VendorEntity
Job ID: VendorEntity-082625161430
2025-08-26
Completed
Generating your report with AI insights. This may take a moment...
Overall Alignment
54.8%
Controls Aligned
182 / 332
Frameworks
2
CIS
NIST
Assessment frameworks applied
Key Controls
120 / 179
Overall Alignment
Framework Breakdown
Key Controls Status
Framework Compliance Overview
| Framework | Total Controls | Aligned | Gaps | Compliance Progress |
|---|---|---|---|---|
| CIS | 34 | 7 | 27 |
|
| NIST | 298 | 175 | 123 |
|
| OVERALL | 332 | 182 | 150 |
|
Document Analysis Details
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf 2 frameworks
| Framework | Total | Aligned | Coverage |
|---|---|---|---|
| CIS | 34 | 1 |
|
| NIST | 298 | 21 |
|
01_-_Handbook_-_Verterim_-_10182019.pdf 2 frameworks
| Framework | Total | Aligned | Coverage |
|---|---|---|---|
| CIS | 34 | 0 |
|
| NIST | 298 | 23 |
|
Acceptable_Use_Policy.docx 2 frameworks
| Framework | Total | Aligned | Coverage |
|---|---|---|---|
| CIS | 34 | 3 |
|
| NIST | 298 | 56 |
|
Business_Continuity_Plan.docx 2 frameworks
| Framework | Total | Aligned | Coverage |
|---|---|---|---|
| CIS | 34 | 0 |
|
| NIST | 298 | 17 |
|
Equipment_Disposal_Policy.docx 2 frameworks
| Framework | Total | Aligned | Coverage |
|---|---|---|---|
| CIS | 34 | 2 |
|
| NIST | 298 | 7 |
|
Information_Security_Policy.docx 2 frameworks
| Framework | Total | Aligned | Coverage |
|---|---|---|---|
| CIS | 34 | 0 |
|
| NIST | 298 | 64 |
|
Workstation_Security_Policy.docx 2 frameworks
| Framework | Total | Aligned | Coverage |
|---|---|---|---|
| CIS | 34 | 0 |
|
| NIST | 298 | 48 |
|
Incident_Response_Procedure.docx 2 frameworks
| Framework | Total | Aligned | Coverage |
|---|---|---|---|
| CIS | 34 | 1 |
|
| NIST | 298 | 47 |
|
Information_Sensitivity_Policy.docx 2 frameworks
| Framework | Total | Aligned | Coverage |
|---|---|---|---|
| CIS | 34 | 4 |
|
| NIST | 298 | 33 |
|
Acceptable_Encryption_Policy.docx 2 frameworks
| Framework | Total | Aligned | Coverage |
|---|---|---|---|
| CIS | 34 | 1 |
|
| NIST | 298 | 2 |
|
Ethical_Sourcing_Policy.docx 1 frameworks
| Framework | Total | Aligned | Coverage |
|---|---|---|---|
| NIST | 298 | 3 |
|
34 Total Controls
| Control ID | Control Name | Status | Evidence Section | Document | Actions |
|---|---|---|---|---|---|
| 1.1 |
Establish and Maintain Detailed Enterprise Asset Inventory
Key Control
|
Gap |
Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with...
Critical Gap - Key Control Missing
|
||
| 1.2 |
Address Unauthorized Assets
|
Gap | Ensure that a process exists to address unauthorized assets on a weekly basis. The enterprise may ch... | ||
| 1.3 |
Utilize an Active Discovery Tool
|
Gap | Utilize an active discovery tool to identify assets connected to the enterprise’s network. Configure... | ||
| 1.4 |
Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory
|
Gap | Use DHCP logging on all DHCP servers or Internet Protocol (IP) address management tools to update th... | ||
| 1.5 |
Use a Passive Asset Discovery Tool
|
Gap | Use a passive discovery tool to identify assets connected to the enterprise’s network. Review and us... | ||
| 2.1 |
Establish and Maintain a Software Inventory
Key Control
|
Gap |
Establish and maintain a detailed inventory of all licensed software installed on enterprise assets....
Critical Gap - Key Control Missing
|
||
| 2.2 |
Ensure Authorized Software is Currently Supported
Key Control
|
Gap |
Ensure that only currently supported software is designated as authorized in the software inventory ...
Critical Gap - Key Control Missing
|
||
| 2.3 |
Address Unauthorized Software
|
Gap | Ensure that unauthorized software is either removed from use on enterprise assets or receives a docu... | ||
| 2.4 |
Utilize Automated Software Inventory Tools
|
Gap | Utilize software inventory tools, when possible, throughout the enterprise to automate the discovery... | ||
| 2.7 |
Allowlist Authorized Scripts
|
Gap | Use technical controls, such as digital signatures and version control, to ensure that only authoriz... | ||
| 3.1 |
Establish and Maintain a Data Management Process
Key Control
|
Aligned | Overview and Purpose... |
Equipment_Disposal_Policy.docx
|
|
| 3.1 |
Establish and Maintain a Data Management Process
Key Control
|
Aligned | Storage and Disposal/Destruction... |
Information_Sensitivity_Policy.docx
|
|
| 3.2 |
Establish and Maintain a Data Inventory
Key Control
|
Gap |
Establish and maintain a data inventory based on the enterprise’s data management process. Inventory...
Critical Gap - Key Control Missing
|
||
| 3.3 |
Configure Data Access Control Lists
|
Gap | Configure data access control lists based on a user’s need to know. Apply data access control lists,... | ||
| 3.4 |
Enforce Data Retention
Key Control
|
Gap |
Retain data according to the enterprise’s documented data management process. Data retention must in...
Critical Gap - Key Control Missing
|
||
| 3.5 |
Securely Dispose of Data
Key Control
|
Aligned | Overview... |
Equipment_Disposal_Policy.docx
|
|
| 3.5 |
Securely Dispose of Data
Key Control
|
Aligned | Disposal/Destruction... |
Information_Sensitivity_Policy.docx
|
|
| 3.6 |
Encrypt Data on End-User Devices
|
Gap | Encrypt data on end-user devices containing sensitive data. Example implementations can include: Win... | ||
| 3.7 |
Establish and Maintain a Data Classification Scheme
|
Aligned | Proprietary Information and Confidential Information... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| 3.7 |
Establish and Maintain a Data Classification Scheme
|
Aligned | Guidelines on information classification... |
Acceptable_Use_Policy.docx
|
|
| 3.7 |
Establish and Maintain a Data Classification Scheme
|
Aligned | Sensitivity Guidelines... |
Information_Sensitivity_Policy.docx
|
|
| 3.8 |
Document Data Flows
Key Control
|
Gap |
Document data flows. Data flow documentation includes service provider data flows and should be base...
Critical Gap - Key Control Missing
|
||
| 3.9 |
Encrypt Data on Removable Media
|
Gap | Encrypt data on removable media.... | ||
| 3.11 |
Encrypt Sensitive Data at Rest
Key Control
|
Aligned | Section 3: Recommendations on Sensitive Data... |
Acceptable_Use_Policy.docx
|
|
| 3.11 |
Encrypt Sensitive Data at Rest
Key Control
|
Aligned | Encryption Policy... |
Acceptable_Encryption_Policy.docx
|
|
| 3.12 |
Segment Data Processing and Storage Based on Sensitivity
|
Gap | Segment data processing and storage based on the sensitivity of the data. Do not process sensitive d... | ||
| 3.13 |
Deploy a Data Loss Prevention Solution
Key Control
|
Gap |
Implement an automated tool, such as a host-based Data Loss Prevention (DLP) tool to identify all se...
Critical Gap - Key Control Missing
|
||
| 3.14 |
Log Sensitive Data Access
Key Control
|
Aligned | Handling of Information for Legal Proceedings... |
Incident_Response_Procedure.docx
|
|
| 4.1 |
Establish and Maintain a Secure Configuration Process
Key Control
|
Gap |
Establish and maintain a documented secure configuration process for enterprise assets (end-user dev...
Critical Gap - Key Control Missing
|
||
| 4.2 |
Establish and Maintain a Secure Configuration Process for Network Infrastructure
Key Control
|
Gap |
Establish and maintain a documented secure configuration process for network devices. Review and upd...
Critical Gap - Key Control Missing
|
||
| 4.3 |
Configure Automatic Session Locking on Enterprise Assets
|
Aligned | Section 2: Automatic Session Locking... |
Acceptable_Use_Policy.docx
|
|
| 4.4 |
Implement and Manage a Firewall on Servers
|
Gap | Implement and manage a firewall on servers, where supported. Example implementations include a virtu... | ||
| 4.5 |
Implement and Manage a Firewall on End-User Devices
|
Gap | Implement and manage a host-based firewall or port-filtering tool on end-user devices, with a defaul... | ||
| 4.6 |
Securely Manage Enterprise Assets and Software
Key Control
|
Aligned | Storage... |
Information_Sensitivity_Policy.docx
|
|
| 4.7 |
Manage Default Accounts on Enterprise Assets and Software
|
Gap | Manage default accounts on enterprise assets and software, such as root, administrator, and other pr... | ||
| 4.9 |
Configure Trusted DNS Servers on Enterprise Assets
|
Gap | Configure trusted DNS servers on network infrastructure. Example implementations include configuring... | ||
| 4.11 |
Enforce Remote Wipe Capability on Portable End-User Devices
Key Control
|
Gap |
Remotely wipe enterprise data from enterprise-owned portable end-user devices when deemed appropriat...
Critical Gap - Key Control Missing
|
||
| 4.12 |
Separate Enterprise Workspaces on Mobile End-User Devices
Key Control
|
Gap |
Ensure separate enterprise workspaces are used on mobile end-user devices, where supported. Example ...
Critical Gap - Key Control Missing
|
||
| 5.1 |
Establish and Maintain an Inventory of Accounts
Key Control
|
Gap |
Establish and maintain an inventory of all accounts managed in the enterprise. The inventory must at...
Critical Gap - Key Control Missing
|
||
298 Total Controls
| Control ID | Control Name | Status | Evidence Section | Document | Actions |
|---|---|---|---|---|---|
| AC-1 |
Policy and Procedures
Key Control
|
Aligned | Storage and Disposal/Destruction sections emphasize the need... |
Information_Sensitivity_Policy.docx
|
|
| AC-1 |
Policy and Procedures
Key Control
|
Aligned | 4.0 Policy... |
Acceptable_Use_Policy.docx
|
|
| AC-1 |
Policy and Procedures
Key Control
|
Aligned | Decisions made that contain Information Security, Privacy, o... |
Information_Security_Policy.docx
|
|
| AC-1 |
Policy and Procedures
Key Control
|
Aligned | 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| AC-10 |
Concurrent Session Control
|
Gap | Organizations may define the maximum number of concurrent sessions for system accounts globally, by ... | ||
| AC-11 |
Device Lock
Key Control
|
Aligned | 2. All PCs, laptops and workstations should be secured with ... |
Acceptable_Use_Policy.docx
|
|
| AC-11 |
Device Lock
Key Control
|
Aligned | Securing workstations (screen lock or logout) prior to leavi... |
Workstation_Security_Policy.docx
|
|
| AC-12 |
Session Termination
|
Gap | Session termination addresses the termination of user-initiated logical sessions (in contrast to SC-... | ||
| AC-14 |
Permitted Actions Without Identification or Authentication
Key Control
|
Aligned | USE OF PERSONAL CELL PHONES AND MOBILE COMMUNICATION DEVICES... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| AC-14 |
Permitted Actions Without Identification or Authentication
Key Control
|
Aligned | 11. Circumventing user authentication or security of any hos... |
Acceptable_Use_Policy.docx
|
|
| AC-16 |
Security and Privacy Attributes
Key Control
|
Aligned | 1. Purpose and Scope... |
Information_Sensitivity_Policy.docx
|
|
| AC-16 |
Security and Privacy Attributes
Key Control
|
Aligned | 3.1 Workforce members using workstations shall consider the ... |
Workstation_Security_Policy.docx
|
|
| AC-17 |
Remote Access
Key Control
|
Aligned | Configuration of Verterim-to-other business connections... |
Information_Sensitivity_Policy.docx
|
|
| AC-17 |
Remote Access
Key Control
|
Aligned | Affecting security breaches or disruptions of network commun... |
Acceptable_Use_Policy.docx
|
|
| AC-17 |
Remote Access
Key Control
|
Aligned | 3.2 Verterim will implement physical and technical safeguard... |
Workstation_Security_Policy.docx
|
|
| AC-18 |
Wireless Access
|
Gap | Wireless technologies include microwave, packet radio (ultra-high frequency or very high frequency),... | ||
| AC-19 |
Access Control for Mobile Devices
Key Control
|
Aligned | USE OF PERSONAL CELL PHONES AND MOBILE COMMUNICATION DEVICES... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| AC-19 |
Access Control for Mobile Devices
Key Control
|
Aligned | Usage restrictions and specific implementation guidance for ... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| AC-2 |
Account Management
Key Control
|
Aligned | Ensuring workstations are used for authorized business purpo... |
Workstation_Security_Policy.docx
|
|
| AC-20 |
Use of External Systems
Key Control
|
Aligned | Configuration of Verterim-to-other business connections... |
Information_Sensitivity_Policy.docx
|
|
| AC-21 |
Information Sharing
Key Control
|
Aligned | Proprietary Information... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| AC-21 |
Information Sharing
Key Control
|
Aligned | Purpose... |
Information_Sensitivity_Policy.docx
|
|
| AC-21 |
Information Sharing
Key Control
|
Aligned | Handling of Potential Evidence... |
Incident_Response_Procedure.docx
|
|
| AC-21 |
Information Sharing
Key Control
|
Aligned | 1. While Verterim desires to provide a reasonable level of p... |
Acceptable_Use_Policy.docx
|
|
| AC-21 |
Information Sharing
Key Control
|
Aligned | 3. Verterim recommends that any information that users consi... |
Acceptable_Use_Policy.docx
|
|
| AC-21 |
Information Sharing
Key Control
|
Aligned | Protection of Associates' Protected Health Information... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| AC-21 |
Information Sharing
Key Control
|
Aligned | 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| AC-22 |
Publicly Accessible Content
Key Control
|
Aligned | Discussion of Confidential Information or Proprietary Inform... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| AC-22 |
Publicly Accessible Content
Key Control
|
Aligned | Purpose... |
Information_Sensitivity_Policy.docx
|
|
| AC-22 |
Publicly Accessible Content
Key Control
|
Aligned | 1. While Verterim desires to provide a reasonable level of p... |
Acceptable_Use_Policy.docx
|
|
| AC-22 |
Publicly Accessible Content
Key Control
|
Aligned | 2. Employees are responsible for exercising good judgment re... |
Acceptable_Use_Policy.docx
|
|
| AC-22 |
Publicly Accessible Content
Key Control
|
Aligned | 3. Verterim recommends that any information that users consi... |
Acceptable_Use_Policy.docx
|
|
| AC-22 |
Publicly Accessible Content
Key Control
|
Aligned | 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| AC-23 |
Data Mining Protection
|
Aligned | Proprietary Information and Confidential Information Protect... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| AC-24 |
Access Control Decisions
|
Gap | Access control decisions (also known as authorization decisions) occur when authorization informatio... | ||
| AC-25 |
Reference Monitor
Key Control
|
Aligned | Section 4 and 5 regarding monitoring and auditing... |
Acceptable_Use_Policy.docx
|
|
| AC-25 |
Reference Monitor
Key Control
|
Aligned | 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| AC-3 |
Access Enforcement
Key Control
|
Aligned | Compliance with policies and requirements concerning Confide... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| AC-3 |
Access Enforcement
Key Control
|
Aligned | To minimize risk to Verterim from an outside business connec... |
Information_Sensitivity_Policy.docx
|
|
| AC-3 |
Access Enforcement
Key Control
|
Aligned | Storage... |
Information_Sensitivity_Policy.docx
|
|
| AC-3 |
Access Enforcement
Key Control
|
Aligned | Circumventing user authentication or security of any host, n... |
Acceptable_Use_Policy.docx
|
|
| AC-3 |
Access Enforcement
Key Control
|
Aligned | 4.0 Policy... |
Acceptable_Use_Policy.docx
|
|
| AC-3 |
Access Enforcement
Key Control
|
Aligned | 2. All PCs, laptops and workstations should be secured with ... |
Acceptable_Use_Policy.docx
|
|
| AC-3 |
Access Enforcement
Key Control
|
Aligned | Access control and accountability... |
Information_Security_Policy.docx
|
|
| AC-3 |
Access Enforcement
Key Control
|
Aligned | 3.1 Workforce members using workstations shall consider the ... |
Workstation_Security_Policy.docx
|
|
| AC-3 |
Access Enforcement
Key Control
|
Aligned | 3.2 Verterim will implement physical and technical safeguard... |
Workstation_Security_Policy.docx
|
|
| AC-3 |
Access Enforcement
Key Control
|
Aligned | 3.2... |
Workstation_Security_Policy.docx
|
|
| AC-4 |
Information Flow Enforcement
Key Control
|
Aligned | Compliance with policies concerning Confidential Information... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| AC-4 |
Information Flow Enforcement
Key Control
|
Aligned | Affecting security breaches or disruptions of network commun... |
Acceptable_Use_Policy.docx
|
|
| AC-5 |
Separation of Duties
Key Control
|
Aligned | 9. Affecting security breaches or disruptions of network com... |
Acceptable_Use_Policy.docx
|
|
| AC-5 |
Separation of Duties
Key Control
|
Aligned | Internal control – defined responsibility and delegation of ... |
Information_Security_Policy.docx
|
|
| AC-6 |
Least Privilege
|
Aligned | Access control and accountability... |
Information_Security_Policy.docx
|
|
| AC-7 |
Unsuccessful Logon Attempts
|
Aligned | Affecting security breaches or disruptions of network commun... |
Acceptable_Use_Policy.docx
|
|
| AC-7 |
Unsuccessful Logon Attempts
|
Aligned | Circumventing user authentication or security of any host, n... |
Acceptable_Use_Policy.docx
|
|
| AC-7 |
Unsuccessful Logon Attempts
|
Aligned | Interfering with or denying service to any user other than t... |
Acceptable_Use_Policy.docx
|
|
| AC-8 |
System Use Notification
|
Gap | System use notifications can be implemented using messages or warning banners displayed before indiv... | ||
| AC-9 |
Previous Logon Notification
|
Gap | Previous logon notification is applicable to system access via human user interfaces and access to s... | ||
| AT-1 |
Policy and Procedures
Key Control
|
Aligned | Awareness and training policy and procedures... |
Acceptable_Use_Policy.docx
|
|
| AT-1 |
Policy and Procedures
Key Control
|
Aligned | Decisions made that contain Information Security, Privacy, o... |
Information_Security_Policy.docx
|
|
| AT-1 |
Policy and Procedures
Key Control
|
Aligned | 1.0 Purpose, 2.0 Scope, 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| AT-2 |
Literacy Training and Awareness
Key Control
|
Gap |
Organizations provide basic and advanced levels of literacy training to system users, including meas...
Critical Gap - Key Control Missing
|
||
| AT-3 |
Role-based Training
Key Control
|
Gap |
Organizations determine the content of training based on the assigned roles and responsibilities of ...
Critical Gap - Key Control Missing
|
||
| AT-4 |
Training Records
Key Control
|
Gap |
Documentation for specialized training may be maintained by individual supervisors at the discretion...
Critical Gap - Key Control Missing
|
||
| AT-6 |
Training Feedback
|
Gap | Training feedback includes awareness training results and role-based training results. Training resu... | ||
| AU-1 |
Policy and Procedures
Key Control
|
Aligned | 1.0 Purpose and 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| AU-10 |
Non-repudiation
|
Aligned | Handling of Potential Evidence... |
Incident_Response_Procedure.docx
|
|
| AU-11 |
Audit Record Retention
Key Control
|
Aligned | Handling of Potential Evidence... |
Incident_Response_Procedure.docx
|
|
| AU-12 |
Audit Record Generation
|
Gap | Audit records can be generated from many different system components. The event types specified in A... | ||
| AU-13 |
Monitoring for Information Disclosure
Key Control
|
Aligned | Proprietary Information Definition and Obligations... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| AU-13 |
Monitoring for Information Disclosure
Key Control
|
Aligned | Information Classification... |
Information_Sensitivity_Policy.docx
|
|
| AU-13 |
Monitoring for Information Disclosure
Key Control
|
Aligned | Protection of Associates' Protected Health Information... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| AU-14 |
Session Audit
Key Control
|
Aligned | Handling of Potential Evidence... |
Incident_Response_Procedure.docx
|
|
| AU-14 |
Session Audit
Key Control
|
Aligned | Section 9 and 10 regarding security breaches and network mon... |
Acceptable_Use_Policy.docx
|
|
| AU-14 |
Session Audit
Key Control
|
Aligned | Personal Use of Business Computer Systems and Communication ... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| AU-16 |
Cross-organizational Audit Logging
Key Control
|
Aligned | In addition, any information gathered that may be of value i... |
Incident_Response_Procedure.docx
|
|
| AU-2 |
Event Logging
Key Control
|
Aligned | In addition, any information gathered that may be of value i... |
Incident_Response_Procedure.docx
|
|
| AU-3 |
Content of Audit Records
Key Control
|
Aligned | In addition, any information gathered that may be of value i... |
Incident_Response_Procedure.docx
|
|
| AU-4 |
Audit Log Storage Capacity
Key Control
|
Aligned | Handling of Potential Evidence... |
Incident_Response_Procedure.docx
|
|
| AU-5 |
Response to Audit Logging Process Failures
Key Control
|
Gap |
Audit logging process failures include software and hardware errors, failures in audit log capturing...
Critical Gap - Key Control Missing
|
||
| AU-6 |
Audit Record Review, Analysis, and Reporting
Key Control
|
Aligned | In addition, any information gathered that may be of value i... |
Incident_Response_Procedure.docx
|
|
| AU-6 |
Audit Record Review, Analysis, and Reporting
Key Control
|
Aligned | Section 4 and 5 regarding monitoring and auditing of network... |
Acceptable_Use_Policy.docx
|
|
| AU-7 |
Audit Record Reduction and Report Generation
Key Control
|
Gap |
Audit record reduction is a process that manipulates collected audit log information and organizes i...
Critical Gap - Key Control Missing
|
||
| AU-8 |
Time Stamps
|
Gap | Time stamps generated by the system include date and time. Time is commonly expressed in Coordinated... | ||
| AU-9 |
Protection of Audit Information
Key Control
|
Aligned | Handling of Potential Evidence... |
Incident_Response_Procedure.docx
|
|
| AU-9 |
Protection of Audit Information
Key Control
|
Aligned | Section 5: Auditing Networks and Systems... |
Acceptable_Use_Policy.docx
|
|
| CA-1 |
Policy and Procedures
Key Control
|
Aligned | Computer Security Incident Response plan... |
Incident_Response_Procedure.docx
|
|
| CA-1 |
Policy and Procedures
Key Control
|
Aligned | Decisions made that contain Information Security, Privacy, o... |
Information_Security_Policy.docx
|
|
| CA-1 |
Policy and Procedures
Key Control
|
Aligned | 1.0 Purpose and 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| CA-2 |
Control Assessments
Key Control
|
Aligned | Review of the Plan... |
Incident_Response_Procedure.docx
|
|
| CA-3 |
Information Exchange
Key Control
|
Aligned | Configuration of Verterim-to-other business connections... |
Information_Sensitivity_Policy.docx
|
|
| CA-5 |
Plan of Action and Milestones
|
Aligned | Business Continuity... |
Information_Security_Policy.docx
|
|
| CA-6 |
Authorization
Key Control
|
Gap |
Authorizations are official management decisions by senior officials to authorize operation of syste...
Critical Gap - Key Control Missing
|
||
| CA-7 |
Continuous Monitoring
Key Control
|
Aligned | Section 4 and 5 regarding monitoring and auditing of network... |
Acceptable_Use_Policy.docx
|
|
| CA-8 |
Penetration Testing
|
Gap | Penetration testing is a specialized type of assessment conducted on systems or individual system co... | ||
| CA-9 |
Internal System Connections
Key Control
|
Gap |
Internal system connections are connections between organizational systems and separate constituent ...
Critical Gap - Key Control Missing
|
||
| CM-1 |
Policy and Procedures
|
Aligned | The ISMS will define processes and standard practices that a... |
Information_Security_Policy.docx
|
|
| CM-1 |
Policy and Procedures
|
Aligned | 1.0 Purpose, 2.0 Scope, 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| CM-10 |
Software Usage Restrictions
Key Control
|
Aligned | Violations of the rights of any person or company protected ... |
Acceptable_Use_Policy.docx
|
|
| CM-10 |
Software Usage Restrictions
Key Control
|
Aligned | Software License Compliance... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| CM-11 |
User-installed Software
Key Control
|
Aligned | Violations of the rights of any person or company protected ... |
Acceptable_Use_Policy.docx
|
|
| CM-11 |
User-installed Software
Key Control
|
Aligned | Unauthorized copying of copyrighted material... |
Acceptable_Use_Policy.docx
|
|
| CM-11 |
User-installed Software
Key Control
|
Aligned | Exporting software, technical information, encryption softwa... |
Acceptable_Use_Policy.docx
|
|
| CM-11 |
User-installed Software
Key Control
|
Aligned | Introduction of malicious code or programs... |
Acceptable_Use_Policy.docx
|
|
| CM-11 |
User-installed Software
Key Control
|
Aligned | Software Installation Policy... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| CM-12 |
Information Location
Key Control
|
Aligned | Purpose and Scope... |
Information_Sensitivity_Policy.docx
|
|
| CM-13 |
Data Action Mapping
Key Control
|
Aligned | 1. While Verterim desires to provide a reasonable level of p... |
Acceptable_Use_Policy.docx
|
|
| CM-13 |
Data Action Mapping
Key Control
|
Aligned | 3. Verterim recommends that any information that users consi... |
Acceptable_Use_Policy.docx
|
|
| CM-13 |
Data Action Mapping
Key Control
|
Aligned | 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| CM-14 |
Signed Components
|
Gap | Software and firmware components prevented from installation unless signed with recognized and appro... | ||
| CM-2 |
Baseline Configuration
|
Gap | Baseline configurations for systems and system components include connectivity, operational, and com... | ||
| CM-3 |
Configuration Change Control
Key Control
|
Aligned | The Security Team reviews the Plan periodically as Verterim ... |
Incident_Response_Procedure.docx
|
|
| CM-4 |
Impact Analyses
Key Control
|
Aligned | 2.1 Events and Incidents... |
Incident_Response_Procedure.docx
|
|
| CM-4 |
Impact Analyses
Key Control
|
Aligned | Decisions made that contain Information Security, Privacy, o... |
Information_Security_Policy.docx
|
|
| CM-5 |
Access Restrictions for Change
Key Control
|
Aligned | 3.1 and 3.2... |
Workstation_Security_Policy.docx
|
|
| CM-6 |
Configuration Settings
|
Gap | Configuration settings are the parameters that can be changed in the hardware, software, or firmware... | ||
| CM-7 |
Least Functionality
|
Aligned | Affecting security breaches or disruptions of network commun... |
Acceptable_Use_Policy.docx
|
|
| CM-8 |
System Component Inventory
Key Control
|
Gap |
System components are discrete, identifiable information technology assets that include hardware, so...
Critical Gap - Key Control Missing
|
||
| CM-9 |
Configuration Management Plan
Key Control
|
Gap |
Configuration management activities occur throughout the system development life cycle. As such, the...
Critical Gap - Key Control Missing
|
||
| CP-1 |
Policy and Procedures
Key Control
|
Aligned | Contingency Planning Policy and Procedures... |
Business_Continuity_Plan.docx
|
|
| CP-1 |
Policy and Procedures
Key Control
|
Aligned | This Computer Security Incident Response plan (the "Plan") d... |
Incident_Response_Procedure.docx
|
|
| CP-1 |
Policy and Procedures
Key Control
|
Aligned | Contingency planning policy and procedures... |
Information_Security_Policy.docx
|
|
| CP-1 |
Policy and Procedures
Key Control
|
Aligned | 1.0 Purpose and 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| CP-10 |
System Recovery and Reconstitution
|
Aligned | Recovery-time objectives... |
Business_Continuity_Plan.docx
|
|
| CP-10 |
System Recovery and Reconstitution
|
Aligned | 4 Recovery... |
Incident_Response_Procedure.docx
|
|
| CP-10 |
System Recovery and Reconstitution
|
Aligned | Business Continuity... |
Information_Security_Policy.docx
|
|
| CP-11 |
Alternate Communications Protocols
|
Aligned | Alternate Communications Between Verterim and Clients, Emplo... |
Business_Continuity_Plan.docx
|
|
| CP-11 |
Alternate Communications Protocols
|
Aligned | Business Continuity... |
Information_Security_Policy.docx
|
|
| CP-12 |
Safe Mode
Key Control
|
Gap |
For systems that support critical mission and business functions—including military operations...
Critical Gap - Key Control Missing
|
||
| CP-13 |
Alternative Security Mechanisms
Key Control
|
Aligned | Our Business Continuity Plan... |
Business_Continuity_Plan.docx
|
|
| CP-13 |
Alternative Security Mechanisms
Key Control
|
Aligned | The timely restoration of service disrupted by a failure wit... |
Information_Security_Policy.docx
|
|
| CP-2 |
Contingency Plan
Key Control
|
Aligned | Our Business Continuity Plan... |
Business_Continuity_Plan.docx
|
|
| CP-2 |
Contingency Plan
Key Control
|
Aligned | Contingency Planning for Systems... |
Incident_Response_Procedure.docx
|
|
| CP-2 |
Contingency Plan
Key Control
|
Aligned | Business Continuity... |
Information_Security_Policy.docx
|
|
| CP-2 |
Contingency Plan
Key Control
|
Aligned | Contingency Planning... |
Information_Security_Policy.docx
|
|
| CP-3 |
Contingency Training
Key Control
|
Aligned | Business Continuity... |
Information_Security_Policy.docx
|
|
| CP-4 |
Contingency Plan Testing
|
Aligned | Business Continuity... |
Information_Security_Policy.docx
|
|
| CP-6 |
Alternate Storage Site
Key Control
|
Aligned | Our Business Continuity Plan... |
Business_Continuity_Plan.docx
|
|
| CP-6 |
Alternate Storage Site
Key Control
|
Aligned | Business Continuity... |
Information_Security_Policy.docx
|
|
| CP-7 |
Alternate Processing Site
Key Control
|
Aligned | Alternate Communications Between Verterim and Clients, Emplo... |
Business_Continuity_Plan.docx
|
|
| CP-7 |
Alternate Processing Site
Key Control
|
Aligned | Business Continuity... |
Information_Security_Policy.docx
|
|
| CP-8 |
Telecommunications Services
Key Control
|
Aligned | Business Continuity... |
Information_Security_Policy.docx
|
|
| CP-9 |
System Backup
Key Control
|
Aligned | Operational Risk... |
Business_Continuity_Plan.docx
|
|
| CP-9 |
System Backup
Key Control
|
Aligned | Proprietary Information and Confidential Information Protect... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| CP-9 |
System Backup
Key Control
|
Aligned | 3.3.4 Collection of Evidence... |
Incident_Response_Procedure.docx
|
|
| CP-9 |
System Backup
Key Control
|
Aligned | 3.1 and 3.2... |
Workstation_Security_Policy.docx
|
|
| IA-1 |
Policy and Procedures
Key Control
|
Aligned | Decisions made that contain Information Security, Privacy, o... |
Information_Security_Policy.docx
|
|
| IA-1 |
Policy and Procedures
Key Control
|
Aligned | 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| IA-10 |
Adaptive Authentication
|
Aligned | 9. Affecting security breaches or disruptions of network com... |
Acceptable_Use_Policy.docx
|
|
| IA-10 |
Adaptive Authentication
|
Aligned | 11. Circumventing user authentication or security of any hos... |
Acceptable_Use_Policy.docx
|
|
| IA-11 |
Re-authentication
Key Control
|
Gap |
In addition to the re-authentication requirements associated with device locks, organizations may re...
Critical Gap - Key Control Missing
|
||
| IA-12 |
Identity Proofing
Key Control
|
Aligned | Employment Eligibility Verification... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| IA-2 |
Identification and Authentication (Organizational Users)
Key Control
|
Aligned | Identification and Authentication Requirements... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| IA-3 |
Device Identification and Authentication
Key Control
|
Aligned | Section 9-12 regarding security breaches and unauthorized ac... |
Acceptable_Use_Policy.docx
|
|
| IA-4 |
Identifier Management
Key Control
|
Gap |
Common device identifiers include Media Access Control (MAC) addresses, Internet Protocol (IP) addre...
Critical Gap - Key Control Missing
|
||
| IA-5 |
Authenticator Management
Key Control
|
Aligned | One Time Password Authentication... |
Information_Sensitivity_Policy.docx
|
|
| IA-5 |
Authenticator Management
Key Control
|
Aligned | 1. Keep passwords secure and do not share accounts.... |
Acceptable_Use_Policy.docx
|
|
| IA-5 |
Authenticator Management
Key Control
|
Aligned | Authenticator management and issuance... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| IA-5 |
Authenticator Management
Key Control
|
Aligned | Access control and accountability... |
Information_Security_Policy.docx
|
|
| IA-5 |
Authenticator Management
Key Control
|
Aligned | Enabling a password-protected screen saver with a short time... |
Workstation_Security_Policy.docx
|
|
| IA-6 |
Authentication Feedback
|
Gap | Authentication feedback from systems does not provide information that would allow unauthorized indi... | ||
| IA-7 |
Cryptographic Module Authentication
Key Control
|
Aligned | Access control and accountability... |
Information_Security_Policy.docx
|
|
| IA-8 |
Identification and Authentication (Non-organizational Users)
Key Control
|
Gap |
Non-organizational users include system users other than organizational users explicitly covered by ...
