pdf
PL-1	Policy and Procedures	Aligned	Information Security Incident Management and Compliance...	3.0_IS_Information_Security_Policy_2.pdf
PL-1	Policy and Procedures	Aligned	Compliance...	3.0_IS_Information_Security_Policy_2.pdf
PL-1	Policy and Procedures	Aligned	Compliance...	3.0_IS_Information_Security_Policy_2.pdf
PL-1	Policy and Procedures	Aligned	Compliance...	3.0_IS_Information_Security_Policy_2.pdf
PL-1	Policy and Procedures	Aligned	Risk Policy...	3.0_IS_Information_Security_Policy_2.pdf
PL-1	Policy and Procedures	Aligned	1.1 SCOPE & APPLICABILITY...	20.0_IS_Risk_Management_Policy_2.pdf
PL-1	Policy and Procedures	Aligned	Policy exception process and implementation of security requ...	7.0_IS_Asset_Management_Policy.pdf
PL-1	Policy and Procedures	Aligned	EXCEPTION...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
PL-1	Policy and Procedures	Aligned	Policy statement requiring the exception....	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PL-10	Baseline Selection Key Control	Aligned	Control References...	6.1_IS_Data_Security_Standards.pdf
PL-10	Baseline Selection Key Control	Aligned	Control Baselines...	2.0_IS_Acceptable_Use_Policy.pdf
PL-10	Baseline Selection Key Control	Aligned	1.12 GOVERNANCE...	19.0_IS_Cloud_Computing_Security_Policy.pdf
PL-10	Baseline Selection Key Control	Aligned	Baseline security requirements...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PL-10	Baseline Selection Key Control	Aligned	Control: PL-10...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
PL-10	Baseline Selection Key Control	Aligned	The protection of data against unintentional, unlawful, or u...	3.0_IS_Information_Security_Policy_2.pdf
PL-11	Baseline Tailoring	Aligned	Control: PL-11...	2.0_IS_Acceptable_Use_Policy.pdf
PL-11	Baseline Tailoring	Aligned	1.12 GOVERNANCE...	19.0_IS_Cloud_Computing_Security_Policy.pdf
PL-11	Baseline Tailoring	Aligned	Baseline security control requirements should be established...	19.0_IS_Cloud_Computing_Security_Policy.pdf
PL-11	Baseline Tailoring	Aligned	Tailoring Actions and Customization of Controls...	6.0_IS_Data_Security_Policy_1.pdf
PL-11	Baseline Tailoring	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
PL-11	Baseline Tailoring	Aligned	1.6 EXCEPTION...	7.1_IS_Asset_Management_Standard.pdf
PL-11	Baseline Tailoring	Aligned	The practice of protecting information and information syste...	3.0_IS_Information_Security_Policy_2.pdf
PL-11	Baseline Tailoring	Aligned	Clause 8.3 Design & Development...	20.0_IS_Risk_Management_Policy_2.pdf
PL-11	Baseline Tailoring	Aligned	Control: PL-11...	7.0_IS_Asset_Management_Policy.pdf
PL-2	System Security and Privacy Plans	Aligned	1.5 CLOUD SECURITY MANAGEMENT...	19.0_IS_Cloud_Computing_Security_Policy.pdf
PL-2	System Security and Privacy Plans	Aligned	Section 1.2.2 Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PL-2	System Security and Privacy Plans	Aligned	Risk Policy...	3.0_IS_Information_Security_Policy_2.pdf
PL-2	System Security and Privacy Plans	Aligned	Section 1.4 REQUIREMENT...	20.0_IS_Risk_Management_Policy_2.pdf
PL-4	Rules of Behavior Key Control	Aligned	Control Name...	6.1_IS_Data_Security_Standards.pdf
PL-4	Rules of Behavior Key Control	Aligned	1.6 ENFORCEMENT/COMPLIANCE...	2.1_IS_Acceptable_Use_Standard.pdf
PL-4	Rules of Behavior Key Control	Aligned	1.11 USER ID & PASSWORD SECURITY...	2.0_IS_Acceptable_Use_Policy.pdf
PL-4	Rules of Behavior Key Control	Aligned	Roles & Responsibilities...	2.0_IS_Acceptable_Use_Policy.pdf
PL-4	Rules of Behavior Key Control	Aligned	Further, Users could be held individually liable for illegal...	7.1_IS_Asset_Management_Standard.pdf
PL-4	Rules of Behavior Key Control	Aligned	Identification & Authentication \| Authenticator Management...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PL-4	Rules of Behavior Key Control	Aligned	Access Control Roles and Responsibilities...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PL-4	Rules of Behavior Key Control	Aligned	Any User found to have violated any of these policies may be...	7.2_IS_End_User_Device_Standard.pdf
PL-4	Rules of Behavior Key Control	Aligned	1.7 ENFORCEMENT...	3.0_IS_Information_Security_Policy_2.pdf
PL-4	Rules of Behavior Key Control	Aligned	The requirement to protect individual authenticators may be ...	7.0_IS_Asset_Management_Policy.pdf
PL-4	Rules of Behavior Key Control	Aligned	Rules of behavior represent a type of access agreement for o...	7.0_IS_Asset_Management_Policy.pdf
PL-4	Rules of Behavior Key Control	Aligned	1.2.1 Access Control...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
PL-7	Concept of Operations Key Control	Gap	The CONOPS may be included in the security or privacy plans for the system or in other system develo... Critical Gap - Key Control Missing
PL-8	Security and Privacy Architectures	Aligned	Section 2.1 Acceptable Use Standard and Access Control Polic...	2.0_IS_Acceptable_Use_Policy.pdf
PL-8	Security and Privacy Architectures	Aligned	System Acquisition, Development and Maintenance...	3.0_IS_Information_Security_Policy_2.pdf
PL-8	Security and Privacy Architectures	Aligned	1.4 REQUIREMENT...	20.0_IS_Risk_Management_Policy_2.pdf
PL-9	Central Management Key Control	Aligned	Central management refers to organization-wide management an...	6.0_IS_Data_Security_Policy_1.pdf
PL-9	Central Management Key Control	Aligned	Central management refers to organization-wide management an...	3.0_IS_Information_Security_Policy_2.pdf
PL-9	Central Management Key Control	Aligned	Incident Lifecycle...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
PM-1	Information Security Program Plan	Aligned	Cloud Security Program Management...	19.0_IS_Cloud_Computing_Security_Policy.pdf
PM-1	Information Security Program Plan	Aligned	1.0 PURPOSE...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
PM-1	Information Security Program Plan	Aligned	Organization of Information Security – Establishes a managem...	3.0_IS_Information_Security_Policy_2.pdf
PM-1	Information Security Program Plan	Aligned	XII. There may be instances where there is a justifiable bus...	3.0_IS_Information_Security_Policy_2.pdf
PM-1	Information Security Program Plan	Aligned	the organization’s cybersecurity program...	3.0_IS_Information_Security_Policy_2.pdf
PM-1	Information Security Program Plan	Aligned	Information Security incidents that are investigated and ana...	20.0_IS_Risk_Management_Policy_2.pdf
PM-1	Information Security Program Plan	Aligned	Control: PM-1...	7.0_IS_Asset_Management_Policy.pdf
PM-1	Information Security Program Plan	Aligned	Information Security Program Plan Overview...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
PM-1	Information Security Program Plan	Aligned	1.1 SCOPE & APPLICABILITY...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-10	Authorization Process Key Control	Aligned	Authorization processes for organizational systems and envir...	19.0_IS_Cloud_Computing_Security_Policy.pdf
PM-10	Authorization Process Key Control	Aligned	Role Responsibility...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PM-10	Authorization Process Key Control	Aligned	1.5 ROLES & RESPONSIBILITIES...	20.0_IS_Risk_Management_Policy_2.pdf
PM-10	Authorization Process Key Control	Aligned	Authorization processes for organizational systems and envir...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
PM-10	Authorization Process Key Control	Aligned	Responsibilities for information security risk management ac...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	1.0 PURPOSE...	6.0_IS_Data_Security_Policy_1.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	Policy Exception Process...	7.2_IS_End_User_Device_Standard.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	Section 1.5 - Exceptions to the policy...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	Information Security Incident Management and Compliance...	3.0_IS_Information_Security_Policy_2.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	Risk Policy...	3.0_IS_Information_Security_Policy_2.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	1.4 REQUIREMENT...	20.0_IS_Risk_Management_Policy_2.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	Protection needs are technology-independent capabilities tha...	7.0_IS_Asset_Management_Policy.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	Responsibilities for the protection of individual assets and...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-11	Mission and Business Process Definition Key Control	Aligned	Responsibilities for information security risk management ac...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-12	Insider Threat Program Key Control	Aligned	Insider threat programs include controls to detect and preve...	2.0_IS_Acceptable_Use_Policy.pdf
PM-12	Insider Threat Program Key Control	Aligned	Personnel Security \| Policy & Procedures...	7.0_IS_Asset_Management_Policy.pdf
PM-13	Security and Privacy Workforce Key Control	Aligned	Security and privacy workforce development and improvement p...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PM-13	Security and Privacy Workforce Key Control	Aligned	Security responsibilities by employees under their supervisi...	5.0_IS_Human_Resource_Security_Policy_1.pdf
PM-13	Security and Privacy Workforce Key Control	Aligned	Information Security Awareness, Education & Training...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
PM-13	Security and Privacy Workforce Key Control	Aligned	Security Awareness & Skills Training...	3.0_IS_Information_Security_Policy_2.pdf
PM-13	Security and Privacy Workforce Key Control	Aligned	Program Management \| Security & Privacy Workforce...	3.0_IS_Information_Security_Policy_2.pdf
PM-14	Testing, Training, and Monitoring	Aligned	2.1 Acceptable Use Standard and 8.0 Access Control Policy...	2.0_IS_Acceptable_Use_Policy.pdf
PM-14	Testing, Training, and Monitoring	Aligned	Processes, procedures, and controls to safeguard Lazard’s en...	19.0_IS_Cloud_Computing_Security_Policy.pdf
PM-14	Testing, Training, and Monitoring	Aligned	The Information Security Team should periodically conduct a ...	19.0_IS_Cloud_Computing_Security_Policy.pdf
PM-14	Testing, Training, and Monitoring	Aligned	Assessment, Authorization & Monitoring \| Control Assessments...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PM-14	Testing, Training, and Monitoring	Aligned	1.2.7 Vulnerability Scanning...	26.0_IS_Vulnerability_Management_Policy.pdf
PM-14	Testing, Training, and Monitoring	Aligned	1.3 ROLES & RESPONSIBILITIES...	26.0_IS_Vulnerability_Management_Policy.pdf
PM-14	Testing, Training, and Monitoring	Aligned	Security Awareness Training Responsibilities...	5.0_IS_Human_Resource_Security_Policy_1.pdf
PM-14	Testing, Training, and Monitoring	Aligned	Access Control \| Concurrent Session Control, System & Commun...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PM-14	Testing, Training, and Monitoring	Aligned	Information Security Awareness, Education & Training...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
PM-14	Testing, Training, and Monitoring	Aligned	the organization’s cybersecurity program...	3.0_IS_Information_Security_Policy_2.pdf
PM-14	Testing, Training, and Monitoring	Aligned	Job Description (JD) and Management Responsibilities...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-14	Testing, Training, and Monitoring	Aligned	Management Responsibilities...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-14	Testing, Training, and Monitoring	Aligned	Management Responsibilities...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-15	Security and Privacy Groups and Associations	Aligned	Assessment, Authorization & Monitoring \| Continuous Monitori...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PM-16	Threat Awareness Program	Aligned	1.2.1 General Requirements...	26.0_IS_Vulnerability_Management_Policy.pdf
PM-17	Protecting Controlled Unclassified Information on External Systems	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
PM-17	Protecting Controlled Unclassified Information on External Systems	Aligned	1.0 PURPOSE...	6.0_IS_Data_Security_Policy_1.pdf
PM-17	Protecting Controlled Unclassified Information on External Systems	Aligned	DOCUMENT CLASSIFICATION...	20.0_IS_Risk_Management_Policy_2.pdf
PM-18	Privacy Program Plan	Gap	A privacy program plan is a formal document that provides an overview of an organizationâ€šÃ„Ã´s pri...
PM-19	Privacy Program Leadership Role	Gap	The privacy officer is an organizational official. For federal agenciesâ€šÃ„Ã®as defined by applicab...
PM-2	Information Security Program Leadership Role	Aligned	1.11 DOCUMENT INFORMATION...	6.1_IS_Data_Security_Standards.pdf
PM-2	Information Security Program Leadership Role	Aligned	1.11 DOCUMENT INFORMATION...	2.1_IS_Acceptable_Use_Standard.pdf
PM-2	Information Security Program Leadership Role	Aligned	Roles and Responsibilities for Governance of Cloud Security ...	19.0_IS_Cloud_Computing_Security_Policy.pdf
PM-2	Information Security Program Leadership Role	Aligned	POSITION...	26.0_IS_Vulnerability_Management_Policy.pdf
PM-2	Information Security Program Leadership Role	Aligned	1.10 DOCUMENT INFORMATION...	7.2_IS_End_User_Device_Standard.pdf
PM-2	Information Security Program Leadership Role	Aligned	1.3 MANAGEMENT DIRECTION FOR INFORMATION SECURITY...	3.0_IS_Information_Security_Policy_2.pdf
PM-2	Information Security Program Leadership Role	Aligned	1.5 ROLES & RESPONSIBILITIES...	20.0_IS_Risk_Management_Policy_2.pdf
PM-2	Information Security Program Leadership Role	Aligned	1.11 DOCUMENT INFORMATION...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
PM-20	Dissemination of Privacy Program Information	Gap	For federal agencies, the webpage is located at www.[agency].gov/privacy. Federal agencies include p...
PM-21	Accounting of Disclosures Key Control	Aligned	Section ii to viii regarding personal and sensitive informat...	6.0_IS_Data_Security_Policy_1.pdf
PM-22	Personally Identifiable Information Quality Management	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
PM-23	Data Governance Body Key Control	Aligned	Data Governance Body responsibilities and data protection re...	6.1_IS_Data_Security_Standards.pdf
PM-23	Data Governance Body Key Control	Aligned	1.12 GOVERNANCE...	19.0_IS_Cloud_Computing_Security_Policy.pdf
PM-23	Data Governance Body Key Control	Aligned	Data retention policies are driven by legal and regulatory r...	6.0_IS_Data_Security_Policy_1.pdf
PM-23	Data Governance Body Key Control	Aligned	The protection of data against unintentional, unlawful, or u...	3.0_IS_Information_Security_Policy_2.pdf
PM-24	Data Integrity Board	Aligned	The accuracy, completeness, and quality of data as it is mai...	3.0_IS_Information_Security_Policy_2.pdf
PM-25	Minimization of Personally Identifiable Information Used in Testing, Training, and Research Key Control	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
PM-25	Minimization of Personally Identifiable Information Used in Testing, Training, and Research Key Control	Aligned	Handling of personal information and data classified as prod...	6.0_IS_Data_Security_Policy_1.pdf
PM-26	Complaint Management	Gap	Complaints, concerns, and questions from individuals can serve as valuable sources of input to organ...
PM-27	Privacy Reporting Key Control	Gap	Through internal and external reporting, organizations promote accountability and transparency in or... Critical Gap - Key Control Missing
PM-28	Risk Framing	Aligned	Program Management \| Risk Framing...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PM-28	Risk Framing	Aligned	Information Security incidents that are investigated and ana...	20.0_IS_Risk_Management_Policy_2.pdf
PM-28	Risk Framing	Aligned	Assets ownership and responsibilities...	7.0_IS_Asset_Management_Policy.pdf
PM-28	Risk Framing	Aligned	Risk Framing...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
PM-28	Risk Framing	Aligned	Responsibilities for information security risk management ac...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-29	Risk Management Program Leadership Roles	Aligned	1.5 ROLES & RESPONSIBILITIES...	20.0_IS_Risk_Management_Policy_2.pdf
PM-29	Risk Management Program Leadership Roles	Aligned	Information Security Policies for Supplier Relationships...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-3	Information Security and Privacy Resources	Aligned	1.12 GOVERNANCE...	19.0_IS_Cloud_Computing_Security_Policy.pdf
PM-3	Information Security and Privacy Resources	Aligned	1.5 ROLES & RESPONSIBILITIES...	20.0_IS_Risk_Management_Policy_2.pdf
PM-30	Supply Chain Risk Management Strategy	Aligned	Supply Chain Risk Management...	6.1_IS_Data_Security_Standards.pdf
PM-30	Supply Chain Risk Management Strategy	Aligned	Supply Chain Risk Management \| Supply Chain Risk Management ...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PM-30	Supply Chain Risk Management Strategy	Aligned	Risk Management Performance...	20.0_IS_Risk_Management_Policy_2.pdf
PM-31	Continuous Monitoring Strategy Key Control	Aligned	Access Control \| Information Flow Enforcement, Access Contro...	6.1_IS_Data_Security_Standards.pdf
PM-31	Continuous Monitoring Strategy Key Control	Aligned	1.2 SYSTEM USE NOTIFICATION...	2.1_IS_Acceptable_Use_Standard.pdf
PM-31	Continuous Monitoring Strategy Key Control	Aligned	Continuous Vulnerability Management...	26.0_IS_Vulnerability_Management_Policy.pdf
PM-31	Continuous Monitoring Strategy Key Control	Aligned	1.2.1 General Network Security...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
PM-31	Continuous Monitoring Strategy Key Control	Aligned	Maintaining processes to track cybersecurity related risk ac...	20.0_IS_Risk_Management_Policy_2.pdf
PM-32	Purposing Key Control	Aligned	1.0 PURPOSE...	2.1_IS_Acceptable_Use_Standard.pdf
PM-32	Purposing Key Control	Aligned	Lazard System and Application Owners should prepare and reco...	19.0_IS_Cloud_Computing_Security_Policy.pdf
PM-4	Plan of Action and Milestones Process	Aligned	Assessment, Authorization & Monitoring \| Plan of Action & Mi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PM-4	Plan of Action and Milestones Process	Aligned	Program Management \| Plan of Action & Milestones Process...	26.0_IS_Vulnerability_Management_Policy.pdf
PM-4	Plan of Action and Milestones Process	Aligned	Risk Mitigator/Responder...	20.0_IS_Risk_Management_Policy_2.pdf
PM-5	System Inventory	Aligned	Inventory and Control of Enterprise Assets...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PM-5	System Inventory	Aligned	NIST SP 800-53 Rev 5...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PM-5	System Inventory	Aligned	Inventories of all hardware and software...	26.0_IS_Vulnerability_Management_Policy.pdf
PM-5	System Inventory	Aligned	Inventory & Control of Enterprise Assets...	7.0_IS_Asset_Management_Policy.pdf
PM-6	Measures of Performance	Aligned	Program Management \| Measures of Performance...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PM-6	Measures of Performance	Aligned	Develops policy, standards and guidelines and approves solut...	20.0_IS_Risk_Management_Policy_2.pdf
PM-6	Measures of Performance	Aligned	1.4.4 Risk Management Performance...	20.0_IS_Risk_Management_Policy_2.pdf
PM-7	Enterprise Architecture	Aligned	1.4 REQUIREMENT...	20.0_IS_Risk_Management_Policy_2.pdf
PM-8	Critical Infrastructure Plan	Aligned	Program Management \| Critical Infrastructure Plan...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PM-8	Critical Infrastructure Plan	Aligned	1.2 POLICY...	26.0_IS_Vulnerability_Management_Policy.pdf
PM-8	Critical Infrastructure Plan	Aligned	Protection Strategies and Policy Exceptions...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PM-8	Critical Infrastructure Plan	Aligned	Section p) and r)...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
PM-8	Critical Infrastructure Plan	Aligned	Section (b) and (c) regarding identifying threats and vulner...	3.0_IS_Information_Security_Policy_2.pdf
PM-8	Critical Infrastructure Plan	Aligned	Risk Assessment...	20.0_IS_Risk_Management_Policy_2.pdf
PM-9	Risk Management Strategy	Aligned	Program Management \| Risk Management Strategy...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PM-9	Risk Management Strategy	Aligned	Program Management \| Risk Management Strategy...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PM-9	Risk Management Strategy	Aligned	1.2 POLICY...	26.0_IS_Vulnerability_Management_Policy.pdf
PM-9	Risk Management Strategy	Aligned	Policy Exception Process...	7.1_IS_Asset_Management_Standard.pdf
PM-9	Risk Management Strategy	Aligned	Policy Exception Process...	7.2_IS_End_User_Device_Standard.pdf
PM-9	Risk Management Strategy	Aligned	Risk Policy...	3.0_IS_Information_Security_Policy_2.pdf
PM-9	Risk Management Strategy	Aligned	Information Security incidents that are investigated and ana...	20.0_IS_Risk_Management_Policy_2.pdf
PM-9	Risk Management Strategy	Aligned	Privacy risk assessments are used to prioritize the risks th...	7.0_IS_Asset_Management_Policy.pdf
PM-9	Risk Management Strategy	Aligned	Assets ownership and responsibilities...	7.0_IS_Asset_Management_Policy.pdf
PM-9	Risk Management Strategy	Aligned	Responsibilities for information security risk management ac...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PM-9	Risk Management Strategy	Aligned	Responsibilities for information security risk management ac...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PS-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	6.1_IS_Data_Security_Standards.pdf
PS-1	Policy and Procedures Key Control	Aligned	1.5 EXCEPTION...	2.1_IS_Acceptable_Use_Standard.pdf
PS-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
PS-1	Policy and Procedures Key Control	Aligned	Policy and Procedures for Security Controls...	26.0_IS_Vulnerability_Management_Policy.pdf
PS-1	Policy and Procedures Key Control	Aligned	Personnel security policy and procedures for the controls in...	6.0_IS_Data_Security_Policy_1.pdf
PS-1	Policy and Procedures Key Control	Aligned	Security responsibilities by employees under their supervisi...	5.0_IS_Human_Resource_Security_Policy_1.pdf
PS-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	7.1_IS_Asset_Management_Standard.pdf
PS-1	Policy and Procedures Key Control	Aligned	Personnel security policy and procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PS-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	7.2_IS_End_User_Device_Standard.pdf
PS-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
PS-1	Policy and Procedures Key Control	Aligned	Personnel security policy and procedures...	3.0_IS_Information_Security_Policy_2.pdf
PS-1	Policy and Procedures Key Control	Aligned	Personnel Security Policy and Procedures...	20.0_IS_Risk_Management_Policy_2.pdf
PS-1	Policy and Procedures Key Control	Aligned	Divisions & Functions are free to define and implement stron...	7.0_IS_Asset_Management_Policy.pdf
PS-1	Policy and Procedures Key Control	Aligned	EXCEPTION...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
PS-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
PS-1	Policy and Procedures Key Control	Aligned	Job Description and Security Roles and Responsibilities...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PS-1	Policy and Procedures Key Control	Aligned	Segregation of Duties and Compensating Controls...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PS-1	Policy and Procedures Key Control	Aligned	Contact with Authorities...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PS-2	Position Risk Designation Key Control	Aligned	Position risk designations reflect Office of Personnel Manag...	2.1_IS_Acceptable_Use_Standard.pdf
PS-2	Position Risk Designation Key Control	Aligned	2.1 Acceptable Use Standard and 8.0 Access Control Policy...	2.0_IS_Acceptable_Use_Policy.pdf
PS-2	Position Risk Designation Key Control	Aligned	Personnel Security \| Position Risk Designation...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PS-2	Position Risk Designation Key Control	Aligned	Position risk designations reflect Office of Personnel Manag...	6.0_IS_Data_Security_Policy_1.pdf
PS-2	Position Risk Designation Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
PS-2	Position Risk Designation Key Control	Aligned	Personnel Security \| Position Risk Designation...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PS-2	Position Risk Designation Key Control	Aligned	Personnel Security \| Position Risk Designation...	7.0_IS_Asset_Management_Policy.pdf
PS-2	Position Risk Designation Key Control	Aligned	Position risk designations reflect Office of Personnel Manag...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PS-3	Personnel Screening Key Control	Aligned	Personnel Security \| Personnel Screening...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PS-3	Personnel Screening Key Control	Aligned	Baseline security requirements should be established for dev...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PS-3	Personnel Screening Key Control	Aligned	Personnel Security \| Personnel Screening...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PS-3	Personnel Screening Key Control	Aligned	Human Resource Security...	3.0_IS_Information_Security_Policy_2.pdf
PS-3	Personnel Screening Key Control	Aligned	Personnel Security \| Personnel Screening...	7.0_IS_Asset_Management_Policy.pdf
PS-3	Personnel Screening Key Control	Aligned	Access Control \| Policy & Procedures...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PS-4	Personnel Termination Key Control	Aligned	1.9 LEAVING LAZARD...	5.0_IS_Human_Resource_Security_Policy_1.pdf
PS-4	Personnel Termination Key Control	Aligned	User accounts management upon employment status changes...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PS-4	Personnel Termination Key Control	Aligned	User accounts management upon termination...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PS-4	Personnel Termination Key Control	Aligned	User accounts management upon termination...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PS-4	Personnel Termination Key Control	Aligned	User accounts management upon termination...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PS-4	Personnel Termination Key Control	Aligned	20.5.2 Non-Compliance...	20.0_IS_Risk_Management_Policy_2.pdf
PS-4	Personnel Termination Key Control	Aligned	a) Managers / HR should ensure that all Lazard employees and...	7.0_IS_Asset_Management_Policy.pdf
PS-4	Personnel Termination Key Control	Aligned	c) In cases where an employee or external party User has kno...	7.0_IS_Asset_Management_Policy.pdf
PS-4	Personnel Termination Key Control	Aligned	Access rights to the Lazard information resources should be ...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
PS-5	Personnel Transfer Key Control	Aligned	LEAVING LAZARD...	5.0_IS_Human_Resource_Security_Policy_1.pdf
PS-5	Personnel Transfer Key Control	Aligned	Service Account: Upon termination of the service account own...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PS-6	Access Agreements	Aligned	User Consent and Acknowledgment...	2.0_IS_Acceptable_Use_Policy.pdf
PS-6	Access Agreements	Aligned	1.6 INFORMATION SECURITY AWARENESS...	5.0_IS_Human_Resource_Security_Policy_1.pdf
PS-6	Access Agreements	Aligned	Scope & Applicability...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
PS-6	Access Agreements	Aligned	The requirement to protect individual authenticators may be ...	7.0_IS_Asset_Management_Policy.pdf
PS-6	Access Agreements	Aligned	Other types of access agreements include nondisclosure agree...	7.0_IS_Asset_Management_Policy.pdf
PS-6	Access Agreements	Aligned	Acceptable Use of Assets...	7.0_IS_Asset_Management_Policy.pdf
PS-7	External Personnel Security Key Control	Aligned	This policy is applicable to all Lazard employees, contracto...	2.0_IS_Acceptable_Use_Policy.pdf
PS-7	External Personnel Security Key Control	Aligned	External entities using Lazard cloud services...	19.0_IS_Cloud_Computing_Security_Policy.pdf
PS-7	External Personnel Security Key Control	Aligned	Processes, structures, and internal control mechanisms for l...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PS-7	External Personnel Security Key Control	Aligned	Applicability...	6.0_IS_Data_Security_Policy_1.pdf
PS-7	External Personnel Security Key Control	Aligned	External Provider Management...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
PS-7	External Personnel Security Key Control	Aligned	Application Credential Management Policy...	3.0_IS_Information_Security_Policy_2.pdf
PS-7	External Personnel Security Key Control	Aligned	a) Managers / HR should ensure that all Lazard employees and...	7.0_IS_Asset_Management_Policy.pdf
