Agenda packet — Finance Committee, April 29, 2024 (part 3 of 8)

IN NO EVENT WILL THE CONTRACTOR’S LIABILITY FOR ANY DAMAGES TO THE STATE EVER EXCEED __________________________________. LIMITS OF

LIABILITY FOR STATE CLAIMS WHICH MAY BE AGREED BY THE STATE SHALL NOT APPLY TO STATE CLAIMS ARISING OUT OF: (A) CONTRACTOR’S OBLIGATION TO INDEMNIFY THE STATE; (B) CONTRACTOR’S
CONFIDENTIALITY OBLIGATIONS TO THE STATE; (C) PERSONAL INJURY OR DAMAGE TO REAL OR PERSONAL PROPERTY; (D) CONTRACTOR’S GROSS NEGLIGENCE, FRAUD OR INTENTIONAL MISCONDUCT; OR (E) VIOLATIONS OF THE STATE OF VERMONT FRAUDULENT CLAIMS ACT. IN NO EVENT SHALL CONTRACTOR’S LIABILITY BE LIMITED FOR THIRD PARTY CLAIMS AGAINST THE CONTRACTOR WHICH MAY ARISE OUT OF CONTRACTOR’S ACTS OR OMISSIONS IN THE PERFORMANCE OF THIS CONTRACT.

NEITHER PARTY SHALL BE LIABLE TO THE OTHER FOR ANY INDIRECT,

INCIDENTAL OR SPECIAL DAMAGES, DAMAGES WHICH ARE

UNFORESEEABLE TO THE PARTIES AT THE TIME OF CONTRACTING,

DAMAGES WHICH ARE NOT PROXIMATELY CAUSED BY A PARTY, SUCH AS

LOSS OF ANTICIPATED BUSINESS, OR LOST PROFITS, INCOME, GOODWILL,

OR REVENUE IN CONNECTION WITH OR ARISING OUT OF THE SUBJECT MATTER OF THIS CONTRACT.

The provisions of this Section shall apply notwithstanding any other provisions of this Contract or any other agreement, and shall survive the expiration or termination of this Contract.
9 SOVEREIGN IMMUNITY
The Contractor acknowledges that the State reserves all immunities, defenses, rights or actions arising out of the State’s sovereign status or under the Eleventh Amendment to the United States Constitution. No waiver of any such immunities, defenses, rights or actions shall be implied or otherwise deemed to exist by reason of the State’s entry into this Contract.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 271
#2..
- 315 -
10 DISPUTE RESOLUTION

10.1 Governing Law; Jurisdiction. The Contractor agrees that this Contract, including any Contractor Document, shall be governed by and construed in accordance with the laws of the State of Vermont and that any action or proceeding brought by either the State or the Contractor in connection with this Contract shall be brought and enforced in the Superior Court of the State of Vermont, Civil Division, Washington Unit. The Contractor irrevocably submits to the jurisdiction of such court in respect of any such action or proceeding. The State shall not be liable for attorneys’ fees in any proceeding.

10.2 Contractor Default. The Contractor shall be in default under this Contract if Contractor commits any material breach of any covenant, warranty, obligation or certification under this Contract, fails to perform the Services in conformance with the specifications and warranties provided in this Contract, or clearly manifests an intent not to perform future obligations under this Contract, and such breach or default is not cured, or such manifestation of an intent not to perform is not corrected by reasonable written assurances of performance within thirty (30) days after delivery of the State’s notice period, or such longer period as the State may specify in such notice.

10.3 State Default. State shall be in default under this Contract if State commits any material breach or default of any covenant, warranty, or obligation under this Contract and State fails to cure such failure within thirty (30) business days after delivery of Contractor’s notice or such longer period as Contractor may specify in such notice.

10.4 Trial by Jury. The Contractor acknowledges and agrees that public policy prohibits the State from agreeing to arbitration and/or from waiving any right to a trial by jury. Therefore, Contractor further acknowledges and agrees that, to the extent a Contractor Document expressly provides for arbitration or waiver of the State’s right to a jury trial of the Contractor and/or other third parties by the State, such sections shall be waived and shall have no force and effect with respect to the State.