Critical Gap - Key Control Missing
|
||
| IA-9 |
Service Identification and Authentication
Key Control
|
Aligned | DocuSign: e-signature processing for legal execution of cont... |
Business_Continuity_Plan.docx
|
|
| IR-1 |
Policy and Procedures
|
Aligned | 1.2 Purpose... |
Incident_Response_Procedure.docx
|
|
| IR-1 |
Policy and Procedures
|
Aligned | Incident Response Policy and Procedures... |
Information_Security_Policy.docx
|
|
| IR-1 |
Policy and Procedures
|
Aligned | 1.0 Purpose, 2.0 Scope, 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| IR-2 |
Incident Response Training
|
Aligned | Incident Response Organization... |
Incident_Response_Procedure.docx
|
|
| IR-3 |
Incident Response Testing
|
Gap | Organizations test incident response capabilities to determine their effectiveness and identify pote... | ||
| IR-4 |
Incident Handling
Key Control
|
Aligned | Incident Response Planning... |
Incident_Response_Procedure.docx
|
|
| IR-4 |
Incident Handling
Key Control
|
Aligned | Section 9-12 regarding security breaches and network disrupt... |
Acceptable_Use_Policy.docx
|
|
| IR-5 |
Incident Monitoring
|
Aligned | 3 Incident Response... |
Incident_Response_Procedure.docx
|
|
| IR-6 |
Incident Reporting
|
Aligned | Incident Reporting Procedures... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| IR-7 |
Incident Response Assistance
|
Aligned | Section 3: Incident Response... |
Incident_Response_Procedure.docx
|
|
| IR-8 |
Incident Response Plan
Key Control
|
Aligned | 3 Incident Response... |
Incident_Response_Procedure.docx
|
|
| IR-9 |
Information Spillage Response
|
Aligned | Affecting security breaches or disruptions of network commun... |
Acceptable_Use_Policy.docx
|
|
| MA-1 |
Policy and Procedures
Key Control
|
Aligned | 3.3.3 Response Activities and 3.3.4 Collection of Evidence... |
Incident_Response_Procedure.docx
|
|
| MA-1 |
Policy and Procedures
Key Control
|
Aligned | 1.0 Purpose and 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| MA-2 |
Controlled Maintenance
Key Control
|
Gap |
Controlling system maintenance addresses the information security aspects of the system maintenance ...
Critical Gap - Key Control Missing
|
||
| MA-3 |
Maintenance Tools
Key Control
|
Gap |
Approving, controlling, monitoring, and reviewing maintenance tools address security-related issues ...
Critical Gap - Key Control Missing
|
||
| MA-4 |
Nonlocal Maintenance
|
Gap | Nonlocal maintenance and diagnostic activities are conducted by individuals who communicate through ... | ||
| MA-5 |
Maintenance Personnel
Key Control
|
Aligned | 3.1 Workforce members using workstations shall consider the ... |
Workstation_Security_Policy.docx
|
|
| MA-6 |
Timely Maintenance
Key Control
|
Aligned | Business Continuity... |
Information_Security_Policy.docx
|
|
| MA-7 |
Field Maintenance
|
Gap | Field maintenance is the type of maintenance conducted on a system or system component after the sys... | ||
| MP-1 |
Policy and Procedures
Key Control
|
Aligned | Purpose and Scope... |
Information_Sensitivity_Policy.docx
|
|
| MP-1 |
Policy and Procedures
Key Control
|
Aligned | Decisions made that contain Information Security, Privacy, o... |
Information_Security_Policy.docx
|
|
| MP-1 |
Policy and Procedures
Key Control
|
Aligned | 1.0 Purpose, 2.0 Scope, 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| MP-1 |
Policy and Procedures
Key Control
|
Aligned | 1. Overview... |
Equipment_Disposal_Policy.docx
|
|
| MP-2 |
Media Access
|
Gap | System media includes digital and non-digital media. Digital media includes flash drives, diskettes,... | ||
| MP-3 |
Media Marking
|
Aligned | Marking is at the discretion of the owner or custodian of th... |
Information_Sensitivity_Policy.docx
|
|
| MP-4 |
Media Storage
Key Control
|
Aligned | Physical Security Measures... |
Information_Sensitivity_Policy.docx
|
|
| MP-4 |
Media Storage
Key Control
|
Aligned | Overview... |
Equipment_Disposal_Policy.docx
|
|
| MP-5 |
Media Transport
Key Control
|
Aligned | In addition, any information gathered that may be of value i... |
Incident_Response_Procedure.docx
|
|
| MP-6 |
Media Sanitization
|
Aligned | Disposal/Destruction... |
Information_Sensitivity_Policy.docx
|
|
| MP-6 |
Media Sanitization
|
Aligned | Overview... |
Equipment_Disposal_Policy.docx
|
|
| MP-7 |
Media Use
Key Control
|
Gap |
System media includes both digital and non-digital media. Digital media includes diskettes, magnetic...
Critical Gap - Key Control Missing
|
||
| MP-8 |
Media Downgrading
|
Aligned | 1. Overview... |
Equipment_Disposal_Policy.docx
|
|
| PE-1 |
Policy and Procedures
Key Control
|
Aligned | 4.0 Policy... |
Acceptable_Use_Policy.docx
|
|
| PE-1 |
Policy and Procedures
Key Control
|
Aligned | 1.0 Purpose and 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| PE-1 |
Policy and Procedures
Key Control
|
Aligned | Overview and Purpose... |
Equipment_Disposal_Policy.docx
|
|
| PE-10 |
Emergency Shutoff
|
Gap | Emergency power shutoff primarily applies to organizational facilities that contain concentrations o... | ||
| PE-11 |
Emergency Power
|
Aligned | Ensuring that all workstations use a surge protector or a UP... |
Workstation_Security_Policy.docx
|
|
| PE-12 |
Emergency Lighting
Key Control
|
Aligned | Business Continuity... |
Information_Security_Policy.docx
|
|
| PE-13 |
Fire Protection
|
Gap | The provision of fire detection and suppression systems applies primarily to organizational faciliti... | ||
| PE-14 |
Environmental Controls
Key Control
|
Gap |
The provision of environmental controls applies primarily to organizational facilities that contain ...
Critical Gap - Key Control Missing
|
||
| PE-15 |
Water Damage Protection
|
Gap | The provision of water damage protection primarily applies to organizational facilities that contain... | ||
| PE-16 |
Delivery and Removal
Key Control
|
Aligned | Access Control Procedures... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| PE-16 |
Delivery and Removal
Key Control
|
Aligned | Restricting physical access to workstations... |
Workstation_Security_Policy.docx
|
|
| PE-17 |
Alternate Work Site
Key Control
|
Aligned | Business Continuity... |
Information_Security_Policy.docx
|
|
| PE-18 |
Location of System Components
Key Control
|
Aligned | 9. Affecting security breaches or disruptions of network com... |
Acceptable_Use_Policy.docx
|
|
| PE-18 |
Location of System Components
Key Control
|
Aligned | Restricting physical access to workstations and securing wor... |
Workstation_Security_Policy.docx
|
|
| PE-19 |
Information Leakage
|
Aligned | Information Classification... |
Information_Sensitivity_Policy.docx
|
|
| PE-19 |
Information Leakage
|
Aligned | Affecting security breaches or disruptions of network commun... |
Acceptable_Use_Policy.docx
|
|
| PE-2 |
Physical Access Authorizations
Key Control
|
Aligned | Physical Access Authorizations... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| PE-2 |
Physical Access Authorizations
Key Control
|
Aligned | 3.2 Verterim will implement physical and technical safeguard... |
Workstation_Security_Policy.docx
|
|
| PE-2 |
Physical Access Authorizations
Key Control
|
Aligned | 3.2 Verterim will implement physical and technical safeguard... |
Workstation_Security_Policy.docx
|
|
| PE-20 |
Asset Monitoring and Tracking
Key Control
|
Gap |
Asset location technologies can help ensure that critical assets—including vehicles, equipment...
Critical Gap - Key Control Missing
|
||
| PE-21 |
Electromagnetic Pulse Protection
|
Gap | An electromagnetic pulse (EMP) is a short burst of electromagnetic energy that is spread over a rang... | ||
| PE-22 |
Component Marking
Key Control
|
Gap |
Hardware components that may require marking include input and output devices. Input devices include...
Critical Gap - Key Control Missing
|
||
| PE-23 |
Facility Location
|
Gap | Physical and environmental hazards include floods, fires, tornadoes, earthquakes, hurricanes, terror... | ||
| PE-3 |
Physical Access Control
Key Control
|
Aligned | Physical Security... |
Information_Sensitivity_Policy.docx
|
|
| PE-3 |
Physical Access Control
Key Control
|
Aligned | Physical Security... |
Information_Sensitivity_Policy.docx
|
|
| PE-3 |
Physical Access Control
Key Control
|
Aligned | Physical Access Control Procedures... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| PE-3 |
Physical Access Control
Key Control
|
Aligned | Restricting physical access to workstations and securing wor... |
Workstation_Security_Policy.docx
|
|
| PE-4 |
Access Control for Transmission
|
Aligned | Physical security... |
Information_Sensitivity_Policy.docx
|
|
| PE-5 |
Access Control for Output Devices
Key Control
|
Aligned | Physical security means either having actual possession of a... |
Information_Sensitivity_Policy.docx
|
|
| PE-5 |
Access Control for Output Devices
Key Control
|
Aligned | Restricting physical access to workstations and ensuring mon... |
Workstation_Security_Policy.docx
|
|
| PE-6 |
Monitoring Physical Access
Key Control
|
Gap |
Physical access monitoring includes publicly accessible areas within organizational facilities. Exam...
Critical Gap - Key Control Missing
|
||
| PE-8 |
Visitor Access Records
Key Control
|
Gap |
Visitor access records include the names and organizations of individuals visiting, visitor signatur...
Critical Gap - Key Control Missing
|
||
| PE-9 |
Power Equipment and Cabling
|
Aligned | Protection of Power Equipment and Cabling... |
Workstation_Security_Policy.docx
|
|
| PL-1 |
Policy and Procedures
|
Aligned | Purpose and Scope... |
Information_Sensitivity_Policy.docx
|
|
| PL-1 |
Policy and Procedures
|
Aligned | 1.1 Audience and 1.2 Purpose... |
Incident_Response_Procedure.docx
|
|
| PL-1 |
Policy and Procedures
|
Aligned | 4.0 Policy... |
Acceptable_Use_Policy.docx
|
|
| PL-1 |
Policy and Procedures
|
Aligned | Decisions made that contain Information Security, Privacy, o... |
Information_Security_Policy.docx
|
|
| PL-1 |
Policy and Procedures
|
Aligned | 1.0 Purpose, 2.0 Scope, 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| PL-10 |
Baseline Selection
Key Control
|
Gap |
Control baselines are predefined sets of controls specifically assembled to address the protection n...
Critical Gap - Key Control Missing
|
||
| PL-11 |
Baseline Tailoring
|
Aligned | The Security Team reviews the Plan periodically as Verterim ... |
Incident_Response_Procedure.docx
|
|
| PL-2 |
System Security and Privacy Plans
|
Aligned | Section 2.2 Incident Response Organization... |
Incident_Response_Procedure.docx
|
|
| PL-2 |
System Security and Privacy Plans
|
Aligned | Section 2.1 describes the different types of requirements th... |
Information_Security_Policy.docx
|
|
| PL-4 |
Rules of Behavior
Key Control
|
Aligned | VERTERIM ASSOCIATE CODE OF ETHICS AND BUSINESS CONDUCT... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| PL-4 |
Rules of Behavior
Key Control
|
Aligned | 1. Keep passwords secure and do not share accounts.... |
Acceptable_Use_Policy.docx
|
|
| PL-4 |
Rules of Behavior
Key Control
|
Aligned | 4.0 Policy... |
Acceptable_Use_Policy.docx
|
|
| PL-4 |
Rules of Behavior
Key Control
|
Aligned | Rules for handling keys and passwords... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| PL-7 |
Concept of Operations
Key Control
|
Gap |
The CONOPS may be included in the security or privacy plans for the system or in other system develo...
Critical Gap - Key Control Missing
|
||
| PL-8 |
Security and Privacy Architectures
|
Gap | The security and privacy architectures at the system level are consistent with the organization-wide... | ||
| PL-9 |
Central Management
Key Control
|
Aligned | Consistent execution of well defined processes will be an in... |
Information_Security_Policy.docx
|
|
| PM-1 |
Information Security Program Plan
|
Aligned | Information Security Program... |
Information_Security_Policy.docx
|
|
| PM-10 |
Authorization Process
Key Control
|
Aligned | Integration of Information Security processes into business ... |
Information_Security_Policy.docx
|
|
| PM-11 |
Mission and Business Process Definition
Key Control
|
Aligned | Proprietary Information and Confidential Information Protect... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| PM-11 |
Mission and Business Process Definition
Key Control
|
Aligned | Purpose and Scope... |
Information_Sensitivity_Policy.docx
|
|
| PM-11 |
Mission and Business Process Definition
Key Control
|
Aligned | 2.2 Incident Response Organization... |
Incident_Response_Procedure.docx
|
|
| PM-11 |
Mission and Business Process Definition
Key Control
|
Aligned | 1. While Verterim desires to provide a reasonable level of p... |
Acceptable_Use_Policy.docx
|
|
| PM-11 |
Mission and Business Process Definition
Key Control
|
Aligned | 2. Employees are responsible for exercising good judgment re... |
Acceptable_Use_Policy.docx
|
|
| PM-11 |
Mission and Business Process Definition
Key Control
|
Aligned | 3. Verterim recommends that any information that users consi... |
Acceptable_Use_Policy.docx
|
|
| PM-11 |
Mission and Business Process Definition
Key Control
|
Aligned | Decisions made that contain Information Security, Privacy, o... |
Information_Security_Policy.docx
|
|
| PM-11 |
Mission and Business Process Definition
Key Control
|
Aligned | 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| PM-12 |
Insider Threat Program
Key Control
|
Gap |
Organizations that handle classified information are required, under Executive Order 13587 EO 13587 ...
Critical Gap - Key Control Missing
|
||
| PM-13 |
Security and Privacy Workforce
Key Control
|
Aligned | Commitment to Information Security and the establishment of ... |
Information_Security_Policy.docx
|
|
| PM-14 |
Testing, Training, and Monitoring
|
Aligned | Show active and clear support for the principles of Informat... |
Information_Security_Policy.docx
|
|
| PM-15 |
Security and Privacy Groups and Associations
|
Gap | Ongoing contact with security and privacy groups and associations is important in an environment of ... | ||
| PM-16 |
Threat Awareness Program
|
Aligned | Threat Information Classification... |
Information_Sensitivity_Policy.docx
|
|
| PM-17 |
Protecting Controlled Unclassified Information on External Systems
|
Aligned | Purpose and Scope... |
Information_Sensitivity_Policy.docx
|
|
| PM-18 |
Privacy Program Plan
|
Gap | A privacy program plan is a formal document that provides an overview of an organization’s pri... | ||
| PM-19 |
Privacy Program Leadership Role
|
Gap | The privacy officer is an organizational official. For federal agencies—as defined by applicab... | ||
| PM-2 |
Information Security Program Leadership Role
|
Aligned | Scope... |
Information_Security_Policy.docx
|
|
| PM-20 |
Dissemination of Privacy Program Information
|
Gap | For federal agencies, the webpage is located at www.[agency].gov/privacy. Federal agencies include p... | ||
| PM-21 |
Accounting of Disclosures
Key Control
|
Aligned | Handling of potential evidence... |
Incident_Response_Procedure.docx
|
|
| PM-22 |
Personally Identifiable Information Quality Management
|
Gap | Personally identifiable information quality management includes steps that organizations take to con... | ||
| PM-23 |
Data Governance Body
Key Control
|
Gap |
A Data Governance Body can help ensure that the organization has coherent policies and the ability t...
Critical Gap - Key Control Missing
|
||
| PM-24 |
Data Integrity Board
|
Gap | A Data Integrity Board is the board of senior officials designated by the head of a federal agency a... | ||
| PM-25 |
Minimization of Personally Identifiable Information Used in Testing, Training, and Research
Key Control
|
Aligned | 3.1 Workforce members using workstations shall consider the ... |
Workstation_Security_Policy.docx
|
|
| PM-26 |
Complaint Management
|
Aligned | Complaints of policy violation will be promptly and carefull... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| PM-27 |
Privacy Reporting
Key Control
|
Gap |
Through internal and external reporting, organizations promote accountability and transparency in or...
Critical Gap - Key Control Missing
|
||
| PM-28 |
Risk Framing
|
Gap | Risk framing is most effective when conducted at the organization level and in consultation with sta... | ||
| PM-29 |
Risk Management Program Leadership Roles
|
Gap | The senior accountable official for risk management leads the risk executive (function) in organizat... | ||
| PM-3 |
Information Security and Privacy Resources
|
Aligned | Support for Information Security Principles and Roles and Re... |
Information_Security_Policy.docx
|
|
| PM-30 |
Supply Chain Risk Management Strategy
|
Gap | An organization-wide supply chain risk management strategy includes an unambiguous expression of the... | ||
| PM-31 |
Continuous Monitoring Strategy
Key Control
|
Gap |
Continuous monitoring at the organization level facilitates ongoing awareness of the security and pr...
Critical Gap - Key Control Missing
|
||
| PM-32 |
Purposing
Key Control
|
Aligned | Mission Critical Systems... |
Business_Continuity_Plan.docx
|
|
| PM-4 |
Plan of Action and Milestones Process
|
Gap | The plan of action and milestones is a key organizational document and is subject to reporting requi... | ||
| PM-5 |
System Inventory
|
Gap | OMB A-130 provides guidance on developing systems inventories and associated reporting requirements.... | ||
| PM-6 |
Measures of Performance
|
Aligned | Performance Management and Organizational Capability... |
Information_Security_Policy.docx
|
|
| PM-7 |
Enterprise Architecture
|
Aligned | Integration of Information Security processes into other bus... |
Information_Security_Policy.docx
|
|
| PM-8 |
Critical Infrastructure Plan
|
Aligned | Business Continuity... |
Information_Security_Policy.docx
|
|
| PM-9 |
Risk Management Strategy
|
Aligned | Comprehensive Strategy... |
Information_Security_Policy.docx
|
|
| PS-1 |
Policy and Procedures
Key Control
|
Aligned | 4.0 Policy... |
Acceptable_Use_Policy.docx
|
|
| PS-1 |
Policy and Procedures
Key Control
|
Aligned | Decisions made that contain Information Security, Privacy, o... |
Information_Security_Policy.docx
|
|
| PS-1 |
Policy and Procedures
Key Control
|
Aligned | 1.0 Purpose and 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| PS-2 |
Position Risk Designation
Key Control
|
Aligned | Position risk designations reflect Office of Personnel Manag... |
Workstation_Security_Policy.docx
|
|
| PS-3 |
Personnel Screening
Key Control
|
Gap |
Personnel screening and rescreening activities reflect applicable laws, executive orders, directives...
Critical Gap - Key Control Missing
|
||
| PS-4 |
Personnel Termination
Key Control
|
Aligned | Exit Responsibilities of Associates... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| PS-4 |
Personnel Termination
Key Control
|
Aligned | Exit Interview Process and Return of Property... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| PS-5 |
Personnel Transfer
Key Control
|
Aligned | Personnel Transfer Policy... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| PS-6 |
Access Agreements
|
Gap | Access agreements include nondisclosure agreements, acceptable use agreements, rules of behavior, an... | ||
| PS-7 |
External Personnel Security
Key Control
|
Aligned | 3.0 Scope... |
Acceptable_Use_Policy.docx
|
|
| PS-7 |
External Personnel Security
Key Control
|
Aligned | Personnel controls and Contractual controls... |
Information_Security_Policy.docx
|
|
| PS-7 |
External Personnel Security
Key Control
|
Aligned | All Vendors / Suppliers that provide software and/or Service... |
Ethical_Sourcing_Policy.docx
|
|
| PS-8 |
Personnel Sanctions
Key Control
|
Aligned | PAYMENTS TO GOVERNMENT OFFICIALS... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| PS-8 |
Personnel Sanctions
Key Control
|
Aligned | Penalty for deliberate or inadvertent disclosure... |
Information_Sensitivity_Policy.docx
|
|
| PS-8 |
Personnel Sanctions
Key Control
|
Aligned | Enforcement... |
Information_Sensitivity_Policy.docx
|
|
| PS-8 |
Personnel Sanctions
Key Control
|
Aligned | Enforcement of Policies... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| PS-8 |
Personnel Sanctions
Key Control
|
Aligned | Disciplinary Actions... |
Information_Security_Policy.docx
|
|
| PS-9 |
Position Descriptions
Key Control
|
Aligned | Decisions made that contain Information Security, Privacy, o... |
Information_Security_Policy.docx
|
|
| PT-1 |
Policy and Procedures
Key Control
|
Aligned | 2.2 Incident Response Organization... |
Incident_Response_Procedure.docx
|
|
| PT-1 |
Policy and Procedures
Key Control
|
Aligned | 1. While Verterim desires to provide a reasonable level of p... |
Acceptable_Use_Policy.docx
|
|
| PT-1 |
Policy and Procedures
Key Control
|
Aligned | 2. Employees are responsible for exercising good judgment re... |
Acceptable_Use_Policy.docx
|
|
| PT-1 |
Policy and Procedures
Key Control
|
Aligned | 3. Verterim recommends that any information that users consi... |
Acceptable_Use_Policy.docx
|
|
| PT-1 |
Policy and Procedures
Key Control
|
Aligned | Decisions made that contain Information Security, Privacy, o... |
Information_Security_Policy.docx
|
|
| PT-1 |
Policy and Procedures
Key Control
|
Aligned | 1.0 Purpose, 2.0 Scope, 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| PT-2 |
Authority to Process Personally Identifiable Information
Key Control
|
Aligned | In addition, any information gathered that may be of value i... |
Incident_Response_Procedure.docx
|
|
| PT-2 |
Authority to Process Personally Identifiable Information
Key Control
|
Aligned | Processing of Personally Identifiable Information... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| PT-2 |
Authority to Process Personally Identifiable Information
Key Control
|
Aligned | 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| PT-3 |
Personally Identifiable Information Processing Purposes
Key Control
|
Gap |
Identifying and documenting the purpose for processing provides organizations with a basis for under...
Critical Gap - Key Control Missing
|
||
| PT-4 |
Consent
|
Gap | Consent allows individuals to participate in making decisions about the processing of their informat... | ||
| PT-5 |
Privacy Notice
Key Control
|
Gap |
Privacy notices help inform individuals about how their personally identifiable information is being...
Critical Gap - Key Control Missing
|
||
| PT-6 |
System of Records Notice
|
Gap | The PRIVACT requires that federal agencies publish a system of records notice in the Federal Registe... | ||
| PT-7 |
Specific Categories of Personally Identifiable Information
Key Control
|
Aligned | 1. While Verterim desires to provide a reasonable level of p... |
Acceptable_Use_Policy.docx
|
|
| PT-7 |
Specific Categories of Personally Identifiable Information
Key Control
|
Aligned | 3. Verterim recommends that any information that users consi... |
Acceptable_Use_Policy.docx
|
|
| PT-7 |
Specific Categories of Personally Identifiable Information
Key Control
|
Aligned | Protection of Associates’ Protected Health Information... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| PT-7 |
Specific Categories of Personally Identifiable Information
Key Control
|
Aligned | 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| PT-8 |
Computer Matching Requirements
|
Gap | The PRIVACT establishes requirements for federal and non-federal agencies if they engage in a matchi... | ||
| RA-1 |
Policy and Procedures
Key Control
|
Aligned | Decisions made that contain Information Security, Privacy, o... |
Information_Security_Policy.docx
|
|
| RA-1 |
Policy and Procedures
Key Control
|
Aligned | 1.0 Purpose and 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| RA-10 |
Threat Hunting
|
Aligned | Response Objectives... |
Incident_Response_Procedure.docx
|
|
| RA-2 |
Security Categorization
|
Aligned | Purpose and Scope... |
Information_Sensitivity_Policy.docx
|
|
| RA-2 |
Security Categorization
|
Aligned | Incident Response Organization... |
Incident_Response_Procedure.docx
|
|
| RA-2 |
Security Categorization
|
Aligned | Purpose... |
Information_Security_Policy.docx
|
|
| RA-2 |
Security Categorization
|
Aligned | 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| RA-3 |
Risk Assessment
Key Control
|
Gap |
Risk assessments consider threats, vulnerabilities, likelihood, and impact to organizational operati...
Critical Gap - Key Control Missing
|
||
| RA-5 |
Vulnerability Monitoring and Scanning
|
Gap | Security categorization of information and systems guides the frequency and comprehensiveness of vul... | ||
| RA-6 |
Technical Surveillance Countermeasures Survey
|
Gap | A technical surveillance countermeasures survey is a service provided by qualified personnel to dete... | ||
| RA-7 |
Risk Response
|
Aligned | Response Team Decision-Making... |
Incident_Response_Procedure.docx
|
|
| RA-8 |
Privacy Impact Assessments
|
Gap | A privacy impact assessment is an analysis of how personally identifiable information is handled to ... | ||
| RA-9 |
Criticality Analysis
Key Control
|
Gap |
Not all system components, functions, or services necessarily require significant protections. For e...
Critical Gap - Key Control Missing
|
||
| SA-1 |
Policy and Procedures
Key Control
|
Aligned | Controls... |
Information_Security_Policy.docx
|
|
| SA-1 |
Policy and Procedures
Key Control
|
Aligned | 1.0 Purpose, 2.0 Scope, 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| SA-10 |
Developer Configuration Management
Key Control
|
Gap |
Organizations consider the quality and completeness of configuration management activities conducted...
Critical Gap - Key Control Missing
|
||
| SA-11 |
Developer Testing and Evaluation
|
Aligned | Security Team reviews the Plan periodically... |
Incident_Response_Procedure.docx
|
|
| SA-15 |
Development Process, Standards, and Tools
Key Control
|
Aligned | Information Security Management System (ISMS) Processes... |
Information_Security_Policy.docx
|
|
| SA-16 |
Developer-provided Training
|
Gap | Developer-provided training applies to external and internal (in-house) developers. Training personn... | ||
| SA-17 |
Developer Security and Privacy Architecture and Design
|
Gap | Developer security and privacy architecture and design are directed at external developers, although... | ||
| SA-2 |
Allocation of Resources
Key Control
|
Aligned | Resource allocation for information security and privacy... |
Information_Security_Policy.docx
|
|
| SA-20 |
Customized Development of Critical Components
Key Control
|
Gap |
Organizations determine that certain system components likely cannot be trusted due to specific thre...
Critical Gap - Key Control Missing
|
||
| SA-21 |
Developer Screening
Key Control
|
Gap |
Developer screening is directed at external developers. Internal developer screening is addressed by...
Critical Gap - Key Control Missing
|
||
| SA-22 |
Unsupported System Components
Key Control
|
Gap |
Support for system components includes software patches, firmware updates, replacement parts, and ma...
Critical Gap - Key Control Missing
|
||
| SA-23 |
Specialization
Key Control
|
Gap |
It is often necessary for a system or system component that supports mission-essential services or f...
Critical Gap - Key Control Missing
|
||
| SA-3 |
System Development Life Cycle
Key Control
|
Aligned | Consistent execution of well defined processes will be an in... |
Information_Security_Policy.docx
|
|
| SA-4 |
Acquisition Process
|
Aligned | Controls... |
Information_Security_Policy.docx
|
|
| SA-5 |
System Documentation
|
Aligned | 3.3.4 Collection of Evidence... |
Incident_Response_Procedure.docx
|
|
| SA-8 |
Security and Privacy Engineering Principles
|
Aligned | Information Security Management System (ISMS) Processes... |
Information_Security_Policy.docx
|
|
| SA-8 |
Security and Privacy Engineering Principles
|
Aligned | Where feasible and efficient, Information Security processes... |
Information_Security_Policy.docx
|
|
| SA-9 |
External System Services
Key Control
|
Aligned | Establishing relationships with external service providers... |
Business_Continuity_Plan.docx
|
|
| SC-1 |
Policy and Procedures
|
Aligned | System and communications protection policy and procedures... |
Business_Continuity_Plan.docx
|
|
| SC-1 |
Policy and Procedures
|
Aligned | 2.2 Incident Response Organization... |
Incident_Response_Procedure.docx
|
|
| SC-1 |
Policy and Procedures
|
Aligned | 4.0 Policy... |
Acceptable_Use_Policy.docx
|
|
| SC-1 |
Policy and Procedures
|
Aligned | Decisions made that contain Information Security, Privacy, o... |
Information_Security_Policy.docx
|
|
| SC-1 |
Policy and Procedures
|
Aligned | 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| SC-10 |
Network Disconnect
|
Gap | Network disconnect applies to internal and external networks. Terminating network connections associ... | ||
| SC-11 |
Trusted Path
|
Gap | Trusted paths are mechanisms by which users can communicate (using input devices such as keyboards) ... | ||
| SC-12 |
Cryptographic Key Establishment and Management
|
Aligned | Section 3: Encryption Recommendations... |
Acceptable_Use_Policy.docx
|
|
| SC-12 |
Cryptographic Key Establishment and Management
|
Aligned | Cryptographic controls... |
Information_Security_Policy.docx
|
|
| SC-12 |
Cryptographic Key Establishment and Management
|
Aligned | 3.0 Policy... |
Acceptable_Encryption_Policy.docx
|
|
| SC-13 |
Cryptographic Protection
|
Aligned | Approved Encrypted email and files... |
Information_Sensitivity_Policy.docx
|
|
| SC-13 |
Cryptographic Protection
|
Aligned | Section 3: Encryption Recommendations... |
Acceptable_Use_Policy.docx
|
|
| SC-13 |
Cryptographic Protection
|
Aligned | 3.0 Policy... |
Acceptable_Encryption_Policy.docx
|
|
| SC-15 |
Collaborative Computing Devices and Applications
|
Gap | Collaborative computing devices and applications include remote meeting devices and applications, ne... | ||
| SC-16 |
Transmission of Security and Privacy Attributes
Key Control
|
Aligned | Proprietary Information and Confidential Information... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| SC-16 |
Transmission of Security and Privacy Attributes
Key Control
|
Aligned | Purpose and Scope... |
Information_Sensitivity_Policy.docx
|
|
| SC-16 |
Transmission of Security and Privacy Attributes
Key Control
|
Aligned | 1. While Verterim desires to provide a reasonable level of p... |
Acceptable_Use_Policy.docx
|
|
| SC-16 |
Transmission of Security and Privacy Attributes
Key Control
|
Aligned | Privacy and Confidentiality of Protected Health Information... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| SC-16 |
Transmission of Security and Privacy Attributes
Key Control
|
Aligned | 3.1 Workforce members using workstations shall consider the ... |
Workstation_Security_Policy.docx
|
|
| SC-17 |
Public Key Infrastructure Certificates
|
Gap | Public key infrastructure (PKI) certificates are certificates with visibility external to organizati... | ||
| SC-18 |
Mobile Code
|
Gap | Mobile code includes any program, application, or content that can be transmitted across a network (... | ||
| SC-2 |
Separation of System and User Functionality
|
Gap | System management functionality includes functions that are necessary to administer databases, netwo... | ||
| SC-20 |
Secure Name/Address Resolution Service (Authoritative Source)
Key Control
|
Gap |
Providing authoritative source information enables external clients, including remote Internet clien...
Critical Gap - Key Control Missing
|
||
| SC-21 |
Secure Name/Address Resolution Service (Recursive or Caching Resolver)
|
Gap | Each client of name resolution services either performs this validation on its own or has authentica... | ||
| SC-22 |
Architecture and Provisioning for Name/Address Resolution Service
|
Gap | Systems that provide name and address resolution services include domain name system (DNS) servers. ... | ||
| SC-23 |
Session Authenticity
|
Aligned | 9. Affecting security breaches or disruptions of network com... |
Acceptable_Use_Policy.docx
|
|
| SC-24 |
Fail in Known State
|
Aligned | 3.3.4 Collection of Evidence... |
Incident_Response_Procedure.docx
|
|
| SC-24 |
Fail in Known State
|
Aligned | The timely restoration of service disrupted by a failure wit... |
Information_Security_Policy.docx
|
|
| SC-25 |
Thin Nodes
|
Gap | The deployment of system components with minimal functionality reduces the need to secure every endp... | ||
| SC-26 |
Decoys
|
Gap | Decoys (i.e., honeypots, honeynets, or deception nets) are established to attract adversaries and de... | ||
| SC-27 |
Platform-independent Applications
|
Gap | Platforms are combinations of hardware, firmware, and software components used to execute software a... | ||
| SC-28 |
Protection of Information at Rest
Key Control
|
Aligned | Proprietary Information and Confidential Information Protect... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| SC-28 |
Protection of Information at Rest
Key Control
|
Aligned | Verterim and Clients reserve the right to access and disclos... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| SC-28 |
Protection of Information at Rest
Key Control
|
Aligned | 3.1 and 3.2... |
Workstation_Security_Policy.docx
|
|
| SC-29 |
Heterogeneity
|
Gap | Increasing the diversity of information technologies within organizational systems reduces the impac... | ||
| SC-3 |
Security Function Isolation
|
Gap | Security functions are isolated from nonsecurity functions by means of an isolation boundary impleme... | ||
| SC-30 |
Concealment and Misdirection
|
Gap | Concealment and misdirection techniques can significantly reduce the targeting capabilities of adver... | ||
| SC-31 |
Covert Channel Analysis
|
Aligned | 9. Affecting security breaches or disruptions of network com... |
Acceptable_Use_Policy.docx
|
|
| SC-32 |
System Partitioning
|
Gap | System partitioning is part of a defense-in-depth protection strategy. Organizations determine the d... | ||
| SC-34 |
Non-modifiable Executable Programs
Key Control
|
Gap |
The operating environment for a system contains the code that hosts applications, including operatin...
Critical Gap - Key Control Missing
|
||
| SC-35 |
External Malicious Code Identification
|
Gap | External malicious code identification differs from decoys in SC-26 in that the components actively ... | ||
| SC-36 |
Distributed Processing and Storage
Key Control
|
Gap |
Distributing processing and storage across multiple physical locations or logical domains provides a...