PS-7	External Personnel Security Key Control	Aligned	Coordination and oversight of third-party relationships...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PS-8	Personnel Sanctions Key Control	Aligned	Disciplinary Actions for Policy Violations...	6.1_IS_Data_Security_Standards.pdf
PS-8	Personnel Sanctions Key Control	Aligned	1.6 ENFORCEMENT/COMPLIANCE...	2.1_IS_Acceptable_Use_Standard.pdf
PS-8	Personnel Sanctions Key Control	Aligned	1.18 ENFORCEMENT/COMPLIANCE...	2.0_IS_Acceptable_Use_Policy.pdf
PS-8	Personnel Sanctions Key Control	Aligned	Non-Compliance...	19.0_IS_Cloud_Computing_Security_Policy.pdf
PS-8	Personnel Sanctions Key Control	Aligned	ENFORCEMENT Non-Compliance...	6.0_IS_Data_Security_Policy_1.pdf
PS-8	Personnel Sanctions Key Control	Aligned	1.8 DISCIPLINARY PROCESS...	5.0_IS_Human_Resource_Security_Policy_1.pdf
PS-8	Personnel Sanctions Key Control	Aligned	Section discussing user liability and policy violations...	7.1_IS_Asset_Management_Standard.pdf
PS-8	Personnel Sanctions Key Control	Aligned	Disciplinary Actions for Policy Violations...	7.2_IS_End_User_Device_Standard.pdf
PS-8	Personnel Sanctions Key Control	Aligned	Violation of these policies by anyone other than an employee...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
PS-8	Personnel Sanctions Key Control	Aligned	1.7 ENFORCEMENT...	3.0_IS_Information_Security_Policy_2.pdf
PS-8	Personnel Sanctions Key Control	Aligned	Section 1.4 - Consequences for Violations...	7.0_IS_Asset_Management_Policy.pdf
PS-9	Position Descriptions Key Control	Aligned	Table 3 - Cloud Security Roles...	19.0_IS_Cloud_Computing_Security_Policy.pdf
PS-9	Position Descriptions Key Control	Aligned	Security responsibilities by employees under their supervisi...	5.0_IS_Human_Resource_Security_Policy_1.pdf
PS-9	Position Descriptions Key Control	Aligned	1.5 ROLES & RESPONSIBILITIES...	20.0_IS_Risk_Management_Policy_2.pdf
PS-9	Position Descriptions Key Control	Aligned	Personnel Security \| Position Descriptions...	7.0_IS_Asset_Management_Policy.pdf
PS-9	Position Descriptions Key Control	Aligned	Information Security Roles & Responsibilities...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PT-1	Policy and Procedures Key Control	Aligned	Control References...	6.1_IS_Data_Security_Standards.pdf
PT-1	Policy and Procedures Key Control	Aligned	1.5 EXCEPTION...	2.1_IS_Acceptable_Use_Standard.pdf
PT-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
PT-1	Policy and Procedures Key Control	Aligned	1.0 PURPOSE and 1.2 SCOPE & APPLICABILITY...	5.0_IS_Human_Resource_Security_Policy_1.pdf
PT-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	7.1_IS_Asset_Management_Standard.pdf
PT-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	7.2_IS_End_User_Device_Standard.pdf
PT-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy and the process for requesting exce...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
PT-1	Policy and Procedures Key Control	Aligned	1.0 PURPOSE...	3.0_IS_Information_Security_Policy_2.pdf
PT-1	Policy and Procedures Key Control	Aligned	Information Security incidents that are investigated and ana...	20.0_IS_Risk_Management_Policy_2.pdf
PT-1	Policy and Procedures Key Control	Aligned	EXCEPTION...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
PT-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PT-2	Authority to Process Personally Identifiable Information Key Control	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
PT-2	Authority to Process Personally Identifiable Information Key Control	Aligned	User Agreement on Data Management and Monitoring...	2.1_IS_Acceptable_Use_Standard.pdf
PT-2	Authority to Process Personally Identifiable Information Key Control	Aligned	Shareholders personal information such as Social Security Nu...	6.0_IS_Data_Security_Policy_1.pdf
PT-2	Authority to Process Personally Identifiable Information Key Control	Aligned	Internal and external audit reports....	6.0_IS_Data_Security_Policy_1.pdf
PT-2	Authority to Process Personally Identifiable Information Key Control	Aligned	All personal data that is not required solely for identifica...	6.0_IS_Data_Security_Policy_1.pdf
PT-3	Personally Identifiable Information Processing Purposes Key Control	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
PT-4	Consent	Aligned	User Consent and Monitoring Policy...	2.0_IS_Acceptable_Use_Policy.pdf
PT-5	Privacy Notice Key Control	Gap	Privacy notices help inform individuals about how their personally identifiable information is being... Critical Gap - Key Control Missing
PT-6	System of Records Notice	Gap	The PRIVACT requires that federal agencies publish a system of records notice in the Federal Registe...
PT-7	Specific Categories of Personally Identifiable Information Key Control	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
PT-7	Specific Categories of Personally Identifiable Information Key Control	Aligned	Shareholders personal information such as Social Security Nu...	6.0_IS_Data_Security_Policy_1.pdf
PT-8	Computer Matching Requirements	Gap	The PRIVACT establishes requirements for federal and non-federal agencies if they engage in a matchi...
RA-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy...	6.1_IS_Data_Security_Standards.pdf
RA-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
RA-1	Policy and Procedures Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
RA-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	7.1_IS_Asset_Management_Standard.pdf
RA-1	Policy and Procedures Key Control	Aligned	Risk Assessment Policy and Procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
RA-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	7.2_IS_End_User_Device_Standard.pdf
RA-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy and technical and organizational co...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
RA-1	Policy and Procedures Key Control	Aligned	Risk Policy...	3.0_IS_Information_Security_Policy_2.pdf
RA-1	Policy and Procedures Key Control	Aligned	Risk Policy...	3.0_IS_Information_Security_Policy_2.pdf
RA-1	Policy and Procedures Key Control	Aligned	Risk Policy...	3.0_IS_Information_Security_Policy_2.pdf
RA-1	Policy and Procedures Key Control	Aligned	Risk Policy...	3.0_IS_Information_Security_Policy_2.pdf
RA-1	Policy and Procedures Key Control	Aligned	Risk Policy...	3.0_IS_Information_Security_Policy_2.pdf
RA-1	Policy and Procedures Key Control	Aligned	Risk Policy...	3.0_IS_Information_Security_Policy_2.pdf
RA-1	Policy and Procedures Key Control	Aligned	Risk assessments completed for all organization events and p...	20.0_IS_Risk_Management_Policy_2.pdf
RA-1	Policy and Procedures Key Control	Aligned	1.4.1 RISK REGISTER...	20.0_IS_Risk_Management_Policy_2.pdf
RA-1	Policy and Procedures Key Control	Aligned	1.4 REQUIREMENT...	20.0_IS_Risk_Management_Policy_2.pdf
RA-1	Policy and Procedures Key Control	Aligned	Risk assessments completed for all organization events and p...	20.0_IS_Risk_Management_Policy_2.pdf
RA-1	Policy and Procedures Key Control	Aligned	Divisions & Functions are free to define and implement stron...	7.0_IS_Asset_Management_Policy.pdf
RA-1	Policy and Procedures Key Control	Aligned	EXCEPTION...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
RA-1	Policy and Procedures Key Control	Aligned	Incident Lifecycle...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
RA-1	Policy and Procedures Key Control	Aligned	Responsibilities for information security risk management ac...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
RA-10	Threat Hunting	Aligned	Incident Response \| Incident Handling...	19.1_IS_Cloud_Computing_Security_Standard.pdf
RA-10	Threat Hunting	Aligned	maintaining processes to track cybersecurity related risk ac...	20.0_IS_Risk_Management_Policy_2.pdf
RA-10	Threat Hunting	Aligned	Network Monitoring & Defense...	7.0_IS_Asset_Management_Policy.pdf
RA-2	Security Categorization	Aligned	Security categorization processes facilitate the development...	6.1_IS_Data_Security_Standards.pdf
RA-2	Security Categorization	Aligned	Classification of Information...	2.1_IS_Acceptable_Use_Standard.pdf
RA-2	Security Categorization	Aligned	Risk Assessment \| Security Categorization...	2.1_IS_Acceptable_Use_Standard.pdf
RA-2	Security Categorization	Aligned	2.1 Acceptable Use Standard...	2.0_IS_Acceptable_Use_Policy.pdf
RA-2	Security Categorization	Aligned	Risk assessments can also be conducted at various steps in t...	2.0_IS_Acceptable_Use_Policy.pdf
RA-2	Security Categorization	Aligned	Security categorization of information and systems guides th...	2.0_IS_Acceptable_Use_Policy.pdf
RA-2	Security Categorization	Aligned	Such analysis is conducted as part of security categorizatio...	2.0_IS_Acceptable_Use_Policy.pdf
RA-2	Security Categorization	Aligned	Security Categorization Process...	26.0_IS_Vulnerability_Management_Policy.pdf
RA-2	Security Categorization	Aligned	Assessment, Authorization & Monitoring...	6.0_IS_Data_Security_Policy_1.pdf
RA-2	Security Categorization	Aligned	1.0 PURPOSE...	6.0_IS_Data_Security_Policy_1.pdf
RA-2	Security Categorization	Aligned	Risk Assessment \| Risk Categorization...	6.0_IS_Data_Security_Policy_1.pdf
RA-2	Security Categorization	Aligned	Security categorization processes facilitate the development...	3.0_IS_Information_Security_Policy_2.pdf
RA-2	Security Categorization	Aligned	Network Monitoring & Defense...	7.0_IS_Asset_Management_Policy.pdf
RA-2	Security Categorization	Aligned	Risk Assessment \| Risk Categorization...	7.0_IS_Asset_Management_Policy.pdf
RA-2	Security Categorization	Aligned	Security Categorization...	7.0_IS_Asset_Management_Policy.pdf
RA-2	Security Categorization	Aligned	Risk Assessment \| Risk Categorization...	7.0_IS_Asset_Management_Policy.pdf
RA-3	Risk Assessment Key Control	Aligned	Risk assessments consider threats, vulnerabilities, likeliho...	2.0_IS_Acceptable_Use_Policy.pdf
RA-3	Risk Assessment Key Control	Aligned	Risk Assessment \| System Development Life Cycle...	19.1_IS_Cloud_Computing_Security_Standard.pdf
RA-3	Risk Assessment Key Control	Aligned	Vulnerability Ownership & Remediation Responsibility...	26.0_IS_Vulnerability_Management_Policy.pdf
RA-3	Risk Assessment Key Control	Aligned	Risk Assessment \| Risk Categorization...	6.0_IS_Data_Security_Policy_1.pdf
RA-3	Risk Assessment Key Control	Aligned	Risk Assessment...	20.0_IS_Risk_Management_Policy_2.pdf
RA-3	Risk Assessment Key Control	Aligned	Risk Assessment and Reporting...	20.0_IS_Risk_Management_Policy_2.pdf
RA-3	Risk Assessment Key Control	Aligned	Incident Lifecycle...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
RA-3	Risk Assessment Key Control	Aligned	Responsibilities for information security risk management ac...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Vulnerability monitoring includes scanning for patch levels;...	6.1_IS_Data_Security_Standards.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Vulnerability monitoring includes scanning for patch levels;...	2.0_IS_Acceptable_Use_Policy.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	The Information Security Team should periodically conduct a ...	19.0_IS_Cloud_Computing_Security_Policy.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Vulnerability monitoring includes scanning for patch levels;...	19.0_IS_Cloud_Computing_Security_Policy.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	The Information Security Team should periodically conduct a ...	19.0_IS_Cloud_Computing_Security_Policy.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	The Information Security Team should periodically conduct a ...	19.0_IS_Cloud_Computing_Security_Policy.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Vulnerability Monitoring and Scanning...	19.1_IS_Cloud_Computing_Security_Standard.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Technical compliance review...	19.1_IS_Cloud_Computing_Security_Standard.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Technical review of applications after operating platform ch...	19.1_IS_Cloud_Computing_Security_Standard.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Risk Assessment \| Vulnerability Monitoring & Scanning...	26.0_IS_Vulnerability_Management_Policy.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Automated vulnerability scans should be used to scan all ide...	26.0_IS_Vulnerability_Management_Policy.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	A.14.1.3 Protecting Application Services Transactions...	6.0_IS_Data_Security_Policy_1.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Vulnerability Monitoring...	3.0_IS_Information_Security_Policy_2.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Risk Assessment...	20.0_IS_Risk_Management_Policy_2.pdf
RA-5	Vulnerability Monitoring and Scanning	Aligned	Material Reactive Services...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
RA-6	Technical Surveillance Countermeasures Survey	Gap	A technical surveillance countermeasures survey is a service provided by qualified personnel to dete...
RA-7	Risk Response	Aligned	Detailed explanation of why the exception is necessary and D...	19.0_IS_Cloud_Computing_Security_Policy.pdf
RA-7	Risk Response	Aligned	Risk Assessment \| Risk Response...	19.1_IS_Cloud_Computing_Security_Standard.pdf
RA-7	Risk Response	Aligned	Detailed mitigation information, if available....	26.0_IS_Vulnerability_Management_Policy.pdf
RA-7	Risk Response	Aligned	Policy statement requiring the exception....	6.0_IS_Data_Security_Policy_1.pdf
RA-7	Risk Response	Aligned	Detailed explanation of why the exception is necessary and D...	5.0_IS_Human_Resource_Security_Policy_1.pdf
RA-7	Risk Response	Aligned	Information Security Incident Management and Risk Policy...	3.0_IS_Information_Security_Policy_2.pdf
RA-7	Risk Response	Aligned	Risk Management Performance...	20.0_IS_Risk_Management_Policy_2.pdf
RA-7	Risk Response	Aligned	Incident Lifecycle...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
RA-7	Risk Response	Aligned	Detailed mitigation information, if available....	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
RA-7	Risk Response	Aligned	Policy statement requiring the exception....	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
RA-8	Privacy Impact Assessments	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
RA-9	Criticality Analysis Key Control	Aligned	Criticality analysis is performed when an architecture or de...	6.1_IS_Data_Security_Standards.pdf
RA-9	Criticality Analysis Key Control	Aligned	Risk Assessment \| Criticality Analysis...	2.1_IS_Acceptable_Use_Standard.pdf
RA-9	Criticality Analysis Key Control	Aligned	Risk assessments can play an important role in control selec...	2.0_IS_Acceptable_Use_Policy.pdf
RA-9	Criticality Analysis Key Control	Aligned	Criticality analysis is performed when an architecture or de...	2.0_IS_Acceptable_Use_Policy.pdf
RA-9	Criticality Analysis Key Control	Aligned	Risk Assessment \| Criticality Analysis...	19.1_IS_Cloud_Computing_Security_Standard.pdf
RA-9	Criticality Analysis Key Control	Aligned	Assessment, Authorization & Monitoring...	6.0_IS_Data_Security_Policy_1.pdf
RA-9	Criticality Analysis Key Control	Aligned	Risk Assessment \| Risk Categorization...	6.0_IS_Data_Security_Policy_1.pdf
RA-9	Criticality Analysis Key Control	Aligned	Risk Assessment \| Criticality Analysis...	7.0_IS_Asset_Management_Policy.pdf
RA-9	Criticality Analysis Key Control	Aligned	Criticality Analysis...	7.0_IS_Asset_Management_Policy.pdf
RA-9	Criticality Analysis Key Control	Aligned	Risk Assessment \| Criticality Analysis...	7.0_IS_Asset_Management_Policy.pdf
SA-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	6.1_IS_Data_Security_Standards.pdf
SA-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.1_IS_Acceptable_Use_Standard.pdf
SA-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
SA-1	Policy and Procedures Key Control	Aligned	1.15 EXCEPTION...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SA-1	Policy and Procedures Key Control	Aligned	System and services acquisition policy and procedures...	26.0_IS_Vulnerability_Management_Policy.pdf
SA-1	Policy and Procedures Key Control	Aligned	1.12 EXCEPTION...	6.0_IS_Data_Security_Policy_1.pdf
SA-1	Policy and Procedures Key Control	Aligned	Policy exception process...	7.1_IS_Asset_Management_Standard.pdf
SA-1	Policy and Procedures Key Control	Aligned	System and services acquisition policy and procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SA-1	Policy and Procedures Key Control	Aligned	Section 1.5 - Policy Exceptions...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SA-1	Policy and Procedures Key Control	Aligned	Information Security and Service Delivery...	3.0_IS_Information_Security_Policy_2.pdf
SA-1	Policy and Procedures Key Control	Aligned	System Acquisition, Development and Maintenance...	3.0_IS_Information_Security_Policy_2.pdf
SA-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	20.0_IS_Risk_Management_Policy_2.pdf
SA-1	Policy and Procedures Key Control	Aligned	Divisions & Functions are free to define and implement stron...	7.0_IS_Asset_Management_Policy.pdf
SA-1	Policy and Procedures Key Control	Aligned	EXCEPTION...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
SA-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
SA-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SA-10	Developer Configuration Management Key Control	Aligned	2.1 Acceptable Use Standard and 8.0 Access Control Policy...	2.0_IS_Acceptable_Use_Policy.pdf
SA-10	Developer Configuration Management Key Control	Aligned	1.5 CLOUD SECURITY MANAGEMENT...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SA-10	Developer Configuration Management Key Control	Aligned	Secure Configuration of Enterprise Assets and Software...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SA-10	Developer Configuration Management Key Control	Aligned	Protecting Application Services Transactions...	6.0_IS_Data_Security_Policy_1.pdf
SA-10	Developer Configuration Management Key Control	Aligned	Configuration Management \| Policies & Procedures, Configurat...	3.0_IS_Information_Security_Policy_2.pdf
SA-10	Developer Configuration Management Key Control	Aligned	Configuration Management Activities...	7.0_IS_Asset_Management_Policy.pdf
SA-11	Developer Testing and Evaluation	Aligned	Developmental testing and evaluation confirms that the requi...	2.0_IS_Acceptable_Use_Policy.pdf
SA-11	Developer Testing and Evaluation	Aligned	Processes, procedures, and controls to safeguard Lazard’s en...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SA-11	Developer Testing and Evaluation	Aligned	The Information Security Team should periodically conduct a ...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SA-11	Developer Testing and Evaluation	Aligned	The Information Security Team should utilize specialized sof...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SA-11	Developer Testing and Evaluation	Aligned	Management of technical vulnerabilities...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SA-11	Developer Testing and Evaluation	Aligned	Protecting Application Services Transactions...	6.0_IS_Data_Security_Policy_1.pdf
SA-11	Developer Testing and Evaluation	Aligned	Configuration Management \| Policies & Procedures...	3.0_IS_Information_Security_Policy_2.pdf
SA-15	Development Process, Standards, and Tools Key Control	Aligned	System & Services Acquisition \| Developer Security & Privacy...	6.0_IS_Data_Security_Policy_1.pdf
SA-15	Development Process, Standards, and Tools Key Control	Aligned	Development tools and processes integrity...	3.0_IS_Information_Security_Policy_2.pdf
SA-16	Developer-provided Training	Aligned	Awareness & Training \| Role-based Training...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SA-16	Developer-provided Training	Aligned	Security Awareness Training Program responsibilities...	5.0_IS_Human_Resource_Security_Policy_1.pdf
SA-16	Developer-provided Training	Aligned	Security Awareness & Skills Training...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SA-17	Developer Security and Privacy Architecture and Design	Aligned	Section 2.1 Acceptable Use Standard and Access Control Polic...	2.0_IS_Acceptable_Use_Policy.pdf
SA-17	Developer Security and Privacy Architecture and Design	Aligned	System Acquisition, Development and Maintenance...	3.0_IS_Information_Security_Policy_2.pdf
SA-2	Allocation of Resources Key Control	Aligned	Security and privacy functional requirements are typically d...	2.0_IS_Acceptable_Use_Policy.pdf
SA-2	Allocation of Resources Key Control	Aligned	Cloud Security Management...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SA-2	Allocation of Resources Key Control	Aligned	CLOUD SECURITY MANAGEMENT...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SA-2	Allocation of Resources Key Control	Aligned	Technical and Organizational Controls...	26.0_IS_Vulnerability_Management_Policy.pdf
SA-2	Allocation of Resources Key Control	Aligned	The IT team should identify the security features and manage...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SA-2	Allocation of Resources Key Control	Aligned	System Acquisition, Development and Maintenance...	3.0_IS_Information_Security_Policy_2.pdf
SA-20	Customized Development of Critical Components Key Control	Aligned	2.1 Acceptable Use Standard and 8.0 Access Control Policy...	2.0_IS_Acceptable_Use_Policy.pdf
SA-20	Customized Development of Critical Components Key Control	Aligned	Access Control Policy...	2.0_IS_Acceptable_Use_Policy.pdf
SA-20	Customized Development of Critical Components Key Control	Aligned	Controls can be viewed as descriptions of the safeguards and...	2.0_IS_Acceptable_Use_Policy.pdf
SA-20	Customized Development of Critical Components Key Control	Aligned	Supply Chain Risk Management...	2.0_IS_Acceptable_Use_Policy.pdf
SA-20	Customized Development of Critical Components Key Control	Aligned	Management of technical vulnerabilities...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SA-21	Developer Screening Key Control	Aligned	Baseline security requirements should be established for dev...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SA-21	Developer Screening Key Control	Aligned	System & Services Acquisition \| Developer Screening...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SA-21	Developer Screening Key Control	Aligned	Access Control \| Policy & Procedures...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SA-22	Unsupported System Components Key Control	Aligned	h. A regular schedule will be developed for patching of all ...	26.0_IS_Vulnerability_Management_Policy.pdf
SA-22	Unsupported System Components Key Control	Aligned	i. System components and devices attached to the Lazard netw...	26.0_IS_Vulnerability_Management_Policy.pdf
SA-22	Unsupported System Components Key Control	Aligned	j. Patching should include updates to all operating systems ...	26.0_IS_Vulnerability_Management_Policy.pdf
SA-22	Unsupported System Components Key Control	Aligned	k. Other patches not designated as critical by the vendor sh...	26.0_IS_Vulnerability_Management_Policy.pdf
SA-22	Unsupported System Components Key Control	Aligned	u) There are cases where Lazard will allow external connecti...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SA-22	Unsupported System Components Key Control	Aligned	Support for system components includes software patches, fir...	3.0_IS_Information_Security_Policy_2.pdf
SA-23	Specialization Key Control	Aligned	Security features of network services include, but are not l...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SA-3	System Development Life Cycle Key Control	Aligned	CLOUD SECURITY MANAGEMENT...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SA-3	System Development Life Cycle Key Control	Aligned	CLOUD SECURITY MANAGEMENT...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SA-3	System Development Life Cycle Key Control	Aligned	Baseline security requirements should be established for dev...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SA-3	System Development Life Cycle Key Control	Aligned	Security mechanisms, service levels and management requireme...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SA-3	System Development Life Cycle Key Control	Aligned	System Acquisition, Development and Maintenance...	3.0_IS_Information_Security_Policy_2.pdf
SA-3	System Development Life Cycle Key Control	Aligned	1.4 REQUIREMENT...	20.0_IS_Risk_Management_Policy_2.pdf
SA-3	System Development Life Cycle Key Control	Aligned	System Development Life Cycle...	7.0_IS_Asset_Management_Policy.pdf
SA-3	System Development Life Cycle Key Control	Aligned	System Development Life Cycle Process...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
SA-3	System Development Life Cycle Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SA-4	Acquisition Process	Aligned	1.5 EXCEPTION...	2.1_IS_Acceptable_Use_Standard.pdf
SA-4	Acquisition Process	Aligned	Security and privacy functional requirements are typically d...	2.0_IS_Acceptable_Use_Policy.pdf
SA-4	Acquisition Process	Aligned	CLOUD SECURITY MANAGEMENT...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SA-4	Acquisition Process	Aligned	Management of technical vulnerabilities...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SA-4	Acquisition Process	Aligned	System & Services Acquisition \| Development Process, Standar...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SA-4	Acquisition Process	Aligned	System & Services Acquisition \| Development Process, Standar...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SA-4	Acquisition Process	Aligned	Technical and Organizational Controls...	26.0_IS_Vulnerability_Management_Policy.pdf
SA-4	Acquisition Process	Aligned	Security and privacy functional requirements are typically d...	6.0_IS_Data_Security_Policy_1.pdf
SA-4	Acquisition Process	Aligned	Security mechanisms, service levels and management requireme...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SA-4	Acquisition Process	Aligned	System Acquisition, Development and Maintenance...	3.0_IS_Information_Security_Policy_2.pdf
SA-4	Acquisition Process	Aligned	1.4 REQUIREMENT...	20.0_IS_Risk_Management_Policy_2.pdf
SA-4	Acquisition Process	Aligned	Control: SA-4...	7.0_IS_Asset_Management_Policy.pdf
SA-4	Acquisition Process	Aligned	EXCEPTION...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
SA-4	Acquisition Process	Aligned	1.1 SCOPE & APPLICABILITY...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SA-5	System Documentation	Aligned	1.12 GOVERNANCE...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SA-5	System Documentation	Aligned	System Documentation...	7.0_IS_Asset_Management_Policy.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	Control: SA-8: Systems security and privacy engineering prin...	2.0_IS_Acceptable_Use_Policy.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	CLOUD SECURITY MANAGEMENT...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	CLOUD SECURITY MANAGEMENT...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	The security engineering principles in SA-8 help individuals...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	Endpoint Security Device Management...	7.1_IS_Asset_Management_Standard.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	The IT team should identify the security features and manage...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	Control: SA-8...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	System Acquisition, Development and Maintenance...	3.0_IS_Information_Security_Policy_2.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	System Acquisition, Development and Maintenance...	3.0_IS_Information_Security_Policy_2.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	1.4 REQUIREMENT...	20.0_IS_Risk_Management_Policy_2.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	Security Engineering Principles...	7.0_IS_Asset_Management_Policy.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	Control: SA-8: Systems security and privacy engineering prin...	7.0_IS_Asset_Management_Policy.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	Security Engineering Principles...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	1.2 INFORMATION SECURITY ROLES & RESPONSIBILITIES...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SA-8	Security and Privacy Engineering Principles	Aligned	1.1 SCOPE & APPLICABILITY...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SA-9	External System Services Key Control	Aligned	High-Risk Technology Assets...	6.1_IS_Data_Security_Standards.pdf