10.5 Trade Secret, Patent, and Copyright Infringement. The State shall not be deemed to waive any of its rights or remedies at law or in equity in the event of Contractor’s trade secret, patent and/or copyright infringement.

10.6 Limits on Actions Prohibited. The Contractor acknowledges and agrees that 12 V.S.A. § 465 renders null and void any contractual provision which limits the time in which an action may be brought under the contract, or waives the statute of limitations.

10.7 Continuity of Performance. In the event of a dispute between the Contractor and the State, each party will continue to perform its obligations under this Contract during the resolution of such dispute unless and until this Contract is terminated in accordance with its terms.
11 REMEDIES FOR DEFAULT
In the event either party is in default under this Contract, the non-defaulting party may, at its option, pursue any or all of the remedies available to it under this Contract, including termination for cause, and at law or in equity.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 272
#2..
- 316 -
12 TERMINATION

12.1 Termination Assistance. [ALTERNATIVE LANGUAGE AVAILABLE FOR SAAS] Upon nearing the end of the final term of this Contract, and without respect to either the cause or time of such termination, the Contractor shall take all reasonable and prudent measures to facilitate the transition to a successor provider, to the extent required by the State. The primary activities in this turnover are focused on transition planning to ensure operational readiness for the State and/or successor provider. This includes both a knowledge transfer period, and the turnover of the solution and supporting services to the State and/or successor provider. The State shall sign-off on each defined transition milestone to ensure that all transition Deliverables (set forth below), and exit criteria are fully executed based on agreed upon Contract terms.

Upon the sooner of a date specified in a notice of termination from either party, or within 90 days of Contract expiration, the Contractor shall:

Deliverable 1 - Develop a System Turnover Plan at no additional cost to the State.

The Solution Turnover Plan shall include, at minimum:
• Proposed approach to Turnover.
• Tasks and subtasks for Turnover.
• Schedule for Turnover.
• Entrance and exit criteria.
• Readiness walkthrough process.
• Documentation update procedures during Turnover.
• Description of Contractor coordination activities that will occur during the Turnover Phase that will be implemented to ensure continued functionality of the Solution and services as deemed appropriate by the State.

Deliverable 2 - Develop a Solution Requirements Statement at no additional cost that would be required by the State and/or successor provider to fully take over the Solution, technical, and business functions outlined in the Contract. The Statement shall also include an estimate of the number, type, and salary of personnel required to perform the other functions of the project work, implemented solution, and all supporting services. The Statement shall be separated by type of activity of the personnel. The Statement shall include all facilities and any other resources required to operate the Solution, including, but not limited to:
• Telecommunications networks.
• Office space.
• Hardware.
• Software.
• Other technology.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 273
#2..
- 317 -
The Statement shall be based on the Contractor’s experience in the operation of the Solution and shall include actual Contractor resources devoted to operations activities.

Deliverable 3 - Develop and submit a Transition Plan including, at minimum:
• Proposed approach to transition.
• Proposed approach for conducting a knowledge transfer from the Contractor to the State or successor provider.
• Proposed approach for consolidating applicable sections from the Contractor’s Turnover Plan into the transition planning activity.
• Tasks and activities for transition.
• Personnel and level of effort in hours.
• Completion date.
• Transition Milestones.
• Entrance and exit criteria.
• Schedule for transition.
• Production program and documentation update procedures during transition. • Readiness walkthrough.
• Parallel test procedures.
• Provider training.
• Interface testing.

The Contractor shall execute the Transition Plan and activities at no additional cost.

The Contactor agrees, after receipt of a notice of termination, and except as otherwise directed by the State, the Contactor shall:

1. Stop work under the Contract on the date, and to the extent, specified in the notice;

2. Immediately deliver to the State all State Data and historical project records in a form acceptable to the State, and copies of all subcontracts and all third party contracts executed in connection with the performance of the Services;

3. Place no further orders or subcontracts for Services, except as may be necessary for completion of such portion of the work under the Contract that is not terminated as specified in writing by the State;

4. Assign, to the extent applicable or as the State may require, all subcontracts and all third party contracts executed in connection with the performance of the Services to the State or a successor provider, as the State may require; State of Utah Bid CH16012
3/22/2016 4:23 PM p. 274
#2..
- 318 -

5. Perform, as the State may require, such knowledge transfer and other services as are required to allow the Services to continue without interruption or adverse effect and to facilitate orderly migration and transfer of the services to the successor provider;

6. Complete performance of such part of the work as shall not have been terminated; and

7. Take such action as may be necessary, or as the State may direct, for the protection and preservation of the property related to this Contract which is in the possession of the Contractor and in which the State has or may acquire an interest and to transfer that property to the State or a successor provider.