Critical Gap - Key Control Missing
|
||
| SC-37 |
Out-of-band Channels
Key Control
|
Aligned | Distribution outside of Verterim internal mail... |
Information_Sensitivity_Policy.docx
|
|
| SC-37 |
Out-of-band Channels
Key Control
|
Aligned | Electronic distribution... |
Information_Sensitivity_Policy.docx
|
|
| SC-38 |
Operations Security
|
Aligned | Proprietary Information... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| SC-38 |
Operations Security
|
Aligned | Purpose... |
Information_Sensitivity_Policy.docx
|
|
| SC-38 |
Operations Security
|
Aligned | 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| SC-39 |
Process Isolation
|
Gap | Systems can maintain separate execution domains for each executing process by assigning each process... | ||
| SC-4 |
Information in Shared System Resources
Key Control
|
Aligned | 9. Affecting security breaches or disruptions of network com... |
Acceptable_Use_Policy.docx
|
|
| SC-4 |
Information in Shared System Resources
Key Control
|
Aligned | Overview... |
Equipment_Disposal_Policy.docx
|
|
| SC-40 |
Wireless Link Protection
|
Aligned | 9. Affecting security breaches or disruptions of network com... |
Acceptable_Use_Policy.docx
|
|
| SC-41 |
Port and I/O Device Access
|
Gap | Connection ports include Universal Serial Bus (USB), Thunderbolt, and Firewire (IEEE 1394). Input/ou... | ||
| SC-42 |
Sensor Capability and Data
Key Control
|
Aligned | USE OF PERSONAL CELL PHONES AND MOBILE COMMUNICATION DEVICES... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| SC-42 |
Sensor Capability and Data
Key Control
|
Aligned | Use of personal cell phones and other mobile communication d... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| SC-43 |
Usage Restrictions
Key Control
|
Aligned | USE OF PERSONAL CELL PHONES AND MOBILE COMMUNICATION DEVICES... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| SC-43 |
Usage Restrictions
Key Control
|
Aligned | 4.3. Unacceptable Use... |
Acceptable_Use_Policy.docx
|
|
| SC-44 |
Detonation Chambers
|
Gap | Detonation chambers, also known as dynamic execution environments, allow organizations to open email... | ||
| SC-45 |
System Time Synchronization
|
Gap | Time synchronization of system clocks is essential for the correct execution of many system services... | ||
| SC-46 |
Cross Domain Policy Enforcement
Key Control
|
Aligned | Section 9-12 regarding security breaches and network monitor... |
Acceptable_Use_Policy.docx
|
|
| SC-47 |
Alternate Communications Paths
|
Aligned | Alternate Communications Between Verterim and Clients, Emplo... |
Business_Continuity_Plan.docx
|
|
| SC-47 |
Alternate Communications Paths
|
Aligned | Response Team Coordination... |
Incident_Response_Procedure.docx
|
|
| SC-47 |
Alternate Communications Paths
|
Aligned | Affecting security breaches or disruptions of network commun... |
Acceptable_Use_Policy.docx
|
|
| SC-47 |
Alternate Communications Paths
|
Aligned | The timely restoration of service disrupted by a failure wit... |
Information_Security_Policy.docx
|
|
| SC-48 |
Sensor Relocation
Key Control
|
Aligned | Affecting security breaches or disruptions of network commun... |
Acceptable_Use_Policy.docx
|
|
| SC-49 |
Hardware-enforced Separation and Policy Enforcement
Key Control
|
Gap |
System owners may require additional strength of mechanism and robustness to ensure domain separatio...
Critical Gap - Key Control Missing
|
||
| SC-5 |
Denial-of-service Protection
|
Aligned | Affecting security breaches or disruptions of network commun... |
Acceptable_Use_Policy.docx
|
|
| SC-5 |
Denial-of-service Protection
|
Aligned | Interfering with or denying service to any user other than t... |
Acceptable_Use_Policy.docx
|
|
| SC-50 |
Software-enforced Separation and Policy Enforcement
Key Control
|
Gap |
System owners may require additional strength of mechanism to ensure domain separation and policy en...
Critical Gap - Key Control Missing
|
||
| SC-51 |
Hardware-based Protection
|
Gap | None.... | ||
| SC-6 |
Resource Availability
|
Gap | Priority protection prevents lower-priority processes from delaying or interfering with the system t... | ||
| SC-7 |
Boundary Protection
Key Control
|
Aligned | Configuration of Verterim-to-other business connections... |
Information_Sensitivity_Policy.docx
|
|
| SC-7 |
Boundary Protection
Key Control
|
Aligned | Section 9: Affecting security breaches or disruptions of net... |
Acceptable_Use_Policy.docx
|
|
| SC-7 |
Boundary Protection
Key Control
|
Aligned | Section 11: Circumventing user authentication or security of... |
Acceptable_Use_Policy.docx
|
|
| SC-7 |
Boundary Protection
Key Control
|
Aligned | Section 12: Interfering with or denying service to any user ... |
Acceptable_Use_Policy.docx
|
|
| SC-7 |
Boundary Protection
Key Control
|
Aligned | Zones and gateways – physical and network security, and remo... |
Information_Security_Policy.docx
|
|
| SC-8 |
Transmission Confidentiality and Integrity
Key Control
|
Aligned | Operational Risk... |
Business_Continuity_Plan.docx
|
|
| SC-8 |
Transmission Confidentiality and Integrity
Key Control
|
Aligned | Verterim Confidential... |
Information_Sensitivity_Policy.docx
|
|
| SC-8 |
Transmission Confidentiality and Integrity
Key Control
|
Aligned | Section 3: Verterim recommends that any information that use... |
Acceptable_Use_Policy.docx
|
|
| SI-1 |
Policy and Procedures
Key Control
|
Aligned | 2.2 Incident Response Organization... |
Incident_Response_Procedure.docx
|
|
| SI-1 |
Policy and Procedures
Key Control
|
Aligned | 4.0 Policy... |
Acceptable_Use_Policy.docx
|
|
| SI-1 |
Policy and Procedures
Key Control
|
Aligned | Support for Information Security principles and integration ... |
Information_Security_Policy.docx
|
|
| SI-1 |
Policy and Procedures
Key Control
|
Aligned | 1.0 Purpose and 3.0 Policy... |
Workstation_Security_Policy.docx
|
|
| SI-10 |
Information Input Validation
|
Gap | Checking the valid syntax and semantics of system inputs—including character set, length, nume... | ||
| SI-11 |
Error Handling
|
Gap | Organizations consider the structure and content of error messages. The extent to which systems can ... | ||
| SI-12 |
Information Management and Retention
|
Aligned | Records Management and Backup Procedures... |
Business_Continuity_Plan.docx
|
|
| SI-12 |
Information Management and Retention
|
Aligned | VERTERIM ASSOCIATE CODE OF ETHICS AND BUSINESS CONDUCT... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| SI-12 |
Information Management and Retention
|
Aligned | Storage and Disposal/Destruction... |
Information_Sensitivity_Policy.docx
|
|
| SI-12 |
Information Management and Retention
|
Aligned | 3.3.5 Notification... |
Incident_Response_Procedure.docx
|
|
| SI-13 |
Predictable Failure Prevention
Key Control
|
Aligned | Business Continuity... |
Information_Security_Policy.docx
|
|
| SI-14 |
Non-persistence
|
Gap | Implementation of non-persistent components and services mitigates risk from advanced persistent thr... | ||
| SI-15 |
Information Output Filtering
|
Gap | Certain types of attacks, including SQL injections, produce output results that are unexpected or in... | ||
| SI-16 |
Memory Protection
|
Gap | Some adversaries launch attacks with the intent of executing code in non-executable regions of memor... | ||
| SI-17 |
Fail-safe Procedures
Key Control
|
Aligned | Business Continuity... |
Information_Security_Policy.docx
|
|
| SI-18 |
Personally Identifiable Information Quality Operations
Key Control
|
Aligned | Handling of Associates’ protected health information... |
01_-_Handbook_-_Verterim_-_10182019.pdf
|
|
| SI-18 |
Personally Identifiable Information Quality Operations
Key Control
|
Aligned | 3.1 Workforce members using workstations shall consider the ... |
Workstation_Security_Policy.docx
|
|
| SI-19 |
De-identification
|
Gap | De-identification is the general term for the process of removing the association between a set of i... | ||
| SI-2 |
Flaw Remediation
Key Control
|
Gap |
The need to remediate system flaws applies to all types of software and firmware. Organizations iden...
Critical Gap - Key Control Missing
|
||
| SI-20 |
Tainting
|
Aligned | 2.2 Incident Response Organization... |
Incident_Response_Procedure.docx
|
|
| SI-20 |
Tainting
|
Aligned | Affecting security breaches or disruptions of network commun... |
Acceptable_Use_Policy.docx
|
|
| SI-21 |
Information Refresh
|
Gap | Retaining information for longer than it is needed makes it an increasingly valuable and enticing ta... | ||
| SI-22 |
Information Diversity
Key Control
|
Gap |
Actions taken by a system service or a function are often driven by the information it receives. Cor...
Critical Gap - Key Control Missing
|
||
| SI-23 |
Information Fragmentation
|
Gap | One objective of the advanced persistent threat is to exfiltrate valuable information. Once exfiltra... | ||
| SI-3 |
Malicious Code Protection
|
Aligned | Section 9-12 regarding security breaches and disruptions of ... |
Acceptable_Use_Policy.docx
|
|
| SI-4 |
System Monitoring
|
Aligned | 3.3.4 Collection of Evidence... |
Incident_Response_Procedure.docx
|
|
| SI-4 |
System Monitoring
|
Aligned | Affecting security breaches or disruptions of network commun... |
Acceptable_Use_Policy.docx
|
|
| SI-4 |
System Monitoring
|
Aligned | Operations controls... |
Information_Security_Policy.docx
|
|
| SI-5 |
Security Alerts, Advisories, and Directives
Key Control
|
Aligned | Incident Response Objectives... |
Incident_Response_Procedure.docx
|
|
| SI-6 |
Security and Privacy Function Verification
Key Control
|
Gap |
Transitional states for systems include system startup, restart, shutdown, and abort. System notific...
Critical Gap - Key Control Missing
|
||
| SI-7 |
Software, Firmware, and Information Integrity
Key Control
|
Gap |
Unauthorized changes to software, firmware, and information can occur due to errors or malicious act...
Critical Gap - Key Control Missing
|
||
| SI-8 |
Spam Protection
Key Control
|
Aligned | Email and Communications Activities... |
Acceptable_Use_Policy.docx
|
|
| SR-1 |
Policy and Procedures
Key Control
|
Aligned | Decisions made that contain Information Security, Privacy, o... |
Information_Security_Policy.docx
|
|
| SR-10 |
Inspection of Systems or Components
|
Gap | The inspection of systems or systems components for tamper resistance and detection addresses physic... | ||
| SR-11 |
Component Authenticity
|
Aligned | Section 4: Introduction of malicious code or programs... |
Acceptable_Use_Policy.docx
|
|
| SR-12 |
Component Disposal
Key Control
|
Aligned | Disposal/Destruction... |
Information_Sensitivity_Policy.docx
|
|
| SR-12 |
Component Disposal
Key Control
|
Aligned | Overview... |
Equipment_Disposal_Policy.docx
|
|
| SR-2 |
Supply Chain Risk Management Plan
Key Control
|
Aligned | Supply Chain Risk Management Policy... |
Ethical_Sourcing_Policy.docx
|
|
| SR-3 |
Supply Chain Controls and Processes
Key Control
|
Aligned | 3.5 Working Conditions... |
Ethical_Sourcing_Policy.docx
|
|
| SR-4 |
Provenance
Key Control
|
Aligned | 3.3.4 Collection of Evidence... |
Incident_Response_Procedure.docx
|
|
| SR-5 |
Acquisition Strategies, Tools, and Methods
Key Control
|
Gap |
The use of the acquisition process provides an important vehicle to protect the supply chain. There ...
Critical Gap - Key Control Missing
|
||
| SR-6 |
Supplier Assessments and Reviews
Key Control
|
Aligned | Assessment and review of supplier risk... |
Business_Continuity_Plan.docx
|
|
| SR-7 |
Supply Chain Operations Security
Key Control
|
Aligned | Proprietary Information and Confidential Information Protect... |
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf
|
|
| SR-8 |
Notification Agreements
Key Control
|
Aligned | Communication with Critical Business Constituents... |
Business_Continuity_Plan.docx
|
|
| SR-9 |
Tamper Resistance and Detection
|
Gap | Anti-tamper technologies, tools, and techniques provide a level of protection for systems, system co... | ||
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf CIS
1 matches foundDocument Content
Matched Section
Section: Proprietary Information and Confidential Information
Content: • Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information. Proprietary Information shall include, without limitation, trade secrets and information regarding VERTERIM or a Client’s: (1) business; (2) financial performance, if it is not already generally publically available; (3) customers; (4) products, services, and pricing; (5) patents and other intellectual property; (6) systems plans and information; (7) data centers or other property information; (8) passwords and computer programs; (9) business plans; (10) marketing plans, strategies, and costs; and (11) potential acquisitions and divestitures. Proprietary Information may, but need not, be confidential.
Content: • Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information. Proprietary Information shall include, without limitation, trade secrets and information regarding VERTERIM or a Client’s: (1) business; (2) financial performance, if it is not already generally publically available; (3) customers; (4) products, services, and pricing; (5) patents and other intellectual property; (6) systems plans and information; (7) data centers or other property information; (8) passwords and computer programs; (9) business plans; (10) marketing plans, strategies, and costs; and (11) potential acquisitions and divestitures. Proprietary Information may, but need not, be confidential.
AI Justification
The text discusses the classification of Proprietary Information and Confidential Information, which aligns with establishing a data classification scheme.
01_-_Handbook_-_Verterim_-_10182019.pdf CIS
0 matches foundNo detailed analysis available for this document.
Acceptable_Use_Policy.docx CIS
3 matches foundDocument Content
Matched Section
Section: Guidelines on information classification
Content: Verterim recommends that any information that users consider sensitive or vulnerable be encrypted. For guidelines on information classification, see Verterim's Information Sensitivity Policy.
Content: Verterim recommends that any information that users consider sensitive or vulnerable be encrypted. For guidelines on information classification, see Verterim's Information Sensitivity Policy.
AI Justification
The chunk discusses the importance of classifying sensitive information and refers to Verterim's Information Sensitivity Policy, which aligns with the establishment and maintenance of a data classification scheme.
Document Content
Matched Section
Section: Section 3: Recommendations on Sensitive Data
Content: Verterim recommends that any information that users consider sensitive or vulnerable be encrypted. For guidelines on information classification, see Verterim's Information Sensitivity Policy. For guidelines on encrypting email and documents, see Verterim’s Acceptable Encryption Policy.
Content: Verterim recommends that any information that users consider sensitive or vulnerable be encrypted. For guidelines on information classification, see Verterim's Information Sensitivity Policy. For guidelines on encrypting email and documents, see Verterim’s Acceptable Encryption Policy.
AI Justification
The text recommends encrypting sensitive or vulnerable information, which aligns with the control's focus on encryption of sensitive data.
Document Content
Matched Section
Section: Section 2: Automatic Session Locking
Content: All PCs, laptops and workstations should be secured with a password-protected screensaver with the automatic activation feature set at 10 minutes or less, or by logging-off when the host will be unattended.
Content: All PCs, laptops and workstations should be secured with a password-protected screensaver with the automatic activation feature set at 10 minutes or less, or by logging-off when the host will be unattended.
AI Justification
The chunk specifies that PCs, laptops, and workstations should have a password-protected screensaver with automatic activation set at 10 minutes or less, which aligns with the requirement for configuring automatic session locking after a defined period of inactivity.
Business_Continuity_Plan.docx CIS
0 matches foundNo detailed analysis available for this document.
Equipment_Disposal_Policy.docx CIS
2 matches foundDocument Content
Matched Section
Section: Overview and Purpose
Content: Technology equipment often contains parts, which cannot simply be thrown away. Proper disposal of equipment is both environmentally responsible and often required by law. In addition, hard drives, USB drives, CD-ROMs and other storage media contain various kinds of Verterim data, some of which is considered sensitive. In order to protect our constituent’s data, all storage mediums must be properly erased before being disposed of.
Content: Technology equipment often contains parts, which cannot simply be thrown away. Proper disposal of equipment is both environmentally responsible and often required by law. In addition, hard drives, USB drives, CD-ROMs and other storage media contain various kinds of Verterim data, some of which is considered sensitive. In order to protect our constituent’s data, all storage mediums must be properly erased before being disposed of.
AI Justification
The text discusses the proper disposal of technology equipment and the need to securely erase sensitive data, which aligns with the requirement to establish a documented data management process that includes handling of data and disposal requirements.
Document Content
Matched Section
Section: Overview
Content: Technology equipment often contains parts, which cannot simply be thrown away. Proper disposal of equipment is both environmentally responsible and often required by law. In addition, hard drives, USB drives, CD-ROMs and other storage media contain various kinds of Verterim data, some of which is considered sensitive. In order to protect our constituent’s data, all storage mediums must be properly erased before being disposed of. However, simply deleting or even formatting data is not considered sufficient. When deleting files or formatting a device, data is marked for deletion, but is still accessible until being overwritten by a new file. Therefore, special tools must be used to securely erase data prior to equipment disposal.
Content: Technology equipment often contains parts, which cannot simply be thrown away. Proper disposal of equipment is both environmentally responsible and often required by law. In addition, hard drives, USB drives, CD-ROMs and other storage media contain various kinds of Verterim data, some of which is considered sensitive. In order to protect our constituent’s data, all storage mediums must be properly erased before being disposed of. However, simply deleting or even formatting data is not considered sufficient. When deleting files or formatting a device, data is marked for deletion, but is still accessible until being overwritten by a new file. Therefore, special tools must be used to securely erase data prior to equipment disposal.
AI Justification
The text discusses the proper disposal of technology equipment and emphasizes the need for securely erasing data before disposal, aligning with the requirement to securely dispose of data as outlined in the enterprise’s documented data management process.
Information_Security_Policy.docx CIS
0 matches foundNo detailed analysis available for this document.
Workstation_Security_Policy.docx CIS
0 matches foundNo detailed analysis available for this document.
Incident_Response_Procedure.docx CIS
1 matches foundDocument Content
Matched Section
Section: Handling of Information for Legal Proceedings
Content: In addition, any information gathered that may be of value in future legal proceedings should be handled as follows: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
Content: In addition, any information gathered that may be of value in future legal proceedings should be handled as follows: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
AI Justification
The text explicitly mentions that all information must be logged, including actions taken with potential evidence, which aligns with the requirement to log sensitive data access.
Information_Sensitivity_Policy.docx CIS
4 matches foundDocument Content
Matched Section
Section: Storage and Disposal/Destruction
Content: Individual access controls are very highly recommended for electronic information. Physical security is generally used, and information should be stored in a physically secured computer. Strongly Encouraged: In specially marked disposal bins on Verterim premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.
Content: Individual access controls are very highly recommended for electronic information. Physical security is generally used, and information should be stored in a physically secured computer. Strongly Encouraged: In specially marked disposal bins on Verterim premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.
AI Justification
The chunk discusses the importance of data handling, storage, and disposal, which aligns with the need for a documented data management process.
Document Content
Matched Section
Section: Disposal/Destruction
Content: Strongly Encouraged: In specially marked disposal bins on Verterim premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.
Content: Strongly Encouraged: In specially marked disposal bins on Verterim premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.
AI Justification
The chunk explicitly mentions the disposal of electronic data and the methods for securely erasing or destroying media, which aligns with the control's focus on securely disposing of data.
Document Content
Matched Section
Section: Sensitivity Guidelines
Content: The Sensitivity Guidelines below provides details on how to protect information at varying sensitivity levels. Use these guidelines as a reference only, as Verterim Confidential information in each column may necessitate more or less stringent measures of protection depending upon the circumstances and the nature of the Verterim Confidential information in question.
Content: The Sensitivity Guidelines below provides details on how to protect information at varying sensitivity levels. Use these guidelines as a reference only, as Verterim Confidential information in each column may necessitate more or less stringent measures of protection depending upon the circumstances and the nature of the Verterim Confidential information in question.
AI Justification
The text discusses sensitivity guidelines and how to protect information at varying sensitivity levels, which aligns with establishing a data classification scheme.
Document Content
Matched Section
Section: Storage
Content: Machines should be administered with security in mind. Protect from loss; electronic information should have individual access controls where possible and appropriate.
Content: Machines should be administered with security in mind. Protect from loss; electronic information should have individual access controls where possible and appropriate.
AI Justification
The text discusses the management of electronic information and the importance of access controls, which aligns with securely managing enterprise assets.
Acceptable_Encryption_Policy.docx CIS
1 matches foundDocument Content
Matched Section
Section: Encryption Policy
Content: The use of proprietary encryption algorithms is not allowed for any purpose, unless reviewed by qualified experts outside of the vendor in question and approved by InfoSec.
Content: The use of proprietary encryption algorithms is not allowed for any purpose, unless reviewed by qualified experts outside of the vendor in question and approved by InfoSec.
AI Justification
The text discusses the use of encryption algorithms and the restrictions on proprietary encryption, which relates to the encryption of sensitive data.
Business_Continuity_Plan.docx NIST
17 matches foundDocument Content
Matched Section
Section: Contingency Planning Policy and Procedures
Content: Our plan anticipates two kinds of SBDs, internal and external. Internal SBDs affect only our firm’s ability to communicate and do business, such as a telecommunications or email failure. External SBDs prevent the operation of our cloud services and/or a number of firms, such as a terrorist attack, a city flood, or a wide-scale, regional disruption. Our response to an external SBD relies more heavily on other organizations and systems, especially on the capabilities of hosting partner, Microsoft or Google.
Content: Our plan anticipates two kinds of SBDs, internal and external. Internal SBDs affect only our firm’s ability to communicate and do business, such as a telecommunications or email failure. External SBDs prevent the operation of our cloud services and/or a number of firms, such as a terrorist attack, a city flood, or a wide-scale, regional disruption. Our response to an external SBD relies more heavily on other organizations and systems, especially on the capabilities of hosting partner, Microsoft or Google.
AI Justification
The text discusses the importance of contingency planning policies and procedures, including their development and execution, which aligns directly with CP-1.
Document Content
Matched Section
Section: Recovery-time objectives
Content: Recovery-time objectives provide concrete goals to plan for and test against. They are not, however, hard and fast deadlines that must be met in every emergency situation, and various external factors surrounding a disruption, such as time of day, scope of disruption and status of critical infrastructure—particularly telecommunications—can affect actual recovery times.
Content: Recovery-time objectives provide concrete goals to plan for and test against. They are not, however, hard and fast deadlines that must be met in every emergency situation, and various external factors surrounding a disruption, such as time of day, scope of disruption and status of critical infrastructure—particularly telecommunications—can affect actual recovery times.
AI Justification
The text discusses recovery-time objectives and their importance in planning and testing against disruptions, which aligns with the control's focus on recovery and reconstitution activities.
Document Content
Matched Section
Section: Our Business Continuity Plan
Content: Our business continuity plan is designed to permit our firm to resume operations as quickly as possible, given the scope and severity of the significant business disruption.
Content: Our business continuity plan is designed to permit our firm to resume operations as quickly as possible, given the scope and severity of the significant business disruption.
AI Justification
The business continuity plan outlines measures to quickly recover and resume operations after disruptions, aligning with the need for alternative mechanisms to ensure continuity.
Document Content
Matched Section
Section: Alternate Communications Between Verterim and Clients, Employees, and Partners
Content: Should an Internet connection be unavailable, Verterim would seek to deploy resources with an available Internet connection, for example, in another region to support the ongoing capability of our consulting division. In the event of a Global disaster eliminating Internet connectivity or prioritizing Internet connectivity to Emergency Services Personnel, Verterim would be forced to halt these services until Internet connectivity was restored.
Content: Should an Internet connection be unavailable, Verterim would seek to deploy resources with an available Internet connection, for example, in another region to support the ongoing capability of our consulting division. In the event of a Global disaster eliminating Internet connectivity or prioritizing Internet connectivity to Emergency Services Personnel, Verterim would be forced to halt these services until Internet connectivity was restored.
AI Justification
The text discusses the allocation of resources and the need for alternate communication capabilities in the event of an Internet outage, which aligns with the need for contingency planning and alternate communication protocols.
Document Content
Matched Section
Section: Our Business Continuity Plan
Content: Our Business Continuity Plan – We plan to quickly recover and resume business operations after a significant business disruption and respond by safeguarding our employees and property, making a financial and operational assessment, protecting the firm’s books and records, and allowing our customers to transact business. In short, our business continuity plan is designed to permit our firm to resume operations as quickly as possible, given the scope and severity of the significant business disruption.
Content: Our Business Continuity Plan – We plan to quickly recover and resume business operations after a significant business disruption and respond by safeguarding our employees and property, making a financial and operational assessment, protecting the firm’s books and records, and allowing our customers to transact business. In short, our business continuity plan is designed to permit our firm to resume operations as quickly as possible, given the scope and severity of the significant business disruption.
AI Justification
The text discusses a Business Continuity Plan that includes recovery and resumption of operations after disruptions, aligning with the principles of contingency planning.
Document Content
Matched Section
Section: Alternate Communications Between Verterim and Clients, Employees, and Partners
Content: Verterim supports the allocation of human capital to deliver professional services for the configuration and implementation of technical services to support a GRC program. This involves consultative services, all of which can be handled in a remote capacity, with the availability of an Internet connection. Should an Internet connection be unavailable, Verterim would seek to deploy resources with an available Internet connection, for example, in another region to support the ongoing capability of our consulting division.
Content: Verterim supports the allocation of human capital to deliver professional services for the configuration and implementation of technical services to support a GRC program. This involves consultative services, all of which can be handled in a remote capacity, with the availability of an Internet connection. Should an Internet connection be unavailable, Verterim would seek to deploy resources with an available Internet connection, for example, in another region to support the ongoing capability of our consulting division.
AI Justification
The text discusses the allocation of resources in different regions to maintain service capability, which aligns with the concept of alternate processing sites.
Document Content
Matched Section
Section: Operational Risk
Content: In the event of an SBD, we will immediately identify what means will permit us to communicate with our customers, employees, critical business constituents, critical banks, and critical counter-parties. Although the effects of an SBD will determine the means of alternative communication, the communications options we will employ will include our website, telephone voice mail, secure email, cellular phones and instant messaging platforms. In addition, we will retrieve our key activity records as described in the section above, Data Back-Up and Recovery (Hard Copy and Electronic).
Content: In the event of an SBD, we will immediately identify what means will permit us to communicate with our customers, employees, critical business constituents, critical banks, and critical counter-parties. Although the effects of an SBD will determine the means of alternative communication, the communications options we will employ will include our website, telephone voice mail, secure email, cellular phones and instant messaging platforms. In addition, we will retrieve our key activity records as described in the section above, Data Back-Up and Recovery (Hard Copy and Electronic).
AI Justification
The chunk discusses the importance of communication and retrieval of key activity records in the event of a significant business disruption (SBD), which aligns with the requirements for system backups and recovery.
Document Content
Matched Section
Section: Our Business Continuity Plan
Content: Our business continuity plan addresses: data backup and recovery; all mission critical systems; financial and operational assessments; alternative communications with customers, employees, and regulators; alternate physical location of employees; critical suppliers, contractors, banks and counter-party impacts and assures our clients with prompt access to their hosted GRC instances.
Content: Our business continuity plan addresses: data backup and recovery; all mission critical systems; financial and operational assessments; alternative communications with customers, employees, and regulators; alternate physical location of employees; critical suppliers, contractors, banks and counter-party impacts and assures our clients with prompt access to their hosted GRC instances.
AI Justification
The business continuity plan includes provisions for data backup and recovery, which aligns with the requirements for alternate storage sites to maintain duplicate copies of information and data.
Document Content
Matched Section
Section: DocuSign: e-signature processing for legal execution of contracts and other legal documents
Content: DocuSign: e-signature processing for legal execution of contracts and other legal documents
Content: DocuSign: e-signature processing for legal execution of contracts and other legal documents
AI Justification
The mention of e-signature processing and the responsibilities related to accurate payroll services imply the need for identification and authentication mechanisms to ensure the integrity and legality of the documents and services provided.
Document Content
Matched Section
Section: Mission Critical Systems
Content: Our firm’s “mission critical systems” are those that ensure prompt and accurate payroll services to our employees, contractors and subcontractors, processing of our client contracted work, including order taking, allocation of resources, accurate bookkeeping, the maintenance of client hosted GRC instances, access to client GRC instances and the professional service delivery against statements of work.
Content: Our firm’s “mission critical systems” are those that ensure prompt and accurate payroll services to our employees, contractors and subcontractors, processing of our client contracted work, including order taking, allocation of resources, accurate bookkeeping, the maintenance of client hosted GRC instances, access to client GRC instances and the professional service delivery against statements of work.
AI Justification
The chunk discusses the firm's mission critical systems that ensure payroll services and client work, which aligns with the control's focus on systems supporting specific business functions.
Document Content
Matched Section
Section: Establishing relationships with external service providers
Content: Verterim has contacted our critical business constituents (businesses with which we have an ongoing commercial relationship in support of our operating activities, such as vendors providing us critical services), and determined the extent to which we can continue our business relationship with them in light of the internal or external SBD.
Content: Verterim has contacted our critical business constituents (businesses with which we have an ongoing commercial relationship in support of our operating activities, such as vendors providing us critical services), and determined the extent to which we can continue our business relationship with them in light of the internal or external SBD.
AI Justification
The text discusses the organization's relationships with external service providers and the establishment of alternative arrangements, which aligns with the requirements of managing risks associated with external system services.
Document Content
Matched Section
Section: System and communications protection policy and procedures
Content: Verterim utilizes several continuously monitored services as well as credit risk signal processors to alert executive leadership for changes in externally reported financial or operational health. These services include reports aligned to security and compliance frameworks, such as NIST and ISO 27001/2.
Content: Verterim utilizes several continuously monitored services as well as credit risk signal processors to alert executive leadership for changes in externally reported financial or operational health. These services include reports aligned to security and compliance frameworks, such as NIST and ISO 27001/2.
AI Justification
The text discusses the importance of policies and procedures for system and communications protection, aligning with the SC-1 control.
Document Content
Matched Section
Section: Alternate Communications Between Verterim and Clients, Employees, and Partners
Content: Should an Internet connection be unavailable, Verterim would seek to deploy resources with an available Internet connection, for example, in another region to support the ongoing capability of our consulting division.
Content: Should an Internet connection be unavailable, Verterim would seek to deploy resources with an available Internet connection, for example, in another region to support the ongoing capability of our consulting division.
AI Justification
The text discusses the importance of maintaining communication paths and the measures taken to ensure continuity of services during disruptions, which aligns with the need for alternate communications paths as outlined in SC-47.
Document Content
Matched Section
Section: Operational Risk
Content: In the event of an SBD, we will immediately identify what means will permit us to communicate with our customers, employees, critical business constituents, critical banks, and critical counter-parties. Although the effects of an SBD will determine the means of alternative communication, the communications options we will employ will include our website, telephone voice mail, secure email, cellular phones and instant messaging platforms.
Content: In the event of an SBD, we will immediately identify what means will permit us to communicate with our customers, employees, critical business constituents, critical banks, and critical counter-parties. Although the effects of an SBD will determine the means of alternative communication, the communications options we will employ will include our website, telephone voice mail, secure email, cellular phones and instant messaging platforms.
AI Justification
The chunk discusses communication methods and the importance of maintaining communication integrity and confidentiality during an SBD, which aligns with the control's focus on protecting transmitted information.
Document Content
Matched Section
Section: Records Management and Backup Procedures
Content: Verterim maintains its primary hard copy books and records and its electronic records at 9 Queen Anne Rd., Hopkinton, MA 01748. Peter Ridgley, President is responsible for the maintenance of these books and records. Verterim maintains the following document types and forms: HR records, Financial Records, Services Contracts, Legal Records. The firm backs up its electronic records daily through services from Office365 and Microsoft Azure.
Content: Verterim maintains its primary hard copy books and records and its electronic records at 9 Queen Anne Rd., Hopkinton, MA 01748. Peter Ridgley, President is responsible for the maintenance of these books and records. Verterim maintains the following document types and forms: HR records, Financial Records, Services Contracts, Legal Records. The firm backs up its electronic records daily through services from Office365 and Microsoft Azure.
AI Justification
The text discusses the maintenance and backup of records, which aligns with information management and retention requirements.
Document Content
Matched Section
Section: Assessment and review of supplier risk
Content: Verterim has contacted our critical business constituents (businesses with which we have an ongoing commercial relationship in support of our operating activities, such as vendors providing us critical services), and determined the extent to which we can continue our business relationship with them in light of the internal or external SBD.
Content: Verterim has contacted our critical business constituents (businesses with which we have an ongoing commercial relationship in support of our operating activities, such as vendors providing us critical services), and determined the extent to which we can continue our business relationship with them in light of the internal or external SBD.
AI Justification
The text discusses the assessment of business relationships with suppliers and the establishment of alternative arrangements, which aligns with the control's focus on supplier risk management processes.
Document Content
Matched Section
Section: Communication with Critical Business Constituents
Content: Verterim has contacted our critical business constituents (businesses with which we have an ongoing commercial relationship in support of our operating activities, such as vendors providing us critical services), and determined the extent to which we can continue our business relationship with them in light of the internal or external SBD.
Content: Verterim has contacted our critical business constituents (businesses with which we have an ongoing commercial relationship in support of our operating activities, such as vendors providing us critical services), and determined the extent to which we can continue our business relationship with them in light of the internal or external SBD.
AI Justification
The text discusses the establishment of agreements and procedures with critical business constituents, which aligns with the need for effective communication in the supply chain as outlined in SR-8.
02_-_Code_of_Ethics_and_Business_Conduct_-_Verterim.pdf NIST
21 matches foundDocument Content
Matched Section
Section: USE OF PERSONAL CELL PHONES AND MOBILE COMMUNICATION DEVICES
Content: Associate use of personal cell phones and other mobile communication devices (including iPads and other tablet computers, iPods, laptop computers, and similar devices) at a Client’s place of business must comply with such Client’s policies.
Content: Associate use of personal cell phones and other mobile communication devices (including iPads and other tablet computers, iPods, laptop computers, and similar devices) at a Client’s place of business must comply with such Client’s policies.