SA-9	External System Services Key Control	Aligned	External entities using Lazard cloud services...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SA-9	External System Services Key Control	Aligned	Processes, structures, and internal control mechanisms for l...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SA-9	External System Services Key Control	Aligned	Supply Chain Risk Management \| Supplier Assessments & Review...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SA-9	External System Services Key Control	Aligned	Supply Chain Risk Management \| Supply Chain Controls & Proce...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SA-9	External System Services Key Control	Aligned	External Connections from System Vendors...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SA-9	External System Services Key Control	Aligned	Coordination and oversight of third-party relationships...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SC-1	Policy and Procedures	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	6.1_IS_Data_Security_Standards.pdf
SC-1	Policy and Procedures	Aligned	1.1 SCOPE & APPLICABILITY...	2.1_IS_Acceptable_Use_Standard.pdf
SC-1	Policy and Procedures	Aligned	1.2 SYSTEM USE NOTIFICATION...	2.1_IS_Acceptable_Use_Standard.pdf
SC-1	Policy and Procedures	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
SC-1	Policy and Procedures	Aligned	Mobile Device Policy, Teleworking, Security of Kit and Asset...	6.0_IS_Data_Security_Policy_1.pdf
SC-1	Policy and Procedures	Aligned	Security responsibilities by employees under their supervisi...	5.0_IS_Human_Resource_Security_Policy_1.pdf
SC-1	Policy and Procedures	Aligned	Policy Exception Process...	7.1_IS_Asset_Management_Standard.pdf
SC-1	Policy and Procedures	Aligned	System and Communications Protection Policy and Procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-1	Policy and Procedures	Aligned	Policy Exception Process...	7.2_IS_End_User_Device_Standard.pdf
SC-1	Policy and Procedures	Aligned	General Network Security & Management (Section 1.2.1) and Re...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-1	Policy and Procedures	Aligned	Communications Security...	3.0_IS_Information_Security_Policy_2.pdf
SC-1	Policy and Procedures	Aligned	Information Security incidents that are investigated and ana...	20.0_IS_Risk_Management_Policy_2.pdf
SC-1	Policy and Procedures	Aligned	Policy Exceptions and Implementation...	7.0_IS_Asset_Management_Policy.pdf
SC-1	Policy and Procedures	Aligned	EXCEPTION...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
SC-1	Policy and Procedures	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
SC-1	Policy and Procedures	Aligned	1.1 SCOPE & APPLICABILITY...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SC-10	Network Disconnect	Aligned	i. Appropriate interfaces are created to segregate Lazard’s ...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-10	Network Disconnect	Aligned	Network Infrastructure Management...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-10	Network Disconnect	Aligned	Devices that are Internet-facing and outside the Lazard fire...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-11	Trusted Path	Gap	Trusted paths are mechanisms by which users can communicate (using input devices such as keyboards) ...
SC-12	Cryptographic Key Establishment and Management	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-12	Cryptographic Key Establishment and Management	Aligned	Cryptographic Key Management and Establishment...	6.0_IS_Data_Security_Policy_1.pdf
SC-12	Cryptographic Key Establishment and Management	Aligned	Cryptography...	3.0_IS_Information_Security_Policy_2.pdf
SC-13	Cryptographic Protection	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-13	Cryptographic Protection	Aligned	Cryptographic Protection and Digital Certificates...	6.0_IS_Data_Security_Policy_1.pdf
SC-13	Cryptographic Protection	Aligned	Security features of network services include, but are not l...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-13	Cryptographic Protection	Aligned	Cryptography...	3.0_IS_Information_Security_Policy_2.pdf
SC-13	Cryptographic Protection	Aligned	Cryptography can be employed to support a variety of securit...	7.0_IS_Asset_Management_Policy.pdf
SC-15	Collaborative Computing Devices and Applications	Aligned	Network Controls...	6.0_IS_Data_Security_Policy_1.pdf
SC-16	Transmission of Security and Privacy Attributes Key Control	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
SC-16	Transmission of Security and Privacy Attributes Key Control	Aligned	Disseminating information about employees or lists of Lazard...	2.1_IS_Acceptable_Use_Standard.pdf
SC-16	Transmission of Security and Privacy Attributes Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
SC-16	Transmission of Security and Privacy Attributes Key Control	Aligned	Attributes aspects of an identity....	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-16	Transmission of Security and Privacy Attributes Key Control	Aligned	Shareholders personal information and all data classified as...	6.0_IS_Data_Security_Policy_1.pdf
SC-16	Transmission of Security and Privacy Attributes Key Control	Aligned	Access Control...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-16	Transmission of Security and Privacy Attributes Key Control	Aligned	Overview and Scope & Applicability...	7.2_IS_End_User_Device_Standard.pdf
SC-17	Public Key Infrastructure Certificates	Aligned	Discussion on digital certificates and their verification...	6.0_IS_Data_Security_Policy_1.pdf
SC-18	Mobile Code	Aligned	Procedures for preventing malware execution on endpoint devi...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SC-2	Separation of System and User Functionality	Aligned	1.11 USER ID & PASSWORD SECURITY...	2.0_IS_Acceptable_Use_Policy.pdf
SC-2	Separation of System and User Functionality	Aligned	segregated and access restricted to prevent inappropriate di...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-2	Separation of System and User Functionality	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
SC-2	Separation of System and User Functionality	Aligned	Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-2	Separation of System and User Functionality	Aligned	Section 6: Desktops and 1.1.3 Laptops...	7.2_IS_End_User_Device_Standard.pdf
SC-2	Separation of System and User Functionality	Aligned	Access Control \| Use of External Systems...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-20	Secure Name/Address Resolution Service (Authoritative Source) Key Control	Aligned	System & Communications Protection\| Secure Name/address Reso...	6.1_IS_Data_Security_Standards.pdf
SC-20	Secure Name/Address Resolution Service (Authoritative Source) Key Control	Aligned	System & Communications Protection \| Secure Name/Address Res...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-20	Secure Name/Address Resolution Service (Authoritative Source) Key Control	Aligned	System & Communications Protection \| Secure Name/Address Res...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-20	Secure Name/Address Resolution Service (Authoritative Source) Key Control	Aligned	System & Communications Protection \| Architecture and Provis...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-20	Secure Name/Address Resolution Service (Authoritative Source) Key Control	Aligned	Network Controls...	6.0_IS_Data_Security_Policy_1.pdf
SC-20	Secure Name/Address Resolution Service (Authoritative Source) Key Control	Aligned	System & Communications Protection\| Secure Name/address Reso...	6.0_IS_Data_Security_Policy_1.pdf
SC-20	Secure Name/Address Resolution Service (Authoritative Source) Key Control	Aligned	Network Infrastructure Management...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-20	Secure Name/Address Resolution Service (Authoritative Source) Key Control	Aligned	1.2.3 Network Segregation & Segmentation...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-21	Secure Name/Address Resolution Service (Recursive or Caching Resolver)	Aligned	System & Communications Protection \| Secure Name/Address Res...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-21	Secure Name/Address Resolution Service (Recursive or Caching Resolver)	Aligned	System & Communications Protection \| Secure Name/Address Res...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-21	Secure Name/Address Resolution Service (Recursive or Caching Resolver)	Aligned	System & Communications Protection \| Architecture and Provis...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-21	Secure Name/Address Resolution Service (Recursive or Caching Resolver)	Aligned	System & Communications Protection\| Secure Name/address Reso...	6.0_IS_Data_Security_Policy_1.pdf
SC-22	Architecture and Provisioning for Name/Address Resolution Service	Aligned	System & Communications Protection \| Secure Name/Address Res...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-22	Architecture and Provisioning for Name/Address Resolution Service	Aligned	System & Communications Protection \| Secure Name/Address Res...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-22	Architecture and Provisioning for Name/Address Resolution Service	Aligned	System & Communications Protection \| Architecture and Provis...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-22	Architecture and Provisioning for Name/Address Resolution Service	Aligned	System & Communications Protection\| Secure Name/address Reso...	6.0_IS_Data_Security_Policy_1.pdf
SC-22	Architecture and Provisioning for Name/Address Resolution Service	Aligned	1.2.3 Network Segregation & Segmentation...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-23	Session Authenticity	Gap	Protecting session authenticity addresses communications protection at the session level, not at the...
SC-24	Fail in Known State	Aligned	Information Security Aspects of Business Continuity Manageme...	3.0_IS_Information_Security_Policy_2.pdf
SC-24	Fail in Known State	Aligned	Recovery...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
SC-25	Thin Nodes	Aligned	The principle of least functionality provides that informati...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-26	Decoys	Aligned	Section 3 and Section 5...	2.1_IS_Acceptable_Use_Standard.pdf
SC-27	Platform-independent Applications	Aligned	Portability and Cloud Services...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	Data at rest* Required - Encrypt PII/NPI data element under ...	6.1_IS_Data_Security_Standards.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	Data at rest* Required - Encrypt PII/NPI data element under ...	6.1_IS_Data_Security_Standards.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	d. Each email gateway should utilize Lazard Information Secu...	26.0_IS_Vulnerability_Management_Policy.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	f. All files received over networks or from any external sto...	26.0_IS_Vulnerability_Management_Policy.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	Information at rest refers to the state of information when ...	6.0_IS_Data_Security_Policy_1.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	IT Asset (NEW) and other assets Retirement and Disposal...	7.1_IS_Asset_Management_Standard.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	10. Employees should take appropriate measures, whenever pos...	7.2_IS_End_User_Device_Standard.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	1.1.4 Smartphones, Mobile, and Other Wireless Devices...	7.2_IS_End_User_Device_Standard.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	Asset Management, Access Control, Cryptography, Operations S...	3.0_IS_Information_Security_Policy_2.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	PURPOSE...	20.0_IS_Risk_Management_Policy_2.pdf
SC-28	Protection of Information at Rest Key Control	Aligned	Access Control \| Security & Privacy Attributes...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SC-29	Heterogeneity	Aligned	1.2.1 General Network Security...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-3	Security Function Isolation	Aligned	Access Control \| Information Flow Enforcement, Access Contro...	6.1_IS_Data_Security_Standards.pdf
SC-3	Security Function Isolation	Aligned	Control: SC-3...	6.0_IS_Data_Security_Policy_1.pdf
SC-3	Security Function Isolation	Aligned	Access Control \| Use of External Systems...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-30	Concealment and Misdirection	Gap	Concealment and misdirection techniques can significantly reduce the targeting capabilities of adver...
SC-31	Covert Channel Analysis	Gap	Developers are in the best position to identify potential areas within systems that might lead to co...
SC-32	System Partitioning	Aligned	1.2.3 Network Segregation & Segmentation...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-34	Non-modifiable Executable Programs Key Control	Gap	The operating environment for a system contains the code that hosts applications, including operatin... Critical Gap - Key Control Missing
SC-35	External Malicious Code Identification	Aligned	Section 3 and Section 5...	2.1_IS_Acceptable_Use_Standard.pdf
SC-35	External Malicious Code Identification	Aligned	Procedures, supporting business processes, and technical mea...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SC-35	External Malicious Code Identification	Aligned	Policies and procedures should be established, and supportin...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-35	External Malicious Code Identification	Aligned	Section d, e, and f regarding email gateway virus protection...	26.0_IS_Vulnerability_Management_Policy.pdf
SC-36	Distributed Processing and Storage Key Control	Gap	Distributing processing and storage across multiple physical locations or logical domains provides a... Critical Gap - Key Control Missing
SC-37	Out-of-band Channels Key Control	Aligned	System & Communications Protection \| Out-of-Band Channels...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-37	Out-of-band Channels Key Control	Aligned	o) Modems and or any out of band management products that co...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-38	Operations Security	Aligned	System & Communications Protection\| Session Authenticity...	6.1_IS_Data_Security_Standards.pdf
SC-38	Operations Security	Aligned	System & Communications Protection\| Session Authenticity...	6.0_IS_Data_Security_Policy_1.pdf
SC-38	Operations Security	Aligned	Operations Security...	3.0_IS_Information_Security_Policy_2.pdf
SC-39	Process Isolation	Gap	Systems can maintain separate execution domains for each executing process by assigning each process...
SC-4	Information in Shared System Resources Key Control	Aligned	Section 6-10 regarding dissemination and unauthorized action...	2.1_IS_Acceptable_Use_Standard.pdf
SC-4	Information in Shared System Resources Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
SC-4	Information in Shared System Resources Key Control	Aligned	Data Destruction Procedures...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SC-4	Information in Shared System Resources Key Control	Aligned	Data Loss Prevention Mechanism...	6.0_IS_Data_Security_Policy_1.pdf
SC-4	Information in Shared System Resources Key Control	Aligned	Applicability...	5.0_IS_Human_Resource_Security_Policy_1.pdf
SC-4	Information in Shared System Resources Key Control	Aligned	IS Risk Management Policy...	20.0_IS_Risk_Management_Policy_2.pdf
SC-4	Information in Shared System Resources Key Control	Aligned	Responsibilities during a BC/DR event, test, or execution...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
SC-40	Wireless Link Protection	Aligned	Data Protection, Access Control Management, Network Infrastr...	6.0_IS_Data_Security_Policy_1.pdf
SC-40	Wireless Link Protection	Aligned	c. The following controls apply to wireless access points wi...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-40	Wireless Link Protection	Aligned	Section 10 and 11 regarding approved end-user devices and un...	7.2_IS_End_User_Device_Standard.pdf
SC-40	Wireless Link Protection	Aligned	Wireless Public Internet Connections (Section 1.2.6)...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-41	Port and I/O Device Access	Gap	Connection ports include Universal Serial Bus (USB), Thunderbolt, and Firewire (IEEE 1394). Input/ou...
SC-42	Sensor Capability and Data Key Control	Aligned	User agrees that designated staff can monitor his/her device...	2.1_IS_Acceptable_Use_Standard.pdf
SC-42	Sensor Capability and Data Key Control	Aligned	1.14 BRING YOUR OWN DEVICE (BYOD)...	2.0_IS_Acceptable_Use_Policy.pdf
SC-42	Sensor Capability and Data Key Control	Aligned	1.1.4 Smartphones, Mobile, and Other Wireless Devices...	7.2_IS_End_User_Device_Standard.pdf
SC-42	Sensor Capability and Data Key Control	Aligned	End-user Device Security Policy...	3.0_IS_Information_Security_Policy_2.pdf
SC-42	Sensor Capability and Data Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SC-43	Usage Restrictions Key Control	Aligned	Section 2 and VI. BYOD...	2.1_IS_Acceptable_Use_Standard.pdf
SC-43	Usage Restrictions Key Control	Aligned	1.3 ACCEPTABLE USE...	2.0_IS_Acceptable_Use_Policy.pdf
SC-43	Usage Restrictions Key Control	Aligned	segregated and access restricted to prevent inappropriate di...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-43	Usage Restrictions Key Control	Aligned	Mobile Device Policy...	6.0_IS_Data_Security_Policy_1.pdf
SC-43	Usage Restrictions Key Control	Aligned	Section 1.6 EXCEPTION...	7.1_IS_Asset_Management_Standard.pdf
SC-43	Usage Restrictions Key Control	Aligned	Section 1.2.2 Access to Networks and Network Services...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-43	Usage Restrictions Key Control	Aligned	Equipment and media containing confidential information shou...	7.2_IS_End_User_Device_Standard.pdf
SC-43	Usage Restrictions Key Control	Aligned	Section s) and t)...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-43	Usage Restrictions Key Control	Aligned	End-user Device Security Policy...	3.0_IS_Information_Security_Policy_2.pdf
SC-44	Detonation Chambers	Aligned	System & Communications Protection \| Detonation Chambers...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-45	System Time Synchronization	Gap	Time synchronization of system clocks is essential for the correct execution of many system services...
SC-46	Cross Domain Policy Enforcement Key Control	Aligned	Section 9 and 10 regarding equipment and media security and ...	7.2_IS_End_User_Device_Standard.pdf
SC-46	Cross Domain Policy Enforcement Key Control	Aligned	Section p) and q)...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-47	Alternate Communications Paths	Aligned	System & Communications Protection\| Out-of-Band Channels...	6.1_IS_Data_Security_Standards.pdf
SC-47	Alternate Communications Paths	Aligned	System & Communications Protection\| Alternate Communications...	6.1_IS_Data_Security_Standards.pdf
SC-47	Alternate Communications Paths	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
SC-48	Sensor Relocation Key Control	Aligned	1.2.1 General Network Security...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-48	Sensor Relocation Key Control	Aligned	Adversarial strategies during security events...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
SC-49	Hardware-enforced Separation and Policy Enforcement Key Control	Aligned	Access Control and User Management...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-49	Hardware-enforced Separation and Policy Enforcement Key Control	Aligned	1.6 EXCEPTION...	7.1_IS_Asset_Management_Standard.pdf
SC-49	Hardware-enforced Separation and Policy Enforcement Key Control	Aligned	EXCEPTION...	7.2_IS_End_User_Device_Standard.pdf
SC-49	Hardware-enforced Separation and Policy Enforcement Key Control	Aligned	1.2.3 Network Segregation & Segmentation...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-49	Hardware-enforced Separation and Policy Enforcement Key Control	Aligned	Divisions & Functions are free to define and implement stron...	7.0_IS_Asset_Management_Policy.pdf
SC-5	Denial-of-service Protection	Aligned	System & Communications Protection \| Denial of Service Prote...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-5	Denial-of-service Protection	Aligned	Network Infrastructure Management...	6.0_IS_Data_Security_Policy_1.pdf
SC-5	Denial-of-service Protection	Aligned	Security mechanisms, service levels and management requireme...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-5	Denial-of-service Protection	Aligned	Containment strategies for incidents...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
SC-50	Software-enforced Separation and Policy Enforcement Key Control	Aligned	Technical and Organizational Controls...	26.0_IS_Vulnerability_Management_Policy.pdf
SC-50	Software-enforced Separation and Policy Enforcement Key Control	Aligned	1.6 EXCEPTION...	7.1_IS_Asset_Management_Standard.pdf
SC-50	Software-enforced Separation and Policy Enforcement Key Control	Aligned	EXCEPTION...	7.2_IS_End_User_Device_Standard.pdf
SC-50	Software-enforced Separation and Policy Enforcement Key Control	Aligned	1.2.3 Network Segregation & Segmentation...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-50	Software-enforced Separation and Policy Enforcement Key Control	Aligned	Divisions & Functions may implement stronger security requir...	7.0_IS_Asset_Management_Policy.pdf
SC-50	Software-enforced Separation and Policy Enforcement Key Control	Aligned	EXCEPTION...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
SC-50	Software-enforced Separation and Policy Enforcement Key Control	Aligned	Exceptions to the policy should be approved by InfoSec in ad...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
SC-51	Hardware-based Protection	Gap	None....
SC-6	Resource Availability	Aligned	System & Communications Protection...	7.0_IS_Asset_Management_Policy.pdf
SC-7	Boundary Protection Key Control	Aligned	Network Controls...	6.1_IS_Data_Security_Standards.pdf
SC-7	Boundary Protection Key Control	Aligned	Control Name...	6.1_IS_Data_Security_Standards.pdf
SC-7	Boundary Protection Key Control	Aligned	Development of Lazard Internet sites and Internet activities...	2.0_IS_Acceptable_Use_Policy.pdf
SC-7	Boundary Protection Key Control	Aligned	System & Communications Protection \| Boundary Protection...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-7	Boundary Protection Key Control	Aligned	Control: SC-7...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-7	Boundary Protection Key Control	Aligned	Controls to prevent or detect the use of known or suspected ...	26.0_IS_Vulnerability_Management_Policy.pdf
SC-7	Boundary Protection Key Control	Aligned	All files received over networks or from any external storag...	26.0_IS_Vulnerability_Management_Policy.pdf
SC-7	Boundary Protection Key Control	Aligned	Network Infrastructure Management...	6.0_IS_Data_Security_Policy_1.pdf
SC-7	Boundary Protection Key Control	Aligned	Network Infrastructure Management...	6.0_IS_Data_Security_Policy_1.pdf
SC-7	Boundary Protection Key Control	Aligned	Network Controls...	6.0_IS_Data_Security_Policy_1.pdf
SC-7	Boundary Protection Key Control	Aligned	Access Control Policy...	5.0_IS_Human_Resource_Security_Policy_1.pdf
SC-7	Boundary Protection Key Control	Aligned	Access Control \| Policy & Procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-7	Boundary Protection Key Control	Aligned	i. Appropriate interfaces are created to segregate Lazard’s ...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SC-7	Boundary Protection Key Control	Aligned	Voice Communications Equipment Protection...	7.2_IS_End_User_Device_Standard.pdf
SC-7	Boundary Protection Key Control	Aligned	Network Monitoring and Defense...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-7	Boundary Protection Key Control	Aligned	Network Infrastructure Management...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-7	Boundary Protection Key Control	Aligned	Access Control \| Use of External Systems...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-7	Boundary Protection Key Control	Aligned	k) Information Security should explicitly authorize all netw...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-7	Boundary Protection Key Control	Aligned	Access Control \| Use of External Systems...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-7	Boundary Protection Key Control	Aligned	Access Control \| Use of External Systems...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-7	Boundary Protection Key Control	Aligned	Network and Firewall Security Policy...	3.0_IS_Information_Security_Policy_2.pdf
SC-7	Boundary Protection Key Control	Aligned	Network Controls...	7.0_IS_Asset_Management_Policy.pdf
SC-7	Boundary Protection Key Control	Aligned	Segregation in Networks...	7.0_IS_Asset_Management_Policy.pdf
SC-7	Boundary Protection Key Control	Aligned	Control: SC-8: Protecting the confidentiality and integrity ...	7.0_IS_Asset_Management_Policy.pdf
SC-7	Boundary Protection Key Control	Aligned	Discussion on various types of attacks and incidents related...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
SC-7	Boundary Protection Key Control	Aligned	Electronic Messaging...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SC-8	Transmission Confidentiality and Integrity Key Control	Aligned	Control Name...	6.1_IS_Data_Security_Standards.pdf
SC-8	Transmission Confidentiality and Integrity Key Control	Aligned	2.1 Acceptable Use Standard...	2.0_IS_Acceptable_Use_Policy.pdf
SC-8	Transmission Confidentiality and Integrity Key Control	Aligned	1.7 CLOUD SYSTEMS...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SC-8	Transmission Confidentiality and Integrity Key Control	Aligned	System & Communications Protection...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SC-8	Transmission Confidentiality and Integrity Key Control	Aligned	System & Communications Protection \| Protecting the confiden...	6.0_IS_Data_Security_Policy_1.pdf
SC-8	Transmission Confidentiality and Integrity Key Control	Aligned	System and Communications Protection...	6.0_IS_Data_Security_Policy_1.pdf
SC-8	Transmission Confidentiality and Integrity Key Control	Aligned	1.1.6 Telecommunications...	7.2_IS_End_User_Device_Standard.pdf
SC-8	Transmission Confidentiality and Integrity Key Control	Aligned	Security features of network services include, but are not l...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SC-8	Transmission Confidentiality and Integrity Key Control	Aligned	Communications Security...	3.0_IS_Information_Security_Policy_2.pdf
SC-8	Transmission Confidentiality and Integrity Key Control	Aligned	Control: SC-8: Protecting the confidentiality and integrity ...	7.0_IS_Asset_Management_Policy.pdf
SC-8	Transmission Confidentiality and Integrity Key Control	Aligned	Electronic Messaging...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SI-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy...	6.1_IS_Data_Security_Standards.pdf
SI-1	Policy and Procedures Key Control	Aligned	1.5 EXCEPTION...	2.1_IS_Acceptable_Use_Standard.pdf
SI-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	2.0_IS_Acceptable_Use_Policy.pdf
SI-1	Policy and Procedures Key Control	Aligned	1.15 EXCEPTION...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SI-1	Policy and Procedures Key Control	Aligned	System and Information Integrity Policy and Procedures...	26.0_IS_Vulnerability_Management_Policy.pdf
SI-1	Policy and Procedures Key Control	Aligned	1.12 EXCEPTION...	6.0_IS_Data_Security_Policy_1.pdf
SI-1	Policy and Procedures Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
SI-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	7.1_IS_Asset_Management_Standard.pdf
SI-1	Policy and Procedures Key Control	Aligned	System and information integrity policy and procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SI-1	Policy and Procedures Key Control	Aligned	Policy Exception Process...	7.2_IS_End_User_Device_Standard.pdf
SI-1	Policy and Procedures Key Control	Aligned	Section 1.5 - Exceptions to the policy...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SI-1	Policy and Procedures Key Control	Aligned	Data Security – Establishes controls and framework for class...	3.0_IS_Information_Security_Policy_2.pdf
SI-1	Policy and Procedures Key Control	Aligned	II. Lazard understands that information security is critical...	3.0_IS_Information_Security_Policy_2.pdf
SI-1	Policy and Procedures Key Control	Aligned	III. Lazard should ensure that applicable regulatory, legisl...	3.0_IS_Information_Security_Policy_2.pdf
SI-1	Policy and Procedures Key Control	Aligned	IV. Lazard should strive to provide a secure working environ...	3.0_IS_Information_Security_Policy_2.pdf