Contractor acknowledges that, if it were to breach, or threaten to breach, its obligation to provide the State with the foregoing assistance, the State would be immediately and irreparably harmed and monetary compensation would not be measurable or adequate. In such circumstances, the State shall be entitled to obtain such injunctive, declaratory or other equitable relief as the State deems necessary to prevent such breach or threatened breach, without the requirement of posting any bond and Contractor waives any right it may have to allege or plead or prove that the State is not entitled to injunctive, declaratory or other equitable relief. If the court should find that Contractor has breached (or attempted or threatened to breach) any such obligations, Contractor agrees that without any additional findings of irreparable injury or other conditions to injunctive or any equitable relief, Contractor will not oppose the entry of an order compelling its performance and restraining Contractor from any further breaches (or attempted or threatened breaches).

12.3 Contractor Bankruptcy. Contractor acknowledges that if Contractor, as a debtor in possession, or a trustee in bankruptcy in a case under Section 365(n) of Title 11, United States Code (the "Bankruptcy Code"), rejects this Contract, the State may elect to retain its rights under this Contract as provided in Section 365(n) of the Bankruptcy Code. Upon written request of the State to Contractor or the Bankruptcy Trustee, Contractor or such Bankruptcy Trustee shall not interfere with the rights of the State as provided in this Contract, including the right to obtain the State Intellectual Property.
13 ACCESS TO STATE DATA; RETURN OF PROPERTY

13.1 Access to State Data. Within ten (10) business days of a request by State, the Contractor will make available to State a complete and secure (i.e. encrypted and appropriately authenticated) download file of State Intellectual Property and State Data in a format acceptable to State including all schema and transformation definitions and/or delimited text files with documented, detailed schema definitions along with attachments in their native format. Provided, however, in the event the Contractor ceases conducting business in the normal course, becomes insolvent, makes a general assignment for the benefit of creditors, suffers or permits the appointment of a receiver for its business or State of Utah Bid CH16012
3/22/2016 4:23 PM p. 275
#2..
- 319 -
assets or avails itself of or becomes subject to any proceeding under the Federal Bankruptcy Act or any statute of any state relating to insolvency or the protection of rights of creditors, the Contractor shall immediately return all State Intellectual Property and State Data to State control; including, but not limited to, making all necessary access to applicable remote systems available to the State for purposes of downloading all State Data.

13.2 Return of Property. Upon termination of this Contract for any reason whatsoever, Contractor shall immediately deliver to State all State Intellectual Property and State Data (including without limitation any Deliverables for which State has made payment in whole or in part), that are in the possession or under the control of Contractor in whatever stage of development and form of recordation such State property is expressed or embodied at that time.

The Contractor’s policies regarding the retrieval of data upon the termination of services have been made available to the State upon execution of this Contract under separate cover. The Contractor shall provide the State with not less than thirty (30) days advance written notice of any material amendment or modification of such policies. 14 STATE FACILITIES
During the term of this Contract, the State may make available to Contractor space in any State facility applicable to the Services, subject to the conditions that Contractor: (i) shall only use such space solely and exclusively for and in support of the Services; (ii) shall not use State facilities to provide goods or services to or for the benefit of any third party; (iii) shall comply with the leases, security, use and rules and agreements applicable to the State facilities; (iv) shall not use State facilities for any unlawful purpose; (v) shall comply with all policies and procedures governing access to and use of State facilities that are provided to Contractor in writing; (vi) instruct Contractor personnel not to photograph or record, duplicate, disclose, transmit or communicate any State information, materials, data or other items, tangible or intangible, obtained or available as a result of permitted use of State facilities; and (vii) return such space to the State in the same condition it was in at the commencement of this Contract, ordinary wear and tear excepted. State facilities will be made available to Contractor on an “AS IS, WHERE IS” basis, with no warranties whatsoever.
15 AUDIT