AI Justification
The chunk discusses the use of personal cell phones and mobile devices, which may involve actions that do not require identification or authentication under certain conditions, aligning with the control's focus on permissible actions without such requirements.
Document Content
Matched Section
Section: USE OF PERSONAL CELL PHONES AND MOBILE COMMUNICATION DEVICES
Content: Associate use of personal cell phones and other mobile communication devices (including iPads and other tablet computers, iPods, laptop computers, and similar devices) at a Client’s place of business must comply with such Client’s policies.
Content: Associate use of personal cell phones and other mobile communication devices (including iPads and other tablet computers, iPods, laptop computers, and similar devices) at a Client’s place of business must comply with such Client’s policies.
AI Justification
The text discusses the use of personal mobile devices and the associated policies that govern their use, which aligns with the definition and control measures outlined in AC-19.
Document Content
Matched Section
Section: Discussion of Confidential Information or Proprietary Information on social networking websites
Content: Any discussion of Confidential Information or Proprietary Information (that is confidential) on social networking websites and weblogs such as Facebook, LinkedIn, Twitter, MySpace and similar sites is strictly prohibited, regardless of privacy settings and/or the intended recipient.
Content: Any discussion of Confidential Information or Proprietary Information (that is confidential) on social networking websites and weblogs such as Facebook, LinkedIn, Twitter, MySpace and similar sites is strictly prohibited, regardless of privacy settings and/or the intended recipient.
AI Justification
The chunk discusses the prohibition of discussing confidential or proprietary information on social networking sites, aligning with the control's focus on restricting access to nonpublic information.
Document Content
Matched Section
Section: Proprietary Information
Content: Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information. Proprietary Information shall include, without limitation, trade secrets and information regarding VERTERIM or a Client’s: (1) business; (2) financial performance, if it is not already generally publically available; (3) customers; (4) products, services, and pricing; (5) patents and other intellectual property; (6) systems plans and information; (7) data centers or other property information; (8) passwords and computer programs; (9) business plans; (10) marketing plans, strategies, and costs; and (11) potential acquisitions and divestitures. Proprietary Information may, but need not, be confidential.
Content: Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information. Proprietary Information shall include, without limitation, trade secrets and information regarding VERTERIM or a Client’s: (1) business; (2) financial performance, if it is not already generally publically available; (3) customers; (4) products, services, and pricing; (5) patents and other intellectual property; (6) systems plans and information; (7) data centers or other property information; (8) passwords and computer programs; (9) business plans; (10) marketing plans, strategies, and costs; and (11) potential acquisitions and divestitures. Proprietary Information may, but need not, be confidential.
AI Justification
The chunk discusses proprietary information, which aligns with the definition of information that may be restricted based on formal or administrative determinations.
Document Content
Matched Section
Section: Proprietary Information and Confidential Information Protection
Content: Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information.
Content: Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information.
AI Justification
The chunk discusses the protection of proprietary and confidential information, which aligns with the need to prevent unauthorized data mining activities.
Document Content
Matched Section
Section: Compliance with policies and requirements concerning Confidential Information and Proprietary Information
Content: In addition to strictly complying with the above requirements concerning Confidential Information and Proprietary Information, Associates must also strictly comply with any additional policies and requirements prescribed by Clients that restrict the flow of Confidential Information and Proprietary Information between such Client’s business units.
Content: In addition to strictly complying with the above requirements concerning Confidential Information and Proprietary Information, Associates must also strictly comply with any additional policies and requirements prescribed by Clients that restrict the flow of Confidential Information and Proprietary Information between such Client’s business units.
AI Justification
The text discusses compliance with policies that restrict the flow of Confidential Information and Proprietary Information, which aligns with the concept of access control policies that govern access to sensitive information.
Document Content
Matched Section
Section: Compliance with policies concerning Confidential Information and Proprietary Information
Content: In addition to strictly complying with the above requirements concerning Confidential Information and Proprietary Information, Associates must also strictly comply with any additional policies and requirements prescribed by Clients that restrict the flow of Confidential Information and Proprietary Information between such Client’s business units.
Content: In addition to strictly complying with the above requirements concerning Confidential Information and Proprietary Information, Associates must also strictly comply with any additional policies and requirements prescribed by Clients that restrict the flow of Confidential Information and Proprietary Information between such Client’s business units.
AI Justification
The text discusses the strict compliance with policies that restrict the flow of Confidential Information and Proprietary Information, which aligns with the principles of information flow control.
Document Content
Matched Section
Section: Proprietary Information Definition and Obligations
Content: Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information. Proprietary Information shall include, without limitation, trade secrets and information regarding VERTERIM or a Client’s: (1) business; (2) financial performance, if it is not already generally publically available; (3) customers; (4) products, services, and pricing; (5) patents and other intellectual property; (6) systems plans and information; (7) data centers or other property information; (8) passwords and computer programs; (9) business plans; (10) marketing plans, strategies, and costs; and (11) potential acquisitions and divestitures. Proprietary Information may, but need not, be confidential.
Content: Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information. Proprietary Information shall include, without limitation, trade secrets and information regarding VERTERIM or a Client’s: (1) business; (2) financial performance, if it is not already generally publically available; (3) customers; (4) products, services, and pricing; (5) patents and other intellectual property; (6) systems plans and information; (7) data centers or other property information; (8) passwords and computer programs; (9) business plans; (10) marketing plans, strategies, and costs; and (11) potential acquisitions and divestitures. Proprietary Information may, but need not, be confidential.
AI Justification
The chunk discusses the definition and examples of proprietary information, which aligns with the control's focus on unauthorized disclosure and data leakage.
Document Content
Matched Section
Section: Proprietary Information and Confidential Information Protection
Content: Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information.
Content: Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information.
AI Justification
The chunk discusses the protection of proprietary information, which aligns with the control's focus on protecting system-level information and ensuring the integrity of backups.
Document Content
Matched Section
Section: VERTERIM ASSOCIATE CODE OF ETHICS AND BUSINESS CONDUCT
Content: When an Associate leaves the employ of VERTERIM, the Associate must continue to uphold the VERTERIM standards for treatment of Confidential Information and Proprietary Information, including, without limitation, not disclosing or using any Confidential Information or Proprietary Information in a manner that is harmful to VERTERIM or its Client, useful to competitors, or for such Associate’s own or another’s gain.
Content: When an Associate leaves the employ of VERTERIM, the Associate must continue to uphold the VERTERIM standards for treatment of Confidential Information and Proprietary Information, including, without limitation, not disclosing or using any Confidential Information or Proprietary Information in a manner that is harmful to VERTERIM or its Client, useful to competitors, or for such Associate’s own or another’s gain.
AI Justification
The text discusses the obligations of Associates regarding Confidential Information and Proprietary Information, which aligns with the concept of rules of behavior for organizational users.
Document Content
Matched Section
Section: Proprietary Information and Confidential Information Protection
Content: Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information. Proprietary Information shall include, without limitation, trade secrets and information regarding VERTERIM or a Client’s: (1) business; (2) financial performance, if it is not already generally publically available; (3) customers; (4) products, services, and pricing; (5) patents and other intellectual property; (6) systems plans and information; (7) data centers or other property information; (8) passwords and computer programs; (9) business plans; (10) marketing plans, strategies, and costs; and (11) potential acquisitions and divestitures. Proprietary Information may, but need not, be confidential.
Content: Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information. Proprietary Information shall include, without limitation, trade secrets and information regarding VERTERIM or a Client’s: (1) business; (2) financial performance, if it is not already generally publically available; (3) customers; (4) products, services, and pricing; (5) patents and other intellectual property; (6) systems plans and information; (7) data centers or other property information; (8) passwords and computer programs; (9) business plans; (10) marketing plans, strategies, and costs; and (11) potential acquisitions and divestitures. Proprietary Information may, but need not, be confidential.
AI Justification
The text discusses the importance of protecting proprietary and confidential information, which aligns with the need for technology-independent capabilities to counter threats to information.
Document Content
Matched Section
Section: Exit Responsibilities of Associates
Content: When an Associate leaves the employ of VERTERIM, the Associate must continue to uphold the VERTERIM standards for treatment of Confidential Information and Proprietary Information, including, without limitation, not disclosing or using any Confidential Information or Proprietary Information in a manner that is harmful to VERTERIM or its Client, useful to competitors, or for such Associate’s own or another’s gain.
Content: When an Associate leaves the employ of VERTERIM, the Associate must continue to uphold the VERTERIM standards for treatment of Confidential Information and Proprietary Information, including, without limitation, not disclosing or using any Confidential Information or Proprietary Information in a manner that is harmful to VERTERIM or its Client, useful to competitors, or for such Associate’s own or another’s gain.
AI Justification
The text discusses the responsibilities of an Associate upon leaving the company, including the return of confidential information and adherence to nondisclosure agreements, which aligns with the control's focus on accountability for system-related property.
Document Content
Matched Section
Section: PAYMENTS TO GOVERNMENT OFFICIALS
Content: No Associate shall make any payment to, or provide any business courtesies to a government official in order to obtain favored treatment with respect to the VERTERIM business.
Content: No Associate shall make any payment to, or provide any business courtesies to a government official in order to obtain favored treatment with respect to the VERTERIM business.
AI Justification
The text discusses the prohibition of payments and business courtesies to government officials, which aligns with the need for organizational sanctions reflecting applicable laws and regulations.
Document Content
Matched Section
Section: Personnel Transfer Policy
Content: When an Associate leaves the employ of VERTERIM, the Associate must continue to uphold the VERTERIM standards for treatment of Confidential Information and Proprietary Information, including, without limitation, not disclosing or using any Confidential Information or Proprietary Information in a manner that is harmful to VERTERIM or its Client, useful to competitors, or for such Associate’s own or another’s gain.
Content: When an Associate leaves the employ of VERTERIM, the Associate must continue to uphold the VERTERIM standards for treatment of Confidential Information and Proprietary Information, including, without limitation, not disclosing or using any Confidential Information or Proprietary Information in a manner that is harmful to VERTERIM or its Client, useful to competitors, or for such Associate’s own or another’s gain.
AI Justification
The text discusses the responsibilities of an Associate upon leaving the organization, which aligns with the control's focus on actions required during personnel transfers.
Document Content
Matched Section
Section: Proprietary Information and Confidential Information
Content: • Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information. Proprietary Information shall include, without limitation, trade secrets and information regarding VERTERIM or a Client’s: (1) business; (2) financial performance, if it is not already generally publically available; (3) customers; (4) products, services, and pricing; (5) patents and other intellectual property; (6) systems plans and information; (7) data centers or other property information; (8) passwords and computer programs; (9) business plans; (10) marketing plans, strategies, and costs; and (11) potential acquisitions and divestitures. Proprietary Information may, but need not, be confidential.
Content: • Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information. Proprietary Information shall include, without limitation, trade secrets and information regarding VERTERIM or a Client’s: (1) business; (2) financial performance, if it is not already generally publically available; (3) customers; (4) products, services, and pricing; (5) patents and other intellectual property; (6) systems plans and information; (7) data centers or other property information; (8) passwords and computer programs; (9) business plans; (10) marketing plans, strategies, and costs; and (11) potential acquisitions and divestitures. Proprietary Information may, but need not, be confidential.
AI Justification
The chunk discusses Proprietary Information and the obligation to protect it, which relates to the management of security and privacy attributes associated with information.
Document Content
Matched Section
Section: Proprietary Information and Confidential Information Protection
Content: Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information. Proprietary Information shall include, without limitation, trade secrets and information regarding VERTERIM or a Client’s: (1) business; (2) financial performance, if it is not already generally publically available; (3) customers; (4) products, services, and pricing; (5) patents and other intellectual property; (6) systems plans and information; (7) data centers or other property information; (8) passwords and computer programs; (9) business plans; (10) marketing plans, strategies, and costs; and (11) potential acquisitions and divestitures. Proprietary Information may, but need not, be confidential.
Content: Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information. Proprietary Information shall include, without limitation, trade secrets and information regarding VERTERIM or a Client’s: (1) business; (2) financial performance, if it is not already generally publically available; (3) customers; (4) products, services, and pricing; (5) patents and other intellectual property; (6) systems plans and information; (7) data centers or other property information; (8) passwords and computer programs; (9) business plans; (10) marketing plans, strategies, and costs; and (11) potential acquisitions and divestitures. Proprietary Information may, but need not, be confidential.
AI Justification
The chunk discusses the protection of proprietary and confidential information, which aligns with the control's focus on the confidentiality and integrity of information at rest.
Document Content
Matched Section
Section: Proprietary Information
Content: Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information. Proprietary Information shall include, without limitation, trade secrets and information regarding VERTERIM or a Client’s: (1) business; (2) financial performance, if it is not already generally publically available; (3) customers; (4) products, services, and pricing; (5) patents and other intellectual property; (6) systems plans and information; (7) data centers or other property information; (8) passwords and computer programs; (9) business plans; (10) marketing plans, strategies, and costs; and (11) potential acquisitions and divestitures. Proprietary Information may, but need not, be confidential.
Content: Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information. Proprietary Information shall include, without limitation, trade secrets and information regarding VERTERIM or a Client’s: (1) business; (2) financial performance, if it is not already generally publically available; (3) customers; (4) products, services, and pricing; (5) patents and other intellectual property; (6) systems plans and information; (7) data centers or other property information; (8) passwords and computer programs; (9) business plans; (10) marketing plans, strategies, and costs; and (11) potential acquisitions and divestitures. Proprietary Information may, but need not, be confidential.
AI Justification
The chunk discusses the protection of proprietary information, which aligns with the OPSEC process of identifying and protecting critical information.
Document Content
Matched Section
Section: USE OF PERSONAL CELL PHONES AND MOBILE COMMUNICATION DEVICES
Content: Associate use of personal cell phones and other mobile communication devices (including iPads and other tablet computers, iPods, laptop computers, and similar devices) at a Client’s place of business must comply with such Client’s policies.
Content: Associate use of personal cell phones and other mobile communication devices (including iPads and other tablet computers, iPods, laptop computers, and similar devices) at a Client’s place of business must comply with such Client’s policies.
AI Justification
The chunk discusses the use of personal mobile devices and the associated policies regarding their use, which aligns with the control's focus on sensor capabilities in mobile devices.
Document Content
Matched Section
Section: USE OF PERSONAL CELL PHONES AND MOBILE COMMUNICATION DEVICES
Content: Associate use of personal cell phones and other mobile communication devices (including iPads and other tablet computers, iPods, laptop computers, and similar devices) at a Client’s place of business must comply with such Client’s policies. Personal calls of any kind at the Client location must be kept to a minimum and must neither interfere with your job performance nor interrupt those around you. In addition, personal communications may only occur during break times in appropriate area(s) away from an Associate’s workspace. Cameras incorporated in any cell phone or other mobile communication device must be used in a reasonable manner and, in no event, in any manner that does not comply with VERTERIM or Client policies or in a manner that would invade the privacy of VERTERIM, a Client or any third party and/or otherwise violate this Code.
Content: Associate use of personal cell phones and other mobile communication devices (including iPads and other tablet computers, iPods, laptop computers, and similar devices) at a Client’s place of business must comply with such Client’s policies. Personal calls of any kind at the Client location must be kept to a minimum and must neither interfere with your job performance nor interrupt those around you. In addition, personal communications may only occur during break times in appropriate area(s) away from an Associate’s workspace. Cameras incorporated in any cell phone or other mobile communication device must be used in a reasonable manner and, in no event, in any manner that does not comply with VERTERIM or Client policies or in a manner that would invade the privacy of VERTERIM, a Client or any third party and/or otherwise violate this Code.
AI Justification
The section discusses the restrictions and guidelines for using personal cell phones and mobile devices at a Client's place of business, ensuring compliance with policies to prevent unauthorized use.
Document Content
Matched Section
Section: VERTERIM ASSOCIATE CODE OF ETHICS AND BUSINESS CONDUCT
Content: When an Associate leaves the employ of VERTERIM, the Associate must continue to uphold the VERTERIM standards for treatment of Confidential Information and Proprietary Information, including, without limitation, not disclosing or using any Confidential Information or Proprietary Information in a manner that is harmful to VERTERIM or its Client, useful to competitors, or for such Associate’s own or another’s gain.
Content: When an Associate leaves the employ of VERTERIM, the Associate must continue to uphold the VERTERIM standards for treatment of Confidential Information and Proprietary Information, including, without limitation, not disclosing or using any Confidential Information or Proprietary Information in a manner that is harmful to VERTERIM or its Client, useful to competitors, or for such Associate’s own or another’s gain.
AI Justification
The text discusses the responsibilities of Associates regarding the handling and return of Confidential Information and Proprietary Information upon leaving the company, which aligns with information management and retention practices.
Document Content
Matched Section
Section: Proprietary Information and Confidential Information Protection
Content: Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information. Proprietary Information shall include, without limitation, trade secrets and information regarding VERTERIM or a Client’s: (1) business; (2) financial performance, if it is not already generally publically available; (3) customers; (4) products, services, and pricing; (5) patents and other intellectual property; (6) systems plans and information; (7) data centers or other property information; (8) passwords and computer programs; (9) business plans; (10) marketing plans, strategies, and costs; and (11) potential acquisitions and divestitures. Proprietary Information may, but need not, be confidential.
Content: Proprietary Information is any information that is the property of a Client or VERTERIM, or that a Client or VERTERIM obtains the right to use from a third party that owns such information. Proprietary Information shall include, without limitation, trade secrets and information regarding VERTERIM or a Client’s: (1) business; (2) financial performance, if it is not already generally publically available; (3) customers; (4) products, services, and pricing; (5) patents and other intellectual property; (6) systems plans and information; (7) data centers or other property information; (8) passwords and computer programs; (9) business plans; (10) marketing plans, strategies, and costs; and (11) potential acquisitions and divestitures. Proprietary Information may, but need not, be confidential.
AI Justification
The text discusses the protection of proprietary information, which aligns with the principles of supply chain OPSEC, including safeguarding critical information and managing risks associated with suppliers.
Information_Sensitivity_Policy.docx NIST
37 matches foundDocument Content
Matched Section
Section: Storage and Disposal/Destruction sections emphasize the need for individual access controls and secure handling of information.
Content: Individual access controls are very highly recommended for electronic information. Physical security is generally used, and information should be stored in a physically secured computer. Strongly Encouraged: In specially marked disposal bins on Verterim premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.
Content: Individual access controls are very highly recommended for electronic information. Physical security is generally used, and information should be stored in a physically secured computer. Strongly Encouraged: In specially marked disposal bins on Verterim premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.
AI Justification
The text discusses the importance of access controls and the need for policies and procedures related to access control, which aligns with AC-1.
Document Content
Matched Section
Section: 1. Purpose and Scope
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
AI Justification
The section discusses the importance of information labeling and handling guidelines, which aligns with the control's focus on data structures and attributes associated with information.
Document Content
Matched Section
Section: Configuration of Verterim-to-other business connections
Content: Connections shall be set up to allow other businesses to see only what they need to see. This involves setting up both applications and network configurations to allow access to only what is necessary.
Content: Connections shall be set up to allow other businesses to see only what they need to see. This involves setting up both applications and network configurations to allow access to only what is necessary.
AI Justification
The text discusses the need to restrict access to corporate information from outside connections, which aligns with the principles of remote access control.
Document Content
Matched Section
Section: To minimize risk to Verterim from an outside business connection.
Content: Verterim computer use by competitors and unauthorized personnel must be restricted so that, in the event of an attempt to access Verterim corporate information, the amount of information at risk is minimized.
Content: Verterim computer use by competitors and unauthorized personnel must be restricted so that, in the event of an attempt to access Verterim corporate information, the amount of information at risk is minimized.
AI Justification
The text emphasizes the need to restrict unauthorized personnel from accessing corporate information, which is a key aspect of access enforcement.
Document Content
Matched Section
Section: Configuration of Verterim-to-other business connections
Content: Connections shall be set up to allow other businesses to see only what they need to see. This involves setting up both applications and network configurations to allow access to only what is necessary.
Content: Connections shall be set up to allow other businesses to see only what they need to see. This involves setting up both applications and network configurations to allow access to only what is necessary.
AI Justification
The text discusses the need to restrict access to corporate information from external business connections, which aligns with the control's focus on managing external systems and their access.
Document Content
Matched Section
Section: Purpose
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
AI Justification
The section discusses guidelines for determining what information can be disclosed and emphasizes the sensitivity of information, aligning with the control's focus on restricted information sharing.
Document Content
Matched Section
Section: Purpose
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
AI Justification
The Information Sensitivity Policy outlines guidelines for determining what information can be disclosed to non-employees, aligning with the control's focus on restricting access to nonpublic information.
Document Content
Matched Section
Section: Storage
Content: Individual access controls are very highly recommended for electronic information. Physical security is generally used, and information should be stored in a physically secured computer.
Content: Individual access controls are very highly recommended for electronic information. Physical security is generally used, and information should be stored in a physically secured computer.
AI Justification
The chunk discusses individual access controls and physical security measures for electronic information, aligning with the principles of access control policies.
Document Content
Matched Section
Section: Information Classification
Content: * Verterim Public * Verterim Confidential * Verterim Client Confidential Verterim Public information is information that has been declared public knowledge by someone with the authority to do so, and can freely be given to anyone without any possible damage to Verterim Systems, Inc. Verterim Confidential contains all other information. It is a continuum, in that it is understood that some information is more sensitive than other information, and should be protected in a more secure manner. Included is information that should be protected very closely, such as trade secrets, development programs, potential acquisition targets, and other information integral to the success of our company. Also included in Verterim Confidential is information that is less critical, such as telephone directories, general corporate information, personnel information, etc., which does not require as stringent a degree of protection.
Content: * Verterim Public * Verterim Confidential * Verterim Client Confidential Verterim Public information is information that has been declared public knowledge by someone with the authority to do so, and can freely be given to anyone without any possible damage to Verterim Systems, Inc. Verterim Confidential contains all other information. It is a continuum, in that it is understood that some information is more sensitive than other information, and should be protected in a more secure manner. Included is information that should be protected very closely, such as trade secrets, development programs, potential acquisition targets, and other information integral to the success of our company. Also included in Verterim Confidential is information that is less critical, such as telephone directories, general corporate information, personnel information, etc., which does not require as stringent a degree of protection.
AI Justification
The chunk discusses the classification of information into public and confidential categories, which relates to the control's focus on preventing unauthorized disclosure of sensitive information.
Document Content
Matched Section
Section: Configuration of Verterim-to-other business connections
Content: Connections shall be set up to allow other businesses to see only what they need to see. This involves setting up both applications and network configurations to allow access to only what is necessary.
Content: Connections shall be set up to allow other businesses to see only what they need to see. This involves setting up both applications and network configurations to allow access to only what is necessary.
AI Justification
The text discusses minimizing risk from outside business connections and ensuring that only necessary information is accessible, which aligns with the requirements for system information exchanges.
Document Content
Matched Section
Section: Purpose and Scope
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization. The information covered in these guidelines includes, but is not limited to, information that is either stored or shared via any means.
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization. The information covered in these guidelines includes, but is not limited to, information that is either stored or shared via any means.
AI Justification
The section discusses the classification and handling of information, which aligns with understanding where information is processed and stored.
Document Content
Matched Section
Section: Physical Security
Content: Physical security means either having actual possession of a computer at all times, or locking the computer in an unusable state to an object that is immovable. Methods of accomplishing this include having a special key to unlock the computer so it can be used, thereby ensuring that the computer cannot be simply rebooted to get around the protection. If it is a laptop or other portable computer, never leave it alone in a conference room, hotel room or on an airplane seat, etc. Make arrangements to lock the device in a hotel safe, or take it with you. In the office, always use a lockdown cable. When leaving the office for the day, secure the laptop and any other sensitive material in a locked drawer or cabinet.
Content: Physical security means either having actual possession of a computer at all times, or locking the computer in an unusable state to an object that is immovable. Methods of accomplishing this include having a special key to unlock the computer so it can be used, thereby ensuring that the computer cannot be simply rebooted to get around the protection. If it is a laptop or other portable computer, never leave it alone in a conference room, hotel room or on an airplane seat, etc. Make arrangements to lock the device in a hotel safe, or take it with you. In the office, always use a lockdown cable. When leaving the office for the day, secure the laptop and any other sensitive material in a locked drawer or cabinet.
AI Justification
The text discusses methods to secure physical access to computers, which aligns with the physical access control measures outlined in PE-3.
Document Content
Matched Section
Section: One Time Password Authentication
Content: One Time Password Authentication on Internet connections is accomplished by using a one time password token to connect to Verterim's internal network over the Internet. Contact your support organization for more information on how to set this up.
Content: One Time Password Authentication on Internet connections is accomplished by using a one time password token to connect to Verterim's internal network over the Internet. Contact your support organization for more information on how to set this up.
AI Justification
The chunk discusses the use of one-time password authentication, which aligns with the control's focus on various types of authenticators including one-time password devices.
Document Content
Matched Section
Section: Purpose and Scope
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
AI Justification
The text discusses the importance of policies and procedures related to information sensitivity and handling, which aligns with the requirements of MP-1 for establishing media protection policies.
Document Content
Matched Section
Section: Marking is at the discretion of the owner or custodian of the information.
Content: Marking is at the discretion of the owner or custodian of the information. If marking is desired, the words 'Verterim Confidential' may be written or designated in a conspicuous place on or in the information in question. If no marking is present, Verterim information is presumed to be 'Verterim Confidential' unless expressly determined to be Verterim Public information by a Verterim employee with authority to do so.
Content: Marking is at the discretion of the owner or custodian of the information. If marking is desired, the words 'Verterim Confidential' may be written or designated in a conspicuous place on or in the information in question. If no marking is present, Verterim information is presumed to be 'Verterim Confidential' unless expressly determined to be Verterim Public information by a Verterim employee with authority to do so.
AI Justification
The text discusses the marking of information as 'Verterim Confidential' and the implications of marking or not marking information, which aligns with the control's focus on security marking.
Document Content
Matched Section
Section: Disposal/Destruction
Content: Strongly Encouraged: In specially marked disposal bins on Verterim premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.
Content: Strongly Encouraged: In specially marked disposal bins on Verterim premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.
AI Justification
The chunk discusses the importance of securely disposing of electronic data and physically destroying media, which aligns with the requirements for media sanitization.
Document Content
Matched Section
Section: Physical Security Measures
Content: Physical security means either having actual possession of a computer at all times, or locking the computer in an unusable state to an object that is immovable. Methods of accomplishing this include having a special key to unlock the computer so it can be used, thereby ensuring that the computer cannot be simply rebooted to get around the protection. If it is a laptop or other portable computer, never leave it alone in a conference room, hotel room or on an airplane seat, etc. Make arrangements to lock the device in a hotel safe, or take it with you. In the office, always use a lockdown cable. When leaving the office for the day, secure the laptop and any other sensitive material in a locked drawer or cabinet.
Content: Physical security means either having actual possession of a computer at all times, or locking the computer in an unusable state to an object that is immovable. Methods of accomplishing this include having a special key to unlock the computer so it can be used, thereby ensuring that the computer cannot be simply rebooted to get around the protection. If it is a laptop or other portable computer, never leave it alone in a conference room, hotel room or on an airplane seat, etc. Make arrangements to lock the device in a hotel safe, or take it with you. In the office, always use a lockdown cable. When leaving the office for the day, secure the laptop and any other sensitive material in a locked drawer or cabinet.
AI Justification
The text discusses physical security measures for computers and sensitive materials, which aligns with the control's focus on securing both digital and non-digital media.
Document Content
Matched Section
Section: Information Classification
Content: Verterim Confidential contains all other information. It is a continuum, in that it is understood that some information is more sensitive than other information, and should be protected in a more secure manner.
Content: Verterim Confidential contains all other information. It is a continuum, in that it is understood that some information is more sensitive than other information, and should be protected in a more secure manner.
AI Justification
The text discusses the classification of information and the need to protect sensitive information, which aligns with the control's focus on preventing information leakage.
Document Content
Matched Section
Section: Physical Security
Content: Physical security means either having actual possession of a computer at all times, or locking the computer in an unusable state to an object that is immovable. Methods of accomplishing this include having a special key to unlock the computer so it can be used, thereby ensuring that the computer cannot be simply rebooted to get around the protection. If it is a laptop or other portable computer, never leave it alone in a conference room, hotel room or on an airplane seat, etc. Make arrangements to lock the device in a hotel safe, or take it with you. In the office, always use a lockdown cable. When leaving the office for the day, secure the laptop and any other sensitive material in a locked drawer or cabinet.
Content: Physical security means either having actual possession of a computer at all times, or locking the computer in an unusable state to an object that is immovable. Methods of accomplishing this include having a special key to unlock the computer so it can be used, thereby ensuring that the computer cannot be simply rebooted to get around the protection. If it is a laptop or other portable computer, never leave it alone in a conference room, hotel room or on an airplane seat, etc. Make arrangements to lock the device in a hotel safe, or take it with you. In the office, always use a lockdown cable. When leaving the office for the day, secure the laptop and any other sensitive material in a locked drawer or cabinet.
AI Justification
The chunk discusses methods for securing computers and sensitive materials, which aligns with the physical access control measures outlined in PE-3.
Document Content
Matched Section
Section: Physical security
Content: Physical security means either having actual possession of a computer at all times, or locking the computer in an unusable state to an object that is immovable. Methods of accomplishing this include having a special key to unlock the computer so it can be used, thereby ensuring that the computer cannot be simply rebooted to get around the protection. If it is a laptop or other portable computer, never leave it alone in a conference room, hotel room or on an airplane seat, etc. Make arrangements to lock the device in a hotel safe, or take it with you. In the office, always use a lockdown cable. When leaving the office for the day, secure the laptop and any other sensitive material in a locked drawer or cabinet.
Content: Physical security means either having actual possession of a computer at all times, or locking the computer in an unusable state to an object that is immovable. Methods of accomplishing this include having a special key to unlock the computer so it can be used, thereby ensuring that the computer cannot be simply rebooted to get around the protection. If it is a laptop or other portable computer, never leave it alone in a conference room, hotel room or on an airplane seat, etc. Make arrangements to lock the device in a hotel safe, or take it with you. In the office, always use a lockdown cable. When leaving the office for the day, secure the laptop and any other sensitive material in a locked drawer or cabinet.
AI Justification
The chunk discusses methods of securing physical devices, which aligns with the control's focus on preventing physical tampering and ensuring security for devices.
Document Content
Matched Section
Section: Physical security means either having actual possession of a computer at all times, or locking the computer in an unusable state to an object that is immovable.
Content: Methods of accomplishing this include having a special key to unlock the computer so it can be used, thereby ensuring that the computer cannot be simply rebooted to get around the protection. If it is a laptop or other portable computer, never leave it alone in a conference room, hotel room or on an airplane seat, etc. Make arrangements to lock the device in a hotel safe, or take it with you. In the office, always use a lockdown cable. When leaving the office for the day, secure the laptop and any other sensitive material in a locked drawer or cabinet.
Content: Methods of accomplishing this include having a special key to unlock the computer so it can be used, thereby ensuring that the computer cannot be simply rebooted to get around the protection. If it is a laptop or other portable computer, never leave it alone in a conference room, hotel room or on an airplane seat, etc. Make arrangements to lock the device in a hotel safe, or take it with you. In the office, always use a lockdown cable. When leaving the office for the day, secure the laptop and any other sensitive material in a locked drawer or cabinet.
AI Justification
The text discusses methods for securing computers and portable devices, which aligns with controlling physical access to output devices.
Document Content
Matched Section
Section: Purpose and Scope
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
AI Justification
The chunk discusses the establishment of policies and procedures for handling sensitive information, which aligns with the planning and implementation of security and privacy controls.
Document Content
Matched Section
Section: Purpose and Scope
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
AI Justification
The text discusses the categorization of information and the sensitivity of information that should not be disclosed, which aligns with the need to protect information and assess risks associated with its compromise.
Document Content
Matched Section
Section: Purpose and Scope
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
AI Justification
The text discusses the sensitivity of information and the guidelines for disclosing information to non-employees, which aligns with the requirements for safeguarding controlled unclassified information.
Document Content
Matched Section
Section: Threat Information Classification
Content: * Verterim Public * Verterim Confidential * Verterim Client Confidential Verterim Public information is information that has been declared public knowledge by someone with the authority to do so, and can freely be given to anyone without any possible damage to Verterim Systems, Inc. Verterim Confidential contains all other information. It is a continuum, in that it is understood that some information is more sensitive than other information, and should be protected in a more secure manner. Included is information that should be protected very closely, such as trade secrets, development programs, potential acquisition targets, and other information integral to the success of our company. Also included in Verterim Confidential is information that is less critical, such as telephone directories, general corporate information, personnel information, etc., which does not require as stringent a degree of protection.
Content: * Verterim Public * Verterim Confidential * Verterim Client Confidential Verterim Public information is information that has been declared public knowledge by someone with the authority to do so, and can freely be given to anyone without any possible damage to Verterim Systems, Inc. Verterim Confidential contains all other information. It is a continuum, in that it is understood that some information is more sensitive than other information, and should be protected in a more secure manner. Included is information that should be protected very closely, such as trade secrets, development programs, potential acquisition targets, and other information integral to the success of our company. Also included in Verterim Confidential is information that is less critical, such as telephone directories, general corporate information, personnel information, etc., which does not require as stringent a degree of protection.
AI Justification
The text discusses the importance of sharing threat information to mitigate risks from adversaries, which aligns with the control's focus on threat information sharing.
Document Content
Matched Section
Section: Penalty for deliberate or inadvertent disclosure
Content: Penalty for deliberate or inadvertent disclosure: Up to and including termination, possible civil and/or criminal prosecution to the full extent of the law.
Content: Penalty for deliberate or inadvertent disclosure: Up to and including termination, possible civil and/or criminal prosecution to the full extent of the law.
AI Justification
The chunk discusses penalties for violations of policy, including termination and potential legal action, which aligns with the concept of organizational sanctions.
Document Content
Matched Section
Section: Enforcement
Content: Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
Content: Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
AI Justification
The enforcement section indicates that employees may face disciplinary action for policy violations, which is a reflection of organizational sanctions.