SI-1	Policy and Procedures Key Control	Aligned	VI. Lazard should develop a detailed set of policies, on a r...	3.0_IS_Information_Security_Policy_2.pdf
SI-1	Policy and Procedures Key Control	Aligned	Information Security incidents that are investigated and ana...	20.0_IS_Risk_Management_Policy_2.pdf
SI-1	Policy and Procedures Key Control	Aligned	Divisions & Functions are free to define and implement stron...	7.0_IS_Asset_Management_Policy.pdf
SI-1	Policy and Procedures Key Control	Aligned	EXCEPTION...	27.0_IS_Lazard_Reference_Timeout_Standard.pdf
SI-1	Policy and Procedures Key Control	Aligned	System and information integrity policy and procedures...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
SI-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy...	16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf
SI-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SI-10	Information Input Validation	Aligned	Data Owners are ultimately responsible for the integrity of ...	6.0_IS_Data_Security_Policy_1.pdf
SI-11	Error Handling	Gap	Organizations consider the structure and content of error messages. The extent to which systems can ...
SI-12	Information Management and Retention	Aligned	Disposal (in accordance with Retention Policy)...	6.1_IS_Data_Security_Standards.pdf
SI-12	Information Management and Retention	Aligned	Classification of Information...	2.1_IS_Acceptable_Use_Standard.pdf
SI-12	Information Management and Retention	Aligned	An exit strategy for recovering, transferring, or destroying...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SI-12	Information Management and Retention	Aligned	Data retention policies are driven by legal and regulatory r...	6.0_IS_Data_Security_Policy_1.pdf
SI-12	Information Management and Retention	Aligned	Information management and retention requirements cover the ...	5.0_IS_Human_Resource_Security_Policy_1.pdf
SI-12	Information Management and Retention	Aligned	Information management and retention requirements...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SI-12	Information Management and Retention	Aligned	The protection of data against unintentional, unlawful, or u...	3.0_IS_Information_Security_Policy_2.pdf
SI-12	Information Management and Retention	Aligned	1.0 PURPOSE...	20.0_IS_Risk_Management_Policy_2.pdf
SI-12	Information Management and Retention	Aligned	1.2.2 Asset Disposal & Re-Use...	7.0_IS_Asset_Management_Policy.pdf
SI-12	Information Management and Retention	Aligned	Control: SI-12...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SI-13	Predictable Failure Prevention Key Control	Aligned	Configuration Management \| System Component Inventory...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SI-14	Non-persistence	Aligned	h. A regular schedule will be developed for patching of all ...	26.0_IS_Vulnerability_Management_Policy.pdf
SI-14	Non-persistence	Aligned	Data Protection...	6.0_IS_Data_Security_Policy_1.pdf
SI-14	Non-persistence	Aligned	Access Control \| Use of External Systems...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SI-15	Information Output Filtering	Gap	Certain types of attacks, including SQL injections, produce output results that are unexpected or in...
SI-16	Memory Protection	Aligned	Procedures to prevent malware execution...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SI-16	Memory Protection	Aligned	Policies and procedures should be established, and supportin...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SI-17	Fail-safe Procedures Key Control	Gap	Failure conditions include the loss of communications among critical system components or between sy... Critical Gap - Key Control Missing
SI-18	Personally Identifiable Information Quality Operations Key Control	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
SI-18	Personally Identifiable Information Quality Operations Key Control	Aligned	Shareholders personal information such as Social Security Nu...	6.0_IS_Data_Security_Policy_1.pdf
SI-18	Personally Identifiable Information Quality Operations Key Control	Aligned	All data classified as production, including all customer in...	6.0_IS_Data_Security_Policy_1.pdf
SI-18	Personally Identifiable Information Quality Operations Key Control	Aligned	Internal and external audit reports....	6.0_IS_Data_Security_Policy_1.pdf
SI-18	Personally Identifiable Information Quality Operations Key Control	Aligned	Regulatory agency reports, unless specified by the regulator...	6.0_IS_Data_Security_Policy_1.pdf
SI-18	Personally Identifiable Information Quality Operations Key Control	Aligned	Reports produced by Information Security Data (e.g., vulnera...	6.0_IS_Data_Security_Policy_1.pdf
SI-18	Personally Identifiable Information Quality Operations Key Control	Aligned	Data such as balance sheet and profit and loss figures, Laza...	6.0_IS_Data_Security_Policy_1.pdf
SI-18	Personally Identifiable Information Quality Operations Key Control	Aligned	All personal data that is not required solely for identifica...	6.0_IS_Data_Security_Policy_1.pdf
SI-18	Personally Identifiable Information Quality Operations Key Control	Aligned	The accuracy, completeness, and quality of data as it is mai...	3.0_IS_Information_Security_Policy_2.pdf
SI-19	De-identification	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
SI-19	De-identification	Aligned	The protection of data against unintentional, unlawful, or u...	3.0_IS_Information_Security_Policy_2.pdf
SI-2	Flaw Remediation Key Control	Aligned	Management of technical vulnerabilities...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SI-2	Flaw Remediation Key Control	Aligned	Reporting information security weaknesses...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SI-2	Flaw Remediation Key Control	Aligned	Technical review of applications after operating platform ch...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SI-2	Flaw Remediation Key Control	Aligned	Compliance with security policies and standards...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SI-2	Flaw Remediation Key Control	Aligned	Flaw Remediation and Software Updates...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SI-2	Flaw Remediation Key Control	Aligned	System & Information Integrity \| Flaw Remediation...	26.0_IS_Vulnerability_Management_Policy.pdf
SI-2	Flaw Remediation Key Control	Aligned	b. All Information Resources should be scanned on a regular ...	26.0_IS_Vulnerability_Management_Policy.pdf
SI-2	Flaw Remediation Key Control	Aligned	e. Global software updates and configuration changes applied...	26.0_IS_Vulnerability_Management_Policy.pdf
SI-2	Flaw Remediation Key Control	Aligned	f. Verification of successful software update deployment wil...	26.0_IS_Vulnerability_Management_Policy.pdf
SI-2	Flaw Remediation Key Control	Aligned	g. All system components and software should be protected fr...	26.0_IS_Vulnerability_Management_Policy.pdf
SI-2	Flaw Remediation Key Control	Aligned	Operating system and system software patches relating to sec...	7.2_IS_End_User_Device_Standard.pdf
SI-2	Flaw Remediation Key Control	Aligned	Software/Applications...	7.0_IS_Asset_Management_Policy.pdf
SI-2	Flaw Remediation Key Control	Aligned	Recovery and Post-incident Activity...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
SI-20	Tainting	Aligned	Section 1.5 ORGANIZATIONALY OWNED & MANAGED INFO SYSTEMS & A...	2.0_IS_Acceptable_Use_Policy.pdf
SI-20	Tainting	Aligned	Processes, procedures, and controls to safeguard Lazard’s en...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SI-20	Tainting	Aligned	Controls to prevent or detect the use of known or suspected ...	26.0_IS_Vulnerability_Management_Policy.pdf
SI-20	Tainting	Aligned	Each email gateway should utilize Lazard Information Securit...	26.0_IS_Vulnerability_Management_Policy.pdf
SI-20	Tainting	Aligned	All files received over networks or from any external storag...	26.0_IS_Vulnerability_Management_Policy.pdf
SI-20	Tainting	Aligned	d) A data loss prevention (DLP) mechanism should be implemen...	6.0_IS_Data_Security_Policy_1.pdf
SI-20	Tainting	Aligned	1.8 DISCIPLINARY PROCESS...	5.0_IS_Human_Resource_Security_Policy_1.pdf
SI-20	Tainting	Aligned	Data Security – Establishes controls and framework for class...	3.0_IS_Information_Security_Policy_2.pdf
SI-20	Tainting	Aligned	Cyber Security Incident Response Framework...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
SI-21	Information Refresh	Aligned	Data Disposal and Exit Strategy...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SI-21	Information Refresh	Aligned	Data Governance...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SI-21	Information Refresh	Aligned	Data retention policies...	6.0_IS_Data_Security_Policy_1.pdf
SI-22	Information Diversity Key Control	Aligned	Data Owners are ultimately responsible for the integrity of ...	6.0_IS_Data_Security_Policy_1.pdf
SI-22	Information Diversity Key Control	Aligned	Recovery Plan of Action...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
SI-23	Information Fragmentation	Aligned	Handling requirements for the following shall be developed a...	6.1_IS_Data_Security_Standards.pdf
SI-23	Information Fragmentation	Aligned	Applicability...	5.0_IS_Human_Resource_Security_Policy_1.pdf
SI-3	Malicious Code Protection	Aligned	Section 3: Activities that could introduce malicious code...	2.1_IS_Acceptable_Use_Standard.pdf
SI-3	Malicious Code Protection	Aligned	The Information Security Team should utilize specialized sof...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SI-3	Malicious Code Protection	Aligned	Procedures, supporting business processes, and technical mea...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SI-3	Malicious Code Protection	Aligned	Policies and procedures should be established, and supportin...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SI-3	Malicious Code Protection	Aligned	d. Each email gateway should utilize Lazard Information Secu...	26.0_IS_Vulnerability_Management_Policy.pdf
SI-3	Malicious Code Protection	Aligned	f. All files received over networks or from any external sto...	26.0_IS_Vulnerability_Management_Policy.pdf
SI-3	Malicious Code Protection	Aligned	g. Every virus that is not automatically cleaned by the viru...	26.0_IS_Vulnerability_Management_Policy.pdf
SI-3	Malicious Code Protection	Aligned	The protection of data against unintentional, unlawful, or u...	3.0_IS_Information_Security_Policy_2.pdf
SI-3	Malicious Code Protection	Aligned	Malicious code protection mechanisms include both signature-...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
SI-4	System Monitoring	Aligned	System & Information Integrity \| System Monitoring...	6.1_IS_Data_Security_Standards.pdf
SI-4	System Monitoring	Aligned	1.2 SYSTEM USE NOTIFICATION...	2.1_IS_Acceptable_Use_Standard.pdf
SI-4	System Monitoring	Aligned	2.1 Acceptable Use Standard...	2.0_IS_Acceptable_Use_Policy.pdf
SI-4	System Monitoring	Aligned	Incident Response \| Incident Monitoring...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SI-4	System Monitoring	Aligned	System & Information Integrity \| Malicious Code Protection...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SI-4	System Monitoring	Aligned	System & Information Integrity \| System Monitoring...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SI-4	System Monitoring	Aligned	A.14.1.3 Protecting Application Services Transactions...	6.0_IS_Data_Security_Policy_1.pdf
SI-4	System Monitoring	Aligned	System monitoring includes external and internal monitoring....	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SI-4	System Monitoring	Aligned	Overview and Scope & Applicability...	7.2_IS_End_User_Device_Standard.pdf
SI-4	System Monitoring	Aligned	Access Control \| Use of External Systems...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SI-4	System Monitoring	Aligned	Network Controls...	7.0_IS_Asset_Management_Policy.pdf
SI-4	System Monitoring	Aligned	Network Monitoring & Defense...	7.0_IS_Asset_Management_Policy.pdf
SI-5	Security Alerts, Advisories, and Directives Key Control	Aligned	Situational guidance and formal declaration of a cybersecuri...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
SI-6	Security and Privacy Function Verification Key Control	Aligned	User Consent and Monitoring Policy...	2.0_IS_Acceptable_Use_Policy.pdf
SI-6	Security and Privacy Function Verification Key Control	Aligned	Incident Reporting and Response Process...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
SI-7	Software, Firmware, and Information Integrity Key Control	Aligned	System & Information Integrity \| System Monitoring...	6.1_IS_Data_Security_Standards.pdf
SI-7	Software, Firmware, and Information Integrity Key Control	Aligned	Installation of Software on User’s device....	2.1_IS_Acceptable_Use_Standard.pdf
SI-7	Software, Firmware, and Information Integrity Key Control	Aligned	Procedures, supporting business processes, and technical mea...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SI-7	Software, Firmware, and Information Integrity Key Control	Aligned	Changes to cloud security systems and procedures should be f...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SI-7	Software, Firmware, and Information Integrity Key Control	Aligned	c. Inventories of all hardware and software installed on the...	26.0_IS_Vulnerability_Management_Policy.pdf
SI-7	Software, Firmware, and Information Integrity Key Control	Aligned	d. Automated vulnerability scans should be used to scan all ...	26.0_IS_Vulnerability_Management_Policy.pdf
SI-7	Software, Firmware, and Information Integrity Key Control	Aligned	f. All vulnerabilities and their remediation progress should...	26.0_IS_Vulnerability_Management_Policy.pdf
SI-7	Software, Firmware, and Information Integrity Key Control	Aligned	Data Owners Responsibility for Data Integrity...	6.0_IS_Data_Security_Policy_1.pdf
SI-7	Software, Firmware, and Information Integrity Key Control	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
SI-7	Software, Firmware, and Information Integrity Key Control	Aligned	Software/Applications...	7.0_IS_Asset_Management_Policy.pdf
SI-7	Software, Firmware, and Information Integrity Key Control	Aligned	Discussion of various computer-related incidents and attacks...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
SI-8	Spam Protection Key Control	Aligned	Section 3 and Section 5 regarding unauthorized access and em...	2.1_IS_Acceptable_Use_Standard.pdf
SI-8	Spam Protection Key Control	Aligned	Section 7: Procedures, supporting business processes, and te...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SI-8	Spam Protection Key Control	Aligned	d. Each email gateway should utilize Lazard Information Secu...	26.0_IS_Vulnerability_Management_Policy.pdf
SI-8	Spam Protection Key Control	Aligned	i. Appropriate interfaces are created to segregate Lazard’s ...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SR-1	Policy and Procedures Key Control	Aligned	Exceptions to the policy...	6.1_IS_Data_Security_Standards.pdf
SR-1	Policy and Procedures Key Control	Aligned	Supply Chain Risk Management \| Supply Chain Risk Management ...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SR-1	Policy and Procedures Key Control	Aligned	Information security policy for supplier relationships...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SR-1	Policy and Procedures Key Control	Aligned	1.2 POLICY...	26.0_IS_Vulnerability_Management_Policy.pdf
SR-1	Policy and Procedures Key Control	Aligned	1.2.1 General Requirements...	26.0_IS_Vulnerability_Management_Policy.pdf
SR-1	Policy and Procedures Key Control	Aligned	Supply Chain Risk Management Policy and Procedures...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
SR-1	Policy and Procedures Key Control	Aligned	Supply chain risk management policy and procedures...	3.0_IS_Information_Security_Policy_2.pdf
SR-1	Policy and Procedures Key Control	Aligned	Risk Management Engagement...	20.0_IS_Risk_Management_Policy_2.pdf
SR-1	Policy and Procedures Key Control	Aligned	1.1 SCOPE & APPLICABILITY...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SR-10	Inspection of Systems or Components	Aligned	Access Control \| Information Flow Enforcement, Access Contro...	6.1_IS_Data_Security_Standards.pdf
SR-11	Component Authenticity	Gap	Sources of counterfeit components include manufacturers, developers, vendors, and contractors. Anti-...
SR-12	Component Disposal Key Control	Aligned	Supply Chain Risk Management...	6.1_IS_Data_Security_Standards.pdf
SR-12	Component Disposal Key Control	Aligned	Disposal (in accordance with Retention Policy)...	6.1_IS_Data_Security_Standards.pdf
SR-12	Component Disposal Key Control	Aligned	Supply Chain Risk Management...	6.1_IS_Data_Security_Standards.pdf
SR-12	Component Disposal Key Control	Aligned	User Data Management and Monitoring...	2.1_IS_Acceptable_Use_Standard.pdf
SR-12	Component Disposal Key Control	Aligned	Data Disposal Responsibilities...	19.0_IS_Cloud_Computing_Security_Policy.pdf
SR-12	Component Disposal Key Control	Aligned	Handling of Assets...	6.0_IS_Data_Security_Policy_1.pdf
SR-12	Component Disposal Key Control	Aligned	Disposal of Media...	6.0_IS_Data_Security_Policy_1.pdf
SR-12	Component Disposal Key Control	Aligned	IT Asset (NEW) and other assets Retirement and Disposal...	7.1_IS_Asset_Management_Standard.pdf
SR-12	Component Disposal Key Control	Aligned	1.2.2 Asset Disposal & Re-Use...	7.0_IS_Asset_Management_Policy.pdf
SR-2	Supply Chain Risk Management Plan Key Control	Aligned	Supply Chain Risk Management...	2.0_IS_Acceptable_Use_Policy.pdf
SR-2	Supply Chain Risk Management Plan Key Control	Aligned	Supply Chain Risk Management \| Supply Chain Risk Management ...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SR-2	Supply Chain Risk Management Plan Key Control	Aligned	Supply Chain Risk Management \| Supply Chain Controls & Proce...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SR-2	Supply Chain Risk Management Plan Key Control	Aligned	Supply Chain Risk Management \| Supply Chain Risk Management ...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SR-2	Supply Chain Risk Management Plan Key Control	Aligned	Monitoring and review of supplier services...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SR-2	Supply Chain Risk Management Plan Key Control	Aligned	Address security within supplier agreements...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SR-2	Supply Chain Risk Management Plan Key Control	Aligned	IT Asset Procurement...	7.1_IS_Asset_Management_Standard.pdf
SR-2	Supply Chain Risk Management Plan Key Control	Aligned	Supply Chain Risk Management...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SR-2	Supply Chain Risk Management Plan Key Control	Aligned	Risk Management...	20.0_IS_Risk_Management_Policy_2.pdf
SR-2	Supply Chain Risk Management Plan Key Control	Aligned	Information Security Policies for Supplier Relationships...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
SR-3	Supply Chain Controls and Processes Key Control	Aligned	Supply Chain Risk Management \| Supplier Assessments & Review...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SR-3	Supply Chain Controls and Processes Key Control	Aligned	Supply Chain Risk Management...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SR-3	Supply Chain Controls and Processes Key Control	Aligned	Monitoring and review of supplier services...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SR-4	Provenance Key Control	Gap	Every system and system component has a point of origin and may be changed throughout its existence.... Critical Gap - Key Control Missing
SR-5	Acquisition Strategies, Tools, and Methods Key Control	Aligned	Access Control \| Information Flow Enforcement...	6.1_IS_Data_Security_Standards.pdf
SR-5	Acquisition Strategies, Tools, and Methods Key Control	Aligned	Supply Chain Risk Management \| Acquisition Strategies, Tools...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SR-5	Acquisition Strategies, Tools, and Methods Key Control	Aligned	Managing changes to supplier services...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SR-6	Supplier Assessments and Reviews Key Control	Aligned	Information security policy for supplier relationships...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SR-6	Supplier Assessments and Reviews Key Control	Aligned	Network Security Management...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SR-7	Supply Chain Operations Security Key Control	Aligned	Access Control \| Information Flow Enforcement...	6.1_IS_Data_Security_Standards.pdf
SR-7	Supply Chain Operations Security Key Control	Aligned	Operations Security...	3.0_IS_Information_Security_Policy_2.pdf
SR-8	Notification Agreements Key Control	Aligned	Supply Chain Risk Management \| Supply Chain Risk Management ...	19.1_IS_Cloud_Computing_Security_Standard.pdf
SR-8	Notification Agreements Key Control	Aligned	Network Security Management...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
SR-8	Notification Agreements Key Control	Aligned	Incident Communication and Reporting...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
SR-9	Tamper Resistance and Detection	Aligned	Protection of data against unintentional, unlawful, or unaut...	3.0_IS_Information_Security_Policy_2.pdf
A.13.2.1	Information Transfer Policies & Procedures	Aligned	Any information that can be freely used and easily accessibl...	6.1_IS_Data_Security_Standards.pdf
A.13.2.1	Information Transfer Policies & Procedures	Aligned	Confidential data protection and information transfer...	6.1_IS_Data_Security_Standards.pdf
PR.IP-6	Data Protection	Aligned	Data Protection...	6.1_IS_Data_Security_Standards.pdf
PR.IP-6	Data Protection	Aligned	Data Protection...	6.1_IS_Data_Security_Standards.pdf
A.10.1.1	Policy on the Utilization of Cryptographic Controls	Aligned	Control Name...	6.1_IS_Data_Security_Standards.pdf
A.13.1.1	Network Controls	Aligned	Control Name...	6.1_IS_Data_Security_Standards.pdf
A.13.1.1	Network Controls	Aligned	Network Controls...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
AC-2g	Account Management	Aligned	1.2 SYSTEM USE NOTIFICATION...	2.1_IS_Acceptable_Use_Standard.pdf
AC-2(7)	Account Management - Monitoring	Aligned	1.2 SYSTEM USE NOTIFICATION...	2.1_IS_Acceptable_Use_Standard.pdf
AC-2(7)	Account Management - Monitoring	Aligned	Managers...	5.0_IS_Human_Resource_Security_Policy_1.pdf
CA-6(1)	Authorization of Information Exchanges	Aligned	1.7 CLOUD SYSTEMS...	19.0_IS_Cloud_Computing_Security_Policy.pdf
CA-6(1)	Authorization of Information Exchanges	Aligned	Joint authorization of the systems exchanging information...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PR.IP-2	Information Security Policies and Procedures	Aligned	Audit plans and business continuity planning...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PR.IP-2	Information Security Policies and Procedures	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PR.IP-2	Information Security Policies and Procedures	Aligned	Audit plans and business continuity planning...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PR.IP-2	Information Security Policies and Procedures	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PR.IP-2	Information Security Policies and Procedures	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
RS.RP-1	Response Planning	Aligned	Audit plans and business continuity planning...	19.1_IS_Cloud_Computing_Security_Standard.pdf
RS.RP-1	Response Planning	Aligned	Business continuity planning requirements...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PR.DS-8	Data Protection	Aligned	Policies and procedures should be established, and supportin...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PR.DS-8	Data Protection	Aligned	Policies and procedures should be established, and supportin...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PR.DS-8	Data Protection	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PR.DS-8	Data Protection	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PR.DS-8	Data Protection	Aligned	Policies and procedures should be established, and supportin...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PR.DS-8	Data Protection	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PR.DS-8	Data Protection	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PR.DS-8	Data Protection	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PR.IP-3	Configuration Management	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PR.IP-3	Configuration Management	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PR.IP-3	Configuration Management	Aligned	service-level expectations, and operational continuity requi...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PR.IP-7	Information Security Continuous Monitoring	Aligned	Audit plans and business continuity planning...	19.1_IS_Cloud_Computing_Security_Standard.pdf
PR.IP-7	Information Security Continuous Monitoring	Aligned	Configuration Management \| Configuration Change Control...	3.0_IS_Information_Security_Policy_2.pdf
PR.IP-7	Information Security Continuous Monitoring	Aligned	Continuous Vulnerability Management...	3.0_IS_Information_Security_Policy_2.pdf
A.17.1.1	Planning information security continuity	Aligned	Contingency Planning \| Contingency Plan...	19.1_IS_Cloud_Computing_Security_Standard.pdf
A.11.2.5	Physical Media Transfer	Aligned	Handling of Assets...	6.0_IS_Data_Security_Policy_1.pdf
AC-2(1)	Account Management	Aligned	The controls and control enhancements that are candidates fo...	6.0_IS_Data_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Policy...	5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Policy...	5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Policy...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Policy...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Policy...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access Control Policy...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.9.1.1	Access Control Policy	Aligned	Access to Networks & Network Services...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.9.1.2	Management of Privileged Access Rights	Aligned	Management of Privileged Access Rights...	5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.1.2	Management of Privileged Access Rights	Aligned	Access to Networks & Network Services...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.9.1.2	Management of Privileged Access Rights	Aligned	Access to Networks & Network Services...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.9.1.2	Management of Privileged Access Rights	Aligned	Access to Networks & Network Services...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.9.2.3	Information Access Restriction	Aligned	Information Access Restriction...	5.0_IS_Human_Resource_Security_Policy_1.pdf
A.9.2.3	Information Access Restriction	Aligned	Management of Privileged Access Rights...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.9.2.3	Information Access Restriction	Aligned	Management of Privileged Access Rights...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
PR.AT-2	Information Security Awareness, Education and Training	Aligned	Access Control \| Concurrent Session Control...	8.0_IS_Access_Control_Identity_Management_Policy_1.pdf
CM-6d	Configuration Monitoring	Aligned	1.2.1 General Network Security...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
PR.AC-5	Access Control Policy	Aligned	Access Control \| Use of External Systems...	23.0_IS_Network_and_Firewall_Security_Policy.pdf
AM-1	Asset Management Policy	Aligned	Asset Management...	3.0_IS_Information_Security_Policy_2.pdf
ID.GV-1	Data Protection	Aligned	The accuracy, completeness, and quality of data as it is mai...	3.0_IS_Information_Security_Policy_2.pdf
ID.RA-5	Continuous Vulnerability Management	Aligned	Risk Assessment...	20.0_IS_Risk_Management_Policy_2.pdf
PR.DS-5	Segregation of Duties	Aligned	Physical & Environmental Protection \| Asset Monitoring & Tra...	7.0_IS_Asset_Management_Policy.pdf
PR.DS-5	Segregation of Duties	Aligned	Qualified Personnel in System Development...	7.0_IS_Asset_Management_Policy.pdf
PR.DS-5	Segregation of Duties	Aligned	Access Control Policy...	7.0_IS_Asset_Management_Policy.pdf
CA-2(1)	Control Assessment	Aligned	Incident Lifecycle...	15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf
A.9.4.1	Information Access Restriction	Aligned	Information Access Restriction...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.9.4.1	Information Access Restriction	Aligned	Information Access Restriction...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf
A.9.4.1	Information Access Restriction	Aligned	Information Access Restriction...	4.0_IS_Organization_of_Information_Security_Policy_1.pdf