15.1 Audit Rights. Contractor will maintain and cause its permitted contractors to maintain a complete audit trail of all transactions and activities, financial and nonfinancial, in connection with this Contract. Contractor will provide to the State, its internal or external auditors, clients, inspectors, regulators and other designated representatives, at reasonable times (and in the case of State or federal regulators, at any time required by such regulators) access to Contractor personnel and to any and all Contractor facilities or where the required information, data and records are maintained, for the purpose of performing audits and inspections (including unannounced and random audits) of Contractor and/or Contractor personnel and/or any or all of the records, data and information applicable to this Contract. At a minimum, such audits, inspections and access shall be conducted to the extent permitted or required by any laws applicable to the State or Contractor (or such higher or more rigorous standards, if any, as State or Contractor applies to its own State of Utah Bid CH16012
3/22/2016 4:23 PM p. 276
#2..
- 320 -
similar businesses, operations or activities), to (i) verify the accuracy of charges and invoices; (ii) verify the integrity of State Data and examine the systems that process, store, maintain, support and transmit that data; (iii) examine and verify Contractor’s and/or its permitted contractors’ operations and security procedures and controls; (iv) examine and verify Contractor’s and/or its permitted contractors’ disaster recovery planning and testing, business resumption and continuity planning and testing, contingency arrangements and insurance coverage; and (v) examine Contractor’s and/or its permitted contractors’ performance of the Services including audits of: (1) practices and procedures; (2) systems, communications and information technology; (3) general controls and physical and data/information security practices and procedures; (4) quality initiatives and quality assurance, (5) contingency and continuity planning, disaster recovery and back-up procedures for processes, resources and data; (6) Contractor’s and/or its permitted contractors’ efficiency and costs in performing Services; (7) compliance with the terms of this Contract and applicable laws, and (9) any other matters reasonably requested by the State.

Contractor shall provide and cause its permitted contractors to provide full cooperation to such auditors, inspectors, regulators and representatives in connection with audit functions and with regard to examinations by regulatory authorities, including the installation and operation of audit software.

15.2 Software Licensee Compliance Report. In lieu of any requirement that may be in a Contractor Document that the State provide the Contractor with access to its system for the purpose of determining State compliance with the terms of the Contractor Document, upon request and not more frequently than annually, the State will provide Contractor with a certified report concerning the State’s use of any software licensed for State use pursuant this Contract. The parties agree that any noncompliance indicated by the report shall not constitute infringement of the licensor’s intellectual property rights, and that settlement payment mutually agreeable to the parties shall be the exclusive remedy for any such non-compliance.

15.3 Operations Security. The Contractor shall cause an SSAE 16 SOC 2 Type 2 audit report to be conducted annually. The audit results and the Contractor’s plan for addressing or resolution of the audit results shall be shared with the State within sixty (60) days of the Contractor's receipt of the audit results. Further, on an annual basis, within 90 days of the end of the Contractor’s fiscal year, the Contractor shall transmit its annual audited financial statements to the State.
16 CONFLICTS OF INTEREST
Contractor agrees that during the term of this Contract, its performance shall be solely in the best interest of the State. Contractor will not perform services for any person or entity which has also contracted with the State of Vermont in connection with the same project, without express written consent of the State. Contractor shall fully disclose, in writing, any such conflicts of interest, including the nature and extent of the work to be performed for any other person or entity so that the State may be fully informed prior to giving any consent. Contractor agrees that the failure to disclose any such conflicts shall be deemed State of Utah Bid CH16012
3/22/2016 4:23 PM p. 277
#2..
- 321 -
an event of default under this Contract, and this Contract shall be terminable immediately.
17 MISCELLANEOUS

17.1 Taxes. Most State purchases are not subject to federal or state sales or excise taxes and must be invoiced tax free. An exemption certificate will be furnished upon request covering taxable items. The Contractor agrees to pay all Vermont taxes which may be due as a result of this Contract.

