Key Controls Review
TestEntity 2 - Review and manage critical security controls
Search & Add Controls
AI Search Results
Found semantically similar controls
Current Key Controls
10 TotalScoping Question 1
Will the entity’s personnel require specialized clearances or certifications? Determines if staff need background checks, professional licenses, or industry certifications before starting work. Delays onboarding if certifications lapse; compliance risk if unauthorised staff perform regulated tasks. Credential-verification process Expiration-tracking of certifications Backup resource plan for lapsed clearances
Establish and Maintain an Inventory of Accounts
Establish and maintain an inventory of all accounts managed in the enterprise. The inventory must at a minimum include user, administrator accounts, and service accounts. The inventory, at a minimum, ...
Ensure Authorized Software is Currently Supported
Ensure that only currently supported software is designated as authorized in the software inventory for enterprise assets. If software is unsupported, yet necessary for the fulfillment of the enterpri...
Scoping Question 2
Will the entity have physical access to the entity’s managed devices (e.g., laptops, smartphones, tablets)? Determines if the entity’s personnel will handle or use corporate-owned endpoints, which may store sensitive data. Direct device access can lead to data leakage, malware introduction, or unauthorised configuration changes. Device inventory and tracking Endpoint security policies (e.g., MDM enforcement) Access logging and tamper-evident seals
Enforce Remote Wipe Capability on Portable End-User Devices
Remotely wipe enterprise data from enterprise-owned portable end-user devices when deemed appropriate such as lost or stolen devices, or when an individual no longer supports the enterprise.
Log Sensitive Data Access
Log sensitive data access, including modification and disposal.
Establish and Maintain Detailed Enterprise Asset Inventory
Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with the potential to store or process data, to include: end-user devices (including portable and mobile...
Establish and Maintain a Secure Configuration Process
Establish and maintain a documented secure configuration process for enterprise assets (end-user devices, including portable and mobile, non-computing/IoT devices, and servers) and software (operating...
Scoping Question 3
Does the entity use proprietary or third-party technology that must be licensed separately? Flags dependencies on paid tools, platforms, or IP that add cost or complicate your management landscape. Creates unexpected cost, version-mismatch risk, and additional vendor-management overhead. License-management tracking and renewal reminders Proof-of-license audits Evaluation of alternative open-source options
Establish and Maintain a Software Inventory
Establish and maintain a detailed inventory of all licensed software installed on enterprise assets. The software inventory must document the title, publisher, initial install/use date, and business p...
Ensure Authorized Software is Currently Supported
Ensure that only currently supported software is designated as authorized in the software inventory for enterprise assets. If software is unsupported, yet necessary for the fulfillment of the enterpri...
Scoping Question 4
Will the entity host entity, partner, or customer data in their own network environment? Determines if your data will reside on the provider’s infrastructure rather than your controlled systems. Loss of direct control over data storage, potential co-tenant risks, and challenges in meeting data-sovereignty or compliance requirements. Contractual data-hosting SLA and security requirements Data-segregation (logical/physical) and encryption at rest Periodic network and configuration audits Defined backup, retention, and e-discovery procedures
Establish and Maintain a Data Management Process
Establish and maintain a documented data management process. In the process, address data sensitivity, data owner, handling of data, data retention limits, and disposal requirements, based on sensitiv...
Securely Dispose of Data
Securely dispose of data as outlined in the enterprise’s documented data management process. Ensure the disposal process and method are commensurate with the data sensitivity.
Scoping Question 5
Does the service require handling or custody of the entity’s physical assets (e.g., hardware, inventory)? Flags responsibility for equipment, shipments, or on-site physical items under the entity’s care. Asset damage, loss, or theft can disrupt operations and lead to replacement costs or insurance claims. Asset-tagging and inventory management system Insurance and liability clauses Chain-of-custody documentation for transfers
Establish and Maintain Detailed Enterprise Asset Inventory
Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with the potential to store or process data, to include: end-user devices (including portable and mobile...
Scoping Question 6
Will the service integrate directly with core business processes or systems? Identifies if the entity’s outputs plug into mission-critical workflows (order processing, billing, manufacturing, etc.). A faulty integration can cascade failures into critical operations, causing downtime, data corruption, or billing errors. Formal change-management process Pre-/post-integration validation testing Role-based access controls on integrated interfaces
Document Data Flows
Document data flows. Data flow documentation includes service provider data flows and should be based on the enterprise’s data management process. Review and update documentation annually, or when sig...