Document Content

Matched Section

AI Justification

The section discusses maintaining an inventory of software and applications used within the organization, which aligns with the control's focus on utilizing software inventory tools for documentation.

Document Content

7.2_IS_End_User_Device_Standard.pdf CIS

12 matches found

Document Content

Matched Section

Section: All Firm workstations and laptops should be inventoried for hardware and software on a regular basis.
Content: All Firm workstations and laptops should be inventoried for hardware and software on a regular basis. Automated tools should be used if possible and if available.

AI Justification

The text discusses the inventory of end-user devices and the requirement for regular inventory checks, aligning with the control's focus on maintaining an accurate inventory of assets.

Document Content

Matched Section

The text discusses the management of devices and the use of approved end-user devices, which aligns with securely managing enterprise assets.

Document Content

Matched Section

AI Justification

The section emphasizes the importance of controlling access to the network and ensuring only approved devices can connect, which is a key aspect of access control.

Document Content

Matched Section

AI Justification

The mention of Network Access Control (NAC) technology to monitor compliance directly relates to the control of network access.

Document Content

Matched Section

The text discusses the secure disposal of data and the responsibilities of the Cloud Service Provider in ensuring that Lazard data is removed and disposed of securely, which aligns with logging sensitive data access and disposal.

2.1_IS_Acceptable_Use_Standard.pdf CIS

3 matches found

Document Content

Matched Section

Section: Data Wiping and Removal Procedures
Content: User agrees that designated staff can, under certain circumstances, remotely copy, wipe, or otherwise remove all data from his or her personal device.

AI Justification

The text discusses the remote wiping or removal of data from personal devices, which aligns with the need to securely dispose of data as per the documented data management process.

Document Content

Matched Section

Section: DOCUMENT CLASSIFICATION
Content: DOCUMENT CLASSIFICATION Confidential

AI Justification

The chunk mentions 'DOCUMENT CLASSIFICATION' and the classification of the document as 'Confidential', which aligns with the establishment and maintenance of a data classification scheme.

Document Content

Matched Section

Section: User agrees that designated staff can, under certain circumstances, remotely copy, wipe, or otherwise remove all data from his or her personal device.
Content: User agrees that designated staff can, under certain circumstances, remotely copy, wipe, or otherwise remove all data from his or her personal device. This includes all personal data such as contact information, photos, and personal emails if the personal data is stored or processed by a Lazard managed application.

AI Justification

The text specifies that designated staff can remotely wipe data from personal devices under certain circumstances, which aligns with the control's intent to protect enterprise data on portable devices.

6.1_IS_Data_Security_Standards.pdf CIS

11 matches found

Document Content

Matched Section

Section: Use only Lazard managed equipment for business-related work; use of personal computers or personal email for business-related work is strictly prohibited.
Content: Use only Lazard managed equipment for business-related work; use of personal computers or personal email for business-related work is strictly prohibited.

AI Justification

The text emphasizes the use of Lazard managed equipment and the prohibition of personal computers for business-related work, which aligns with ensuring unauthorized software is not used.

Document Content

Matched Section

Section: Handling requirements for the following shall be developed and implemented in accordance with the information classification scheme adopted by Lazard
Content: Handling requirements for the following shall be developed and implemented in accordance with the information classification scheme adopted by Lazard: Activity Medium Procedure Public Internal Confidential Restricted Collection All Labelling All Collect only the information necessary to meet business objectives or fulfill Customer obligations. Return, discard, mask, or sanitize information that is not required to satisfy business needs. Verify and validate, with the information source, that the information being collected is reliable and relevant. Provide a description of the reason for collecting the information to the information source. If this changes, details of the change should be communicated to the information source. Label information with 'Internal', 'Confidential' or 'Restricted'. Applications should notify users during login that they are handling Confidential or Restricted data. File name should not indicate classification or sensitivity of the data.

AI Justification

The chunk discusses handling requirements and classification of data, which aligns with establishing and maintaining a data inventory.

Document Content

Matched Section

AI Justification

The section discusses the disposal of information and the requirement to securely erase or destroy electronic media, which aligns with data retention practices.

Document Content

Document Content

Matched Section

Section: Details on Encryption see section “Encryption requirements” below
Content: Store data on company-managed equipment (e.g., servers, encrypted laptops, etc.) or authorized business partner hosted systems.

AI Justification

The section discusses the importance of storing data securely, including the use of encryption for sensitive data on company-managed equipment and prohibits the use of unapproved public cloud storage.

Document Content

Matched Section

Section: Disposal (in accordance with Retention Policy)
Content: Delete files from all devices (e.g., laptops, mobile devices, USB drives, etc.) after no longer required to be retained, and place unnecessary paper documents in a shredding bin.

AI Justification

The text discusses the disposal of sensitive information, including placing unattended copies in a shredding bin and securely wiping electronic media, which aligns with logging access and disposal of sensitive data.

Document Content

Matched Section

AI Justification

The text discusses the need for a periodical review of standards and associated documents, which aligns with maintaining a documented secure configuration process.

Document Content

Matched Section

Section: Across High-Risk Technology Assets
Content: Across High-Risk Technology Assets Not required In absence of encryption, appropriate compensating controls approved by Information security should be implemented. High-Risk Technology Assets are (not exhaustive list)  Mobile end user devices such as laptops, tablets and smartphones  Portable (‘Removable’) media such as USB drives and CD/DVD  Backup Media  Internet  Wireless LAN / Bluetooth / Cellular Data  Public Cloud Services o Online, Multi-Tenant (i.e.: shared), elastic and scalable (i.e. pooled resource) technology services. o Infrastructure (i.e. IaaS), Platform (i.e. PaaS) and Application (i.e.: SaaS) o Includes Lazard direct use and third-party service providers. 1.4 MAINTAINANCE A periodical review for this standard and the associated core documents should be performed to identify and implement measures for improvement. The minimal interval for this review is annually from the date of last approval.

AI Justification

The text discusses the need for a documented process for high-risk technology assets, which aligns with maintaining secure configurations.

Document Content

Matched Section

14 matches found

Document Content

Document Content

Matched Section

Section: Inventories of all hardware and software installed on the corporate network should be established and maintained up to date.
Content: Inventories of all hardware and software installed on the corporate network should be established and maintained up to date. This includes devices and software that are both authorized or unauthorized.

AI Justification

The section discusses the establishment and maintenance of inventories of all hardware and software, which aligns with the need to identify assets and update the inventory regularly.

Document Content

Document Content

Matched Section

Section: Policy exceptions process
Content: In exceptional cases Divisions & Functions may implement a lower protection level to adequately address the related information security risk. In such cases, Lazard's policy exception process should be followed and applied.

AI Justification

The text discusses the process for requesting exceptions to security policies, which aligns with the need to manage unauthorized software through documented exceptions.

Document Content

Matched Section

Matched Section

Document Content

Matched Section

The text discusses maintaining a complete inventory of business-critical assets and implementing key management policies, which aligns with securely managing enterprise assets.

Document Content

Matched Section

Section: Policies and procedures should be established, and supporting business processes and technical measures implemented, for the use of encryption protocols for protection of sensitive data
Content: Policies and procedures should be established, and supporting business processes and technical measures implemented, for the use of encryption protocols for protection of sensitive data in storage (e.g., file servers, databases, and end-user workstations), data in use (memory), and data in transmission (e.g., system interfaces, over public networks, and electronic messaging) as per applicable legal, statutory, and regulatory compliance obligations.

AI Justification

The mention of encryption protocols for the protection of sensitive data aligns with data protection controls.

20.0_IS_Risk_Management_Policy_2.pdf CIS

0 matches found

No detailed analysis available for this document.

27.0_IS_Lazard_Reference_Timeout_Standard.pdf CIS

3 matches found

Document Content

Matched Section

AI Justification

The text discusses the process for requesting exceptions to the policy, which aligns with the requirement to manage unauthorized software through documented exceptions.

Document Content

Matched Section

Section: MAINTAINANCE
Content: A periodical review for this standard and the associated core documents should be performed to identify and implement measures for improvement. The minimal interval for this review is annually from the date of last approval.

