Resources and Subprocessers
Access Control Policy:
The organization’s access control policy defines how access to systems and data is managed, including user permissions, authentication, and monitoring to ensure only authorized access.
Asset Management Policy:
The organization’s asset management policy defines how assets are tracked and protected, including inventory management, ownership, and secure use and disposal.
Data Management Policy:
The organization’s data management policy defines how data is handled, stored, and protected, including classification, retention, and secure disposal practices.
Code of Conduct:
The organization’s code of conduct defines expected standards of behavior, ensuring employees act ethically, professionally, and in compliance with policies and laws.
Operations Security Policy:
The organization’s operations security policy defines procedures for secure system operations, including monitoring, change management, and protection of operational processes.
Human Resource Security Policy:
The organization’s human resource security policy defines security practices related to employees, including onboarding, training, and termination procedures.
Physical Security Policy:
The organization’s physical security policy defines how facilities and equipment are protected from unauthorized access, damage, or theft.
Risk Management Policy:
The organization’s risk management policy defines how risks are identified, assessed, and mitigated to protect business operations and information assets.
Information Security Policy (AUP):
The organization’s information security policy defines acceptable use of systems and data, ensuring users follow security requirements and best practices.
Third-Party Management Policy:
The organization’s third-party management policy defines how external vendors are evaluated and monitored to ensure they meet security and compliance standards.
Information Security Roles and Responsibilities:
The organization defines roles and responsibilities to ensure accountability for maintaining and enforcing information security across all functions.
Cryptography Policy:
The organization’s cryptography policy defines how encryption is used to protect data, including key management and secure implementation practices.
Secure Development Policy:
The organization’s secure development policy defines practices for building secure software, including coding standards, testing, and vulnerability management.
Business Continuity and Disaster Recovery Plan:
The organization’s business continuity and disaster recovery plan defines how critical operations are maintained and restored during disruptions or disasters.
Incident Response Plan:
The organization’s incident response plan defines how security incidents are identified, managed, and resolved to minimize impact and ensure recovery.
Amazon Web Services (AWS):
Provides cloud infrastructure and hosting services for storing and processing application data.
GitHub:
Provides version control and code repository services for managing and collaborating on software development.
Google Workspace:
Provides identity management and productivity tools, including email, authentication, and document collaboration.
Linear:
Provides issue tracking and project management tools for internal collaboration and workflow management.
Internal Ticket Solution:
Provides an internal system for tracking, managing, and resolving support and operational requests.
Slack:
Provides a communication platform for internal messaging, collaboration, and team coordination.
Vanta:
Provides continuous security and compliance monitoring to help maintain and demonstrate adherence to security standards.
.png)