Document Content
Matched Section
Section: Purpose and Scope
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
AI Justification
The text discusses the categorization of information sensitivity and the importance of determining what information can be disclosed, which aligns with the security categorization process outlined in RA-2.
Document Content
Matched Section
Section: Approved Encrypted email and files
Content: Techniques include the use of DES and PGP. DES encryption is available via many different public domain packages on all platforms. PGP use within Verterim is done via a license. Please contact the appropriate support organization if you require a license.
Content: Techniques include the use of DES and PGP. DES encryption is available via many different public domain packages on all platforms. PGP use within Verterim is done via a license. Please contact the appropriate support organization if you require a license.
AI Justification
The chunk discusses the use of encryption techniques such as DES and PGP for securing email and files, which aligns with the cryptographic measures outlined in SC-13.
Document Content
Matched Section
Section: Purpose and Scope
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
AI Justification
The text discusses the classification and sensitivity of information, which aligns with the concept of security and privacy attributes as described in SC-16.
Document Content
Matched Section
Section: Purpose
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
Content: The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of Verterim without proper authorization.
AI Justification
The Information Sensitivity Policy outlines the importance of protecting sensitive information and provides guidelines for employees on what information can be disclosed, aligning with the principles of OPSEC.
Document Content
Matched Section
Section: Distribution outside of Verterim internal mail
Content: Sent via U.S. mail or approved private carriers.
Content: Sent via U.S. mail or approved private carriers.
AI Justification
The chunk discusses the use of U.S. mail and approved private carriers for distribution, which aligns with the concept of out-of-band channels as they are separate from electronic channels.
Document Content
Matched Section
Section: Electronic distribution
Content: No restrictions to approved recipients within Verterim, but should be encrypted or sent via a private link to approved recipients outside of Verterim premises.
Content: No restrictions to approved recipients within Verterim, but should be encrypted or sent via a private link to approved recipients outside of Verterim premises.
AI Justification
The mention of electronic distribution being encrypted or sent via a private link aligns with the need for secure transmission methods, which is a consideration for out-of-band channels.
Document Content
Matched Section
Section: Configuration of Verterim-to-other business connections
Content: Connections shall be set up to allow other businesses to see only what they need to see. This involves setting up both applications and network configurations to allow access to only what is necessary.
Content: Connections shall be set up to allow other businesses to see only what they need to see. This involves setting up both applications and network configurations to allow access to only what is necessary.
AI Justification
The text discusses minimizing risk from outside business connections and restricting access to corporate information, which aligns with the concept of boundary protection and managed interfaces.
Document Content
Matched Section
Section: Verterim Confidential
Content: Verterim Confidential contains all other information. It is a continuum, in that it is understood that some information is more sensitive than other information, and should be protected in a more secure manner.
Content: Verterim Confidential contains all other information. It is a continuum, in that it is understood that some information is more sensitive than other information, and should be protected in a more secure manner.
AI Justification
The text discusses the classification of information and the need for varying levels of protection based on sensitivity, which aligns with the control's focus on protecting transmitted information.
Document Content
Matched Section
Section: Storage and Disposal/Destruction
Content: Individual access controls are very highly recommended for electronic information. Physical security is generally used, and information should be stored in a physically secured computer. Strongly Encouraged: In specially marked disposal bins on Verterim premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.
Content: Individual access controls are very highly recommended for electronic information. Physical security is generally used, and information should be stored in a physically secured computer. Strongly Encouraged: In specially marked disposal bins on Verterim premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.
AI Justification
The section discusses the importance of managing and retaining information, including the disposal and destruction of electronic data, which aligns with the requirements of SI-12.
Document Content
Matched Section
Section: Disposal/Destruction
Content: Strongly Encouraged: In specially marked disposal bins on Verterim premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.
Content: Strongly Encouraged: In specially marked disposal bins on Verterim premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.
AI Justification
The section discusses the importance of securely disposing of electronic data and media, which aligns with the control's focus on disposal at any stage of the system development life cycle.
Incident_Response_Procedure.docx NIST
47 matches foundDocument Content
Matched Section
Section: Handling of Potential Evidence
Content: In addition, any information gathered that may be of value in future legal proceedings should be handled as follows: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
Content: In addition, any information gathered that may be of value in future legal proceedings should be handled as follows: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
AI Justification
The chunk discusses the handling and logging of information that may be relevant for legal proceedings, which aligns with the principles of information sharing and access restrictions outlined in AC-21.
Document Content
Matched Section
Section: Handling of Potential Evidence
Content: In addition, any information gathered that may be of value in future legal proceedings should be handled as follows: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
Content: In addition, any information gathered that may be of value in future legal proceedings should be handled as follows: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
AI Justification
The chunk discusses the importance of logging all actions taken with potential evidence, which aligns with the non-repudiation principle of ensuring that actions can be verified and attributed to individuals.
Document Content
Matched Section
Section: Handling of Potential Evidence
Content: In addition, any information gathered that may be of value in future legal proceedings should be handled as follows: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
Content: In addition, any information gathered that may be of value in future legal proceedings should be handled as follows: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
AI Justification
The chunk discusses the logging and handling of information that may be valuable for legal proceedings, which aligns with the requirement to retain audit records until they are no longer needed.
Document Content
Matched Section
Section: Handling of Potential Evidence
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
AI Justification
The chunk discusses the logging of information and handling of potential evidence, which aligns with the session auditing practices outlined in AU-14.
Document Content
Matched Section
Section: In addition, any information gathered that may be of value in future legal proceedings should be handled as follows:
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
AI Justification
The chunk discusses the importance of logging all information and maintaining a chain of evidence, which aligns with the need for coordinated audit logging across organizations.
Document Content
Matched Section
Section: In addition, any information gathered that may be of value in future legal proceedings should be handled as follows:
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
AI Justification
The chunk discusses the importance of logging all information that may be relevant for legal proceedings, which aligns with the requirements for logging significant events as described in AU-2.
Document Content
Matched Section
Section: In addition, any information gathered that may be of value in future legal proceedings should be handled as follows:
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
AI Justification
The chunk discusses the importance of logging information and maintaining a chain of evidence, which aligns with the requirements for audit record content as specified in AU-3.
Document Content
Matched Section
Section: Handling of Potential Evidence
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
AI Justification
The text emphasizes the importance of logging all actions related to potential evidence, which aligns with the need for sufficient audit log storage capacity to prevent loss of logging capability.
Document Content
Matched Section
Section: In addition, any information gathered that may be of value in future legal proceedings should be handled as follows:
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
AI Justification
The chunk discusses the logging of all information and the importance of maintaining a chain of evidence, which aligns with the requirements for audit record review and analysis.
Document Content
Matched Section
Section: Computer Security Incident Response plan
Content: This Computer Security Incident Response plan (the "Plan") describes preparation, policies and procedures for response to an anticipated, suspected or ongoing security incident.
Content: This Computer Security Incident Response plan (the "Plan") describes preparation, policies and procedures for response to an anticipated, suspected or ongoing security incident.
AI Justification
The text discusses the importance of policies and procedures in response to security incidents, aligning with the need for assessment and monitoring as outlined in CA-1.
Document Content
Matched Section
Section: Handling of Potential Evidence
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
AI Justification
The chunk discusses the importance of logging all information and maintaining a chain of evidence, which aligns with the requirements for audit information and logging activities.
Document Content
Matched Section
Section: Review of the Plan
Content: The Security Team reviews the Plan periodically as Verterim adds new clients and operating capacity, and as business requirements change. The Security Team incorporates revisions to the Plan as necessary in the Security Team's discretion.
Content: The Security Team reviews the Plan periodically as Verterim adds new clients and operating capacity, and as business requirements change. The Security Team incorporates revisions to the Plan as necessary in the Security Team's discretion.
AI Justification
The text discusses the periodic review and assessment of the security plan, which aligns with the requirement for organizations to assess controls and ensure they meet current operational needs.
Document Content
Matched Section
Section: The Security Team reviews the Plan periodically as Verterim adds new clients and operating capacity, and as business requirements change.
Content: The Security Team reviews the Plan periodically as Verterim adds new clients and operating capacity, and as business requirements change. The Security Team incorporates revisions to the Plan as necessary in the Security Team's discretion.
Content: The Security Team reviews the Plan periodically as Verterim adds new clients and operating capacity, and as business requirements change. The Security Team incorporates revisions to the Plan as necessary in the Security Team's discretion.
AI Justification
The text discusses the periodic review and revision of the Plan by the Security Team, which aligns with the systematic proposal and review of changes as outlined in CM-3.
Document Content
Matched Section
Section: 2.1 Events and Incidents
Content: The Security Team will distribute all revisions to the Plan to appropriate personnel, who will exchange old Plans for the newly revised Plans. The Security Team will also provide appropriate documentation to clients if any revision to the Plan materially impacts client expectations, agreements, operations, procedures or policies.
Content: The Security Team will distribute all revisions to the Plan to appropriate personnel, who will exchange old Plans for the newly revised Plans. The Security Team will also provide appropriate documentation to clients if any revision to the Plan materially impacts client expectations, agreements, operations, procedures or policies.
AI Justification
The Security Team's actions to distribute revisions and provide documentation align with conducting impact analyses as they ensure that personnel are informed of changes that may affect security and privacy.
Document Content
Matched Section
Section: This Computer Security Incident Response plan (the "Plan") describes preparation, policies and procedures for response to an anticipated, suspected or ongoing security incident.
Content: This Computer Security Incident Response plan (the "Plan") describes preparation, policies and procedures for response to an anticipated, suspected or ongoing security incident. The goal of these procedures is to have a pre-defined incident response program and procedures that will minimize the impact and scope of any incident.
Content: This Computer Security Incident Response plan (the "Plan") describes preparation, policies and procedures for response to an anticipated, suspected or ongoing security incident. The goal of these procedures is to have a pre-defined incident response program and procedures that will minimize the impact and scope of any incident.
AI Justification
The text discusses the importance of having a contingency planning policy and procedures in place for responding to security incidents, which aligns with the requirements of CP-1.
Document Content
Matched Section
Section: 4 Recovery
Content: After elimination, containment and/or recovery of any security threat, recovery begins. At this stage the response team may continue follow-on activities, but procedures to restore normal operating conditions begin. All affected company resources begin the process to restore normal function of systems, business process and data integrity.
Content: After elimination, containment and/or recovery of any security threat, recovery begins. At this stage the response team may continue follow-on activities, but procedures to restore normal operating conditions begin. All affected company resources begin the process to restore normal function of systems, business process and data integrity.
AI Justification
The text discusses the initiation of recovery procedures following a security incident, which aligns with the control's focus on executing contingency plan activities to restore organizational functions.
Document Content
Matched Section
Section: Contingency Planning for Systems
Content: Control: CP-2: Contingency planning for systems is part of an overall program for achieving continuity of operations for organizational mission and business functions. Contingency planning addresses system restoration and implementation of alternative mission or business processes when systems are compromised or breached.
Content: Control: CP-2: Contingency planning for systems is part of an overall program for achieving continuity of operations for organizational mission and business functions. Contingency planning addresses system restoration and implementation of alternative mission or business processes when systems are compromised or breached.
AI Justification
The text discusses the importance of contingency planning in the context of incident response and system recovery, aligning with the principles of CP-2.
Document Content
Matched Section
Section: Incident Response Planning
Content: Organizations consider whether continuity of operations during an incident conflicts with the capability to automatically disable the system, as specified in IR-4(5). Incident response planning is part of contingency planning for organizations and is addressed in the IR (Incident Response) family.
Content: Organizations consider whether continuity of operations during an incident conflicts with the capability to automatically disable the system, as specified in IR-4(5). Incident response planning is part of contingency planning for organizations and is addressed in the IR (Incident Response) family.
AI Justification
The text mentions the coordination of contingency planning with incident handling activities, which aligns with the requirements of IR-4.
Document Content
Matched Section
Section: 3.3.4 Collection of Evidence
Content: Where ever possible, the Response team should capture evidence of system activity and state through system snapshots, backups and/or other copies of data, logs and other system artifacts. The primary function of these snapshots is to document the system state to aid in analysis of the system and the scope of the threat.
Content: Where ever possible, the Response team should capture evidence of system activity and state through system snapshots, backups and/or other copies of data, logs and other system artifacts. The primary function of these snapshots is to document the system state to aid in analysis of the system and the scope of the threat.
AI Justification
The chunk discusses the preservation and documentation of evidence, which relates to the integrity of system backups and the need to capture system state information.
Document Content
Matched Section
Section: Incident Response Organization
Content: The incident response organization (“Response Team”) is composed of the permanent members of the Computer Security Incident Response Team (“Security Team”) and any other individuals or organizations involved in the incident.
Content: The incident response organization (“Response Team”) is composed of the permanent members of the Computer Security Incident Response Team (“Security Team”) and any other individuals or organizations involved in the incident.
AI Justification
The text discusses the composition of the incident response organization and the roles of various members, which aligns with the need for training related to those roles and responsibilities.
Document Content
Matched Section
Section: 1.2 Purpose
Content: The purpose of this plan is to document the Verterim’s prepared response to a Computer Security Incident.
Content: The purpose of this plan is to document the Verterim’s prepared response to a Computer Security Incident.
AI Justification
The text describes the preparation, policies, and procedures for responding to security incidents, which aligns with the requirements of the incident response policy and procedures control.
Document Content
Matched Section
Section: 3 Incident Response
Content: The incident response organization (“Response Team”) is composed of the permanent members of the Computer Security Incident Response Team (“Security Team”) and any other individuals or organizations involved in the incident.
Content: The incident response organization (“Response Team”) is composed of the permanent members of the Computer Security Incident Response Team (“Security Team”) and any other individuals or organizations involved in the incident.
AI Justification
The text discusses the composition of the incident response organization and the involvement of various individuals and organizations in the incident response process, which aligns with the need to document incidents and maintain records.
Document Content
Matched Section
Section: Section 3: Incident Response
Content: The incident response organization (“Response Team”) is composed of the permanent members of the Computer Security Incident Response Team (“Security Team”) and any other individuals or organizations involved in the incident. This includes individuals involved in the discovery, reporting, classification and prioritization of events, Verterim employees with relevant technical, communication or other skills, and 3rd parties (notably Legal, Law Enforcement or other specialists) that the Response Team may choose to involve in the response to an incident.
Content: The incident response organization (“Response Team”) is composed of the permanent members of the Computer Security Incident Response Team (“Security Team”) and any other individuals or organizations involved in the incident. This includes individuals involved in the discovery, reporting, classification and prioritization of events, Verterim employees with relevant technical, communication or other skills, and 3rd parties (notably Legal, Law Enforcement or other specialists) that the Response Team may choose to involve in the response to an incident.
AI Justification
The chunk describes the composition of the incident response organization and mentions various individuals and groups involved in incident response, aligning with the need for support resources.
Document Content
Matched Section
Section: 3 Incident Response
Content: The incident response organization (“Response Team”) is composed of the permanent members of the Computer Security Incident Response Team (“Security Team”) and any other individuals or organizations involved in the incident. This includes individuals involved in the discovery, reporting, classification and prioritization of events, Verterim employees with relevant technical, communication or other skills, and 3rd parties (notably Legal, Law Enforcement or other specialists) that the Response Team may choose to involve in the response to an incident.
Content: The incident response organization (“Response Team”) is composed of the permanent members of the Computer Security Incident Response Team (“Security Team”) and any other individuals or organizations involved in the incident. This includes individuals involved in the discovery, reporting, classification and prioritization of events, Verterim employees with relevant technical, communication or other skills, and 3rd parties (notably Legal, Law Enforcement or other specialists) that the Response Team may choose to involve in the response to an incident.
AI Justification
The text describes the composition of the incident response organization and highlights the involvement of various stakeholders, which aligns with the need for a coordinated approach to incident response as outlined in IR-8.
Document Content
Matched Section
Section: 3.3.3 Response Activities and 3.3.4 Collection of Evidence
Content: A security incident is appropriate grounds for initiating emergency maintenance in a production environment. The Response Team is free to take whatever reasonable steps are necessary to halt any Security Incident, including taking impacted systems offline, denying network access or any other steps that are necessary to protect secure information and systems. Protecting secure information and systems is a higher priority than any ongoing operations of the systems and/or business. Where ever possible, the Response team should capture evidence of system activity and state through system snapshots, backups and/or other copies of data, logs and other system artifacts. The primary function of these snapshots is to document the system state to aid in analysis of the system and the scope of the threat.
Content: A security incident is appropriate grounds for initiating emergency maintenance in a production environment. The Response Team is free to take whatever reasonable steps are necessary to halt any Security Incident, including taking impacted systems offline, denying network access or any other steps that are necessary to protect secure information and systems. Protecting secure information and systems is a higher priority than any ongoing operations of the systems and/or business. Where ever possible, the Response team should capture evidence of system activity and state through system snapshots, backups and/or other copies of data, logs and other system artifacts. The primary function of these snapshots is to document the system state to aid in analysis of the system and the scope of the threat.
AI Justification
The text discusses the importance of maintenance policies and procedures in the context of security incidents and the need for documentation, which aligns with the control's focus on establishing such policies.
Document Content
Matched Section
Section: In addition, any information gathered that may be of value in future legal proceedings should be handled as follows:
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
AI Justification
The section discusses the logging and protection of information that may be used as evidence, which aligns with the requirements for maintaining accountability and tracking media during transport.
Document Content
Matched Section
Section: The Security Team reviews the Plan periodically as Verterim adds new clients and operating capacity, and as business requirements change.
Content: The Security Team reviews the Plan periodically as Verterim adds new clients and operating capacity, and as business requirements change. The Security Team incorporates revisions to the Plan as necessary in the Security Team's discretion.
Content: The Security Team reviews the Plan periodically as Verterim adds new clients and operating capacity, and as business requirements change. The Security Team incorporates revisions to the Plan as necessary in the Security Team's discretion.
AI Justification
The Security Team's periodic review and revision of the Plan aligns with the concept of tailoring controls to reflect changes in business requirements and operational needs.
Document Content
Matched Section
Section: 1.1 Audience and 1.2 Purpose
Content: This Computer Security Incident Response plan (the "Plan") describes preparation, policies and procedures for response to an anticipated, suspected or ongoing security incident.
Content: This Computer Security Incident Response plan (the "Plan") describes preparation, policies and procedures for response to an anticipated, suspected or ongoing security incident.
AI Justification
The chunk describes the preparation, policies, and procedures for responding to security incidents, which aligns with the planning and procedural aspects of control PL-1.
Document Content
Matched Section
Section: Section 2.2 Incident Response Organization
Content: This plan addresses only adverse events that are computer security-related and Data privacy related and excludes adverse events caused by sources such as natural disasters and power failures.
Content: This plan addresses only adverse events that are computer security-related and Data privacy related and excludes adverse events caused by sources such as natural disasters and power failures.
AI Justification
The text discusses the scope and focus of the security and privacy plan, specifically addressing computer security incidents and data privacy-related events, which aligns with the requirements of PL-2.
Document Content
Matched Section
Section: 2.2 Incident Response Organization
Content: This plan addresses only adverse events that are computer security-related and Data privacy related and excludes adverse events caused by sources such as natural disasters and power failures.
Content: This plan addresses only adverse events that are computer security-related and Data privacy related and excludes adverse events caused by sources such as natural disasters and power failures.
AI Justification
The section discusses the identification and management of adverse events related to computer security and data privacy, which aligns with the need for protection capabilities against threats.
Document Content
Matched Section
Section: Handling of potential evidence
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
AI Justification
The chunk discusses the importance of logging all information and maintaining a chain of evidence, which aligns with the purpose of accounting for disclosures as outlined in PM-21.
Document Content
Matched Section
Section: 2.2 Incident Response Organization
Content: This plan addresses only adverse events that are computer security-related and Data privacy related and excludes adverse events caused by sources such as natural disasters and power failures.
Content: This plan addresses only adverse events that are computer security-related and Data privacy related and excludes adverse events caused by sources such as natural disasters and power failures.
AI Justification
The text discusses the importance of policies and procedures related to data privacy and security, which aligns with the requirements for managing personally identifiable information.
Document Content
Matched Section
Section: In addition, any information gathered that may be of value in future legal proceedings should be handled as follows
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
Content: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
AI Justification
The chunk discusses the logging and handling of information that may be used as evidence, which aligns with the processing operations described in PT-2.
Document Content
Matched Section
Section: Response Objectives
Content: The objectives are: • Confirm the threat; • Eliminate the threat – halt the attack, take effected systems offline, deny network access or take whatever steps are necessary to protect secure information and systems.
Content: The objectives are: • Confirm the threat; • Eliminate the threat – halt the attack, take effected systems offline, deny network access or take whatever steps are necessary to protect secure information and systems.
AI Justification
The text discusses the need for tailored response activities and procedures to confirm and eliminate threats, which aligns with the proactive nature of threat hunting.
Document Content
Matched Section
Section: Incident Response Organization
Content: This plan addresses only adverse events that are computer security-related and Data privacy related and excludes adverse events caused by sources such as natural disasters and power failures.
Content: This plan addresses only adverse events that are computer security-related and Data privacy related and excludes adverse events caused by sources such as natural disasters and power failures.
AI Justification
The text discusses adverse events related to computer security and data privacy, which aligns with the need for security categorization to understand potential impacts.
Document Content
Matched Section
Section: Response Team Decision-Making
Content: All available members of the Response team join a conference call where the verifier shares indicators and their analysis. At this time the Response Team may conclude on the basis of the information at hand or additional information that has subsequently become available that no security threat exists and end the response protocol.
Content: All available members of the Response team join a conference call where the verifier shares indicators and their analysis. At this time the Response Team may conclude on the basis of the information at hand or additional information that has subsequently become available that no security threat exists and end the response protocol.
AI Justification
The text discusses the decision-making process of the Response Team regarding the existence of a security threat and the subsequent actions, which aligns with the risk response strategies outlined in RA-7.
Document Content
Matched Section
Section: Security Team reviews the Plan periodically
Content: The Security Team reviews the Plan periodically as Verterim adds new clients and operating capacity, and as business requirements change. The Security Team incorporates revisions to the Plan as necessary in the Security Team's discretion.
Content: The Security Team reviews the Plan periodically as Verterim adds new clients and operating capacity, and as business requirements change. The Security Team incorporates revisions to the Plan as necessary in the Security Team's discretion.
AI Justification
The text discusses the periodic review and evaluation of the security plan, including the incorporation of changes and assessment of test results, which aligns with the requirements for developmental testing and evaluation.
Document Content
Matched Section
Section: 3.3.4 Collection of Evidence
Content: Where ever possible, the Response team should capture evidence of system activity and state through system snapshots, backups and/or other copies of data, logs and other system artifacts. The primary function of these snapshots is to document the system state to aid in analysis of the system and the scope of the threat.
Content: Where ever possible, the Response team should capture evidence of system activity and state through system snapshots, backups and/or other copies of data, logs and other system artifacts. The primary function of these snapshots is to document the system state to aid in analysis of the system and the scope of the threat.
AI Justification
The chunk discusses the importance of documenting evidence and system activity, which aligns with the need for system documentation to understand the implementation and operation of controls.
Document Content
Matched Section
Section: 2.2 Incident Response Organization
Content: This plan addresses only adverse events that are computer security-related and Data privacy related and excludes adverse events caused by sources such as natural disasters and power failures.
Content: This plan addresses only adverse events that are computer security-related and Data privacy related and excludes adverse events caused by sources such as natural disasters and power failures.
AI Justification
The text discusses the importance of policies and procedures related to system and communications protection, which aligns with the control SC-1.
Document Content
Matched Section
Section: 3.3.4 Collection of Evidence
Content: Where ever possible, the Response team should capture evidence of system activity and state through system snapshots, backups and/or other copies of data, logs and other system artifacts. The primary function of these snapshots is to document the system state to aid in analysis of the system and the scope of the threat.
Content: Where ever possible, the Response team should capture evidence of system activity and state through system snapshots, backups and/or other copies of data, logs and other system artifacts. The primary function of these snapshots is to document the system state to aid in analysis of the system and the scope of the threat.
AI Justification
The chunk discusses the importance of preserving system state information and capturing evidence, which aligns with the control's focus on maintaining system integrity and preventing loss of confidentiality, integrity, or availability during failures.
Document Content
Matched Section
Section: Response Team Coordination
Content: All available members of the Response team join a conference call where the verifier shares indicators and their analysis. At this time the Response Team may conclude on the basis of the information at hand or additional information that has subsequently become available that no security threat exists and end the response protocol.
Content: All available members of the Response team join a conference call where the verifier shares indicators and their analysis. At this time the Response Team may conclude on the basis of the information at hand or additional information that has subsequently become available that no security threat exists and end the response protocol.
AI Justification
The text discusses the coordination of the Response Team and the importance of communication during incident response, which aligns with the need for alternate communications paths as stated in SC-47.
Document Content
Matched Section
Section: 2.2 Incident Response Organization
Content: This plan addresses only adverse events that are computer security-related and Data privacy related and excludes adverse events caused by sources such as natural disasters and power failures.
Content: This plan addresses only adverse events that are computer security-related and Data privacy related and excludes adverse events caused by sources such as natural disasters and power failures.
AI Justification
The text discusses the importance of policies and procedures related to system and information integrity, particularly in the context of computer security incidents.
Document Content
Matched Section
Section: 3.3.5 Notification
Content: In addition, any information gathered that may be of value in future legal proceedings should be handled as follows: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
Content: In addition, any information gathered that may be of value in future legal proceedings should be handled as follows: • All information must be logged. • When possible obtain supporting logs from other computers or devices as evidence to support primary evidence. • The chain of evidence must be protected. All actions taken with potential evidence must be logged. This includes change of possession/access, burning to read-only media, change of location. Include who, what, where and when. • All handling of potential evidence must be logged. For example the transfer of evidence from one computer to another and the burning of evidence
AI Justification
The text discusses the logging and handling of information that may be used as evidence, which aligns with the requirements for information management and retention throughout its life cycle.
Document Content
Matched Section
Section: 2.2 Incident Response Organization
Content: This plan addresses only adverse events that are computer security-related and Data privacy related and excludes adverse events caused by sources such as natural disasters and power failures. A Computer Security Incident (“Incident”) is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices. This includes events in which there was a loss of data confidentiality, disruption of data or system integrity, or disruption or denial of availability.
Content: This plan addresses only adverse events that are computer security-related and Data privacy related and excludes adverse events caused by sources such as natural disasters and power failures. A Computer Security Incident (“Incident”) is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices. This includes events in which there was a loss of data confidentiality, disruption of data or system integrity, or disruption or denial of availability.
AI Justification
The text discusses the definition of a computer security incident and the implications of data loss, which aligns with the control's focus on addressing cyber-attacks and data exfiltration.
Document Content
Matched Section
Section: 3.3.4 Collection of Evidence
Content: Where ever possible, the Response team should capture evidence of system activity and state through system snapshots, backups and/or other copies of data, logs and other system artifacts. The primary function of these snapshots is to document the system state to aid in analysis of the system and the scope of the threat.
Content: Where ever possible, the Response team should capture evidence of system activity and state through system snapshots, backups and/or other copies of data, logs and other system artifacts. The primary function of these snapshots is to document the system state to aid in analysis of the system and the scope of the threat.
AI Justification
The text discusses the importance of capturing and documenting evidence, which aligns with the objectives of system monitoring, including the observation of events and the collection of data for future legal proceedings.
Document Content
Matched Section
Section: Incident Response Objectives
Content: Each Security Incident presents its own threats and characteristics. The activities and procedures followed by the Response team must be tailored on-the-fly to respond. However, the overarching objectives of the response are consistent across all incidents. The objectives are: • Confirm the threat; • Eliminate the threat – halt the attack, take effected systems offline, deny network access or take whatever steps are necessary to protect secure information and systems. • Limit access; • Investigate the extent of the damage, if any; • Back-up the affected systems and data; • Eradicate components of the incident including malicious code, compromised accounts, secondary artifacts, etc. • Direct and implement corrective actions to restore service; • Contact law enforcement where applicable to work with the Security team; * Contact Legal to provide a review of the incident and seek guidance as necessary; • Produce an Incident Report within 24 hours detailing the findings;
Content: Each Security Incident presents its own threats and characteristics. The activities and procedures followed by the Response team must be tailored on-the-fly to respond. However, the overarching objectives of the response are consistent across all incidents. The objectives are: • Confirm the threat; • Eliminate the threat – halt the attack, take effected systems offline, deny network access or take whatever steps are necessary to protect secure information and systems. • Limit access; • Investigate the extent of the damage, if any; • Back-up the affected systems and data; • Eradicate components of the incident including malicious code, compromised accounts, secondary artifacts, etc. • Direct and implement corrective actions to restore service; • Contact law enforcement where applicable to work with the Security team; * Contact Legal to provide a review of the incident and seek guidance as necessary; • Produce an Incident Report within 24 hours detailing the findings;
AI Justification
The chunk describes the activities and procedures of a response team tailored to address security incidents, which aligns with the control's focus on maintaining situational awareness and responding to security threats.
Document Content
Matched Section
Section: 3.3.4 Collection of Evidence
Content: Where ever possible, the Response team should capture evidence of system activity and state through system snapshots, backups and/or other copies of data, logs and other system artifacts. The primary function of these snapshots is to document the system state to aid in analysis of the system and the scope of the threat.
Content: Where ever possible, the Response team should capture evidence of system activity and state through system snapshots, backups and/or other copies of data, logs and other system artifacts. The primary function of these snapshots is to document the system state to aid in analysis of the system and the scope of the threat.
AI Justification
The text discusses the importance of preserving and documenting evidence, which aligns with the need for maintaining provenance records and ensuring non-repudiation.
Acceptable_Use_Policy.docx NIST
77 matches foundDocument Content
Matched Section
Section: 4.0 Policy
Content: The purpose of this policy is to outline the acceptable use of computer equipment at Verterim. These rules are in place to protect the employee and Verterim.
Content: The purpose of this policy is to outline the acceptable use of computer equipment at Verterim. These rules are in place to protect the employee and Verterim.
AI Justification
The text discusses the importance of access control policies and procedures, aligning with the requirements of AC-1.
Document Content
Matched Section
Section: 2. All PCs, laptops and workstations should be secured with a password-protected screensaver with the automatic activation feature set at 10 minutes or less, or by logging-off when the host will be unattended.
Content: 2. All PCs, laptops and workstations should be secured with a password-protected screensaver with the automatic activation feature set at 10 minutes or less, or by logging-off when the host will be unattended.
Content: 2. All PCs, laptops and workstations should be secured with a password-protected screensaver with the automatic activation feature set at 10 minutes or less, or by logging-off when the host will be unattended.
AI Justification
The chunk discusses securing PCs, laptops, and workstations with password-protected screensavers and logging off when unattended, which aligns with the concept of device locks as a temporary measure to prevent unauthorized access.
Document Content
Matched Section
Section: 11. Circumventing user authentication or security of any host, network or account.
Content: 11. Circumventing user authentication or security of any host, network or account.
Content: 11. Circumventing user authentication or security of any host, network or account.
AI Justification
The chunk discusses actions that involve circumventing user authentication and security, which aligns with the control's focus on permitting specific user actions without identification or authentication under certain conditions.
Document Content
Matched Section
Section: Affecting security breaches or disruptions of network communication.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
AI Justification
The chunk discusses security breaches and disruptions in network communication, which are relevant to remote access controls and the potential risks associated with unauthorized access.
Document Content
Matched Section
Section: Circumventing user authentication or security of any host, network or account.
Content: Circumventing user authentication or security of any host, network or account.
Content: Circumventing user authentication or security of any host, network or account.
AI Justification
The chunk mentions circumventing user authentication and security, which relates to enforcing access restrictions.
Document Content
Matched Section
Section: 1. While Verterim desires to provide a reasonable level of privacy...
Content: While Verterim desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of Verterim and its clients, partners, or other agents of the company.
Content: While Verterim desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of Verterim and its clients, partners, or other agents of the company.
AI Justification
The text discusses the responsibilities of employees regarding the handling of sensitive information and the importance of guidelines for personal use, which aligns with the control's focus on information sharing and restrictions.
Document Content
Matched Section
Section: 3. Verterim recommends that any information that users consider sensitive or vulnerable be encrypted.
Content: Verterim recommends that any information that users consider sensitive or vulnerable be encrypted.
Content: Verterim recommends that any information that users consider sensitive or vulnerable be encrypted.
AI Justification
The recommendation for encrypting sensitive information aligns with the control's emphasis on protecting restricted information.
Document Content
Matched Section
Section: 1. While Verterim desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of Verterim and its clients, partners, or other agents of the company.
Content: 1. While Verterim desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of Verterim and its clients, partners, or other agents of the company.
Content: 1. While Verterim desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of Verterim and its clients, partners, or other agents of the company.
AI Justification
The text discusses the responsibilities of employees regarding the use of corporate systems and the management of sensitive information, aligning with the principles of access control and information protection.
Document Content
Matched Section
Section: 2. Employees are responsible for exercising good judgment regarding the reasonableness of personal use. Individual departments are responsible for creating guidelines concerning personal use of Internet/Intranet/Extranet systems.
Content: 2. Employees are responsible for exercising good judgment regarding the reasonableness of personal use. Individual departments are responsible for creating guidelines concerning personal use of Internet/Intranet/Extranet systems.
Content: 2. Employees are responsible for exercising good judgment regarding the reasonableness of personal use. Individual departments are responsible for creating guidelines concerning personal use of Internet/Intranet/Extranet systems.
AI Justification
The mention of departmental guidelines for personal use of Internet/Intranet/Extranet systems indicates a structured approach to managing access and use of information, which aligns with access control policies.
Document Content
Matched Section
Section: 3. Verterim recommends that any information that users consider sensitive or vulnerable be encrypted.
Content: 3. Verterim recommends that any information that users consider sensitive or vulnerable be encrypted.
Content: 3. Verterim recommends that any information that users consider sensitive or vulnerable be encrypted.
AI Justification
The recommendation for encrypting sensitive information aligns with the need to protect nonpublic information and manage access to it.
Document Content
Matched Section
Section: Section 4 and 5 regarding monitoring and auditing
Content: 4. For security and network maintenance purposes, authorized individuals within Verterim may monitor equipment, systems and network traffic at any time. 5. Verterim reserves the right to audit networks and systems on a periodic basis to ensure compliance with this policy.