AI Justification

The text discusses the need for a periodical review of standards and associated documents, which aligns with the requirement to review and update documentation annually as stated in control 3.1.

Document Content

Matched Section

Section: Working Sessions and INFORMATION SECURITY GOALS
Content: Information Security Risk from extending timeout is minimal because the screen lock of 15 minutes is still active for all workstations and enforced at the AD Level.

AI Justification

The text discusses the enforcement of a 15-minute screen lock for workstations, which aligns with the requirement for configuring automatic session locking after a defined period of inactivity.

6.1_IS_Data_Security_Standards.pdf NIST

106 matches found

Document Content

Matched Section

Section: Exceptions to the policy
Content: Exceptions to the policy should be approved by InfoSec in advance.

AI Justification

The text discusses the approval process for exceptions to the access control policy, which aligns with the need for documented policies and procedures regarding access control.

Document Content

Matched Section

The text discusses the need for policies and procedures regarding exceptions to security policies, which aligns with the requirements for audit and accountability.

Document Content

Matched Section

Section: Any information that can be freely used and easily accessible by anyone with no existing local, national, regulatory or legal restrictions on access or usage.
Content: Any information that can be freely used and easily accessible by anyone with no existing local, national, regulatory or legal restrictions on access or usage.

AI Justification

The mention of regulatory or legal restrictions on access and usage of information aligns with the need for policies regarding information transfer.

Document Content

Matched Section

The text discusses the approval process for exceptions to the policy, which relates to incident response procedures and the need for a structured approach to policy exceptions.

Document Content

Matched Section

AI Justification

The text discusses handling requirements and procedures for different classifications of information, which aligns with the concept of information spillage and the need for corrective actions based on classification.

Document Content

Matched Section

Section: Exceptions to the policy should be approved by InfoSec in advance.
Content: Exceptions to this policy can be requested by submitting a policy exception form in the ServiceNow portal. The request should contain the supporting information requested below, and should be approved by the Department Manager (not lower than director level) and the CISO or his/her designee.

AI Justification

The text discusses the need for policies and procedures related to maintenance and exceptions, emphasizing the importance of approval processes and adherence to security requirements.

Document Content

Matched Section

The text discusses the disposal and sanitization of both digital and non-digital media, including specific methods such as shredding and securely wiping electronic media, which aligns with the requirements of MP-6.

Document Content

Matched Section

Section: Management of Removable Media
Content: Media use protections also apply to mobile devices with information storage capabilities. In contrast to MP-2, which restricts user access to media, MP-7 restricts the use of certain types of media on systems, for example, restricting or prohibiting the use of flash drives or external hard disk drives.

AI Justification

The text discusses the restrictions and protections related to the use of various types of media, including portable storage devices, which aligns directly with the requirements of MP-7.

Document Content

Matched Section

Section: Handling of Assets | Management of Removable Media
Content: Handling of Assets Management of Removable Media

AI Justification

The chunk discusses the handling of assets, specifically focusing on the management of removable media and the processes involved in ensuring that information is not retrievable or reconstructable when media is released outside the organization.

Document Content

Matched Section

AI Justification

The text discusses the approval process for exceptions to the policy, which aligns with the need for established policies and procedures regarding physical and environmental protection.

The text discusses the need for protection of highly confidential business or personal information, which aligns with the concept of control baselines that address the protection needs of an organization.

Document Content

The chunk discusses handling requirements for information collection and emphasizes the importance of only collecting necessary information, which aligns with the control's focus on managing personally identifiable information (PII) to prevent unauthorized disclosure.

Document Content

Matched Section

Section: Supply Chain Risk Management
Content: An organization-wide supply chain risk management strategy includes an unambiguous expression of the supply chain risk appetite and tolerance for the organization, acceptable supply chain risk mitigation strategies or controls, a process for consistently evaluating and monitoring supply chain risk, approaches for implementing and communicating the supply chain risk management strategy, and the associated roles and responsibilities.

AI Justification

The text discusses the organization-wide supply chain risk management strategy, including risk appetite, mitigation strategies, and roles and responsibilities, which aligns with the control's requirements.

Document Content

The chunk discusses handling requirements for various categories of information, including the necessity to collect only what is needed and to label information according to its sensitivity, which aligns with the need for protections for personally identifiable information.

Document Content

Matched Section

The chunk discusses handling requirements and the importance of collecting only necessary information, which aligns with the principles of conducting a privacy impact assessment.

Document Content

Matched Section

Section: Criticality analysis is performed when an architecture or design is being developed, modified, or upgraded.
Content: Criticality analysis is performed when an architecture or design is being developed, modified, or upgraded. If such analysis is performed early in the system development life cycle, organizations may be able to modify the system design to reduce the critical nature of these components and functions, such as by adding redundancy or alternate paths into the system design.

AI Justification

The text discusses the importance of criticality analysis in identifying and prioritizing protection activities for system components, which aligns with the principles of risk assessment.

Document Content

Matched Section

AI Justification

The text discusses the need for policies and procedures regarding exceptions to security policies, which aligns with the control's focus on acquisition policies and procedures.

Document Content

The chunk discusses the protection of data at rest, specifically mentioning the need for encryption of sensitive information stored on technology assets.

Document Content

Matched Section

The text discusses managed interfaces, boundary protection, and the importance of restricting traffic to enhance security, which aligns with the SC-7 control.

Document Content

The chunk discusses various controls related to access and protection of systems, which aligns with the need for inspection of systems for tamper resistance.

Document Content

Matched Section

AI Justification

The text discusses the importance of supply chain OPSEC, which aligns with the control's focus on protecting critical information related to suppliers and potential suppliers.

2.1_IS_Acceptable_Use_Standard.pdf NIST

72 matches found

Document Content

Matched Section

Section: 1.5 EXCEPTION
Content: Exceptions to the policy should be approved by InfoSec in advance. The technical and organizational controls define minimum requirements for securing assets. Divisions & Functions are free to define and implement stronger security requirements and mechanisms if a higher protection level is necessary and they do not contradict the Policy.

AI Justification

The text discusses the importance of access control policies and procedures, including the process for exceptions, which aligns with the requirements of AC-1.

The text discusses monitoring user activity and ensuring appropriate usage of systems, which aligns with session auditing practices.

Document Content

Matched Section

AI Justification

The chunk discusses monitoring system activity to maintain security and ensure appropriate usage, which aligns with the control's focus on audit record review and analysis.

Document Content

Matched Section

AI Justification

The text discusses the importance of policies and procedures related to assessment, authorization, and monitoring, which aligns with the CA-1 control.

Document Content

The text discusses the necessity of having policies and procedures for incident response, including the management of exceptions and the roles involved in approving them.

Document Content

Matched Section

Document Content

Matched Section

Section: 1.11 DOCUMENT INFORMATION
Content: CONTACT(S): CONTACT DETAILS APPROVERS(S): Peter Keenan POSITION Chief Information Security Officer (CISO) DPO

AI Justification

The mention of the Chief Information Security Officer (CISO) aligns with the definition of the senior agency information security officer as outlined in control PM-2.

Document Content

Matched Section

AI Justification

The text discusses the importance of ongoing monitoring of controls and risks to support risk management decisions, which aligns with the continuous monitoring concept outlined in PM-31.

Document Content

Matched Section

Section: 1.2 SYSTEM USE NOTIFICATION
Content: Lazard should actively monitor the system and activity to maintain system security and availability and to ensure appropriate and legitimate usage.

AI Justification

The mention of monitoring user activity to ensure appropriate usage aligns with the account management control which includes monitoring user actions.

Document Content

Document Content

Matched Section

Section: User Agreement on Data Management and Monitoring
Content: User agrees that designated staff can, under certain circumstances, remotely copy, wipe, or otherwise remove all data from his or her personal device. This includes all personal data such as contact information, photos, and personal emails if the personal data is stored or processed by a Lazard managed application.

AI Justification

The chunk discusses the conditions under which personal data can be wiped or removed, which relates to the processing of personally identifiable information and the authority governing such actions.

Document Content

Document Content

Matched Section

Section: Disseminating information about employees or lists of Lazard employees and Disseminating internal or confidential organization documents.
Content: 6. Disseminating information about employees or lists of Lazard employees (including employees of Lazard subsidiaries), contractors, and customers to any third party unless required for a valid business purpose. 7. Disseminating internal or confidential organization documents or information to external entities, outside of Lazard unless required for a valid business purpose.

AI Justification

The chunk discusses the dissemination of information about employees and internal documents, which relates to the management of personally identifiable information and the implementation of access control policies.

Document Content

Matched Section

Section: Section 3 and Section 5
Content: 3. Visiting sites by “hacking” or other means, where access is restricted by the site owner or prohibited by applicable law. 5. Opening commercial email attachments on any email systems (e.g., Yahoo, Hotmail, Gmail, etc.) other than Lazard’s email system.

AI Justification

The chunk discusses activities that could lead to the discovery and potential execution of malicious code, aligning with the need for external malicious code identification techniques and the isolation measures required to protect organizational systems.

Document Content

Matched Section

The text discusses the importance of monitoring system activities to maintain security and ensure appropriate usage, which aligns with the objectives of SI-4.

Document Content

Matched Section

AI Justification

The mention of monitoring user activities to ensure appropriate usage aligns with the need for monitoring account activities.

Document Content

Matched Section

Section: Installation of Software on User’s device.
Content: User agrees to install required software on his/her device, including but not limited to, antivirus/antimalware, operating system upgrades, and software that accesses and collects data stored in a Lazard managed application.

AI Justification

The chunk discusses the installation and management of software on user devices, which relates to monitoring and preventing unauthorized changes.

Document Content

Section: 1.1 SCOPE & APPLICABILITY
Content: Lazard should define, document, implement, and maintain policies to control the access to and use of their information resources.

AI Justification

The text discusses the importance of defining, documenting, implementing, and maintaining policies to control access to and use of information resources, which aligns with the control's focus on managing access through attributes and data structures.

Document Content

Matched Section

Section: Rules and Standards for managing security for BYOD
Content: When using a personal device for work, the user should adhere to and be in compliance with all rules and controls outlined in this policy and its associated standard, Acceptable Use Standard.

AI Justification

The text discusses the rules and controls for using personal devices for work, which aligns with the requirements for managing mobile devices as outlined in AC-19.

Document Content

Matched Section

Document Content

Matched Section

Section: 1.1 SCOPE & APPLICABILITY
Content: Lazard should define, document, implement, and maintain policies to control the access to and use of their information resources.

AI Justification

The text discusses the need for policies to control access to and use of information resources, which aligns with the principles of information flow control.

Document Content

Matched Section

Document Content

Matched Section

AI Justification

The chunk discusses the importance of protecting information resources and outlines the responsibilities of employees regarding the use and access of information, which aligns with the need for system-level information protection and backup requirements.

Document Content

Matched Section

Section: 1.1 SCOPE & APPLICABILITY
Content: Lazard should define, document, implement, and maintain policies to control the access to and use of their information resources.

AI Justification

The text discusses the importance of defining, documenting, implementing, and maintaining policies to control access to and use of information resources, which aligns with the identification and authentication policy and procedures.

Document Content

Document Content

Matched Section

Section: 1.11 USER ID & PASSWORD SECURITY
Content: Each User should be aware that they are responsible for all transactions made under the authorization of his/her system account(s).

AI Justification

The requirements outlined for user IDs and the responsibilities of users align with the account management activities described in AC-2.

Document Content

Matched Section

AI Justification

The chunk discusses the importance of user IDs and passwords, emphasizing the responsibility of users to protect their passwords and the prohibition of sharing accounts, which aligns with the requirements for authenticators.

Document Content

Matched Section

Section: 1.11 USER ID & PASSWORD SECURITY
Content: A User should protect his/her password as outlined in the Acceptable Use Standards in order to further enhance security of Lazard’s Systems.

AI Justification

The section outlines user responsibilities regarding the protection of passwords and the consequences of disclosing them, which aligns with the control's focus on establishing rules for acceptable behavior.

Document Content

Document Content

Matched Section

Section: 1.1 SCOPE & APPLICABILITY
Content: Lazard should define, document, implement, and maintain policies to control the access to and use of their information resources.

Document Content

Matched Section

AI Justification

The text discusses user consent regarding the use of Lazard's systems, including the acknowledgment of monitoring and lack of privacy, which aligns with the principles of consent outlined in control PT-4.

Document Content

Matched Section

Section: 1.1 SCOPE & APPLICABILITY
Content: Lazard should define, document, implement, and maintain policies to control the access to and use of their information resources.

AI Justification

Document Content

Matched Section

The text references high-level security and privacy requirements, which are foundational to the allocation of resources as described in SA-2.

Document Content

Matched Section

Section: Controls can be viewed as descriptions of the safeguards and protection capabilities appropriate for achieving the particular security and privacy objectives of the organization.
Content: Controls can be viewed as descriptions of the safeguards and protection capabilities appropriate for achieving the particular security and privacy objectives of the organization and for reflecting the security and privacy requirements of stakeholders.

AI Justification

The text discusses the selection and implementation of controls, which aligns with the customization of development processes for critical components.

Document Content

Matched Section

Section: Control: SA-8: Systems security and privacy engineering principles are closely related to and implemented throughout the system development life cycle
Content: Control: SA-8: Systems security and privacy engineering principles are closely related to and implemented throughout the system development life cycle (see SA-3). Organizations can apply systems security and privacy engineering principles to new systems under development or to systems undergoing upgrades.

AI Justification

The text discusses the implementation of systems security and privacy engineering principles throughout the system development life cycle, which aligns directly with control SA-8.

Document Content

Matched Section

AI Justification

The text discusses the importance of defining, documenting, implementing, and maintaining policies to control access to and use of information resources, aligning with the need for a system and communications protection policy.

Document Content

The text discusses user consent and monitoring of systems, which relates to the transitional states and notifications of system usage.

Document Content

Matched Section

Section: Supply Chain Risk Management
Content: The dependence on products, systems, and services from external providers, as well as the nature of the relationships with those providers, present an increasing level of risk to an organization. Threat actions that may increase security or privacy risks include unauthorized production, the insertion or use of counterfeits, tampering, theft, insertion of malicious software and hardware, and poor manufacturing and development practices in the supply chain.

AI Justification

The text discusses the complexities and requirements of managing supply chain risks, which aligns directly with the control's focus on external providers and the associated risks.

Document Content

Matched Section

Document Content

Matched Section

Document Content

Matched Section

Section: Exit Strategy for Data Management
Content: An exit strategy for recovering, transferring, or destroying data should be defined in case the contract ends.

AI Justification

The exit strategy for recovering, transferring, or destroying data aligns with the need to protect system-level information and ensure secure data disposal.

Document Content

Matched Section

Section: The Information Security Team should enforce compliance with the Lazard IS 8.0 Access Control & Identity Management policy for accessing Lazard systems, networks, applications, and files implemented in cloud services.
Content: The Information Security Team should enforce compliance with the Lazard IS 8.0 Access Control & Identity Management policy for accessing Lazard systems, networks, applications, and files implemented in cloud services, both locally and remotely, including passwords and other cloud security access controls, to include authentication of Lazard and non-Lazard users.

AI Justification

The text discusses the enforcement of access control and identity management policies, which aligns with the identification and authentication requirements outlined in IA-2.

Document Content

Matched Section

The text discusses data destruction procedures and the need to destroy data in accordance with its classification, which aligns with the concept of downgrading media to ensure that sensitive information is not retrievable.

Document Content

Matched Section

AI Justification

The text discusses the governance of a Cloud Security Program based on NIST recommended security practices and defined security controls, which aligns with the concept of control baselines as a starting point for protection.

Document Content

Matched Section

Section: 1.12 GOVERNANCE
Content: Cloud security artifacts and system documentation are to be maintained with each business unit by the assigned system and Application Owners.

AI Justification

The mention of tailoring actions to manage risk in accordance with mission and business requirements aligns with the concept of control tailoring.

Document Content

Matched Section

The text discusses the establishment of governance policies and procedures for managing data, which aligns with the role of a Data Governance Body as described in PM-23.

Document Content

Matched Section

AI Justification

The text discusses governance of the Cloud Security Program by the Information Security Team, which aligns with the establishment of champions for information security and privacy.

Document Content

Document Content

Matched Section

Section: Non-Compliance
Content: Any User found to have violated any of these policies may be subject to disciplinary action, if such User is an employee, up to and including dismissal or termination of employment.

AI Justification

The text discusses disciplinary actions for policy violations, which aligns with the concept of organizational sanctions as described in PS-8.

Document Content

Matched Section

Section: Table 3 - Cloud Security Roles
Content: Application Owner Cloud Service Provider

AI Justification

The chunk discusses the roles of Application Owners and Cloud Service Providers, which aligns with the specification of security and privacy roles in organizational position descriptions.

Document Content

Matched Section

The text discusses the importance of establishing policies, conducting risk assessments, and utilizing specialized software to safeguard cloud environments, which aligns with the need for developmental testing and evaluation to ensure security controls are effective.

The procedures mentioned aim to prevent malware execution, which aligns with the need for identifying and isolating malicious code as described in SC-35.

Document Content

Matched Section

AI Justification

The text discusses the importance of data destruction procedures and the protection of data throughout its lifecycle, which aligns with the principles of preventing unauthorized information transfer and ensuring that residual information is properly managed.

Document Content

Document Content

Matched Section

Section: Secure data disposal should follow the Data Security Policy and Data Security Standard documents.
Content: Secure data disposal should follow the Data Security Policy and Data Security Standard documents.

AI Justification

The requirement for secure data disposal and the ability to provide information about data removal timelines aligns with the need to manage audit records effectively.

Document Content

Document Content

Matched Section

Document Content

Matched Section

AI Justification

The text discusses the establishment of user access policies and procedures, which aligns with the concept of access control decisions and the management of access to data.

Document Content

Matched Section

Section: Access Control Policies
Content: User access policies and procedures should be established, and supporting business processes and technical measures implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and customer (tenant) users with access to data.

AI Justification

The text discusses the establishment of user access policies and procedures, which aligns with the control's focus on controlling access to prevent inappropriate disclosure and tampering.

Document Content

Matched Section

AI Justification

The text discusses the importance of segregating access to prevent inappropriate disclosure and tampering, which aligns with the principle of separation of duties.

The text emphasizes the importance of maintaining an inventory of system components for accountability, which aligns with the objectives of PM-5.

Document Content

Matched Section

The text discusses the importance of maintaining an inventory of business-critical assets and the need for operational continuity, which aligns with the requirements for alternate storage sites to ensure data availability and business functions.

Document Content

Matched Section

AI Justification

The mention of encryption protocols for the protection of sensitive data in storage aligns with the control's focus on safeguarding data.

Document Content

Document Content

Matched Section

Section: User registration and de-registration, Management of secret authentication information of users, Use of secret authentication information, Secure logon procedures, Password management system, Privacy and protection of personal information
Content: User registration and de-registration Management of secret authentication information of users Use of secret authentication information Secure logon procedures Password management system Privacy and protection of personal information

AI Justification

The text discusses the importance of having policies and procedures for identification and authentication, which aligns directly with IA-1.

Document Content

Matched Section

AI Justification

The text emphasizes the need for procedures related to user identification and authentication, which is covered by IA-2.

The text discusses the use of encryption protocols for the protection of sensitive data in various states (storage, use, transmission), which aligns with data protection measures.

Document Content

Matched Section

AI Justification

The mention of maintaining an inventory of business-critical assets and their usage aligns with incident response planning and management.

Document Content

Matched Section

The text discusses the need for key management policies and identifiable ownership of keys, which aligns with the requirements for cryptographic key management.

Document Content

Matched Section

AI Justification

The mention of encryption protocols for the protection of sensitive data aligns with the data protection requirements.

Document Content

Matched Section

Section: Attributes aspects of an identity.
Content: attribute aspects of an identity. Attributes can be static (like an organizational unit) or highly dynamic (IP address, device being used, if the user authenticated with MFA, locations, etc. ).

AI Justification

The chunk discusses attributes of identity and their role in access control, which aligns with the definition of security and privacy attributes in SC-16.

Document Content

The control SC-21 focuses on the validation of name resolution services, which is directly addressed by the mention of secure name/address resolution services in the chunk.

Document Content

Matched Section

AI Justification

The control SC-21 also applies to recursive or caching resolvers, which are mentioned in the chunk.

Document Content

Matched Section

Document Content

Matched Section

Section: Policies and procedures should be established, and supporting business processes and technical measures implemented
Content: Policies and procedures should be established, and supporting business processes and technical measures implemented, to prevent the execution of malware on organizationally owned or managed user end-point devices (i.e., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

AI Justification

The chunk discusses the need for policies and procedures to prevent malware execution, which aligns with the control's focus on identifying and isolating malicious code.

Document Content

Matched Section

Section: System & Communications Protection | Out-of-Band Channels
Content: System & Communications Protection | Out-of-Band Channels

AI Justification

The chunk explicitly mentions 'Out-of-Band Channels' which aligns directly with the control SC-37 that discusses the use and characteristics of out-of-band channels.

The text discusses the importance of managing the lifecycle of organizational data, which aligns with the need to retain information only for the minimum period necessary to reduce risk exposure.

Document Content

Matched Section

AI Justification

The chunk discusses the establishment of policies and procedures to prevent malware execution, which aligns with the control's focus on protecting against malicious code.

The text discusses the importance of maintaining up-to-date inventories of hardware and software, which aligns with continuous monitoring practices to support risk management decisions.

Document Content

Matched Section

AI Justification

The mention of automated vulnerability scans aligns with the need for ongoing monitoring of systems to identify weaknesses.

Document Content

Matched Section

The mention of automated vulnerability scans aligns with the control's emphasis on identifying and preventing the use of prohibited functions and services.

The text discusses the importance of monitoring and controlling email gateways and scanning files for malware, which aligns with the need to monitor for unauthorized access and data exfiltration.

Document Content

Document Content

Matched Section

Section: g. Every virus that is not automatically cleaned by the virus protection software constitutes a security incident and should be reported to Lazard IT Support.
Content: g. Every virus that is not automatically cleaned by the virus protection software constitutes a security incident and should be reported to Lazard IT Support.

AI Justification

Reporting uncleaned viruses as security incidents aligns with the control's emphasis on managing and responding to malicious code threats.

Document Content

Document Content

Matched Section

Section: 1.2.1 General Requirements
Content: A vulnerability management plan should be developed and implemented to continuously assess and track vulnerabilities on all Lazard assets within the Lazard infrastructure, in order to remediate, and minimize the window of opportunity for attackers.

