Security at Northwind Cloud

The organization documents and approves change management and secure development procedures that describe how changes to production are requested, reviewed, tested, approved and deployed.

The organization manages production code in a connected version control system, and every active repository is classified as in or out of audit scope.

The organization requires every code change to be reviewed and approved by someone other than its author before it is merged, and enforces this through branch protection that also applies to administrators.

Production systems synchronize their clocks with an approved time source so that timestamps in logs are consistent across systems.

The organization keeps test environments separate from production and does not use production personal data for testing unless it is protected to production standards; every in-scope infrastructure resource has an owner so test resources can be identified.

The organization displays a clearly visible link to its current privacy notice in every in-scope product.

The organization reviews who has access to each production and critical system at the frequency set for that system, and removes or adjusts access that is no longer justified.

The organization documents and approves an access control policy and procedure that describe how access to systems and data is requested, approved, granted, reviewed and removed.

The organization assigns an owner and a documented access model to every critical system, and every active account on those systems has a recorded role consistent with the user's job.

The organization revokes or disables the accounts of departing staff on every critical system as part of offboarding, within the defined offboarding deadline.

The organization limits access to production databases and cloud infrastructure to identified, authorized people: accounts are reviewed periodically, console users and the root account use MFA, credentials unused for 90 days are disabled, and resources are not exposed directly to the internet.

The organization enforces multi-factor authentication on every in-scope critical system, and every human account with access to those systems has it enabled.

The organization periodically reviews the privileges held by accounts on critical systems, confirms that each account belongs to an identified person or service, and removes privileges that exceed what the role needs.

The organization periodically reviews the accounts on each critical system against current staff and their roles, and every active account is mapped to an identified person or classified as a service account.

The organization requires full disk encryption to be enabled on every active in-scope staff device.

The organization requires every staff device to be registered, linked to its user and reporting its status, and to lock the screen automatically after no more than 15 minutes of inactivity.

The organization documents how storage media and devices holding company or customer data are wiped or destroyed before disposal or reuse, and keeps a record of each disposal.

The organization encrypts the production databases and storage services that hold company or customer data at rest.

The organization encrypts data in transit over public networks: products and production endpoints are served only over HTTPS, and TLS is required for connections to production services.

The organization documents which data is backed up, how often, where backups are stored, how long they are kept and how restoration is tested.

Production systems have automated database backups and storage versioning enabled, so that data can be recovered after deletion, loss or corruption.

The organization restores data from backups at least every 12 months to confirm they are complete and usable, and records the result of each test.

The organization assigns a classification level to the information it handles and labels data and systems with that level, so the matching security and privacy safeguards are applied.

The organization documents how long each category of data is kept and how it is securely deleted once its retention period ends.

The organization documents and approves a data protection policy that sets the lawful bases, purposes, safeguards and responsibilities for processing personal data.

The organization tests its disaster recovery plan at least every 12 months and records the results and any follow-up actions.

The organization documents and approves an encryption policy that defines where encryption is required, which algorithms are allowed and how cryptographic keys are managed.

The organization defines password rules covering length, reuse, sharing and storage in an approved password manager, and these rules apply to every account used for company work.

The organization documents and approves a data classification policy that defines the classification levels and the handling rules for each level.

The organization documents and approves a disaster recovery plan that sets recovery objectives, assigns roles and describes how critical systems are restored after a major disruption.

The organization documents and approves a business continuity plan that identifies its critical services and how they keep operating during a disruption.

The organization documents and approves a privacy by design policy that requires privacy to be considered and built in when new products, features or processing activities are designed.

The organization requires anti-malware protection to be installed and running on every active in-scope staff device.

The organization checks staff devices on an ongoing basis against its endpoint security baseline, including that the operating system has no pending security updates.

The organization documents and approves an endpoint security policy that sets the minimum security configuration for every device used to access company data.

The organization requires every staff device to be registered, linked to its user and reporting its status, with full disk encryption enabled.

The organization identifies the production resources its services depend on and monitors their health, so the impact of an outage, change or degradation on in-scope assets can be assessed and acted on.

The organization carries out an internal audit of its security and privacy program at least every 12 months against a defined scope, and records the findings and the corrective actions taken.

Production systems accept connections from the internet only through approved entry points, and in-scope resources are not directly reachable from public networks.

The organization connects its cloud providers for monitoring and configures production network rules to deny traffic by default, allowing only connections that are explicitly required; the firewall ruleset is reviewed at least every 12 months.

The organization maintains an inventory of its in-scope infrastructure resources, and every resource has an assigned owner.

The organization enables a threat detection service on every in-scope cloud account to flag anomalous or malicious activity for investigation.

The organization configures health and capacity alerting for in-scope databases, compute, load balancers and web applications, so that resource exhaustion and degraded performance are detected and handled.

The organization watches for unauthorized access and activity on its critical systems, and uses periodic access reviews to confirm that only approved accounts hold access.

The organization maintains diagrams of its production network and of how data flows between its systems, and updates them at least every 12 months.

The organization assigns an infrastructure operations owner who is accountable for production assets and their configuration.

The organization updates its asset inventory whenever systems or components are installed, moved or removed, and confirms the inventory is accurate during the annual internal audit.

The organization maintains an inventory of staff devices in which every in-scope staff member has reported a device, every device is linked to its user, and every device has reported its status within the last 30 days.

The organization enables audit logging on its in-scope cloud accounts and services, and collects the logs centrally where they are retained for investigation.

The organization routes security alerts and staff reports of suspected incidents automatically to the people responsible for triage, so every event reaches the incident process without manual relay.

The organization gives customers and other external parties a published contact or support page in every in-scope product through which they can report security issues, incidents and complaints.

The organization documents and approves an incident management policy and procedure that define how security and privacy incidents are reported, classified, contained, resolved, communicated and reviewed afterwards.

The organization configures an incident management process, records every reported incident in a register, and tracks each one through investigation to closure.

The organization scans its production systems for vulnerabilities and fixes findings within deadlines based on severity, by default 7 days for critical, 30 for high, 60 for medium and 90 for low.

The organization tracks vulnerability findings from all sources in a central place and resolves each one within the deadline set for its severity.

The organization has a penetration test of its systems performed at least every 12 months and resolves the reported findings within the agreed deadlines.

The organization documents and approves a vulnerability management procedure that sets how systems are scanned, how findings are prioritized and the remediation deadline for each severity.