Content: 4. For security and network maintenance purposes, authorized individuals within Verterim may monitor equipment, systems and network traffic at any time. 5. Verterim reserves the right to audit networks and systems on a periodic basis to ensure compliance with this policy.
AI Justification
The text discusses monitoring and auditing of systems and networks, which relates to enforcing access control policies and ensuring compliance.
Document Content
Matched Section
Section: 4.0 Policy
Content: The purpose of this policy is to outline the acceptable use of computer equipment at Verterim. These rules are in place to protect the employee and Verterim.
Content: The purpose of this policy is to outline the acceptable use of computer equipment at Verterim. These rules are in place to protect the employee and Verterim.
AI Justification
The text emphasizes the importance of guidelines for acceptable use of computer equipment, which aligns with the need for access control policies to protect organizational systems.
Document Content
Matched Section
Section: Affecting security breaches or disruptions of network communication.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes.
AI Justification
The chunk discusses various forms of security breaches and disruptions in network communication, which aligns with the concept of information flow control that regulates how information can travel within and between systems.
Document Content
Matched Section
Section: 9. Affecting security breaches or disruptions of network communication.
Content: Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
Content: Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
AI Justification
The text discusses unauthorized access and actions that can lead to security breaches, which relates to the need for separation of duties to prevent abuse of privileges.
Document Content
Matched Section
Section: Affecting security breaches or disruptions of network communication
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
AI Justification
The text discusses security breaches related to unauthorized access and denial of service, which aligns with the need to limit unsuccessful logon attempts and take action when the maximum number is exceeded.
Document Content
Matched Section
Section: Circumventing user authentication or security of any host, network or account.
Content: Circumventing user authentication or security of any host, network or account.
Content: Circumventing user authentication or security of any host, network or account.
AI Justification
The mention of circumventing user authentication directly relates to the control's focus on managing logon attempts and unauthorized access.
Document Content
Matched Section
Section: Interfering with or denying service to any user other than the employee's host.
Content: Interfering with or denying service to any user other than the employee's host (for example, denial of service attack).
Content: Interfering with or denying service to any user other than the employee's host (for example, denial of service attack).
AI Justification
The reference to denial of service attacks aligns with the control's emphasis on preventing brute force attacks and managing access.
Document Content
Matched Section
Section: Awareness and training policy and procedures
Content: While Verterim desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of Verterim and its clients, partners, or other agents of the company.
Content: While Verterim desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of Verterim and its clients, partners, or other agents of the company.
AI Justification
The text discusses the importance of awareness and training policies and procedures in relation to security and privacy, which aligns with the AT-1 control.
Document Content
Matched Section
Section: Section 9 and 10 regarding security breaches and network monitoring.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes. Executing any form of network monitoring which will intercept data not intended for the employee's host, unless this activity is a part of the employee's normal job/duty.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes. Executing any form of network monitoring which will intercept data not intended for the employee's host, unless this activity is a part of the employee's normal job/duty.
AI Justification
The chunk discusses security breaches and unauthorized access, which relates to the need for session auditing to monitor and track such activities.
Document Content
Matched Section
Section: Section 4 and 5 regarding monitoring and auditing of networks and systems.
Content: 4. For security and network maintenance purposes, authorized individuals within Verterim may monitor equipment, systems and network traffic at any time. 5. Verterim reserves the right to audit networks and systems on a periodic basis to ensure compliance with this policy.
Content: 4. For security and network maintenance purposes, authorized individuals within Verterim may monitor equipment, systems and network traffic at any time. 5. Verterim reserves the right to audit networks and systems on a periodic basis to ensure compliance with this policy.
AI Justification
The text discusses the monitoring of equipment, systems, and network traffic, which aligns with the requirements for audit record review and analysis.
Document Content
Matched Section
Section: Section 5: Auditing Networks and Systems
Content: Verterim reserves the right to audit networks and systems on a periodic basis to ensure compliance with this policy.
Content: Verterim reserves the right to audit networks and systems on a periodic basis to ensure compliance with this policy.
AI Justification
The text discusses the monitoring and auditing of networks and systems, which aligns with the requirements for audit information and protection.
Document Content
Matched Section
Section: Section 4 and 5 regarding monitoring and auditing of networks and systems.
Content: 4. For security and network maintenance purposes, authorized individuals within Verterim may monitor equipment, systems and network traffic at any time. 5. Verterim reserves the right to audit networks and systems on a periodic basis to ensure compliance with this policy.
Content: 4. For security and network maintenance purposes, authorized individuals within Verterim may monitor equipment, systems and network traffic at any time. 5. Verterim reserves the right to audit networks and systems on a periodic basis to ensure compliance with this policy.
AI Justification
The text discusses the monitoring of equipment, systems, and network traffic, which aligns with the continuous monitoring concept outlined in CA-7.
Document Content
Matched Section
Section: Violations of the rights of any person or company protected by copyright, trade secret, patent or other intellectual property
Content: Violations of the rights of any person or company protected by copyright, trade secret, patent or other intellectual property, or similar laws or regulations, including, but not limited to, the installation or distribution of 'pirated' or other software products that are not appropriately licensed for use by Verterim.
Content: Violations of the rights of any person or company protected by copyright, trade secret, patent or other intellectual property, or similar laws or regulations, including, but not limited to, the installation or distribution of 'pirated' or other software products that are not appropriately licensed for use by Verterim.
AI Justification
The chunk discusses violations of copyright and unauthorized copying of copyrighted material, which relates to the tracking of software licenses.
Document Content
Matched Section
Section: 1. While Verterim desires to provide a reasonable level of privacy...
Content: 1. While Verterim desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of Verterim and its clients, partners, or other agents of the company.
Content: 1. While Verterim desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of Verterim and its clients, partners, or other agents of the company.
AI Justification
The chunk discusses the handling of data created on corporate systems, emphasizing the importance of privacy and the responsibility of employees regarding sensitive information, which aligns with the control's focus on processing personally identifiable information and understanding privacy risks.
Document Content
Matched Section
Section: 3. Verterim recommends that any information that users consider sensitive or vulnerable be encrypted.
Content: 3. Verterim recommends that any information that users consider sensitive or vulnerable be encrypted. For guidelines on information classification, see Verterim's Information Sensitivity Policy. For guidelines on encrypting email and documents, see Verterim’s Acceptable Encryption Policy.
Content: 3. Verterim recommends that any information that users consider sensitive or vulnerable be encrypted. For guidelines on information classification, see Verterim's Information Sensitivity Policy. For guidelines on encrypting email and documents, see Verterim’s Acceptable Encryption Policy.
AI Justification
The recommendation for encrypting sensitive information aligns with the control's emphasis on the processing and protection of personally identifiable information.
Document Content
Matched Section
Section: Violations of the rights of any person or company protected by copyright, trade secret, patent or other intellectual property
Content: 1. Violations of the rights of any person or company protected by copyright, trade secret, patent or other intellectual property, or similar laws or regulations, including, but not limited to, the installation or distribution of 'pirated' or other software products that are not appropriately licensed for use by Verterim.
Content: 1. Violations of the rights of any person or company protected by copyright, trade secret, patent or other intellectual property, or similar laws or regulations, including, but not limited to, the installation or distribution of 'pirated' or other software products that are not appropriately licensed for use by Verterim.
AI Justification
The chunk discusses violations related to unauthorized software installation and distribution, which aligns with the control's focus on governing user-installed software.
Document Content
Matched Section
Section: Unauthorized copying of copyrighted material
Content: 2. Unauthorized copying of copyrighted material including, but not limited to, digitization and distribution of photographs from magazines, books or other copyrighted sources, copyrighted music, and the installation of any copyrighted software for which Verterim or the end user does not have an active license is strictly prohibited.
Content: 2. Unauthorized copying of copyrighted material including, but not limited to, digitization and distribution of photographs from magazines, books or other copyrighted sources, copyrighted music, and the installation of any copyrighted software for which Verterim or the end user does not have an active license is strictly prohibited.
AI Justification
The prohibition of unauthorized copying of copyrighted material directly relates to controlling software installations and ensuring compliance with licensing agreements.
Document Content
Matched Section
Section: Exporting software, technical information, encryption software or technology
Content: 3. Exporting software, technical information, encryption software or technology, in violation of international or regional export control laws, is illegal. The appropriate management should be consulted prior to export of any material that is in question.
Content: 3. Exporting software, technical information, encryption software or technology, in violation of international or regional export control laws, is illegal. The appropriate management should be consulted prior to export of any material that is in question.
AI Justification
The mention of exporting software and the need for management consultation aligns with the control's focus on permitted and prohibited actions regarding software installation.
Document Content
Matched Section
Section: Introduction of malicious code or programs
Content: 4. Introduction of malicious code or programs
Content: 4. Introduction of malicious code or programs
AI Justification
The introduction of malicious code relates to the control's emphasis on prohibiting potentially malicious software installations.
Document Content
Matched Section
Section: Affecting security breaches or disruptions of network communication
Content: Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
Content: Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
AI Justification
The text discusses security breaches and unauthorized access, which relates to limiting system functionality to reduce risk.
Document Content
Matched Section
Section: 9. Affecting security breaches or disruptions of network communication
Content: Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
Content: Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
AI Justification
The chunk discusses unauthorized access and the need for additional authentication measures when suspicious behavior is detected, which aligns with the concept of adaptive authentication.
Document Content
Matched Section
Section: 11. Circumventing user authentication or security of any host, network or account.
Content: Circumventing user authentication or security of any host, network or account.
Content: Circumventing user authentication or security of any host, network or account.
AI Justification
The mention of circumventing user authentication aligns with the need for organizations to implement mechanisms to assess and respond to suspicious behavior.
Document Content
Matched Section
Section: Section 9-12 regarding security breaches and unauthorized access.
Content: 9. Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes. 10. Executing any form of network monitoring which will intercept data not intended for the employee's host, unless this activity is a part of the employee's normal job/duty. 11. Circumventing user authentication or security of any host, network or account. 12. Interfering with or denying service to any user other than the employee's host (for example, denial of service attack).
Content: 9. Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes. 10. Executing any form of network monitoring which will intercept data not intended for the employee's host, unless this activity is a part of the employee's normal job/duty. 11. Circumventing user authentication or security of any host, network or account. 12. Interfering with or denying service to any user other than the employee's host (for example, denial of service attack).
AI Justification
The chunk discusses unauthorized access and security breaches, which relate to the need for unique device identification and authentication to prevent such incidents.
Document Content
Matched Section
Section: 1. Keep passwords secure and do not share accounts.
Content: 1. Keep passwords secure and do not share accounts. Authorized users are responsible for the security of their passwords and accounts. System level passwords should be changed quarterly; user level passwords should be changed every six months.
Content: 1. Keep passwords secure and do not share accounts. Authorized users are responsible for the security of their passwords and accounts. System level passwords should be changed quarterly; user level passwords should be changed every six months.
AI Justification
The chunk discusses the importance of keeping passwords secure, changing them regularly, and managing authenticator security, which aligns with the requirements for authenticators outlined in IA-5.
Document Content
Matched Section
Section: 1. Keep passwords secure and do not share accounts.
Content: 1. Keep passwords secure and do not share accounts. Authorized users are responsible for the security of their passwords and accounts.
Content: 1. Keep passwords secure and do not share accounts. Authorized users are responsible for the security of their passwords and accounts.
AI Justification
The chunk emphasizes the responsibilities of authorized users regarding password security, which aligns with the need for established rules of behavior for using authenticators.
Document Content
Matched Section
Section: 2. All PCs, laptops and workstations should be secured with a password-protected screensaver with the automatic activation feature set at 10 minutes or less, or by logging-off when the host will be unattended.
Content: 2. All PCs, laptops and workstations should be secured with a password-protected screensaver with the automatic activation feature set at 10 minutes or less, or by logging-off when the host will be unattended.
Content: 2. All PCs, laptops and workstations should be secured with a password-protected screensaver with the automatic activation feature set at 10 minutes or less, or by logging-off when the host will be unattended.
AI Justification
The chunk mentions the importance of securing systems with password-protected screensavers and logging off when unattended, which aligns with access enforcement controls.
Document Content
Matched Section
Section: Affecting security breaches or disruptions of network communication
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
AI Justification
The chunk discusses security breaches and unauthorized access, which aligns with the concept of information spillage where unauthorized access to information occurs.
Document Content
Matched Section
Section: Section 9-12 regarding security breaches and network disruptions.
Content: 9. Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes. 10. Executing any form of network monitoring which will intercept data not intended for the employee's host, unless this activity is a part of the employee's normal job/duty. 11. Circumventing user authentication or security of any host, network or account. 12. Interfering with or denying service to any user other than the employee's host (for example, denial of service attack).
Content: 9. Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes. 10. Executing any form of network monitoring which will intercept data not intended for the employee's host, unless this activity is a part of the employee's normal job/duty. 11. Circumventing user authentication or security of any host, network or account. 12. Interfering with or denying service to any user other than the employee's host (for example, denial of service attack).
AI Justification
The chunk discusses security breaches and disruptions, which are relevant to incident response capabilities and the need for monitoring and reporting incidents.
Document Content
Matched Section
Section: 4.0 Policy
Content: The purpose of this policy is to outline the acceptable use of computer equipment at Verterim. These rules are in place to protect the employee and Verterim.
Content: The purpose of this policy is to outline the acceptable use of computer equipment at Verterim. These rules are in place to protect the employee and Verterim.
AI Justification
The text discusses the importance of policies and procedures related to security and privacy, which aligns with the control's focus on establishing such policies for physical and environmental protection.
Document Content
Matched Section
Section: 9. Affecting security breaches or disruptions of network communication.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
AI Justification
The chunk discusses security breaches and unauthorized access, which relates to the physical and environmental hazards that could lead to such breaches.
Document Content
Matched Section
Section: Affecting security breaches or disruptions of network communication.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
AI Justification
The section discusses security breaches and unauthorized access to data, which relates to the concept of information leakage as it involves accessing data not intended for the employee.
Document Content
Matched Section
Section: 4.0 Policy
Content: The purpose of this policy is to outline the acceptable use of computer equipment at Verterim. These rules are in place to protect the employee and Verterim.
Content: The purpose of this policy is to outline the acceptable use of computer equipment at Verterim. These rules are in place to protect the employee and Verterim.
AI Justification
The text discusses the importance of policies and procedures for security and privacy, aligning with the need for planning in the implementation of controls.
Document Content
Matched Section
Section: 4.0 Policy
Content: The purpose of this policy is to outline the acceptable use of computer equipment at Verterim. These rules are in place to protect the employee and Verterim. Inappropriate use exposes Verterim to risks including virus attacks, compromise of network systems and services, and legal issues.
Content: The purpose of this policy is to outline the acceptable use of computer equipment at Verterim. These rules are in place to protect the employee and Verterim. Inappropriate use exposes Verterim to risks including virus attacks, compromise of network systems and services, and legal issues.
AI Justification
The text discusses the importance of guidelines for acceptable use of computer equipment, which aligns with the concept of rules of behavior for organizational users.
Document Content
Matched Section
Section: 1. While Verterim desires to provide a reasonable level of privacy
Content: While Verterim desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of Verterim and its clients, partners, or other agents of the company.
Content: While Verterim desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of Verterim and its clients, partners, or other agents of the company.
AI Justification
The text discusses the importance of privacy and the protection of personally identifiable information, which aligns with the need for technology-independent capabilities to counter threats to information.
Document Content
Matched Section
Section: 2. Employees are responsible for exercising good judgment regarding the reasonableness of personal use.
Content: Employees are responsible for exercising good judgment regarding the reasonableness of personal use. Individual departments are responsible for creating guidelines concerning personal use of Internet/Intranet/Extranet systems.
Content: Employees are responsible for exercising good judgment regarding the reasonableness of personal use. Individual departments are responsible for creating guidelines concerning personal use of Internet/Intranet/Extranet systems.
AI Justification
The mention of guidelines for personal use and the responsibility of employees to exercise good judgment relates to the organizational risk management strategy and the need for defined protection requirements.
Document Content
Matched Section
Section: 3. Verterim recommends that any information that users consider sensitive or vulnerable be encrypted.
Content: Verterim recommends that any information that users consider sensitive or vulnerable be encrypted.
Content: Verterim recommends that any information that users consider sensitive or vulnerable be encrypted.
AI Justification
The recommendation for encrypting sensitive information aligns with the need to protect personally identifiable information and the associated risks.
Document Content
Matched Section
Section: 4.0 Policy
Content: The purpose of this policy is to outline the acceptable use of computer equipment at Verterim. These rules are in place to protect the employee and Verterim. Inappropriate use exposes Verterim to risks including virus attacks, compromise of network systems and services, and legal issues.
Content: The purpose of this policy is to outline the acceptable use of computer equipment at Verterim. These rules are in place to protect the employee and Verterim. Inappropriate use exposes Verterim to risks including virus attacks, compromise of network systems and services, and legal issues.
AI Justification
The text emphasizes the importance of policies and procedures for security, which aligns with the need for a personnel security policy as outlined in PS-1.
Document Content
Matched Section
Section: 3.0 Scope
Content: This policy applies to employees, contractors, consultants, temporaries, and other workers at Verterim, including all personnel affiliated with third parties.
Content: This policy applies to employees, contractors, consultants, temporaries, and other workers at Verterim, including all personnel affiliated with third parties.
AI Justification
The text discusses the responsibilities of all personnel, including contractors and third-party affiliates, which aligns with the control's focus on external providers and their security requirements.
Document Content
Matched Section
Section: 1. While Verterim desires to provide a reasonable level of privacy...
Content: While Verterim desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of Verterim and its clients, partners, or other agents of the company.
Content: While Verterim desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of Verterim and its clients, partners, or other agents of the company.
AI Justification
The text discusses the importance of policies and procedures related to personally identifiable information and emphasizes the need for collaboration between security and privacy programs.
Document Content
Matched Section
Section: 2. Employees are responsible for exercising good judgment regarding the reasonableness of personal use.
Content: Employees are responsible for exercising good judgment regarding the reasonableness of personal use. Individual departments are responsible for creating guidelines concerning personal use of Internet/Intranet/Extranet systems.
Content: Employees are responsible for exercising good judgment regarding the reasonableness of personal use. Individual departments are responsible for creating guidelines concerning personal use of Internet/Intranet/Extranet systems.
AI Justification
The mention of departmental guidelines and the responsibility of employees to exercise good judgment aligns with the need for clear policies and procedures regarding data handling.
Document Content
Matched Section
Section: 3. Verterim recommends that any information that users consider sensitive or vulnerable be encrypted.
Content: Verterim recommends that any information that users consider sensitive or vulnerable be encrypted.
Content: Verterim recommends that any information that users consider sensitive or vulnerable be encrypted.
AI Justification
The recommendation for encrypting sensitive information aligns with the need for procedures that address the handling of personally identifiable information.
Document Content
Matched Section
Section: 1. While Verterim desires to provide a reasonable level of privacy...
Content: 1. While Verterim desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of Verterim and its clients, partners, or other agents of the company.
Content: 1. While Verterim desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of Verterim and its clients, partners, or other agents of the company.
AI Justification
The text discusses the responsibility of employees regarding the handling of sensitive information and the need for guidelines, which aligns with the control's focus on applying necessary protections for personally identifiable information.
Document Content
Matched Section
Section: 3. Verterim recommends that any information that users consider sensitive or vulnerable be encrypted.
Content: 3. Verterim recommends that any information that users consider sensitive or vulnerable be encrypted. For guidelines on information classification, see Verterim's Information Sensitivity Policy. For guidelines on encrypting email and documents, see Verterim’s Acceptable Encryption Policy.
Content: 3. Verterim recommends that any information that users consider sensitive or vulnerable be encrypted. For guidelines on information classification, see Verterim's Information Sensitivity Policy. For guidelines on encrypting email and documents, see Verterim’s Acceptable Encryption Policy.
AI Justification
The recommendation for encryption of sensitive information directly relates to the need for applying protections to personally identifiable information.
Document Content
Matched Section
Section: 4.0 Policy
Content: The purpose of this policy is to outline the acceptable use of computer equipment at Verterim. These rules are in place to protect the employee and Verterim.
Content: The purpose of this policy is to outline the acceptable use of computer equipment at Verterim. These rules are in place to protect the employee and Verterim.
AI Justification
The text discusses the importance of policies and procedures related to system and communications protection, emphasizing the need for collaboration between security and privacy programs.
Document Content
Matched Section
Section: Section 3: Encryption Recommendations
Content: Verterim recommends that any information that users consider sensitive or vulnerable be encrypted. For guidelines on information classification, see Verterim's Information Sensitivity Policy. For guidelines on encrypting email and documents, see Verterim’s Acceptable Encryption Policy.
Content: Verterim recommends that any information that users consider sensitive or vulnerable be encrypted. For guidelines on information classification, see Verterim's Information Sensitivity Policy. For guidelines on encrypting email and documents, see Verterim’s Acceptable Encryption Policy.
AI Justification
The chunk discusses the importance of encrypting sensitive or vulnerable information, which aligns with the use of cryptography as outlined in control SC-13.
Document Content
Matched Section
Section: Section 3: Encryption Recommendations
Content: Verterim recommends that any information that users consider sensitive or vulnerable be encrypted. For guidelines on information classification, see Verterim's Information Sensitivity Policy. For guidelines on encrypting email and documents, see Verterim’s Acceptable Encryption Policy.
Content: Verterim recommends that any information that users consider sensitive or vulnerable be encrypted. For guidelines on information classification, see Verterim's Information Sensitivity Policy. For guidelines on encrypting email and documents, see Verterim’s Acceptable Encryption Policy.
AI Justification
The chunk discusses the importance of encrypting sensitive information, which aligns with the need for proper cryptographic key management and establishment as outlined in SC-12.
Document Content
Matched Section
Section: 1. While Verterim desires to provide a reasonable level of privacy...
Content: 1. While Verterim desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of Verterim and its clients, partners, or other agents of the company.
Content: 1. While Verterim desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of Verterim and its clients, partners, or other agents of the company.
AI Justification
The text discusses the ownership of data and the responsibilities of employees regarding personal use, which relates to the management of privacy attributes and their implications on data handling.
Document Content
Matched Section
Section: 9. Affecting security breaches or disruptions of network communication.
Content: Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
Content: Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
AI Justification
The section discusses various forms of network communication breaches and disruptions, including man-in-the-middle attacks and session hijacking, which directly relate to the protection of session authenticity.
Document Content
Matched Section
Section: 9. Affecting security breaches or disruptions of network communication.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
AI Justification
The text discusses security breaches and unauthorized access, which relates to the identification of potential covert channels that could lead to unauthorized information flows.
Document Content
Matched Section
Section: 9. Affecting security breaches or disruptions of network communication.
Content: Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
Content: Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
AI Justification
The chunk discusses various forms of network disruptions and security breaches that can occur, including denial of service and packet spoofing, which are relevant to the protection of wireless links.
Document Content
Matched Section
Section: 9. Affecting security breaches or disruptions of network communication.
Content: Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
Content: Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
AI Justification
The chunk discusses unauthorized access to data and network monitoring, which aligns with the control's focus on preventing unauthorized information transfer.
Document Content
Matched Section
Section: Affecting security breaches or disruptions of network communication.
Content: Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
Content: Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
AI Justification
The text discusses various methods of security breaches and disruptions in network communication, which aligns with the adversarial tactics described in SC-48.
Document Content
Matched Section
Section: Affecting security breaches or disruptions of network communication.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes.
AI Justification
The section discusses disruptions in network communication and the impact of security breaches, which aligns with the need for alternate communications paths to maintain operations during incidents.
Document Content
Matched Section
Section: 4.3. Unacceptable Use
Content: **4.3. Unacceptable Use** The following activities are, in general, prohibited. Employees may be exempted from these restrictions during the course of their legitimate job responsibilities (e.g., systems administration staff may have a need to disable the network access of a host if that host is disrupting production services). Under no circumstances is an employee of Verterim authorized to engage in any activity that is illegal under local, state, federal or international law while utilizing Verterim-owned resources. The lists below are by no means exhaustive, but attempt to provide a framework for activities, which fall into the category of unacceptable use. **System and Network Activities** The following activities are strictly prohibited, with no exceptions:
Content: **4.3. Unacceptable Use** The following activities are, in general, prohibited. Employees may be exempted from these restrictions during the course of their legitimate job responsibilities (e.g., systems administration staff may have a need to disable the network access of a host if that host is disrupting production services). Under no circumstances is an employee of Verterim authorized to engage in any activity that is illegal under local, state, federal or international law while utilizing Verterim-owned resources. The lists below are by no means exhaustive, but attempt to provide a framework for activities, which fall into the category of unacceptable use. **System and Network Activities** The following activities are strictly prohibited, with no exceptions:
AI Justification
The section outlines unacceptable use of system resources, which aligns with the control's focus on usage restrictions for system components.
Document Content
Matched Section
Section: Section 9-12 regarding security breaches and network monitoring
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes. Executing any form of network monitoring which will intercept data not intended for the employee's host, unless this activity is a part of the employee's normal job/duty. Circumventing user authentication or security of any host, network or account. Interfering with or denying service to any user other than the employee's host (for example, denial of service attack).
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes. Executing any form of network monitoring which will intercept data not intended for the employee's host, unless this activity is a part of the employee's normal job/duty. Circumventing user authentication or security of any host, network or account. Interfering with or denying service to any user other than the employee's host (for example, denial of service attack).
AI Justification
The text discusses actions that could bypass security mechanisms and emphasizes the importance of preventing unauthorized access and disruptions, which aligns with the need for robust policy enforcement mechanisms.
Document Content
Matched Section
Section: Affecting security breaches or disruptions of network communication.
Content: Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes.
Content: Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes.
AI Justification
The chunk discusses denial-of-service events and their implications, aligning with the control's focus on mitigating such events.
Document Content
Matched Section
Section: Interfering with or denying service to any user other than the employee's host.
Content: Interfering with or denying service to any user other than the employee's host (for example, denial of service attack).
Content: Interfering with or denying service to any user other than the employee's host (for example, denial of service attack).
AI Justification
The mention of denial of service attacks directly relates to the control's focus on preventing such attacks.
Document Content
Matched Section
Section: Section 3: Verterim recommends that any information that users consider sensitive or vulnerable be encrypted.
Content: Verterim recommends that any information that users consider sensitive or vulnerable be encrypted. For guidelines on information classification, see Verterim's Information Sensitivity Policy. For guidelines on encrypting email and documents, see Verterim’s Acceptable Encryption Policy.
Content: Verterim recommends that any information that users consider sensitive or vulnerable be encrypted. For guidelines on information classification, see Verterim's Information Sensitivity Policy. For guidelines on encrypting email and documents, see Verterim’s Acceptable Encryption Policy.
AI Justification
The chunk discusses the importance of encrypting sensitive information, which aligns with the control's focus on protecting confidentiality and integrity during transmission.
Document Content
Matched Section
Section: 4.0 Policy
Content: The purpose of this policy is to outline the acceptable use of computer equipment at Verterim. These rules are in place to protect the employee and Verterim. Inappropriate use exposes Verterim to risks including virus attacks, compromise of network systems and services, and legal issues.
Content: The purpose of this policy is to outline the acceptable use of computer equipment at Verterim. These rules are in place to protect the employee and Verterim. Inappropriate use exposes Verterim to risks including virus attacks, compromise of network systems and services, and legal issues.
AI Justification
The text discusses the importance of policies and procedures in ensuring effective security and integrity of information systems, aligning with the requirements of SI-1.
Document Content
Matched Section
Section: Section 9: Affecting security breaches or disruptions of network communication.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes.
AI Justification
The text discusses security breaches and disruptions in network communication, which aligns with the control's focus on managed interfaces and boundary protection.
Document Content
Matched Section
Section: Section 11: Circumventing user authentication or security of any host, network or account.
Content: Circumventing user authentication or security of any host, network or account.
Content: Circumventing user authentication or security of any host, network or account.
AI Justification
The mention of circumventing user authentication and denial of service attacks relates to the control's focus on managing interfaces and protecting boundaries.
Document Content
Matched Section
Section: Section 12: Interfering with or denying service to any user other than the employee's host.
Content: Interfering with or denying service to any user other than the employee's host (for example, denial of service attack).
Content: Interfering with or denying service to any user other than the employee's host (for example, denial of service attack).
AI Justification
The text about denying service to users other than the employee's host aligns with the control's focus on boundary protection and managing network traffic.
Document Content
Matched Section
Section: Affecting security breaches or disruptions of network communication
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes.
AI Justification
The text discusses various methods of data exfiltration and the implications of unauthorized access to data, which aligns with the objectives of SI-20.
Document Content
Matched Section
Section: Affecting security breaches or disruptions of network communication
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties.
AI Justification
The chunk discusses security breaches and disruptions in network communication, which aligns with the need for system monitoring to detect unauthorized access and network disruptions.
Document Content
Matched Section
Section: Section 9-12 regarding security breaches and disruptions of network communication.
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes. Executing any form of network monitoring which will intercept data not intended for the employee's host, unless this activity is a part of the employee's normal job/duty. Circumventing user authentication or security of any host, network or account. Interfering with or denying service to any user other than the employee's host (for example, denial of service attack).
Content: Affecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, 'disruption' includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes. Executing any form of network monitoring which will intercept data not intended for the employee's host, unless this activity is a part of the employee's normal job/duty. Circumventing user authentication or security of any host, network or account. Interfering with or denying service to any user other than the employee's host (for example, denial of service attack).
AI Justification
The text discusses various forms of malicious code and the methods to protect against them, which aligns with the control's focus on system entry and exit points and the need for protection mechanisms.
Document Content
Matched Section
Section: Section 4: Introduction of malicious code or programs
Content: 4. Introduction of malicious code or programs
Content: 4. Introduction of malicious code or programs
AI Justification
The chunk discusses the introduction of malicious code and unauthorized software, which aligns with the need for anti-counterfeiting policies to protect against such threats.
Document Content
Matched Section
Section: Email and Communications Activities
Content: 1. Sending unsolicited email messages, including the sending of 'junk mail' or other advertising material to individuals who did not specifically request such material (email spam). 2. Any form of harassment via email, telephone or paging, whether through language, frequency, or size of messages. 3. Unauthorized use, or forging, of email header information. 4. Solicitation of email for any other email address, other than that of the poster's account, with the intent to harass or to collect replies. 5. Creating or forwarding 'chain letters', 'Ponzi' or other 'pyramid' schemes of any type. 6. Use of unsolicited email originating from within Verterim's networks of other Internet/Intranet/Extranet service providers on behalf of, or to advertise, any service hosted by Verterim or connected via Verterim's network. 7. Posting the same or similar non-business-related messages to large numbers of Usenet newsgroups (newsgroup spam).
Content: 1. Sending unsolicited email messages, including the sending of 'junk mail' or other advertising material to individuals who did not specifically request such material (email spam). 2. Any form of harassment via email, telephone or paging, whether through language, frequency, or size of messages. 3. Unauthorized use, or forging, of email header information. 4. Solicitation of email for any other email address, other than that of the poster's account, with the intent to harass or to collect replies. 5. Creating or forwarding 'chain letters', 'Ponzi' or other 'pyramid' schemes of any type. 6. Use of unsolicited email originating from within Verterim's networks of other Internet/Intranet/Extranet service providers on behalf of, or to advertise, any service hosted by Verterim or connected via Verterim's network. 7. Posting the same or similar non-business-related messages to large numbers of Usenet newsgroups (newsgroup spam).
AI Justification
The chunk discusses various forms of email spam and unauthorized email activities, which aligns with the control's focus on spam protection mechanisms.
01_-_Handbook_-_Verterim_-_10182019.pdf NIST
23 matches foundDocument Content
Matched Section
Section: Usage restrictions and specific implementation guidance for mobile devices
Content: Associate use of personal cell phones and other mobile communication devices (including iPads and other tablet computers, iPods, laptop computers, and similar devices) at a Client’s place of business must comply with such Client’s policies.
Content: Associate use of personal cell phones and other mobile communication devices (including iPads and other tablet computers, iPods, laptop computers, and similar devices) at a Client’s place of business must comply with such Client’s policies.
AI Justification
The text discusses the use of personal mobile devices at a client's location, emphasizing compliance with policies and restrictions on their use, which aligns with the control's focus on the protection and control of mobile devices.
Document Content
Matched Section
Section: Protection of Associates' Protected Health Information
Content: Associates’ protected health information is treated as private and confidential, and precautions are taken to protect such information from inappropriate disclosure.
Content: Associates’ protected health information is treated as private and confidential, and precautions are taken to protect such information from inappropriate disclosure.
AI Justification
The chunk discusses the confidentiality and protection of Associates' protected health information, which aligns with the principles of information sharing and access restrictions outlined in AC-21.
Document Content
Matched Section
Section: Protection of Associates' Protected Health Information
Content: Associates’ protected health information is treated as private and confidential, and precautions are taken to protect such information from inappropriate disclosure.
Content: Associates’ protected health information is treated as private and confidential, and precautions are taken to protect such information from inappropriate disclosure.
AI Justification
The section discusses the protection of Associates' protected health information and the consequences of inappropriate disclosure, which aligns with the control's focus on preventing unauthorized disclosure of sensitive information.
Document Content
Matched Section
Section: Personal Use of Business Computer Systems and Communication Devices
Content: Verterim and the Client have the express right to access their respective property including, but not limited to desks, lockers, computers, files, e-mail, voice mail, other electronic communications, and other property owned or operated by Verterim or the Client.
Content: Verterim and the Client have the express right to access their respective property including, but not limited to desks, lockers, computers, files, e-mail, voice mail, other electronic communications, and other property owned or operated by Verterim or the Client.
AI Justification
The text discusses the right to access and monitor property and communications, which aligns with the concept of session auditing and monitoring as described in AU-14.
Document Content
Matched Section
Section: Software License Compliance
Content: You may use software only in accordance with the terms and conditions of the license included with the software. If you are unwilling to comply with the terms and conditions contained in the software license agreement, you must not use or install the software.
Content: You may use software only in accordance with the terms and conditions of the license included with the software. If you are unwilling to comply with the terms and conditions contained in the software license agreement, you must not use or install the software.