AI Justification

The mention of a vulnerability management plan aligns with the need for procedures that describe how policies or controls are implemented.

6.0_IS_Data_Security_Policy_1.pdf NIST

150 matches found

The text discusses data retention policies driven by legal and regulatory requirements, which aligns with the need to retain audit records for administrative, legal, audit, or operational purposes.

Document Content

Matched Section

AI Justification

The chunk discusses sensitive data characteristics and the implications of unauthorized disclosure, aligning with the control's focus on data leakage.

Document Content

Matched Section

AI Justification

The section discusses the protection of log information, which aligns with the need for coordinated audit logging across organizations as described in AU-16.

Document Content

Matched Section

The section discusses the establishment of controls to maintain the confidentiality, integrity, and non-repudiation of log information, which aligns with the requirements for audit record review and analysis.

Document Content

Matched Section

AI Justification

The section discusses the protection of log information, including confidentiality, integrity, and non-repudiation, which aligns with the requirements for audit information protection.

The text discusses the use of digital certificates, which are a form of authentication mechanism, to verify the identity of users and ensure they are authorized to perform actions.

Document Content

Matched Section

AI Justification

The text discusses the necessity of having policies and procedures for incident response, including the management of exceptions and the roles involved in approving such exceptions.

Document Content

The chunk discusses various aspects of physical access control, including the roles of employees and visitors, types of access controls, and compliance with laws and regulations.

Document Content

Matched Section

The text discusses the classification of information and the importance of applying appropriate security measures, which aligns with the requirements for controlled unclassified information as defined by PM-17.

Document Content

Matched Section

Section: Section ii to viii regarding personal and sensitive information.
Content: ii. Shareholders personal information such as Social Security Number (SSN), Date of Birth, and Bank Account Number. iii. All data classified as production, including all customer information when used in system testing or development environments. iv. Internal and external audit reports. v. Regulatory agency reports, unless specified by the regulatory agency as public data. vi. Reports produced by Information Security Data (e.g., vulnerability scan / penetration test report) that the Data Owner determines has potential for providing competitive advantage. vii. Data such as balance sheet and profit and loss figures, Lazard-owned holdings, country exposure, total exposure of major clients, general ledger accounts, legal files, and confidential reports. viii. All personal data that is not required solely for identification. This includes information regarding an individual′s:

AI Justification

The chunk discusses various types of personal and sensitive information, which aligns with the need for accounting of disclosures to ensure compliance with privacy regulations.

The chunk discusses various categories of personal information, including Social Security Numbers and other sensitive data, which aligns with the need for protections as outlined in PT-7.

Document Content

Matched Section

The text discusses the organization's policy on exceptions and the process for managing risks associated with those exceptions, which aligns with the control's focus on risk response options.

Document Content

Matched Section

The chunk discusses digital certificates, their components, and their verification process, which aligns with the description of PKI certificates.

Document Content

Matched Section

The text discusses the importance of verifying the integrity of data and implementing checks such as data type checks, range checks, and format checks, which align with the control's focus on validating system inputs.

Document Content

Matched Section

The text discusses the implementation of a data loss prevention mechanism to monitor and block sensitive information from being leaked, which aligns with the control's focus on protecting organizational information from exfiltration.

Document Content

Matched Section

Section: Data retention policies
Content: Data retention policies are driven by legal and regulatory requirements. The Data Owner should ensure that data is retained as it pertains to Global, Federal, State and Local statutes and regulations and/or requirements.

AI Justification

The text discusses data retention policies and the importance of adhering to legal and regulatory requirements, which aligns with the need to retain information only as long as necessary.

Document Content

Matched Section

AI Justification

The text discusses the integrity of data and the importance of verifying data accuracy, which aligns with the need to protect against corruption and ensure reliable information sources.

91 matches found

Document Content

Matched Section

Section: Access Control Policy
Content: Control: AC-1: Access control policy and procedures address the controls in the AC family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of access control policy and procedures.

AI Justification

The text discusses the importance of access control policies and procedures, their development, and the factors influencing them, which aligns with the requirements of AC-1.

Document Content

Matched Section

Section: 1.9 LEAVING LAZARD
Content: Access privileges of employees should be removed from all systems upon termination. Application Security Administrators (System Administrators) are responsible for disabling IDs in their respective applications.

AI Justification

The text discusses the removal of access privileges and the responsibilities of administrators to disable IDs upon employee termination, which aligns with the concept of session termination.

Document Content

Matched Section

AI Justification

The text discusses the creation and management of user accounts, including the approval process for access and the roles involved in managing permissions.

The text discusses the review and validation of security roles and responsibilities, which aligns with conducting impact analyses to understand the implications of changes in personnel roles on security.

Document Content

Matched Section

AI Justification

The policy emphasizes that individuals should only have access to the information they need, which aligns with access enforcement principles.

Document Content

Matched Section

AI Justification

The text discusses the need for individuals to understand their responsibilities and the conditions under which they can access information systems, which relates to the control's focus on authorized access and changes.

Document Content

Document Content

Matched Section

Section: 1.4 NEW HIRE IDS & PASSWORDS
Content: Identification and authentication requirements for non-organizational users are described in IA-8.

AI Justification

The mention of identification and authentication requirements for non-organizational users aligns with IA-8.

Document Content

Matched Section

AI Justification

The chunk discusses the management of IDs and passwords for new hires, which relates to the management of individual identifiers as mentioned in IA-4.

Document Content

The text mentions ensuring depth of expertise in critical functions to prevent disruption, which relates to contingency planning.

Document Content

Matched Section

Matched Section

AI Justification

The text discusses the responsibilities of employees and the importance of training, which aligns with the specification of security and privacy roles.

Document Content

Matched Section

The text emphasizes the segregation of conflicting duties to minimize risks, which aligns with the requirements of control AC-5.

Document Content

Matched Section

AI Justification

The text mentions the need for depth of expertise and assigning alternates for critical functions, which aligns with the requirements of control CP-2.

Document Content

Document Content

Matched Section

AI Justification

The text discusses the process for requesting exceptions to the policy, which aligns with the need for configuration management policies and procedures that address risk management strategies.

Document Content

Matched Section

Section: IT Asset Procurement
Content: This document establishes required data elements to be recorded and tracked during inventory of information technology (IT) assets and when these data elements are to be updated.

AI Justification

The document establishes required data elements to be recorded and tracked during inventory of IT assets, aligning with the need for effective accountability of system components as outlined in CM-8.

Document Content

Matched Section

AI Justification

The text discusses the process for requesting exceptions to policy, which aligns with the need for contingency planning and procedures to address risks.

Document Content

Matched Section

Section: 1.2 Endpoint Security Device Management
Content: c) All users should be authenticated prior to accessing the organization’s resources. Due diligence should be conducted; forgotten passwords should be reset, and devices should automatically lock after idle time.

AI Justification

The chunk discusses the need for user authentication prior to accessing organizational resources, which aligns with the re-authentication requirements outlined in IA-11.

Document Content

Document Content

Matched Section

Section: Policy Exceptions Process
Content: In exceptional cases Divisions & Functions may implement a lower protection level to adequately address the related information security risk. In such cases, Lazard's policy exception process should be followed and applied.

AI Justification

The text discusses the process for requesting exceptions to the policy, which aligns with the need for incident response policies and procedures that address security risks.

Document Content

Matched Section

AI Justification

The text discusses the implementation of a policy exception process for media protection, which aligns with the need for policies and procedures that address media protection controls.

Document Content

Document Content

Document Content

Matched Section

The text discusses the ability for divisions and functions to implement stronger security requirements and mechanisms, which aligns with the concept of ensuring domain separation and policy enforcement.

Document Content

Document Content

Matched Section

Document Content

Matched Section

AI Justification

The text describes the need for defining, documenting, implementing, and maintaining access control policies, which aligns with the requirements of AC-25 regarding enforcement of access control policies.

The text discusses the establishment of policies and procedures related to security and accountability, which aligns with the requirements of AU-1.

Document Content

Matched Section

AI Justification

The responsibilities outlined include reviewing access rights and reporting suspicious activity, which aligns with the auditing and monitoring aspects of AU-6.

Document Content

Matched Section

The text discusses the need for policies to control access to information resources, which aligns with the requirements for an access control policy.

Document Content

Document Content

Matched Section

Section: Scope & Applicability
Content: Access to Information Resources should be controlled through a managed process that addresses authorizing and modifying and revoking access.

AI Justification

The text mentions the need for managing access through authorizing, modifying, and revoking access, which aligns with the Account Management control.

Document Content

Matched Section

Section: Scope & Applicability
Content: This policy assigns and describes roles and responsibilities for access needs by minimizing risks and maximizing the protection levels for Lazard’s Information Resources.

AI Justification

The text implies the enforcement of access controls based on roles and responsibilities, which aligns with the Access Enforcement control.

Document Content

Matched Section

The text discusses the need for policies to control access to information resources based on roles, which aligns with the requirements of an access control policy.

AI Justification

Document Content

Matched Section

Section: Planning policy and procedures for the controls in the PL family
Content: The technical and organizational controls define minimum requirements for securing assets. Divisions & Functions are free to define and implement stronger security requirements and mechanisms if a higher protection level is necessary and they do not contradict the Policy.

AI Justification

The text discusses the establishment of policies and procedures for security controls, including the process for requesting exceptions to the policy, which aligns with the planning and procedural aspects of control PL-1.

Document Content

Matched Section

The chunk outlines responsibilities related to access rights, validation, and periodic reviews, which align with the need for an organization-wide risk management process and authorization.

Document Content

Matched Section

AI Justification

The text discusses the need for policies to control access to information resources, which aligns with the Access Control Policy control.

Document Content

Matched Section

AI Justification

The text mentions controlling access based on roles and the need for periodic review of access privileges, which aligns with Account Management.

Document Content

Matched Section

Section: Access Control | Concurrent Session Control, System & Communications Protection | Boundary Protection, System & Communications Protection | Network Disconnect, System & Communications Protection | Secure Name/address Resolution Service (authoritative Source)
Content: Access Control | Concurrent Session Control System & Communications Protection | Boundary Protection System & Communications Protection | Network Disconnect System & Communications Protection | Secure Name/address Resolution Service (authoritative Source)

AI Justification

The chunk discusses the importance of security and privacy training, monitoring, and testing, which aligns with the control's focus on organization-wide processes for these activities.

Document Content

Document Content

Matched Section

Section: Access to Information Resources should be controlled through a managed process that addresses authorizing and modifying and revoking access.
Content: Access to Information Resources should be controlled through a managed process that addresses authorizing and modifying and revoking access.

AI Justification

The chunk mentions the management of access privileges, including authorizing, modifying, and revoking access, which aligns with account management controls.

Document Content

Matched Section

Ensuring security controls while using mobile computing and remote access facilities directly relates to remote access controls.

Document Content

Matched Section

The text discusses the segregation and segmentation of networks, which aligns with the control's focus on managing network connections and ensuring integrity.

Document Content

Document Content

Matched Section

Section: Access to Networks and Network Services
Content: d. Segregate access control roles between access request, access authorization, and access administration.

AI Justification

The chunk discusses the segregation of access control roles and preventing unauthorized access, which aligns with the need for system management functionality that requires privileged user access.

Document Content

Matched Section

Section: Access to Networks and Network Services
Content: d. Segregate access control roles between access request, access authorization, and access administration.

AI Justification

The text discusses segregation of access control roles and preventing unauthorized access, which aligns with the principles of access control policies.

Document Content

Matched Section

Document Content

Matched Section

AI Justification

The text discusses the segregation and segmentation of networks, which aligns with the concept of managed interfaces and boundary protection as outlined in control SC-7.

Document Content

Document Content

Matched Section

AI Justification

The text discusses the segregation and segmentation of networks, which aligns with the control's focus on system entry and exit points, including firewalls and network integrity.

Document Content

The text discusses the need for inventorying all Firm workstations and laptops for hardware and software, aligning with the requirements for maintaining a centralized system component inventory.

Document Content

Matched Section

The text discusses the process for requesting exceptions to the policy, which relates to the establishment and maintenance of policies and procedures within the organization.

Document Content

Matched Section

Section: 4. Voice Communications Equipment
Content: Voice Communications Equipment should be protected in the following ways: a. They should be kept in a locked room. b. Management software should be protected by username and password logon. c. They should be configured to prevent hacking. d. They should have system-controlled dial-out access (premium rate numbers barred). e. They should have controlled dial-in access from direct exchange lines for support/maintenance.

AI Justification

The chunk discusses the need for controlled access and maintenance procedures for voice communications equipment, which aligns with the information security aspects of system maintenance.

Document Content

Matched Section

AI Justification

The text discusses the implementation of a policy exception process related to media protection, which aligns with the need for policies and procedures that address media protection controls.

Document Content

Matched Section

Section: Media Protection | Media Access
Content: Denying access to patient medical records in a community hospital unless the individuals seeking access to such records are authorized healthcare providers is an example of restricting access to non-digital media. Limiting access to the design specifications stored on compact discs in the media library to individuals on the system development team is an example of restricting access to digital media.

AI Justification

The text discusses restricting access to both digital and non-digital media, which aligns with the control's focus on media access.

Document Content

Matched Section

The text explicitly discusses the processes and techniques for media sanitization, which aligns directly with control MP-6.

Document Content

Matched Section

Section: Media Protection | Media Downgrading
Content: Media Protection | Media Downgrading

AI Justification

The chunk discusses the process of downgrading media to ensure that information cannot be retrieved or reconstructed, which aligns directly with the definition of MP-8.

Document Content

Matched Section

AI Justification

The text discusses the restrictions and protections related to the use of various types of media, including portable storage devices, which aligns directly with the control's focus on media use restrictions.

Document Content

Matched Section

Section: Media Protection | Media Access
Content: In contrast to MP-2, which restricts user access to media, MP-7 restricts the use of certain types of media on systems.

AI Justification

The text mentions restricting user access to media, which aligns with the control's focus on access restrictions to media.

Document Content

Matched Section

The text discusses securing equipment and media containing confidential information, which aligns with the need to prevent physical tampering and unauthorized access.

Document Content

Matched Section

AI Justification

The mention of approved end-user devices and restrictions on personal devices aligns with access control measures.

Document Content

Matched Section

AI Justification

The restriction on unauthorized networking devices indicates a control over remote access to the network.

Document Content

Matched Section

AI Justification

The text discusses the process for requesting exceptions to the policy, which aligns with the need for planning policies and procedures in managing security risks.

Document Content

Matched Section

Section: Any User found to have violated any of these policies may be subject to disciplinary action...
Content: Any User found to have violated any of these policies may be subject to disciplinary action, if such User is an employee, up to and including dismissal or termination of employment.

AI Justification

The text discusses the consequences of violating policies, which relates to the rules of behavior that govern user actions and responsibilities.

Document Content

Matched Section

AI Justification

The text discusses the process of implementing lower protection levels and the necessity of following a policy exception process, which relates to the organization's protection needs and risk management strategy.

Document Content

The text discusses the enforcement of policies and the ability of divisions to implement stronger security requirements, which aligns with the need for additional strength of mechanism for specific threats.

Document Content

Matched Section

Section: Voice Communications Equipment Protection
Content: Voice Communications Equipment should be protected in the following ways: a. They should be kept in a locked room. b. Management software should be protected by username and password logon. c. They should be configured to prevent hacking. d. They should have system-controlled dial-out access (premium rate numbers barred). e. They should have controlled dial-in access from direct exchange lines for support/maintenance. f. They should have Call Loggers to monitor (and alarm) unusual call patterns.

AI Justification

The text discusses the protection of voice communications equipment and the management of access, which aligns with the concept of boundary protection in network security.

Document Content

Matched Section

Section: 1.1.6 Telecommunications
Content: 1. Voicemail boxes should be secured through a PIN. Outbound dialing from mailboxes should be prevented.

AI Justification

The chunk discusses the use of approved removable devices that support password protection and encryption, which aligns with protecting the confidentiality and integrity of transmitted information.

Document Content

Matched Section

AI Justification

The text discusses the policy exception process and the need for a structured approach to managing exceptions, which aligns with the need for policies and procedures regarding system and information integrity.

Document Content

Matched Section

Section: Operating system and system software patches relating to security should be applied on an as-needed basis by the Lazard IT Department.
Content: Operating system and system software patches relating to security should be applied on an as-needed basis by the Lazard IT Department.

AI Justification

The text discusses the application of operating system and system software patches, which aligns with the need to remediate system flaws and apply security-relevant updates.

Document Content

Matched Section

Document Content

Matched Section

Matched Section

AI Justification

The text discusses the importance of logging and monitoring actions that affect the confidentiality, integrity, and availability of information systems, which aligns with the requirements for logging significant events.

Document Content

Matched Section

AI Justification

The chunk discusses the importance of logging and monitoring actions that may affect the confidentiality, integrity, and availability of information systems, which aligns with the need for coordinated audit logging across organizations.

Document Content

Matched Section

Section: i) Network services provided by third parties are assumed to have different security models than are required by Lazard. Lazard Business Units leveraging such network services should request detailed documentation on the security attributes of all network services provided by third parties.
Content: i) Network services provided by third parties are assumed to have different security models than are required by Lazard. Lazard Business Units leveraging such network services should request detailed documentation on the security attributes of all network services provided by third parties.

AI Justification

The mention of third-party network services and the need for security documentation aligns with the control's emphasis on coordinating audit information requirements across organizational boundaries.

Document Content

Matched Section

AI Justification

Document Content

Matched Section

AI Justification

The chunk discusses appropriate logging and monitoring to detect actions affecting the confidentiality, integrity, and availability of information systems, which aligns with the requirements for audit record review and analysis.

Document Content

Matched Section

AI Justification

The chunk discusses logging and monitoring, which aligns with the need for audit information and logging activities as outlined in AU-9.

Document Content

Matched Section

The text discusses the importance of having contingency planning policies and procedures, including the approval process for exceptions, which aligns with the control's focus on establishing such policies.

SC-20 is relevant as it is part of the centrally managed controls, supporting the overall management of network services.

Document Content

Matched Section

The text discusses the importance of monitoring organizational data flows and configurations of network devices, which aligns with the continuous monitoring concept outlined in PM-31.

Document Content

Matched Section

Section: 1.2.1 General Network Security
Content: c) Configurations of a random sampling of routers and other network devices providing distributed corporate services will be reviewed on a periodic basis to ensure compliance with security controls.

AI Justification

The mention of periodic reviews of configurations of network devices aligns with the continuous monitoring requirement in CA-7.

Document Content

Matched Section

Section: Section p) and r)
Content: p) Telephone lines that could enable remote access into the network from core data centers and other critical data and telecommunications areas will be implemented with security controls (e.g., lines will be unplugged until needed). All modem lines will be restricted to dial-out. Dial-in will be restricted to remote access concentrations (i.e., PERLE access switch). Exceptions to this policy should be authorized by the Lazard IS Department. r) Network devices (Routers, switches, WIFI access points, etc.) should be protected with logon accounts known only to the infrastructure staff and selected support staff. They should have an enabled password for making configuration changes known only to infrastructure staff.

AI Justification

The chunk discusses the implementation of security controls for critical assets, such as telephone lines and network devices, which aligns with the prioritization of critical assets and resources.

Document Content

Matched Section

The text discusses the importance of policies and procedures related to system and services acquisition, emphasizing the need for collaboration between security and privacy programs, which aligns with the requirements of control SA-1.

Document Content

Matched Section

Section: u) There are cases where Lazard will allow external connections from system vendors for the purposes of technical support.
Content: u) There are cases where Lazard will allow external connections from system vendors for the purposes of technical support. The general principles that should be followed in these cases are as follows: i. Wherever possible these connections should utilize the same policies, procedures and technologies that have been designed and approved for Lazard employees. ii. The service provider should provide satisfactory evidence that their staff is rigorously authenticated before allowing such access. iii. Wherever practical the connection or access method should be 'switched-off' when not in use and require a Lazard intervention to switch it on. This may be a physical act (such as powering on a modem) or a configuration change activated through software. iv. The vendor should be assessed to assure Lazard that they are a reputable organization that is likely to be employing adequate security on its systems. v. There should be a log of connections and activity.

AI Justification

The text discusses the principles for allowing external connections from system vendors for technical support, which aligns with the need for support for system components, including the assessment of vendors and ensuring adequate security measures.

Document Content

Matched Section

The text discusses the management of Internet-facing devices and the policies governing their connections, which aligns with the control's focus on terminating network connections and managing network access.

Document Content

Matched Section

Section: Security features of network services include, but are not limited to: Technology applied for security of network services, such as authentication, encryption, and network connection controls.
Content: Security features of network services include, but are not limited to: Technology applied for security of network services, such as authentication, encryption, and network connection controls.

AI Justification

The chunk discusses the use of encryption as a security feature for network services, which aligns with the control's focus on employing cryptography for security solutions.

Document Content

Matched Section

Section: 1.2.3 Network Segregation & Segmentation
Content: infrastructure configuration standards including firewall, IDS/IPS, router, network communication protocols and Domain Name Server (DNS).

AI Justification

The chunk discusses infrastructure configuration standards that include DNS, which relates to the control's focus on authoritative source information for network address resolution.

Document Content

Matched Section

The text discusses the implementation of security controls to prevent unauthorized access and ensure policy enforcement, aligning with the need to avoid logical paths that could bypass security measures.

Document Content

Matched Section

AI Justification

The text discusses the importance of monitoring and detection capabilities in the context of adversaries moving laterally and attempting to exfiltrate information, which aligns with the control's focus on adversary behavior and monitoring.

Document Content

Matched Section

AI Justification

The text discusses the segregation of networks and the control of access between domains, which aligns with the need for additional strength of mechanism and robustness for domain separation as described in SC-49.

Document Content

Matched Section

AI Justification

The text discusses the identification of security mechanisms and management requirements for network services, which aligns with the need to address denial-of-service events and implement protective measures.

Document Content

Matched Section

AI Justification

The text discusses the segregation of networks and the control of access between domains, which aligns with the requirement for additional strength of mechanism for domain separation and policy enforcement.

Document Content

Document Content

Matched Section

AI Justification

The chunk discusses the protection of data against unauthorized access and emphasizes the importance of data integrity and confidentiality, which aligns with the principles of data mining protection.

Document Content

The text discusses the responsibilities of senior executives and the Information Security Committee regarding the approval and implementation of information security policies, which aligns with the authorization responsibilities outlined in CA-6.

The text emphasizes the need for policies and procedures that contribute to security and privacy assurance, which aligns with the establishment of an information security program.

Document Content

Matched Section

AI Justification

The text discusses the identification, evaluation, and management of risk, which aligns with the need for a risk assessment policy.