17.2 Force Majeure. Neither the State nor the Contractor shall be liable to the other for any failure or delay of performance of any obligations hereunder to the extent such failure or delay shall have been wholly or principally caused by acts or events beyond its reasonable control making it illegal or impossible to perform their obligations under this Contract, including without limitation, acts of God, acts of civil or military authority, fires, floods, earthquakes or other natural disasters, war or riots.

If a party asserts Force Majeure as an excuse for failure to perform the party’s obligation, then the nonperforming party must prove that it made all reasonable efforts to remove, eliminate or minimize such cause of delay or damages, diligently pursued performance of its obligations under this Contract, substantially fulfilled all non-excused obligations, and timely notified the other party of the likelihood or actual occurrence of an event described in this paragraph.

17.3 Marketing. Neither party to this Contract shall refer to the other party in any publicity materials, information pamphlets, press releases, research reports, advertising, sales promotions, trade shows, or marketing materials or similar communications to third parties except with the prior written consent of such party prior to release.
18 IRS TERMS IF FEDERAL TAX INFO WILL BE PROCESSED OR STORED (Per IRS Publication 1075)
In addition to any other security standard or requirements set forth in this Contract, the Contractor agrees as follows:

A. PERFORMANCE
In performance of this Contract, the Contractor agrees to comply with and assume responsibility for compliance by its employees with the following requirements:

1. All work will be done under the supervision of the Contractor or the Contractor's employees.

2. Any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material will be treated as confidential and will not be divulged or made known in any manner to any person except as may be necessary in the performance of this Contract.

Disclosure to anyone other than an officer or employee of the Contractor will be prohibited.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 278
#2..
- 322 -

3. All returns and return information will be accounted for upon receipt and properly stored before, during, and after processing. In addition, all related output will be given the same level of protection as required for the source material.

4. The Contractor certifies that the data processed during the performance of this Contract will be completely purged from all data storage components of his or her computer facility, and no output will be retained by the Contractor at the time the work is completed. If immediate purging of all data storage components is not possible, the Contractor certifies that any IRS data remaining in any storage component will be safeguarded to prevent unauthorized disclosures.

5. Any spoilage or any intermediate hard copy printout that may result during the processing of IRS data will be given to the State or his or her designee. When this is not possible, the Contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts, and will provide the State or its designee with a statement containing the date of destruction, description of material destroyed, and the method used.

6. All computer systems processing, storing, or transmitting Federal tax information must meet the requirements defined in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to Federal tax information.

7. No work involving Federal tax information furnished under this Contract will be subcontracted without prior written approval of the IRS.

8. The Contractor will maintain a list of employees authorized access. Such list will be provided to the State and, upon request, to the IRS reviewing office.

9. The State will have the right to void the Contract if the Contractor fails to provide the safeguards described above.

B. CRIMINAL/CIVIL SANCTIONS:

1. Each officer or employee of any person to whom returns or return information is or may be disclosed will be notified in writing by such person that returns or return information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such returns or return information for a purpose or to an extent unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized further disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount not less than $1,000 with respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1.

2. Each officer or employee of any person to whom returns or return information is or may be disclosed shall be notified in writing by such person that any return or return information made available in any format shall be used only for the purpose of carrying out the provisions of this Contract. Information contained in such material shall be treated as confidential and State of Utah Bid CH16012
3/22/2016 4:23 PM p. 279
#2..
- 323 -
shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the Contract. Inspection by or disclosure to anyone without an official need to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also notify each such officer and employee that any such unauthorized inspection or disclosure of returns or return information may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection or disclosure with respect to which such defendant is found liable or the sum of the actual damages sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the action. These penalties are prescribed by IRC section 7213A and 7431.

3. Additionally, it is incumbent upon the Contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a.

Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to State records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

C. INSPECTION:

The IRS and the State shall have the right to send its officers and employees into the offices and plants of the Contractor for inspection of the facilities and operations provided for the performance of any work under this Contract. On the basis of such inspection, specific measures may be required in cases where the Contractor is found to be noncompliant with Contract safeguards.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 280
#2..
- 324 -
AICPA
TSC 2009
AICPA
Trust Service Criteria (SOC 2SM Report)
AICPA
TSC
2014
BITS Shared
Assessments
AUP v5.0
BITS Shared
Assessments
SIG v6.0
BSI
Germany Canada PIPEDA CCM V1.X COBIT 4.1 COBIT 5.0 COPPA CSA
Guidance
V3.0