AI Justification
The chunk discusses the importance of complying with software license agreements, which aligns with the control's focus on tracking software licenses.
Document Content
Matched Section
Section: Software Installation Policy
Content: In order to ensure compliance with copyright laws and software licensing agreements and to prevent computer viruses, you are not permitted to install or download any software onto Verterim’s or the Client’s computer system without prior approval from Verterim management or the Primary Client Contact.
Content: In order to ensure compliance with copyright laws and software licensing agreements and to prevent computer viruses, you are not permitted to install or download any software onto Verterim’s or the Client’s computer system without prior approval from Verterim management or the Primary Client Contact.
AI Justification
The text outlines restrictions on software installation and emphasizes the need for prior approval, aligning with the control's focus on governing user-installed software.
Document Content
Matched Section
Section: Employment Eligibility Verification
Content: Federal law requires all employers to verify the identity and employment eligibility of all persons hired to work in the United States.
Content: Federal law requires all employers to verify the identity and employment eligibility of all persons hired to work in the United States.
AI Justification
The chunk discusses the verification of identity and employment eligibility, which aligns with the identity proofing process outlined in control IA-12.
Document Content
Matched Section
Section: Identification and Authentication Requirements
Content: To facilitate a secure environment, the Client may issue keys and/or passwords only to those individuals with a business need to possess these items. You should always enter and depart through designated entrances and should always be alert for suspicious individuals loitering in or near the facility.
Content: To facilitate a secure environment, the Client may issue keys and/or passwords only to those individuals with a business need to possess these items. You should always enter and depart through designated entrances and should always be alert for suspicious individuals loitering in or near the facility.
AI Justification
The text discusses the issuance of keys and passwords to individuals with a business need, which aligns with the identification and authentication requirements outlined in IA-2.
Document Content
Matched Section
Section: Authenticator management and issuance
Content: To facilitate a secure environment, the Client may issue keys and/or passwords only to those individuals with a business need to possess these items. You should always enter and depart through designated entrances and should always be alert for suspicious individuals loitering in or near the facility. You should notify the Primary Client Contact of any such persons. In addition, if you detect an unauthorized entry into or use of Client facilities or equipment, you should notify your Primary Client Contact immediately.
Content: To facilitate a secure environment, the Client may issue keys and/or passwords only to those individuals with a business need to possess these items. You should always enter and depart through designated entrances and should always be alert for suspicious individuals loitering in or near the facility. You should notify the Primary Client Contact of any such persons. In addition, if you detect an unauthorized entry into or use of Client facilities or equipment, you should notify your Primary Client Contact immediately.
AI Justification
The text discusses the issuance and management of keys and passwords, which aligns with the requirements for authenticators as outlined in IA-5.
Document Content
Matched Section
Section: Rules for handling keys and passwords
Content: If you possess a facility or equipment key, password(s), or both, they are never to be loaned or disclosed to anyone. Individuals requesting either keys or passwords, or use of the same, are to be directed to the Primary Client Contact for assistance.
Content: If you possess a facility or equipment key, password(s), or both, they are never to be loaned or disclosed to anyone. Individuals requesting either keys or passwords, or use of the same, are to be directed to the Primary Client Contact for assistance.
AI Justification
The text emphasizes the importance of not loaning or disclosing keys and passwords, which aligns with the need for rules of behavior regarding the handling of authenticators.
Document Content
Matched Section
Section: Incident Reporting Procedures
Content: You are required to immediately report any observed or known violation with any policy or law, including incidents of discrimination or harassment.
Content: You are required to immediately report any observed or known violation with any policy or law, including incidents of discrimination or harassment.
AI Justification
The text emphasizes the requirement to report violations of policies or laws, aligning with the need for timely reporting of incidents as outlined in IR-6.
Document Content
Matched Section
Section: Access Control Procedures
Content: To facilitate a secure environment, the Client may issue keys and/or passwords only to those individuals with a business need to possess these items. You should always enter and depart through designated entrances and should always be alert for suspicious individuals loitering in or near the facility.
Content: To facilitate a secure environment, the Client may issue keys and/or passwords only to those individuals with a business need to possess these items. You should always enter and depart through designated entrances and should always be alert for suspicious individuals loitering in or near the facility.
AI Justification
The text emphasizes the need for restricting access to keys and passwords, which aligns with enforcing authorizations for entry and exit.
Document Content
Matched Section
Section: Physical Access Authorizations
Content: To facilitate a secure environment, the Client may issue keys and/or passwords only to those individuals with a business need to possess these items.
Content: To facilitate a secure environment, the Client may issue keys and/or passwords only to those individuals with a business need to possess these items.
AI Justification
The text discusses issuing keys and passwords only to individuals with a business need, which aligns with the requirement for physical access authorizations.
Document Content
Matched Section
Section: Physical Access Control Procedures
Content: To facilitate a secure environment, the Client may issue keys and/or passwords only to those individuals with a business need to possess these items. You should always enter and depart through designated entrances and should always be alert for suspicious individuals loitering in or near the facility.
Content: To facilitate a secure environment, the Client may issue keys and/or passwords only to those individuals with a business need to possess these items. You should always enter and depart through designated entrances and should always be alert for suspicious individuals loitering in or near the facility.
AI Justification
The text discusses issuing keys and passwords only to individuals with a business need, which aligns with physical access control measures.
Document Content
Matched Section
Section: Complaints of policy violation will be promptly and carefully investigated
Content: Complaints of policy violation will be promptly and carefully investigated, including interviews with relevant persons. Investigators will conduct an objective investigation with consideration given to each Associate’s desire for privacy; however, no Associate is guaranteed complete confidentiality and/or anonymity during an investigation. Only individuals with a legitimate “need to know” will be given any information regarding the complaint(s). Associates who report policy violations in good faith are assured that they will be free from any and all reprisals from any retaliation from reporting such violation or from cooperating in an investigation.
Content: Complaints of policy violation will be promptly and carefully investigated, including interviews with relevant persons. Investigators will conduct an objective investigation with consideration given to each Associate’s desire for privacy; however, no Associate is guaranteed complete confidentiality and/or anonymity during an investigation. Only individuals with a legitimate “need to know” will be given any information regarding the complaint(s). Associates who report policy violations in good faith are assured that they will be free from any and all reprisals from any retaliation from reporting such violation or from cooperating in an investigation.
AI Justification
The text discusses the investigation of complaints regarding policy violations, which aligns with the control's focus on handling complaints and concerns from individuals.
Document Content
Matched Section
Section: Exit Interview Process and Return of Property
Content: In the case of a resignation, you generally will be interviewed by the Verterim Client Team Manager or Human Resources Representative on or before your last day of employment. This exit interview will be conducted to give you an opportunity to discuss your reasons for leaving, as well as for Verterim to gain information that might improve policies, working conditions, or procedures. On or before your last day of work, you must return any keys, passwords, equipment, or other items issued to you by Verterim or the Client or work product created as a result of employment with Verterim.
Content: In the case of a resignation, you generally will be interviewed by the Verterim Client Team Manager or Human Resources Representative on or before your last day of employment. This exit interview will be conducted to give you an opportunity to discuss your reasons for leaving, as well as for Verterim to gain information that might improve policies, working conditions, or procedures. On or before your last day of work, you must return any keys, passwords, equipment, or other items issued to you by Verterim or the Client or work product created as a result of employment with Verterim.
AI Justification
The exit interview process and the requirement to return issued items align with the control's focus on accountability for system-related property.
Document Content
Matched Section
Section: Enforcement of Policies
Content: Violation of policies and procedures, or reasonable suspicion of any such violation, may result in disciplinary action, up to and including termination of employment. Additionally, violation of certain policies may result in prosecution under civil or criminal laws and possible assessment of civil and/or criminal penalties.
Content: Violation of policies and procedures, or reasonable suspicion of any such violation, may result in disciplinary action, up to and including termination of employment. Additionally, violation of certain policies may result in prosecution under civil or criminal laws and possible assessment of civil and/or criminal penalties.
AI Justification
The text discusses disciplinary actions for violations of policies and procedures, which aligns with the concept of organizational sanctions as described in PS-8.
Document Content
Matched Section
Section: Processing of Personally Identifiable Information
Content: Associates’ protected health information is treated as private and confidential, and precautions are taken to protect such information from inappropriate disclosure.
Content: Associates’ protected health information is treated as private and confidential, and precautions are taken to protect such information from inappropriate disclosure.
AI Justification
The chunk discusses the handling of protected health information, emphasizing the importance of confidentiality and authorized processing, which aligns with the control's focus on the operations involving personally identifiable information.
Document Content
Matched Section
Section: Protection of Associates’ Protected Health Information
Content: Associates’ protected health information is treated as private and confidential, and precautions are taken to protect such information from inappropriate disclosure.
Content: Associates’ protected health information is treated as private and confidential, and precautions are taken to protect such information from inappropriate disclosure.
AI Justification
The text discusses the treatment of protected health information as private and confidential, aligning with the need for conditions or protections for sensitive personally identifiable information.
Document Content
Matched Section
Section: Privacy and Confidentiality of Protected Health Information
Content: Associates’ protected health information is treated as private and confidential, and precautions are taken to protect such information from inappropriate disclosure.
Content: Associates’ protected health information is treated as private and confidential, and precautions are taken to protect such information from inappropriate disclosure.
AI Justification
The chunk discusses the treatment of protected health information and the responsibilities of associates to maintain its privacy and confidentiality, which aligns with the concept of security and privacy attributes.
Document Content
Matched Section
Section: Verterim and Clients reserve the right to access and disclose all use and output generated on or through its or their Systems.
Content: Verterim and Clients (as applicable) reserve the right to access and disclose all use and output generated on or through its or their Systems, without regard to content. Since your personal messages and files can be accessed by Verterim management (or, as applicable, Clients) without prior notice, you should not use Systems to transmit any messages or compose any documents you would not want read by a third party.
Content: Verterim and Clients (as applicable) reserve the right to access and disclose all use and output generated on or through its or their Systems, without regard to content. Since your personal messages and files can be accessed by Verterim management (or, as applicable, Clients) without prior notice, you should not use Systems to transmit any messages or compose any documents you would not want read by a third party.
AI Justification
The chunk discusses the access and disclosure of personal messages and files, which relates to the confidentiality and integrity of information at rest.
Document Content
Matched Section
Section: Use of personal cell phones and other mobile communication devices
Content: Associate use of personal cell phones and other mobile communication devices (including iPads and other tablet computers, iPods, laptop computers, and similar devices) at a Client’s place of business must comply with such Client’s policies.
Content: Associate use of personal cell phones and other mobile communication devices (including iPads and other tablet computers, iPods, laptop computers, and similar devices) at a Client’s place of business must comply with such Client’s policies.
AI Justification
The text discusses the use of mobile devices, including cell phones and tablets, and emphasizes compliance with policies regarding their use, particularly concerning privacy and the use of cameras.
Document Content
Matched Section
Section: Handling of Associates’ protected health information
Content: Associates’ protected health information is treated as private and confidential, and precautions are taken to protect such information from inappropriate disclosure.
Content: Associates’ protected health information is treated as private and confidential, and precautions are taken to protect such information from inappropriate disclosure.
AI Justification
The text discusses the handling and protection of personally identifiable information, particularly in the context of health information, which aligns with the control's focus on ensuring the accuracy and relevance of such information throughout its life cycle.
Information_Security_Policy.docx NIST
66 matches foundDocument Content
Matched Section
Section: Decisions made that contain Information Security, Privacy, or risk-related concerns
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
AI Justification
The text discusses the importance of accountability and authority in decision-making related to information security and privacy, which aligns with the need for an access control policy that defines roles and responsibilities.
Document Content
Matched Section
Section: Internal control – defined responsibility and delegation of authority, process controls, segregation and separation of duties
Content: * Internal control – defined responsibility and delegation of authority, process controls, segregation and separation of duties
Content: * Internal control – defined responsibility and delegation of authority, process controls, segregation and separation of duties
AI Justification
The chunk discusses segregation and separation of duties, which aligns with the principles of AC-5.
Document Content
Matched Section
Section: Decisions made that contain Information Security, Privacy, or risk-related concerns
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
AI Justification
The text discusses the importance of accountability and authority in decision-making related to information security and risk management, which aligns with the need for awareness and training policies.
Document Content
Matched Section
Section: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved. Risks will be reported and aggregated upward for review and treatment as analyzed by the ISP using the policies, procedures, and methodologies of the ISMS.
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved. Risks will be reported and aggregated upward for review and treatment as analyzed by the ISP using the policies, procedures, and methodologies of the ISMS.
AI Justification
The text discusses the importance of accountability and authority in decision-making related to information security and risk, aligning with the need for policies and procedures in the CA family.
Document Content
Matched Section
Section: Business Continuity
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
AI Justification
The text discusses the need for integrated plans to manage business continuity and disaster recovery, which aligns with the requirement for plans of action and milestones to track remedial actions.
Document Content
Matched Section
Section: The ISMS will define processes and standard practices that all divisions, departments, and employees must apply in the development and delivery of secure services.
Content: Consistent execution of well defined processes will be an indicator of organizational capability and maturity regarding Information Security. The ISMS will define processes and standard practices that all divisions, departments, and employees must apply in the development and delivery of secure services and to ensure appropriate security of information.
Content: Consistent execution of well defined processes will be an indicator of organizational capability and maturity regarding Information Security. The ISMS will define processes and standard practices that all divisions, departments, and employees must apply in the development and delivery of secure services and to ensure appropriate security of information.
AI Justification
The text discusses the importance of defining processes and standard practices for Information Security, which aligns with the need for configuration management policies and procedures.
Document Content
Matched Section
Section: Decisions made that contain Information Security, Privacy, or risk-related concerns
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
AI Justification
The text discusses the necessity for individuals with accountability and authority to make decisions regarding risks, which aligns with the requirement for conducting impact analyses by qualified personnel.
Document Content
Matched Section
Section: Business Continuity
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
AI Justification
The text discusses business continuity management processes, which align with the recovery and reconstitution activities outlined in CP-10, emphasizing the importance of restoring essential operations after disruptions.
Document Content
Matched Section
Section: Business Continuity
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
AI Justification
The text discusses the need for integrated plans that ensure critical business services are maintained or restored, which aligns with the requirement for contingency plans to incorporate alternate communications protocols.
Document Content
Matched Section
Section: The timely restoration of service disrupted by a failure within a system, process, or function
Content: * The timely restoration of service disrupted by a failure within a system, process, or function * The emergency recovery of service at an alternate location in the event of a disaster or prolonged outage at the primary site * Limited recovery of critical services in the event of major loss of staff.
Content: * The timely restoration of service disrupted by a failure within a system, process, or function * The emergency recovery of service at an alternate location in the event of a disaster or prolonged outage at the primary site * Limited recovery of critical services in the event of major loss of staff.
AI Justification
The text discusses the timely restoration of services and emergency recovery, which aligns with the concept of using alternative mechanisms to ensure continuity of operations.
Document Content
Matched Section
Section: Contingency planning policy and procedures
Content: Control: CP-1: Contingency planning policy and procedures address the controls in the CP family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of contingency planning policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to contingency planning policy and procedures include assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.
Content: Control: CP-1: Contingency planning policy and procedures address the controls in the CP family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of contingency planning policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to contingency planning policy and procedures include assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.
AI Justification
The content discusses the importance of contingency planning policies and procedures, which aligns directly with control CP-1.
Document Content
Matched Section
Section: Business Continuity
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
AI Justification
The text discusses the importance of business continuity management processes, contingency planning, and disaster recovery, which aligns with the requirements of CP-2.
Document Content
Matched Section
Section: Business Continuity
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
AI Justification
The text discusses the importance of training related to contingency roles and responsibilities, which aligns with the requirement for contingency training linked to assigned roles.
Document Content
Matched Section
Section: Business Continuity
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
AI Justification
The text discusses the need for testing disaster recovery plans and integrated plans to ensure critical business services can be maintained or restored, which aligns with the requirements for testing contingency plans.
Document Content
Matched Section
Section: Business Continuity
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
AI Justification
The text discusses business continuity management processes, which include identifying risks and developing plans to maintain or restore critical services, aligning with the concept of alternate processing sites.
Document Content
Matched Section
Section: Business Continuity
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
AI Justification
The text discusses business continuity management processes and contingency plans, which align with the requirements for telecommunications services to maintain essential functions despite disruptions.
Document Content
Matched Section
Section: Business Continuity
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
AI Justification
The text discusses business continuity management processes, which include identifying risks and developing plans to maintain or restore critical services, aligning with the requirements of alternate storage sites.
Document Content
Matched Section
Section: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved. Risks will be reported and aggregated upward for review and treatment as analyzed by the ISP using the policies, procedures, and methodologies of the ISMS.
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved. Risks will be reported and aggregated upward for review and treatment as analyzed by the ISP using the policies, procedures, and methodologies of the ISMS.
AI Justification
The text discusses the importance of having policies and procedures for identification and authentication, which aligns with the control's focus on establishing such policies within organizations.
Document Content
Matched Section
Section: Access control and accountability
Content: Access control and accountability – identification, authentication, authorization, session control, non-repudiation, and audit
Content: Access control and accountability – identification, authentication, authorization, session control, non-repudiation, and audit
AI Justification
The chunk discusses access control and accountability, which includes identification and authentication, aligning with the need for authentication mechanisms within a cryptographic module.
Document Content
Matched Section
Section: Access control and accountability
Content: Access control and accountability – identification, authentication, authorization, session control, non-repudiation, and audit
Content: Access control and accountability – identification, authentication, authorization, session control, non-repudiation, and audit
AI Justification
The chunk discusses aspects of access control and accountability, which includes identification and authentication, aligning with the requirements for authenticators.
Document Content
Matched Section
Section: Access control and accountability
Content: Access control and accountability – identification, authentication, authorization, session control, non-repudiation, and audit
Content: Access control and accountability – identification, authentication, authorization, session control, non-repudiation, and audit
AI Justification
The mention of identification and authentication in the context of access control aligns with the need for access enforcement mechanisms.
Document Content
Matched Section
Section: Access control and accountability
Content: Access control and accountability – identification, authentication, authorization, session control, non-repudiation, and audit
Content: Access control and accountability – identification, authentication, authorization, session control, non-repudiation, and audit
AI Justification
The section implies the need for proper authorization and accountability, which is a principle of least privilege.
Document Content
Matched Section
Section: Incident Response Policy and Procedures
Content: Control: IR-1: Incident response policy and procedures address the controls in the IR family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of incident response policy and procedures.
Content: Control: IR-1: Incident response policy and procedures address the controls in the IR family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of incident response policy and procedures.
AI Justification
The chunk discusses the importance of incident response policies and procedures, including their development and the need for collaboration between security and privacy programs.
Document Content
Matched Section
Section: Contingency Planning
Content: * The timely restoration of service disrupted by a failure within a system, process, or function * The emergency recovery of service at an alternate location in the event of a disaster or prolonged outage at the primary site * Limited recovery of critical services in the event of major loss of staff.
Content: * The timely restoration of service disrupted by a failure within a system, process, or function * The emergency recovery of service at an alternate location in the event of a disaster or prolonged outage at the primary site * Limited recovery of critical services in the event of major loss of staff.
AI Justification
The chunk mentions timely restoration of services and emergency recovery, which aligns with the need for contingency planning.
Document Content
Matched Section
Section: Business Continuity
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
AI Justification
The text discusses identifying and limiting business risks associated with major failures or disasters, which aligns with specifying system components that result in increased risk.
Document Content
Matched Section
Section: Decisions made that contain Information Security, Privacy, or risk-related concerns
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved. Risks will be reported and aggregated upward for review and treatment as analyzed by the ISP using the policies, procedures, and methodologies of the ISMS.
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved. Risks will be reported and aggregated upward for review and treatment as analyzed by the ISP using the policies, procedures, and methodologies of the ISMS.
AI Justification
The text discusses the importance of having policies and procedures for media protection, which aligns with the control's focus on establishing such policies and procedures within organizations.
Document Content
Matched Section
Section: Business Continuity
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
AI Justification
The text discusses the importance of business continuity management processes and contingency plans, which aligns with the need for emergency lighting provisions in organizational facilities.
Document Content
Matched Section
Section: Business Continuity
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
AI Justification
The text discusses the need for business continuity management processes and contingency plans, which align with the concept of alternate work sites for maintaining operations during disruptions.
Document Content
Matched Section
Section: Decisions made that contain Information Security, Privacy, or risk-related concerns
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
AI Justification
The text discusses the importance of accountability and authority in decision-making related to information security, privacy, and risk management, which aligns with the need for planning policies and procedures.
Document Content
Matched Section
Section: Section 2.1 describes the different types of requirements that are relevant to organizations during the system development life cycle and the relationship between requirements and controls.
Content: Consistent execution of well defined processes will be an indicator of organizational capability and maturity regarding Information Security. The ISMS will define processes and standard practices that all divisions, departments, and employees must apply in the development and delivery of secure services and to ensure appropriate security of information.
Content: Consistent execution of well defined processes will be an indicator of organizational capability and maturity regarding Information Security. The ISMS will define processes and standard practices that all divisions, departments, and employees must apply in the development and delivery of secure services and to ensure appropriate security of information.
AI Justification
The text discusses the definition and execution of processes related to Information Security, which aligns with the need for security and privacy plans that are scoped to the system and contain an overview of security requirements.
Document Content
Matched Section
Section: Integration of Information Security processes into business processes
Content: Where feasible and efficient, Information Security processes will be leverage and integrated into other business processes such as: Business strategies and plans, Risk management, New product / service development, Requirements analysis, Architecture and design, Development and quality assurance, PMO Gating, Performance management.
Content: Where feasible and efficient, Information Security processes will be leverage and integrated into other business processes such as: Business strategies and plans, Risk management, New product / service development, Requirements analysis, Architecture and design, Development and quality assurance, PMO Gating, Performance management.
AI Justification
The text discusses the integration of Information Security processes into business processes, which aligns with the need for an organization-wide risk management process and associated security standards.
Document Content
Matched Section
Section: Information Security Program
Content: An Information Security Program (ISP) will be developed and managed to: Provide Information Security leadership and expertise. Coordinate participation of key resources and stakeholders across the enterprise. Develop, interpret, and implement comprehensive governance of security techniques, procedures, tools, and technologies. Evangelise security strategy and security architecture aligned with business objective, and requirements. Issue reports and make recommendations to management on the status and effectiveness of the ISMS.
Content: An Information Security Program (ISP) will be developed and managed to: Provide Information Security leadership and expertise. Coordinate participation of key resources and stakeholders across the enterprise. Develop, interpret, and implement comprehensive governance of security techniques, procedures, tools, and technologies. Evangelise security strategy and security architecture aligned with business objective, and requirements. Issue reports and make recommendations to management on the status and effectiveness of the ISMS.
AI Justification
The text discusses the development and management of an Information Security Program, which aligns with the requirements for an information security program plan as outlined in PM-1.
Document Content
Matched Section
Section: Consistent execution of well defined processes will be an indicator of organizational capability and maturity regarding Information Security.
Content: Consistent execution of well defined processes will be an indicator of organizational capability and maturity regarding Information Security. The ISMS will define processes and standard practices that all divisions, departments, and employees must apply in the development and delivery of secure services and to ensure appropriate security of information.
Content: Consistent execution of well defined processes will be an indicator of organizational capability and maturity regarding Information Security. The ISMS will define processes and standard practices that all divisions, departments, and employees must apply in the development and delivery of secure services and to ensure appropriate security of information.
AI Justification
The text discusses the importance of consistent execution of defined processes and the integration of Information Security processes into business processes, which aligns with the concept of central management of controls.
Document Content
Matched Section
Section: Decisions made that contain Information Security, Privacy, or risk-related concerns
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
AI Justification
The text discusses the importance of decision-making in the context of information security and privacy, emphasizing accountability and authority in risk management, which aligns with the need for protection capabilities.
Document Content
Matched Section
Section: Show active and clear support for the principles of Information Security: Confidentiality, Integrity and Availability.
Content: * Show active and clear support for the principles of Information Security: Confidentiality, Integrity and Availability. * Ensure that Information Security goals are identified, meet the organizational requirements, and are integrated into the ISMS. * Provide for the proper roles and responsibilities for resources to co-ordinate and operate the ISMS across the organization. * Ensure that proper capacity and resource management is performed to allow for an effective ISMS.
Content: * Show active and clear support for the principles of Information Security: Confidentiality, Integrity and Availability. * Ensure that Information Security goals are identified, meet the organizational requirements, and are integrated into the ISMS. * Provide for the proper roles and responsibilities for resources to co-ordinate and operate the ISMS across the organization. * Ensure that proper capacity and resource management is performed to allow for an effective ISMS.
AI Justification
The chunk discusses the importance of coordination and support for Information Security principles, which aligns with the need for a process for organization-wide security and privacy testing, training, and monitoring.
Document Content
Matched Section
Section: Commitment to Information Security and the establishment of a security culture.
Content: * Clearly express Verterim’s commitment to Information Security throughout the enterprise, and establish this policy as an authoritative document with the support of Management. * Increase security awareness and education, and to foster a security culture amongst staff.
Content: * Clearly express Verterim’s commitment to Information Security throughout the enterprise, and establish this policy as an authoritative document with the support of Management. * Increase security awareness and education, and to foster a security culture amongst staff.
AI Justification
The text emphasizes the importance of increasing security awareness and education, which aligns with the need for workforce development and improvement programs in security and privacy roles.
Document Content
Matched Section
Section: Scope
Content: Management of Verterim, consisting of the President and Senior Executives, hereby formally state their commitment to Information Security, Privacy, and the ISMS being implemented throughout the enterprise by ensuring, to the best of their ability, to:
Content: Management of Verterim, consisting of the President and Senior Executives, hereby formally state their commitment to Information Security, Privacy, and the ISMS being implemented throughout the enterprise by ensuring, to the best of their ability, to:
AI Justification
The text outlines the commitment of senior management to information security, which aligns with the role of a senior agency information security officer as described in control PM-2.
Document Content
Matched Section
Section: Support for Information Security Principles and Roles and Responsibilities
Content: * Show active and clear support for the principles of Information Security: Confidentiality, Integrity and Availability. * Ensure that Information Security goals are identified, meet the organizational requirements, and are integrated into the ISMS. * Provide for the proper roles and responsibilities for resources to co-ordinate and operate the ISMS across the organization.
Content: * Show active and clear support for the principles of Information Security: Confidentiality, Integrity and Availability. * Ensure that Information Security goals are identified, meet the organizational requirements, and are integrated into the ISMS. * Provide for the proper roles and responsibilities for resources to co-ordinate and operate the ISMS across the organization.
AI Justification
The text discusses the need for proper roles and responsibilities and the integration of information security goals, which aligns with establishing champions for information security.
Document Content
Matched Section
Section: Integration of Information Security processes into other business processes
Content: Where feasible and efficient, Information Security processes will be leverage and integrated into other business processes such as: Business strategies and plans, Risk management, New product / service development, Requirements analysis, Architecture and design, Development and quality assurance, PMO Gating, Performance management.
Content: Where feasible and efficient, Information Security processes will be leverage and integrated into other business processes such as: Business strategies and plans, Risk management, New product / service development, Requirements analysis, Architecture and design, Development and quality assurance, PMO Gating, Performance management.
AI Justification
The text discusses the integration of Information Security processes into various business processes, which aligns with the concept of integrating security and privacy requirements into the enterprise architecture.
Document Content
Matched Section
Section: Performance Management and Organizational Capability
Content: Consistent execution of well defined processes will be an indicator of organizational capability and maturity regarding Information Security. The ISMS will define processes and standard practices that all divisions, departments, and employees must apply in the development and delivery of secure services and to ensure appropriate security of information.
Content: Consistent execution of well defined processes will be an indicator of organizational capability and maturity regarding Information Security. The ISMS will define processes and standard practices that all divisions, departments, and employees must apply in the development and delivery of secure services and to ensure appropriate security of information.
AI Justification
The text discusses the execution of defined processes as indicators of organizational capability and maturity, which aligns with the concept of measuring effectiveness and efficiency in information security programs.
Document Content
Matched Section
Section: Business Continuity
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
AI Justification
The text discusses the identification and management of business risks and the criticality of services, which aligns with the prioritization of critical assets and resources.
Document Content
Matched Section
Section: Comprehensive Strategy
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved. Risks will be reported and aggregated upward for review and treatment as analyzed by the ISP using the policies, procedures, and methodologies of the ISMS.
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved. Risks will be reported and aggregated upward for review and treatment as analyzed by the ISP using the policies, procedures, and methodologies of the ISMS.
AI Justification
The text discusses the need for accountability in decision-making related to information security and risk management, aligning with the principles of an organization-wide risk management strategy.
Document Content
Matched Section
Section: Decisions made that contain Information Security, Privacy, or risk-related concerns
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
AI Justification
The text discusses the importance of accountability and authority in decision-making related to information security and risk management, which aligns with the establishment of personnel security policies and procedures.
Document Content
Matched Section
Section: Personnel controls and Contractual controls
Content: Personnel controls – Working with the Human Resources department, will assist with the screening, employment terms and conditions, compliance agreements, awareness, training, supervision, incentives, and consequences for full time and part time staff, contractors and vendors’ personnel. Contractual controls, including outsourcing.
Content: Personnel controls – Working with the Human Resources department, will assist with the screening, employment terms and conditions, compliance agreements, awareness, training, supervision, incentives, and consequences for full time and part time staff, contractors and vendors’ personnel. Contractual controls, including outsourcing.
AI Justification
The chunk discusses personnel controls and contractual controls, which relate to the management of external providers and their personnel.
Document Content
Matched Section
Section: Disciplinary Actions
Content: Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
Content: Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
AI Justification
The text discusses disciplinary actions for policy violations, which aligns with the concept of organizational sanctions.
Document Content
Matched Section
Section: Decisions made that contain Information Security, Privacy, or risk-related concerns
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
AI Justification
The text emphasizes the importance of accountability and authority in decision-making related to Information Security, which aligns with the specification of roles and responsibilities.
Document Content
Matched Section
Section: Decisions made that contain Information Security, Privacy, or risk-related concerns
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
AI Justification
The text discusses the importance of policies and procedures in managing risks related to information security and privacy, which aligns with the requirements of PT-1.
Document Content
Matched Section
Section: Decisions made that contain Information Security, Privacy, or risk-related concerns
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved. Risks will be reported and aggregated upward for review and treatment as analyzed by the ISP using the policies, procedures, and methodologies of the ISMS.
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved. Risks will be reported and aggregated upward for review and treatment as analyzed by the ISP using the policies, procedures, and methodologies of the ISMS.
AI Justification
The text discusses the importance of accountability and authority in decision-making related to information security and risk management, which aligns with the need for established risk assessment policies and procedures.
Document Content
Matched Section
Section: Purpose
Content: Information Security is concerned with the strategies, processes, and methods of ensuring the Confidentiality, Integrity and Availability (CIA) of information, systems, and services used or offered by an organization.
Content: Information Security is concerned with the strategies, processes, and methods of ensuring the Confidentiality, Integrity and Availability (CIA) of information, systems, and services used or offered by an organization.
AI Justification
The chunk discusses the importance of ensuring the Confidentiality, Integrity, and Availability (CIA) of information, which aligns with the need for security categorization to understand potential adverse impacts.
Document Content
Matched Section
Section: Controls
Content: The ISMS shall define specific control requirements and practices in each of the following areas, as deemed appropriate to meet security objectives:
Content: The ISMS shall define specific control requirements and practices in each of the following areas, as deemed appropriate to meet security objectives:
AI Justification
The text discusses the importance of defining processes and standard practices for Information Security, which aligns with the need for policies and procedures in system and services acquisition.
Document Content
Matched Section
Section: Information Security Management System (ISMS) Processes
Content: Consistent execution of well defined processes will be an indicator of organizational capability and maturity regarding Information Security. The ISMS will define processes and standard practices that all divisions, departments, and employees must apply in the development and delivery of secure services and to ensure appropriate security of information.
Content: Consistent execution of well defined processes will be an indicator of organizational capability and maturity regarding Information Security. The ISMS will define processes and standard practices that all divisions, departments, and employees must apply in the development and delivery of secure services and to ensure appropriate security of information.
AI Justification
The chunk discusses the execution of defined processes and the integration of Information Security processes into development and delivery, which aligns with the need for maintaining integrity and configuration control in development tools.
Document Content
Matched Section
Section: Resource allocation for information security and privacy
Content: * Show active and clear support for the principles of Information Security: Confidentiality, Integrity and Availability. * Ensure that Information Security goals are identified, meet the organizational requirements, and are integrated into the ISMS. * Provide for the proper roles and responsibilities for resources to co-ordinate and operate the ISMS across the organization. * Ensure that proper capacity and resource management is performed to allow for an effective ISMS.
Content: * Show active and clear support for the principles of Information Security: Confidentiality, Integrity and Availability. * Ensure that Information Security goals are identified, meet the organizational requirements, and are integrated into the ISMS. * Provide for the proper roles and responsibilities for resources to co-ordinate and operate the ISMS across the organization. * Ensure that proper capacity and resource management is performed to allow for an effective ISMS.
AI Justification
The text discusses the allocation of resources for information security, including roles and responsibilities and capacity management, which aligns with the control's focus on resource allocation for information security and privacy.
Document Content
Matched Section
Section: Information Security Management System (ISMS) Processes
Content: Consistent execution of well defined processes will be an indicator of organizational capability and maturity regarding Information Security. The ISMS will define processes and standard practices that all divisions, departments, and employees must apply in the development and delivery of secure services and to ensure appropriate security of information.
Content: Consistent execution of well defined processes will be an indicator of organizational capability and maturity regarding Information Security. The ISMS will define processes and standard practices that all divisions, departments, and employees must apply in the development and delivery of secure services and to ensure appropriate security of information.
AI Justification
The text discusses the integration of information security processes into various business processes, which aligns with the principles of systems security engineering as outlined in SA-8.
Document Content
Matched Section
Section: Consistent execution of well defined processes will be an indicator of organizational capability and maturity regarding Information Security.