Document Content

Matched Section

Section: Maintain business continuity to counteract interruptions to business activities and to protect critical business processes from effects of major failures or disasters.
Content: (f) Maintain business continuity to counteract interruptions to business activities and to protect critical business processes from effects of major failures or disasters.

AI Justification

The chunk discusses maintaining business continuity and mitigating operational risks, which aligns with the use of alternative security mechanisms to ensure continuity of operations.

Document Content

Matched Section

The text discusses controls for devices used by employees and vendors, which aligns with the requirement for unique device identification and authentication.

Document Content

Matched Section

AI Justification

The text discusses the importance of incident response policies and procedures, aligning with the requirements of control IR-1.

Document Content

Matched Section

The text specifies that all breaches of information security should be reported to the CISO, which aligns with the requirement for reporting incidents and reflects adherence to policies and standards.

Document Content

Matched Section

AI Justification

The text discusses the reporting of breaches to the CISO and the adherence to a Cyber Security Incident Response Plan, which aligns with the need for a coordinated approach to incident response.

Document Content

Document Content

Matched Section

Section: Risk Policy
Content: (q) Risk Policy - Establishes controls to ensure identification, evaluation and management of risk to secure business assets and support achievement of corporate objectives.

AI Justification

The Risk Policy section aligns with the need for controls to identify and manage risks, which is a key aspect of the RA-1 control.

Document Content

Document Content

Matched Section

Section: Compliance and Risk Policy
Content: (p) Compliance – Establishes controls to ensure compliance with legal, statutory, regulatory, and contractual obligations related to information security and of any. (q) Risk Policy - Establishes controls to ensure identification, evaluation and management of risk to secure business assets and support achievement of corporate objectives.

AI Justification

The Compliance and Risk Policy sections indicate the need for policies that ensure compliance and risk management.

Document Content

Matched Section

AI Justification

The text discusses controls related to the use of media, including restrictions on portable storage devices, which aligns with the requirements of MP-7.

Document Content

Document Content

Matched Section

Section: Physical and Environmental Security
Content: Physical and Environmental Security – Establishes controls to prevent unauthorized physical access, damage and interference to the organization’s information assets and information processing facilities.

AI Justification

The chunk discusses controls related to managing access to information assets and preventing unauthorized physical access, which aligns with the requirements for physical access authorizations.

Document Content

Matched Section

AI Justification

The chunk discusses the establishment of controls to prevent unauthorized physical access, which aligns with the monitoring of physical access as described in PE-6.

Document Content

The text discusses the importance of establishing controls for information security incidents and compliance, which aligns with the need for technology-independent capabilities to counter threats and protect information.

Document Content

Matched Section

The chunk discusses the establishment of controls for managing information security incidents and compliance, which aligns with the need for a comprehensive risk management strategy that includes risk identification and management.

Document Content

Matched Section

Section: Human Resource Security
Content: Human Resource Security - Establishes controls to reduce the risk of employee/contractor error, theft, fraud, or misuse of information assets.

AI Justification

The section discusses the establishment of controls related to human resource security, which aligns with the need for personnel screening and rescreening activities.

Document Content

Document Content

Matched Section

Section: Application Credential Management Policy
Content: It is the responsibility of all staff including Lazard personnel, third party consultants, contractors, vendors and visitors to adhere to these policies.

AI Justification

The text discusses the responsibilities of various personnel, including third-party consultants and contractors, in adhering to security policies, which aligns with the management of external providers.

Document Content

Matched Section

Document Content

Matched Section

Section: Security categorization processes facilitate the development of inventories of information assets.
Content: Security categorization processes facilitate the development of inventories of information assets and, along with CM-8, mappings to specific system components where information is processed, stored, or transmitted.

AI Justification

The text discusses the importance of security categorization and its role in identifying potential adverse impacts on organizational operations and assets.

Document Content

Matched Section

The mention of establishing controls for the management of information security incidents aligns with the need for incident response policies and procedures.

Document Content

Matched Section

AI Justification

The text addresses the need for business continuity management, which is a key aspect of contingency planning.

Document Content

Matched Section

AI Justification

The mention of compliance with legal, statutory, regulatory, and contractual obligations indicates the need for a security planning policy.

Document Content

Matched Section

The mention of ensuring that information security is designed and implemented within the development lifecycle aligns with the objectives of PL-8, which focuses on integrating security architecture with enterprise architecture.

Document Content

Matched Section

AI Justification

The chunk discusses the importance of integrating information security throughout the system development lifecycle, which aligns with the resource allocation for security measures.

Document Content

Matched Section

Section: Support for system components includes software patches, firmware updates, replacement parts, and maintenance contracts.
Content: Support for system components includes software patches, firmware updates, replacement parts, and maintenance contracts. An example of unsupported components includes when vendors no longer provide critical software patches or product updates, which can result in an opportunity for adversaries to exploit weaknesses in the installed components.

AI Justification

The text discusses the need for support for system components, including software patches and maintenance contracts, which aligns directly with the control's focus.

Document Content

Document Content

Matched Section

AI Justification

Document Content

Matched Section

AI Justification

The chunk discusses the importance of ensuring continuous business operations and availability of information in the event of major failures or disasters, which aligns with the concept of maintaining a known safe state.

Document Content

Matched Section

Section: Asset Management, Access Control, Cryptography, Operations Security
Content: (f) Asset Management – Establishes controls for asset identification, inventory, ownership and handling. Defines appropriate level of protection requirement and accountabilities for information assets. (g) Access Control – Establishes controls to manage access to information assets and information processing facilities via defined business requirements. (h) Cryptography – Establishes controls for proper and effective use of cryptography to protect the confidentiality, authenticity and/or integrity of information. Physical and Environmental Security – Establishes controls to prevent unauthorized physical access, damage and interference to the organization’s information assets and information processing facilities. (j) Operations Security – Establishes controls to ensure the secure operation of information processing facilities, protection from malwares, protection from loss of data, and other operational aspects.

AI Justification

The chunk discusses the establishment of controls for asset management, access control, cryptography, and operations security, which are relevant to protecting information at rest.

Document Content

The text discusses the protection of data, its integrity, and the need for regulatory compliance, which aligns with the requirements for information management and retention.

Document Content

Matched Section

AI Justification

The chunk discusses the accuracy, completeness, and quality of data, which aligns with the operations for ensuring the quality of personally identifiable information as described in SI-18.

Document Content

Document Content

Document Content

Matched Section

Section: Operations Security
Content: Establishes controls to ensure the secure operation of information processing facilities, protection from malwares, protection from loss of data, and other operational aspects.

AI Justification

The text discusses the importance of establishing controls for asset management and access control, which are relevant to supply chain OPSEC as they involve protecting critical information and managing access to information assets.

Document Content

Matched Section

Section: Access Control
Content: Establishes controls to manage access to information assets and information processing facilities via defined business requirements.

AI Justification

The section on Access Control aligns with the need to manage access to information assets, which is a critical aspect of supply chain OPSEC.

Document Content

Matched Section

AI Justification

The Asset Management section relates to the identification and protection of information assets, which is essential for maintaining supply chain security.

Document Content

Matched Section

Section: Protection of data against unintentional, unlawful, or unauthorized access, disclosure, or theft.
Content: The protection of data against unintentional, unlawful, or unauthorized access, disclosure, or theft.

AI Justification

The chunk discusses the protection of data against unauthorized access and modification, which aligns with the need for anti-tamper technologies to ensure data integrity.

Document Content

Matched Section

The chunk discusses the investigation and analysis of information security incidents, which aligns with the documentation and evaluation of incidents as described in IR-5.

Document Content

Matched Section

AI Justification

The chunk discusses the investigation and analysis of information security incidents, which aligns with the requirements for reporting incidents and their impact on risk assessments.

Document Content

Matched Section

AI Justification

The text discusses the importance of media protection policies and procedures, aligning with the control's focus on establishing such policies within organizations.

Document Content

Matched Section

AI Justification

The chunk discusses the classification and handling of documents, which aligns with the need for security markings on various types of media.

Document Content

Document Content

Matched Section

Section: Clause 8.3 Design & Development
Content: The concept of tailoring allows organizations to specialize or customize a set of baseline controls by applying a defined set of tailoring actions. Tailoring actions facilitate such specialization and customization by allowing organizations to develop security and privacy plans that reflect their specific mission and business functions, the environments where their systems operate, the threats and vulnerabilities that can affect their systems, and any other conditions or situations that can impact their mission or business success.

AI Justification

The text discusses the concept of tailoring controls to meet specific organizational needs, which aligns with the definition and purpose of control PL-11.

Document Content

Matched Section

Section: Section 1.4 REQUIREMENT
Content: The Information Security Team (InfoSec) will develop and maintain an Information Security Risk Management Process to frame, assess, respond, and monitor risk. Guidance for this process will be based on the National Institute of Standards and Technology Cyber Risk Framework (NIST CRF) and specific security regulations e.g. HIPAA, FERPA, etc. if applicable. The risk management process will be designed to assist Lazard to maintain compliance with regulatory requirements, federal and state and local laws.

AI Justification

The text discusses the development and maintenance of an Information Security Risk Management Process, which aligns with the need for security and privacy plans that frame, assess, and monitor risk.

Document Content

Matched Section

AI Justification

The text discusses the importance of an information security program plan, detailing roles and responsibilities related to risk management and incident response, which aligns with the requirements of PM-1.

Document Content

Document Content

The mention of compliance with regulatory requirements and the structured risk management process indicates a level of architecture development that aligns with the control's focus on security and privacy architectures.

Document Content

Matched Section

Section: Risk Assessment
Content: Risk Assessment Policy/Plan? Vulnerability, Patch Management Standards Risk Assessment Process/Plan that contains Risk Tolerance details

AI Justification

The chunk discusses risk assessment processes and prioritization of critical assets, which aligns with the control's focus on protection strategies based on critical asset prioritization.

Document Content

Matched Section

Section: Risk Assessment
Content: Risk Assessment Policy/Plan? Vulnerability, Patch Management Standards Risk Assessment Process/Plan that contains Risk Tolerance details

AI Justification

The mention of risk assessment processes and plans indicates alignment with the control focused on conducting risk assessments.

Document Content

Matched Section

AI Justification

The text discusses the investigation and analysis of information security incidents for risk management, aligning with the organization's risk management strategy.

Document Content

Matched Section

Section: Personnel Security Policy and Procedures
Content: Control: PS-1: Personnel security policy and procedures for the controls in the PS family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures.

AI Justification

The text discusses the importance of personnel security policies and procedures in relation to risk management and organizational security, aligning with the control's focus on establishing such policies.

Document Content

The text discusses various organizational responses to risk, including remediation, mitigation, transfer, acceptance, and avoidance, which aligns with the control's focus on risk response options.

Document Content

Matched Section

AI Justification

The text discusses the importance of policies and procedures related to system and services acquisition, emphasizing the need for collaboration between security and privacy programs.

Document Content

Matched Section

AI Justification

The text discusses the development and maintenance of an Information Security Risk Management Process, which aligns with the principles of integrating security and privacy considerations into the system development life cycle.

Document Content

Matched Section

AI Justification

The mention of assessing and monitoring risk aligns with the requirements for conducting risk assessments as part of the risk management process.

Document Content

Matched Section

AI Justification

The text discusses the development and maintenance of an Information Security Risk Management Process, which aligns with the need for derived security and privacy requirements as outlined in SA-4.

Document Content

AI Justification

The text discusses the importance of engaging stakeholders and departments in risk management, which aligns with the need for coordinated efforts across an organization to manage supply chain risks.

7.0_IS_Asset_Management_Policy.pdf NIST

114 matches found

Document Content

Matched Section

Section: Policy Exceptions and Implementation
Content: Divisions & Functions are free to define and implement stronger security requirements and mechanisms if a higher protection level is necessary and they do not contradict the Policy. In exceptional cases Divisions & Functions may implement a lower protection level to adequately address the related information security risk.

AI Justification

The text discusses the ability of divisions to define and implement security requirements that may deviate from the established policy, which aligns with the need for access control policies and procedures to address organizational security needs.

Document Content

Matched Section

The mention of defining and reviewing access restrictions relates to the application of authorization information to specific accesses.

Document Content

Matched Section

Section: vi. Authorizing and periodically reviewing access entitlements.
Content: vi. Authorizing and periodically reviewing access entitlements.

AI Justification

The chunk discusses authorizing and reviewing access entitlements, which aligns with the enforcement of access control policies as described in AC-25.

Document Content

Matched Section

The text mentions defining and reviewing access restrictions and classification of important assets, which aligns with access control policies.

The text discusses the role of maintenance personnel and their access requirements, which aligns with the control's focus on maintenance activities and access authorizations.

Document Content

Matched Section

AI Justification

The text mentions physical access for maintenance personnel, which aligns with the control's focus on physical access management.

Document Content

Matched Section

AI Justification

The text discusses the establishment of security requirements and mechanisms, as well as the process for requesting exceptions to the policy, which aligns with the need for a media protection policy and procedures.

Document Content

Matched Section

The text discusses the ability of divisions to define and implement security requirements, which aligns with the need for policies and procedures regarding physical and environmental protection.

Document Content

Matched Section

Section: Physical & Environmental Protection | Delivery & Removal
Content: Physical & Environmental Protection | Delivery & Removal

AI Justification

The text discusses the importance of environmental controls in organizational facilities, which aligns with the control's focus on protecting system resources in harsh environments.

Document Content

Matched Section

Section: vi. Authorizing and periodically reviewing access entitlements.
Content: vi. Authorizing and periodically reviewing access entitlements.

AI Justification

The section discusses defining and reviewing access restrictions, which aligns with the need to enforce authorizations for entry and exit of system components.

The text discusses the ability of divisions to define and implement security requirements, which aligns with the need for personnel security policies and procedures that can adapt to specific organizational needs and risks.

Document Content

Matched Section

Matched Section

Document Content

Matched Section

Section: Cryptography can be employed to support a variety of security solutions
Content: Cryptography can be employed to support a variety of security solutions, including the protection of classified information and controlled unclassified information, the provision and implementation of digital signatures, and the enforcement of information separation when authorized individuals have the necessary clearances but lack the necessary formal access approvals.

AI Justification

The text discusses the use of cryptography to protect classified and controlled unclassified information, as well as the implementation of digital signatures, which aligns directly with control SC-13.

Document Content

Matched Section

The text mentions protecting communication paths, which relates to boundary protection measures.

Document Content

Matched Section

Section: Divisions & Functions are free to define and implement stronger security requirements and mechanisms
Content: Divisions & Functions are free to define and implement stronger security requirements and mechanisms if a higher protection level is necessary and they do not contradict the Policy. In exceptional cases Divisions & Functions may implement a lower protection level to adequately address the related information security risk.

AI Justification

The text discusses the establishment of security requirements and mechanisms, including the process for requesting exceptions to the policy, which aligns with the need for a comprehensive system and information integrity policy.

Document Content

Matched Section

The text discusses the secure disposal of assets containing sensitive data and the need for formal procedures, which aligns with the control's emphasis on proper disposal methods throughout the system development life cycle.

27.0_IS_Lazard_Reference_Timeout_Standard.pdf NIST

24 matches found

Document Content

Matched Section

AI Justification

The text discusses the need for an access control policy, procedures for exceptions, and the approval process, which aligns with the requirements of AC-1.

Document Content

Matched Section

Section: Working Sessions and INFORMATION SECURITY GOALS
Content: Working Sessions are often lost due to timeouts. Users need to reestablish state on work every time they are logged out of systems, losing all progress to that point. INFORMATION SECURITY GOALS Information Security Risk from extending timeout is minimal because the screen lock of 15 minutes is still active for all workstations and enforced at the AD Level.

AI Justification

The text discusses the importance of maintaining session state and the use of screen locks to prevent unauthorized access when users are away from their workstations, which aligns with the concept of device locks as a temporary measure to secure systems.

Document Content

Document Content

Document Content

Matched Section

Section: INFORMATION SECURITY GOALS
Content: In order to access any system, a user still needs to go through Cyberark with MFA, and connect via VPN with MFA.

AI Justification

The text discusses the requirement for users to go through Cyberark with Multi-Factor Authentication (MFA) to access systems, which aligns with the identification and authentication requirements.

Document Content

Section: Audit and accountability policy and procedures
Content: Control: AU-1: Audit and accountability policy and procedures address the controls in the AU family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance.

AI Justification

The text discusses the importance of audit and accountability policies and procedures, emphasizing their role in security and privacy assurance, which aligns with AU-1.

Document Content

Matched Section

The chunk discusses preparation activities, including tabletop practice exercises, which align with the methods for testing contingency plans as outlined in CP-4.

Document Content

The mention of conducting risk assessments and implementing controls based on their results aligns with the need for a risk assessment policy and procedures.

Document Content

Matched Section

AI Justification

The text discusses the importance of conducting risk assessments to inform the selection and implementation of controls, which aligns with the requirements of RA-3.

Document Content

Matched Section

Section: Material Reactive Services
Content: • Material Reactive Services o Vulnerability handling o Vulnerability analysis o Vulnerability response coordination

AI Justification

The text discusses various aspects of vulnerability monitoring, including the need for vulnerability analysis, handling, and response coordination, which aligns with the requirements outlined in RA-5.

Document Content

Matched Section

50 matches found

Document Content

Document Content

Document Content

Document Content

The text discusses access rights and the requirement for documented approval for access, which aligns with the identification and authentication of users.

Document Content

Matched Section

Section: Access to Enterprise Servers
Content: Personnel participating in a BC/DR event may require access to enterprise servers (Windows and *Nix) needed in the recovery effort. Requests for the granting of access to Lazard enterprise servers should be documented and approved by one of the following: a. A director level IT representative. b. A member of the Information Security department.

AI Justification

The text outlines the process for granting and revoking access, which is part of account management.

Document Content

Document Content

Matched Section

Section: Security Personnel
Content: Is responsible for reviewing and authorizing personnel entry and exit of physical perimeter should the badge entry system be compromised during a BC/DR event, test or execution.

AI Justification

The text discusses responsibilities related to authorizing access to information resources and physical perimeter management during a BC/DR event, which aligns with the need for physical access controls.

Document Content

Matched Section

Section: Is responsible for reviewing and authorizing access to information resources, networks, network services, and Enterprise Servers during a BC/DR event, test, or execution.
Content: Is responsible for reviewing and authorizing access to information resources, networks, network services, and Enterprise Servers during a BC/DR event, test, or execution.

AI Justification

The text implies the need for authorized personnel to manage access to systems and resources, which relates to the control concerning maintenance personnel and their access requirements.

Document Content

Matched Section

The text discusses the need for policies and procedures regarding exceptions to security policies, which aligns with the control's focus on establishing acquisition policies and procedures.

Document Content

Matched Section

The text discusses the ability of divisions to implement stronger or lower security requirements based on specific threats and operational environments, which aligns with the need for additional strength of mechanism for domain separation and policy enforcement.

The text discusses the importance of policies and procedures related to identification and authentication, aligning with the control's focus on establishing such policies within organizations.

Document Content

Document Content

The text discusses responsibilities for information security risk management activities and acceptance of residual risks, which aligns with the requirements of a risk management strategy.

Document Content

Matched Section

Section: Job Description and Security Roles and Responsibilities
Content: has prepared the Job Description (JD) should be responsible for identifying the security roles and responsibilities associated with every individual.

AI Justification

The text discusses the importance of defining roles and responsibilities related to security, which aligns with the need for personnel security policies and procedures.

Document Content

The text discusses the implementation and operation of information security within Lazard, which aligns with the principles of integrating security into the system development life cycle as outlined in SA-3.

Document Content

Document Content

Document Content

Matched Section

Section: Control: SI-12
Content: Control: SI-12: Information management and retention requirements cover the full life cycle of information, in some cases extending beyond system disposal. Information to be retained may also include policies, procedures, plans, reports, data output from control implementation, and other types of administrative information.

AI Justification

The text discusses the requirements for information management and retention, including the full life cycle of information and coordination with records management personnel.

Document Content

Matched Section

Frameworks

Key Controls

Overall Alignment

Framework Breakdown

Key Controls Status

Compliance Summary & Framework Analysis

Framework Compliance Overview

Document Analysis Details

2.0_IS_Acceptable_Use_Policy.pdf 2 frameworks

4.0_IS_Organization_of_Information_Security_Policy_1.pdf 2 frameworks

7.0_IS_Asset_Management_Policy.pdf 2 frameworks

8.0_IS_Access_Control_Identity_Management_Policy_1.pdf 2 frameworks

7.2_IS_End_User_Device_Standard.pdf 2 frameworks

7.1_IS_Asset_Management_Standard.pdf 2 frameworks

19.0_IS_Cloud_Computing_Security_Policy.pdf 2 frameworks

2.1_IS_Acceptable_Use_Standard.pdf 2 frameworks

6.1_IS_Data_Security_Standards.pdf 2 frameworks

5.0_IS_Human_Resource_Security_Policy_1.pdf 2 frameworks

16.0_IS_Maintaining_Security_during_BC__DR_Policy_1.pdf 2 frameworks

6.0_IS_Data_Security_Policy_1.pdf 2 frameworks

3.0_IS_Information_Security_Policy_2.pdf 2 frameworks

26.0_IS_Vulnerability_Management_Policy.pdf 2 frameworks

23.0_IS_Network_and_Firewall_Security_Policy.pdf 2 frameworks

15.1_IS_Lazard_CSIRT-CSIRP_Framework_Standard.pdf 2 frameworks

19.1_IS_Cloud_Computing_Security_Standard.pdf 2 frameworks

20.0_IS_Risk_Management_Policy_2.pdf 2 frameworks

27.0_IS_Lazard_Reference_Timeout_Standard.pdf 2 frameworks

CIS Framework Checklist Complete control verification 97.6% Complete

NIST Framework Checklist Complete control verification 88.3% Complete

Detailed Document Analysis

2.0_IS_Acceptable_Use_Policy.pdf CIS

1.1 Inventory of Assets... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

3.3 Data Access Control Lists... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

3.1 Access Control Policy... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

3.7 Data Classification Scheme... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

3.9 Encrypt data on removable media... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

4.12 Mobile Device Management... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

4.0_IS_Organization_of_Information_Security_Policy_1.pdf CIS

1.1 Inventory of Assets... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

3.3 Data Access Control Lists... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

3.7 Data Classification Scheme... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

7.0_IS_Asset_Management_Policy.pdf CIS

1.1 Inventory of Assets... Click to view evidence details Matched

Document Content

Matched Section

AI Justification

1.3 Asset Inventory Management... Click to view evidence details Matched

Document Content

Matched Section

AI Justification