ENISA IAF
95/46/EC - European
Union Data Protection
Directive
FedRAMP Security
Controls
(Final Release, Jan
2012)
--LOW IMPACT LEVEL--
FedRAMP Security Controls
(Final Release, Jan 2012)
--MODERATE IMPACT LEVEL--
FERPA
GAPP
(Aug
2009)

HIPAA/HITECH
(Omnibus
Rule)

ISO/IEC
27001:2005

ISO/IEC
27001:2013 ITAR Jericho Forum
Mexico - Federal Law on
Protection of Personal
Data Held by Private
Parties
NERC
CIP NIST SP800-53 R3 NIST SP800-53 R4 Appendix J NZISM PCI DSS v2.0 PCI DSS v3.0 Yes No Not
Applicable
Domain >
Container >
Capability
Public Private PA ID PA level
AIS-01.1 Do you use industry standards (Build Security in Maturity Model [BSIMM] benchmarks, Open Group ACS Trusted Technology
Provider Framework, NIST, etc.) to build in security for your Systems/Software Development Lifecycle (SDLC)?
AIS-01.2 Do you use an automated source code analysis tool to detect security defects in code prior to production?
AIS-01.3 Do you use manual source-code analysis to detect security defects in code prior to production?
AIS-01.4 Do you verify that all of your software suppliers adhere to industry standards for Systems/Software Development Lifecycle (SDLC) security?
AIS-01.5 (SaaS only) Do you review your applications for security vulnerabilities and address any issues prior to deployment to production?
AIS-02.1 Are all identified security, contractual and regulatory requirements for customer access contractually addressed and remediated prior to granting customers access to data, assets and information systems? AIS- 02.2 Are all requirements and trust levels for customers’ access defined and documented?
Application & Interface
Security
Data Integrity
AIS-03 AIS-03.1 Data input and output integrity routines (i.e., reconciliation and edit checks) shall be implemented for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse.

Are data input and output integrity routines (i.e., reconciliation and edit checks) implemented for application interfaces and databases to prevent manual or systematic processing errors or corruption of data?
S3.4 (I3.2.0) The procedures related to completeness,
accuracy, timeliness, and authorization of inputs
are consistent with the documented system
processing integrity policies.
(I3.3.0) The procedures related to completeness,
accuracy, timeliness, and authorization of system
processing, including error correction and database
management, are consistent with documented
system processing integrity policies.
(I3.4.0) The procedures related to completeness,
accuracy, timeliness, and authorization of outputs
are consistent with the documented system
processing integrity policies.
(I3.5.0) There are procedures to enable tracing of
information inputs from their source to their final
disposition and vice versa.

PI1.2
PI1.3
PI1.5
I.4 G.16.3, I.3 Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-05 DSS06.02
DSS06.04
312.8 and 312.10 Application
Services >
Programming
Interfaces > Input
Validation
shared x Domain 10 NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SI-6
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)
NIST SP 800-53 R3 SI-9
NIST SP 800-53 R3 SI-10
NIST SP 800-53 R3 SI-11

1.2.6 45 CFR 164.312
(c)(1) (New)
45 CFR 164.312
(c)(2)(New)
45 CFR
164.312(e)(2)(i)(
New)
A.10.9.2
A.10.9.3
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.6.1
A.15.2.1
A13.2.1,
A13.2.2,
A9.1.1,
A9.4.1,
A10.1.1
A18.1.4
Commandment #1
Commandment #9
Commandment
#11
CIP-003-3 -
R4.2
SI-10
SI-11
SI-2
SI-3
SI-4
SI-6
SI-7
SI-9
AR-7 The organization
designs information
systems to support
privacy by automating
privacy controls.

14.5 14.6
PA25 GP PCI DSS v2.0

6.3.1 PCI DSS v2.0

6.3.2 6.3.1

6.3.2 Application & Interface
Security
Data Security / Integrity
AIS-04 AIS-04.1 Policies and procedures shall be established and maintained in support of data security to include (confidentiality, integrity and availability) across multiple system interfaces, jurisdictions and business functions to prevent improper disclosure, alternation, or destruction.