Content: Consistent execution of well defined processes will be an indicator of organizational capability and maturity regarding Information Security. The ISMS will define processes and standard practices that all divisions, departments, and employees must apply in the development and delivery of secure services and to ensure appropriate security of information.
Content: Consistent execution of well defined processes will be an indicator of organizational capability and maturity regarding Information Security. The ISMS will define processes and standard practices that all divisions, departments, and employees must apply in the development and delivery of secure services and to ensure appropriate security of information.
AI Justification
The text discusses the importance of defined processes and standard practices in the development and delivery of secure services, aligning with the principles of the system development life cycle.
Document Content
Matched Section
Section: Where feasible and efficient, Information Security processes will be leverage and integrated into other business processes such as:
Content: Where feasible and efficient, Information Security processes will be leverage and integrated into other business processes such as: Business strategies and plans, Risk management, New product / service development, Requirements analysis, Architecture and design, Development and quality assurance, PMO Gating, Performance management.
Content: Where feasible and efficient, Information Security processes will be leverage and integrated into other business processes such as: Business strategies and plans, Risk management, New product / service development, Requirements analysis, Architecture and design, Development and quality assurance, PMO Gating, Performance management.
AI Justification
The mention of integrating information security processes into various business processes aligns with the need for security engineering principles in system development.
Document Content
Matched Section
Section: Controls
Content: The ISMS shall define specific control requirements and practices in each of the following areas, as deemed appropriate to meet security objectives:
Content: The ISMS shall define specific control requirements and practices in each of the following areas, as deemed appropriate to meet security objectives:
AI Justification
The text discusses the definition and implementation of processes and controls within an Information Security Management System (ISMS), which aligns with the need for derived security and privacy requirements as outlined in SA-4.
Document Content
Matched Section
Section: Decisions made that contain Information Security, Privacy, or risk-related concerns
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved.
AI Justification
The text discusses the importance of accountability and authority in decision-making related to information security and risk management, which aligns with the need for established policies and procedures.
Document Content
Matched Section
Section: Cryptographic controls
Content: Cryptographic controls – protocols, algorithms, key and certificate management, and products
Content: Cryptographic controls – protocols, algorithms, key and certificate management, and products
AI Justification
The chunk discusses cryptographic controls, which include key and certificate management, aligning with the requirements for managing cryptographic keys as outlined in SC-12.
Document Content
Matched Section
Section: The timely restoration of service disrupted by a failure within a system, process, or function
Content: * The timely restoration of service disrupted by a failure within a system, process, or function * The emergency recovery of service at an alternate location in the event of a disaster or prolonged outage at the primary site * Limited recovery of critical services in the event of major loss of staff.
Content: * The timely restoration of service disrupted by a failure within a system, process, or function * The emergency recovery of service at an alternate location in the event of a disaster or prolonged outage at the primary site * Limited recovery of critical services in the event of major loss of staff.
AI Justification
The chunk discusses the timely restoration of service and emergency recovery, which aligns with the concept of maintaining system integrity and availability during failures.
Document Content
Matched Section
Section: The timely restoration of service disrupted by a failure within a system, process, or function
Content: * The timely restoration of service disrupted by a failure within a system, process, or function * The emergency recovery of service at an alternate location in the event of a disaster or prolonged outage at the primary site * Limited recovery of critical services in the event of major loss of staff.
Content: * The timely restoration of service disrupted by a failure within a system, process, or function * The emergency recovery of service at an alternate location in the event of a disaster or prolonged outage at the primary site * Limited recovery of critical services in the event of major loss of staff.
AI Justification
The chunk discusses the timely restoration of services and emergency recovery, which aligns with the need for alternate communications paths to ensure continuity during disruptions.
Document Content
Matched Section
Section: Zones and gateways – physical and network security, and remote access
Content: Zones and gateways – physical and network security, and remote access
Content: Zones and gateways – physical and network security, and remote access
AI Justification
The chunk discusses planning and architecture related to zones and gateways, which aligns with the control's focus on managed interfaces and boundary protection.
Document Content
Matched Section
Section: Support for Information Security principles and integration into ISMS
Content: * Show active and clear support for the principles of Information Security: Confidentiality, Integrity and Availability. * Ensure that Information Security goals are identified, meet the organizational requirements, and are integrated into the ISMS.
Content: * Show active and clear support for the principles of Information Security: Confidentiality, Integrity and Availability. * Ensure that Information Security goals are identified, meet the organizational requirements, and are integrated into the ISMS.
AI Justification
The text discusses the importance of having policies and procedures that address system and information integrity, aligning with the requirements of control SI-1.
Document Content
Matched Section
Section: Business Continuity
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
AI Justification
The text discusses business continuity management processes that include identifying risks and consequences of failures, which aligns with the intent of predictable failure prevention.
Document Content
Matched Section
Section: Business Continuity
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
Content: Business continuity management processes must be implemented to identify and limit to acceptable levels the business risks and consequences associated with major failures or disasters, considering both the disruption of Verterim services and the capability and time to resume essential operations.
AI Justification
The text discusses the need for business continuity management processes to identify and limit risks associated with failures, which aligns with the control's focus on failure conditions and procedures to handle them.
Document Content
Matched Section
Section: Operations controls
Content: Operations controls – IT service management, operating procedures, system integrity, monitoring and reporting, intrusion detection, and incident management
Content: Operations controls – IT service management, operating procedures, system integrity, monitoring and reporting, intrusion detection, and incident management
AI Justification
The chunk discusses operations controls including monitoring and reporting, which aligns with the objectives of system monitoring as described in control SI-4.
Document Content
Matched Section
Section: Decisions made that contain Information Security, Privacy, or risk-related concerns
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved. Risks will be reported and aggregated upward for review and treatment as analyzed by the ISP using the policies, procedures, and methodologies of the ISMS.
Content: Decisions made that contain Information Security, Privacy, or risk-related concerns must be made by those with accountability and authority for accepting the risks involved. Risks will be reported and aggregated upward for review and treatment as analyzed by the ISP using the policies, procedures, and methodologies of the ISMS.
AI Justification
The text discusses the importance of accountability and authority in decision-making related to information security and risk management, which aligns with the need for a supply chain risk management policy that addresses controls and procedures.
Workstation_Security_Policy.docx NIST
51 matches foundDocument Content
Matched Section
Section: 3.0 Policy
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of access control policies and procedures in ensuring the security of information, which aligns with the requirements of AC-1.
Document Content
Matched Section
Section: Securing workstations (screen lock or logout) prior to leaving area to prevent unauthorized access.
Content: Securing workstations (screen lock or logout) prior to leaving area to prevent unauthorized access.
Content: Securing workstations (screen lock or logout) prior to leaving area to prevent unauthorized access.
AI Justification
The chunk discusses securing workstations through screen locks and logout procedures, which aligns with the concept of device locks as a temporary measure to prevent unauthorized access.
Document Content
Matched Section
Section: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access.
Content: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access.
Content: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access.
AI Justification
The text discusses the importance of attributes associated with active and passive entities for enforcing access control and information flow control, which aligns with the principles of AC-16.
Document Content
Matched Section
Section: 3.2 Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
Content: 3.2 Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
Content: 3.2 Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
AI Justification
The mention of implementing safeguards for workstations accessing sensitive information suggests a need for controls related to remote access and protection of sensitive data.
Document Content
Matched Section
Section: 3.0 Policy
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The policy discusses the importance of protecting sensitive information, including PII, and ensuring that access is restricted to authorized users, which aligns with the principles of information sharing and access restrictions outlined in AC-21.
Document Content
Matched Section
Section: 3.0 Policy
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of restricting access to sensitive information and ensuring that only authorized users can access such information, which aligns with the control's focus on managing access to nonpublic information.
Document Content
Matched Section
Section: 3.0 Policy
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the enforcement of access control policies to restrict access to sensitive information, aligning with the requirements of a reference monitor.
Document Content
Matched Section
Section: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access.
Content: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access.
Content: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access.
AI Justification
The text discusses the importance of considering the sensitivity of information and minimizing unauthorized access, which aligns with the principles of access control policies.
Document Content
Matched Section
Section: 3.2 Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
Content: 3.2 Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
Content: 3.2 Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
AI Justification
The implementation of physical and technical safeguards to restrict access to authorized users directly relates to access control policies.
Document Content
Matched Section
Section: 1.0 Purpose, 2.0 Scope, 3.0 Policy
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. This policy applies to all Verterim employees, contractors, workforce members, vendors and agents with a Verterim-owned or personal-workstation connected to the Verterim network. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. This policy applies to all Verterim employees, contractors, workforce members, vendors and agents with a Verterim-owned or personal-workstation connected to the Verterim network. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of policies and procedures for workstation security, which aligns with the need for awareness and training related to security controls.
Document Content
Matched Section
Section: 1.0 Purpose and 3.0 Policy
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of policies and procedures for ensuring security and privacy, which aligns with the requirements of AU-1 for audit and accountability.
Document Content
Matched Section
Section: 1.0 Purpose and 3.0 Policy
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of policies and procedures for workstation security, which aligns with the need for assessment, authorization, and monitoring policies.
Document Content
Matched Section
Section: 1.0 Purpose, 2.0 Scope, 3.0 Policy
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. This policy applies to all Verterim employees, contractors, workforce members, vendors and agents with a Verterim-owned or personal-workstation connected to the Verterim network. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. This policy applies to all Verterim employees, contractors, workforce members, vendors and agents with a Verterim-owned or personal-workstation connected to the Verterim network. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of policies and procedures for workstation security, which aligns with the need for configuration management policies that address security and privacy assurance.
Document Content
Matched Section
Section: 3.0 Policy
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The chunk discusses the importance of ensuring the confidentiality, integrity, and availability of sensitive information, including PII, which aligns with the control's focus on processing personally identifiable information and understanding the associated risks.
Document Content
Matched Section
Section: 3.1 and 3.2
Content: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access. 3.2 Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
Content: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access. 3.2 Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
AI Justification
The text discusses the importance of restricting access to systems and ensuring that only authorized individuals can make changes, which aligns with the control's focus on managing changes to systems securely.
Document Content
Matched Section
Section: 3.2
Content: 3.2 Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
Content: 3.2 Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
AI Justification
The mention of restricting access to authorized users directly aligns with the access enforcement control.
Document Content
Matched Section
Section: 1.0 Purpose and 3.0 Policy
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of policies and procedures for ensuring security and privacy, which aligns with the requirements of CP-1 regarding contingency planning.
Document Content
Matched Section
Section: 3.1 and 3.2
Content: Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access. Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
Content: Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access. Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
AI Justification
The chunk discusses the sensitivity of information, including PHI and PII, which aligns with the need to protect system-level information and ensure integrity in backups.
Document Content
Matched Section
Section: 3.0 Policy
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of identification and authentication policies and procedures, which aligns with the control's focus on establishing such policies within organizations.
Document Content
Matched Section
Section: 1.0 Purpose, 2.0 Scope, 3.0 Policy
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. This policy applies to all Verterim employees, contractors, workforce members, vendors and agents with a Verterim-owned or personal-workstation connected to the Verterim network. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. This policy applies to all Verterim employees, contractors, workforce members, vendors and agents with a Verterim-owned or personal-workstation connected to the Verterim network. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of policies and procedures related to incident response, emphasizing the need for collaboration between security and privacy programs, which aligns with the intent of the IR-1 control.
Document Content
Matched Section
Section: 1.0 Purpose and 3.0 Policy
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of policies and procedures related to security and privacy, which aligns with the control's focus on maintenance policies and procedures.
Document Content
Matched Section
Section: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access.
Content: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access.
Content: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access.
AI Justification
The text discusses the need for authorized maintenance personnel and the access they require, which aligns with the control's focus on maintenance personnel and their access to systems.
Document Content
Matched Section
Section: 3.2 Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
Content: 3.2 Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
Content: 3.2 Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
AI Justification
The text mentions physical access for maintenance personnel, which aligns with the control's focus on physical access to systems.
Document Content
Matched Section
Section: 1.0 Purpose, 2.0 Scope, 3.0 Policy
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. This policy applies to all Verterim employees, contractors, workforce members, vendors and agents with a Verterim-owned or personal-workstation connected to the Verterim network. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. This policy applies to all Verterim employees, contractors, workforce members, vendors and agents with a Verterim-owned or personal-workstation connected to the Verterim network. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of policies and procedures for workstation security, which aligns with the need for a media protection policy that addresses security and privacy assurance.
Document Content
Matched Section
Section: 1.0 Purpose and 3.0 Policy
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of policies and procedures for workstation security, which aligns with the need for physical and environmental protection policies.
Document Content
Matched Section
Section: Ensuring that all workstations use a surge protector or a UPS
Content: * Ensuring that all workstations use a surge protector (not just a power strip) or a UPS (battery backup).
Content: * Ensuring that all workstations use a surge protector (not just a power strip) or a UPS (battery backup).
AI Justification
The text chunk mentions the use of a UPS for workstations, which aligns with the control's focus on providing emergency power to protect equipment from power disruptions.
Document Content
Matched Section
Section: Restricting physical access to workstations
Content: * Restricting physical access to workstations to only authorized personnel.
Content: * Restricting physical access to workstations to only authorized personnel.
AI Justification
The chunk discusses restricting physical access to workstations and securing them, which aligns with the need to enforce authorizations for entry and exit of system components.
Document Content
Matched Section
Section: Ensuring workstations are used for authorized business purposes only.
Content: * Ensuring workstations are used for authorized business purposes only.
Content: * Ensuring workstations are used for authorized business purposes only.
AI Justification
The chunk emphasizes ensuring workstations are used for authorized business purposes only, which relates to account management and access control.
Document Content
Matched Section
Section: Enabling a password-protected screen saver with a short timeout period
Content: * Enabling a password-protected screen saver with a short timeout period to ensure that workstations that were left unsecured will be protected.
Content: * Enabling a password-protected screen saver with a short timeout period to ensure that workstations that were left unsecured will be protected.
AI Justification
The mention of enabling a password-protected screen saver and securing workstations relates to managing authenticators and preventing unauthorized access.
Document Content
Matched Section
Section: 3.2 Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
Content: 3.2 Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
Content: 3.2 Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
AI Justification
The chunk discusses the need for safeguards and access restrictions for workstations handling sensitive information, aligning with the need for physical access authorizations.
Document Content
Matched Section
Section: Restricting physical access to workstations and securing workstations prior to leaving area.
Content: * Restricting physical access to workstations to only authorized personnel. * Securing workstations (screen lock or logout) prior to leaving area to prevent unauthorized access.
Content: * Restricting physical access to workstations to only authorized personnel. * Securing workstations (screen lock or logout) prior to leaving area to prevent unauthorized access.
AI Justification
The chunk discusses various measures to restrict physical access and secure workstations, which aligns with the control's focus on physical and environmental hazards.
Document Content
Matched Section
Section: Restricting physical access to workstations and securing workstations prior to leaving the area.
Content: * Restricting physical access to workstations to only authorized personnel. * Securing workstations (screen lock or logout) prior to leaving area to prevent unauthorized access. * Enabling a password-protected screen saver with a short timeout period to ensure that workstations that were left unsecured will be protected * Ensuring workstations are used for authorized business purposes only. * Never installing unauthorized software on workstations. * Storing all sensitive information, in an encrypted format * Keeping food and drink away from workstations in order to avoid accidental spills. * Securing laptops that contain sensitive information by using cable locks or locking laptops up in drawers or cabinets. * Complying with the Anti-Virus policy * Ensuring that monitors are positioned away from public view. If necessary, install privacy screen filters or other physical barriers to public viewing.
Content: * Restricting physical access to workstations to only authorized personnel. * Securing workstations (screen lock or logout) prior to leaving area to prevent unauthorized access. * Enabling a password-protected screen saver with a short timeout period to ensure that workstations that were left unsecured will be protected * Ensuring workstations are used for authorized business purposes only. * Never installing unauthorized software on workstations. * Storing all sensitive information, in an encrypted format * Keeping food and drink away from workstations in order to avoid accidental spills. * Securing laptops that contain sensitive information by using cable locks or locking laptops up in drawers or cabinets. * Complying with the Anti-Virus policy * Ensuring that monitors are positioned away from public view. If necessary, install privacy screen filters or other physical barriers to public viewing.
AI Justification
The chunk discusses various measures to restrict physical access to workstations and secure sensitive information, aligning with the requirements of physical access control.
Document Content
Matched Section
Section: Protection of Power Equipment and Cabling
Content: * Ensuring that all workstations use a surge protector (not just a power strip) or a UPS (battery backup).
Content: * Ensuring that all workstations use a surge protector (not just a power strip) or a UPS (battery backup).
AI Justification
The mention of using surge protectors and UPS aligns with the need to determine necessary protections for power equipment and cabling.
Document Content
Matched Section
Section: 1.0 Purpose, 2.0 Scope, 3.0 Policy
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. This policy applies to all Verterim employees, contractors, workforce members, vendors and agents with a Verterim-owned or personal-workstation connected to the Verterim network. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. This policy applies to all Verterim employees, contractors, workforce members, vendors and agents with a Verterim-owned or personal-workstation connected to the Verterim network. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of policies and procedures for workstation security, which aligns with the planning and implementation of controls as outlined in PL-1.
Document Content
Matched Section
Section: Restricting physical access to workstations and ensuring monitors are positioned away from public view.
Content: * Restricting physical access to workstations to only authorized personnel. * Securing workstations (screen lock or logout) prior to leaving area to prevent unauthorized access. * Enabling a password-protected screen saver with a short timeout period to ensure that workstations that were left unsecured will be protected * Ensuring workstations are used for authorized business purposes only. * Never installing unauthorized software on workstations. * Storing all sensitive information, in an encrypted format * Keeping food and drink away from workstations in order to avoid accidental spills. * Securing laptops that contain sensitive information by using cable locks or locking laptops up in drawers or cabinets. * Complying with the Anti-Virus policy * Ensuring that monitors are positioned away from public view. If necessary, install privacy screen filters or other physical barriers to public viewing.
Content: * Restricting physical access to workstations to only authorized personnel. * Securing workstations (screen lock or logout) prior to leaving area to prevent unauthorized access. * Enabling a password-protected screen saver with a short timeout period to ensure that workstations that were left unsecured will be protected * Ensuring workstations are used for authorized business purposes only. * Never installing unauthorized software on workstations. * Storing all sensitive information, in an encrypted format * Keeping food and drink away from workstations in order to avoid accidental spills. * Securing laptops that contain sensitive information by using cable locks or locking laptops up in drawers or cabinets. * Complying with the Anti-Virus policy * Ensuring that monitors are positioned away from public view. If necessary, install privacy screen filters or other physical barriers to public viewing.
AI Justification
The text discusses restricting physical access to workstations and securing devices, which aligns with controlling physical access to output devices.
Document Content
Matched Section
Section: 3.0 Policy
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of ensuring the confidentiality, integrity, and availability of sensitive information, which aligns with the protection needs outlined in control PM-11.
Document Content
Matched Section
Section: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access.
Content: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access.
Content: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access.
AI Justification
The chunk discusses the sensitivity of information, including PII, and emphasizes minimizing unauthorized access, which aligns with the control's focus on managing PII in testing and research.
Document Content
Matched Section
Section: Position risk designations reflect Office of Personnel Management (OPM) policy and guidance.
Content: Control: PS-2: Position risk designations reflect Office of Personnel Management (OPM) policy and guidance. Proper position designation is the foundation of an effective and consistent suitability and personnel security program. The Position Designation System (PDS) assesses the duties and responsibilities of a position to determine the degree of potential damage to the efficiency or integrity of the service due to misconduct of an incumbent of a position and establishes the risk level of that position.
Content: Control: PS-2: Position risk designations reflect Office of Personnel Management (OPM) policy and guidance. Proper position designation is the foundation of an effective and consistent suitability and personnel security program. The Position Designation System (PDS) assesses the duties and responsibilities of a position to determine the degree of potential damage to the efficiency or integrity of the service due to misconduct of an incumbent of a position and establishes the risk level of that position.
AI Justification
The text discusses the importance of position risk designations and their impact on access to organizational information, which aligns with the control's focus on assessing position sensitivity and risk levels.
Document Content
Matched Section
Section: 1.0 Purpose and 3.0 Policy
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of policies and procedures for workstation security, which aligns with the need for personnel security policies that ensure the protection of sensitive information.
Document Content
Matched Section
Section: 1.0 Purpose, 2.0 Scope, 3.0 Policy
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. This policy applies to all Verterim employees, contractors, workforce members, vendors and agents with a Verterim-owned or personal-workstation connected to the Verterim network. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. This policy applies to all Verterim employees, contractors, workforce members, vendors and agents with a Verterim-owned or personal-workstation connected to the Verterim network. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of policies and procedures for handling personally identifiable information (PII) and emphasizes the need for security measures to protect sensitive information.
Document Content
Matched Section
Section: 3.0 Policy
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The chunk discusses the importance of ensuring the confidentiality, integrity, and availability of sensitive information, including PII, which aligns with the control's focus on the processing of PII across its life cycle.
Document Content
Matched Section
Section: 3.0 Policy
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The policy outlines the need for appropriate measures to protect sensitive information, including PII, which aligns with the requirements for applying conditions or protections for specific categories of personally identifiable information.
Document Content
Matched Section
Section: 1.0 Purpose and 3.0 Policy
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of policies and procedures for workstation security, which aligns with the need for risk assessment policies that address security measures.
Document Content
Matched Section
Section: 3.0 Policy
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of ensuring the confidentiality, integrity, and availability of sensitive information, which aligns with the need for security categorization to understand potential adverse impacts.
Document Content
Matched Section
Section: 1.0 Purpose, 2.0 Scope, 3.0 Policy
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. This policy applies to all Verterim employees, contractors, workforce members, vendors and agents with a Verterim-owned or personal-workstation connected to the Verterim network. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. This policy applies to all Verterim employees, contractors, workforce members, vendors and agents with a Verterim-owned or personal-workstation connected to the Verterim network. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of policies and procedures for security and privacy assurance, which aligns with the requirements of SA-1 regarding the establishment of such policies.
Document Content
Matched Section
Section: 3.0 Policy
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of policies and procedures for workstation security, which aligns with the need for a system and communications protection policy.
Document Content
Matched Section
Section: 3.1 Workforce members using workstations shall consider the sensitivity of the information
Content: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access.
Content: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access.
AI Justification
The chunk discusses the sensitivity of information, including PII and PHI, which aligns with the concept of security and privacy attributes as described in control SC-16.
Document Content
Matched Section
Section: 3.1 and 3.2
Content: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access. 3.2 Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
Content: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access. 3.2 Verterim will implement physical and technical safeguards for all workstations that access electronic protected health information to restrict access to authorized users.
AI Justification
The chunk discusses the sensitivity of information, particularly PHI and PII, which aligns with the need to protect information at rest.
Document Content
Matched Section
Section: 3.0 Policy
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of protecting sensitive information and ensuring that access is restricted to authorized users, which aligns with the principles of OPSEC.
Document Content
Matched Section
Section: 1.0 Purpose and 3.0 Policy
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
Content: The purpose of this policy is to provide guidance for workstation security for Verterim workstations in order to ensure the security of information on the workstation and information the workstation may have access to. Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information, including protected health information (PHI), Personally Identifiable Information (PII) and that access to sensitive information is restricted to authorized users and protected from disclosure.
AI Justification
The text discusses the importance of policies and procedures for ensuring the security of information, which aligns with the requirements of the SI family of controls.
Document Content
Matched Section
Section: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access.
Content: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access.
Content: 3.1 Workforce members using workstations shall consider the sensitivity of the information, including protected health information (PHI), Personally Identifiable Information (PII) that may be accessed and minimize the possibility of unauthorized access.
AI Justification
The chunk discusses the handling of sensitive information, including PII, which aligns with the quality operations for PII as described in control SI-18.
Acceptable_Encryption_Policy.docx NIST
2 matches foundDocument Content
Matched Section
Section: 3.0 Policy
Content: All Verterim encryption shall be done using NIST approved cryptographic modules. Common and recommended ciphers include AES 256, Triple DES and RSA. Symmetric cryptosystem key lengths must be at least 128 bits. Asymmetric crypto-system keys must be of a length that yields equivalent strength. Verterim’s key length requirements shall be reviewed annually as part of the yearly security review and upgraded as technology allows.
Content: All Verterim encryption shall be done using NIST approved cryptographic modules. Common and recommended ciphers include AES 256, Triple DES and RSA. Symmetric cryptosystem key lengths must be at least 128 bits. Asymmetric crypto-system keys must be of a length that yields equivalent strength. Verterim’s key length requirements shall be reviewed annually as part of the yearly security review and upgraded as technology allows.
AI Justification
The policy outlines the use of NIST approved cryptographic modules and specifies key length requirements, aligning with the control's focus on key management and establishment.
Document Content
Matched Section
Section: 3.0 Policy
Content: All Verterim encryption shall be done using NIST approved cryptographic modules. Common and recommended ciphers include AES 256, Triple DES and RSA. Symmetric cryptosystem key lengths must be at least 128 bits. Asymmetric crypto-system keys must be of a length that yields equivalent strength. Verterim’s key length requirements shall be reviewed annually as part of the yearly security review and upgraded as technology allows.
Content: All Verterim encryption shall be done using NIST approved cryptographic modules. Common and recommended ciphers include AES 256, Triple DES and RSA. Symmetric cryptosystem key lengths must be at least 128 bits. Asymmetric crypto-system keys must be of a length that yields equivalent strength. Verterim’s key length requirements shall be reviewed annually as part of the yearly security review and upgraded as technology allows.
AI Justification
The policy emphasizes the use of NIST approved cryptographic modules and specifies the use of certain algorithms, aligning with the control's focus on cryptography for security solutions.
Equipment_Disposal_Policy.docx NIST
7 matches foundDocument Content
Matched Section
Section: 1. Overview
Content: Technology equipment often contains parts, which cannot simply be thrown away. Proper disposal of equipment is both environmentally responsible and often required by law. In addition, hard drives, USB drives, CD-ROMs and other storage media contain various kinds of Verterim data, some of which is considered sensitive. In order to protect our constituent’s data, all storage mediums must be properly erased before being disposed of. However, simply deleting or even formatting data is not considered sufficient. When deleting files or formatting a device, data is marked for deletion, but is still accessible until being overwritten by a new file. Therefore, special tools must be used to securely erase data prior to equipment disposal.
Content: Technology equipment often contains parts, which cannot simply be thrown away. Proper disposal of equipment is both environmentally responsible and often required by law. In addition, hard drives, USB drives, CD-ROMs and other storage media contain various kinds of Verterim data, some of which is considered sensitive. In order to protect our constituent’s data, all storage mediums must be properly erased before being disposed of. However, simply deleting or even formatting data is not considered sufficient. When deleting files or formatting a device, data is marked for deletion, but is still accessible until being overwritten by a new file. Therefore, special tools must be used to securely erase data prior to equipment disposal.
AI Justification
The text discusses the importance of having a media protection policy and procedures for the proper disposal of technology equipment, which aligns directly with the control's focus on media protection.
Document Content
Matched Section
Section: Overview
Content: Technology equipment often contains parts, which cannot simply be thrown away. Proper disposal of equipment is both environmentally responsible and often required by law. In addition, hard drives, USB drives, CD-ROMs and other storage media contain various kinds of Verterim data, some of which is considered sensitive. In order to protect our constituent’s data, all storage mediums must be properly erased before being disposed of.
Content: Technology equipment often contains parts, which cannot simply be thrown away. Proper disposal of equipment is both environmentally responsible and often required by law. In addition, hard drives, USB drives, CD-ROMs and other storage media contain various kinds of Verterim data, some of which is considered sensitive. In order to protect our constituent’s data, all storage mediums must be properly erased before being disposed of.
AI Justification
The text discusses the proper disposal of technology equipment and the need to securely erase data from storage media, which aligns with the control's focus on managing and protecting system media.
Document Content
Matched Section
Section: Overview
Content: Technology equipment often contains parts, which cannot simply be thrown away. Proper disposal of equipment is both environmentally responsible and often required by law. In addition, hard drives, USB drives, CD-ROMs and other storage media contain various kinds of Verterim data, some of which is considered sensitive. In order to protect our constituent’s data, all storage mediums must be properly erased before being disposed of. However, simply deleting or even formatting data is not considered sufficient. When deleting files or formatting a device, data is marked for deletion, but is still accessible until being overwritten by a new file. Therefore, special tools must be used to securely erase data prior to equipment disposal.
Content: Technology equipment often contains parts, which cannot simply be thrown away. Proper disposal of equipment is both environmentally responsible and often required by law. In addition, hard drives, USB drives, CD-ROMs and other storage media contain various kinds of Verterim data, some of which is considered sensitive. In order to protect our constituent’s data, all storage mediums must be properly erased before being disposed of. However, simply deleting or even formatting data is not considered sufficient. When deleting files or formatting a device, data is marked for deletion, but is still accessible until being overwritten by a new file. Therefore, special tools must be used to securely erase data prior to equipment disposal.
AI Justification
The chunk discusses the importance of securely erasing data from storage media before disposal, which aligns with the requirements for media sanitization.
Document Content
Matched Section
Section: Overview and Purpose
Content: Technology equipment often contains parts, which cannot simply be thrown away. Proper disposal of equipment is both environmentally responsible and often required by law. In addition, hard drives, USB drives, CD-ROMs and other storage media contain various kinds of Verterim data, some of which is considered sensitive. In order to protect our constituent’s data, all storage mediums must be properly erased before being disposed of.
Content: Technology equipment often contains parts, which cannot simply be thrown away. Proper disposal of equipment is both environmentally responsible and often required by law. In addition, hard drives, USB drives, CD-ROMs and other storage media contain various kinds of Verterim data, some of which is considered sensitive. In order to protect our constituent’s data, all storage mediums must be properly erased before being disposed of.
AI Justification
The chunk discusses the importance of proper disposal of technology equipment and the need for policies and procedures to ensure data protection, which aligns with the requirements of PE-1.
Document Content
Matched Section
Section: 1. Overview
Content: In order to protect our constituent’s data, all storage mediums must be properly erased before being disposed of. However, simply deleting or even formatting data is not considered sufficient. When deleting files or formatting a device, data is marked for deletion, but is still accessible until being overwritten by a new file. Therefore, special tools must be used to securely erase data prior to equipment disposal.
Content: In order to protect our constituent’s data, all storage mediums must be properly erased before being disposed of. However, simply deleting or even formatting data is not considered sufficient. When deleting files or formatting a device, data is marked for deletion, but is still accessible until being overwritten by a new file. Therefore, special tools must be used to securely erase data prior to equipment disposal.
AI Justification
The text discusses the proper disposal and erasure of storage media, which aligns with the concept of media downgrading to ensure sensitive data is not retrievable.
Document Content
Matched Section
Section: Overview
Content: In order to protect our constituent’s data, all storage mediums must be properly erased before being disposed of. However, simply deleting or even formatting data is not considered sufficient.
Content: In order to protect our constituent’s data, all storage mediums must be properly erased before being disposed of. However, simply deleting or even formatting data is not considered sufficient.
AI Justification
The text discusses the importance of securely erasing data from storage media before disposal to prevent unauthorized access to sensitive information, which aligns with the objective of SC-4 regarding preventing unauthorized information transfer.
Document Content
Matched Section
Section: Overview
Content: Technology equipment often contains parts, which cannot simply be thrown away. Proper disposal of equipment is both environmentally responsible and often required by law. In addition, hard drives, USB drives, CD-ROMs and other storage media contain various kinds of Verterim data, some of which is considered sensitive. In order to protect our constituent’s data, all storage mediums must be properly erased before being disposed of.
Content: Technology equipment often contains parts, which cannot simply be thrown away. Proper disposal of equipment is both environmentally responsible and often required by law. In addition, hard drives, USB drives, CD-ROMs and other storage media contain various kinds of Verterim data, some of which is considered sensitive. In order to protect our constituent’s data, all storage mediums must be properly erased before being disposed of.
AI Justification
The text discusses the importance of proper disposal of technology equipment and data, aligning with the control's focus on disposal throughout the system development life cycle.
Ethical_Sourcing_Policy.docx NIST
3 matches foundDocument Content
Matched Section
Section: All Vendors / Suppliers that provide software and/or Services to Verterim or its clients.
Content: All Vendors / Suppliers that provide software and/or Services to Verterim or its clients.
Content: All Vendors / Suppliers that provide software and/or Services to Verterim or its clients.
AI Justification
The text discusses the inclusion of external providers, such as contractors and vendors, and their personnel in the organizational security framework, which aligns with the requirements of PS-7.
Document Content
Matched Section
Section: Supply Chain Risk Management Policy
Content: Verterim expects itself and its suppliers to demonstrate a commitment to implementing the ethical policies and practices consistent with this Policy regarding workplace safety, environment, fair pay, and employment conditions. The Policy sets out the standards that we expect compliance of ourselves and all our suppliers when producing and supplying products for Verterim and Verterim Clients.
Content: Verterim expects itself and its suppliers to demonstrate a commitment to implementing the ethical policies and practices consistent with this Policy regarding workplace safety, environment, fair pay, and employment conditions. The Policy sets out the standards that we expect compliance of ourselves and all our suppliers when producing and supplying products for Verterim and Verterim Clients.
AI Justification
The text discusses the commitment to ethical policies and practices in relation to suppliers, which aligns with managing supply chain risks and ensuring compliance with standards.
Document Content
Matched Section
Section: 3.5 Working Conditions
Content: Suppliers shall provide a safe and hygienic working environment. They shall also provide continuous monitoring to ensure compliance with applicable legislation, regulations and the ILO standards. Suppliers shall ensure that personal protective safety equipment is available and that workers are adequately trained in its use. Safeguards on machinery must meet or exceed local laws, and workers shall be provided with all appropriate protective equipment.
Content: Suppliers shall provide a safe and hygienic working environment. They shall also provide continuous monitoring to ensure compliance with applicable legislation, regulations and the ILO standards. Suppliers shall ensure that personal protective safety equipment is available and that workers are adequately trained in its use. Safeguards on machinery must meet or exceed local laws, and workers shall be provided with all appropriate protective equipment.
AI Justification
The text discusses the importance of validating workers' legal rights to work and ensuring proper processes are in place for workers obtained through employment agencies, which aligns with supply chain management practices.