Is your Data Security Architecture designed using an industry standard (e.g., CDSA, MULITSAFE, CSA Trusted Cloud Architectural Standard, FedRAMP, CAESARS)?
(S3.4) Procedures exist to protect against
unauthorized access to system resources.

CC5.6 B.1 G.8.2.0.2,
G.8.2.0.3,
G.12.1, G.12.4,
G.12.9,
G.12.10,
G.16.2,
G.19.2.1,
G.19.3.2,
G.9.4, G.17.2,
G.17.3, G.17.4,
G.20.1
6 (B)
26 (A+)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-03 COBIT 4.1 DS5.11 APO09.01
APO09.02
APO09.03
APO13.01
DSS05.02
DSS06.06
MEA03.01
MEA03.02
312.8 and 312.10 BOSS > Data
Governance >
Rules for
Information
Leakage
Prevention
shared x Domain 10 6.02. (b)

6.04.03. (a)
Article 17 (1), (2),(3), (4) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-4
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-8

1.1.0 1.2.2

1.2.6 4.2.3

5.2.1 7.1.2

7.2.1 7.2.2

7.2.3 7.2.4

8.2.1 8.2.2

8.2.3 8.2.5

9.2.1 A.10.8.1
A.10.8.2
A.11.1.1
A.11.6.1
A.11.4.6
A.12.3.1
A.12.5.4
A.15.1.4
A13.2.1,
A13.2.2,
A9.1.1,
A9.4.1,
A10.1.1
A18.1.4
All AC-1
AC-4
SC-1
SC-16
AR-7 The organization
designs information
systems to support
privacy by automating
privacy controls.

16.5 16.8

17.4 PA20
PA25
PA29
GP
P
SGP
PCI DSS v2.0

2.3 PCI DSS v2.0

3.4.1,
PCI DSS v2.0

4.1 PCI DSS v2.0

4.1.1 PCI DSS v2.0

6.1 PCI DSS v2.0

6.3.2a
PCI DSS v2.0

6.5c
PCI DSS v2.0

8.3 PCI DSS v2.0

10.5.5 PCI DSS v2.0

11.5 2.3

3.4.1 4.1

4.1.1 6.1

6.3.2a

6.5c, 7.1, 7.2, 7.3,

8.1, 8.2, 8.3, 8.4,

8.5, 8.6, 8.7, 8.8

10.5.5, 10.8

11.5, 11.6
Audit Assurance &
Compliance
Audit Planning
AAC01AAC-01.1 Audit plans shall be developed and maintained to address business process disruptions. Auditing plans shall focus on reviewing the effectiveness of the implementation of security operations. All audit activities must be agreed upon prior to executing any audits.

Do you produce audit assertions using a structured, industry accepted format (e.g., CloudAudit/A6 URI Ontology, CloudTrust, SCAP/CYBEX, GRC XML, ISACA's Cloud Computing Management Audit/Assurance Program, etc.)?
S4.1.0
S4.2.0
(S4.1.0) The entity’s system security is periodically
reviewed and compared with the defined system
security policies.
(S4.2.0) There is a process to identify and address
potential impairments to the entity’s ongoing
ability to achieve its objectives in accordance with
its defined system security policies.

CC4.1 L.1, L.2, L.7,
L.9, L.11
58 (B) CO-01 COBIT 4.1 ME

2.1, ME 2.2 PO

9.5 PO 9.6
APO12.04
APO12.05
APO12.06
MEA02.01
MEA02.02
Title 16 Part 312 BOSS >
Compliance >
Audit Planning
shared x Domain 2,
4 6.01. (d) NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2
(1)
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)
NIST SP 800-53 R3 PL-6

10.2.5 45 CFR
164.312(b)
Clause 4.2.3 e)
Clause 4.2.3b
Clause 5.1 g
Clause 6
A.15.3.1
Clauses

4.3(a),

4.3(b),

5.1(e),

5.1(f),

6.2(e),

9.1,

9.1(e),

9.2,

9.3(f),
Commandment #1
Commandment #2
Commandment #3
CA-2
CA-7
PL-6
AR-4 Privacy Auditing and
Monitoring. To promote
accountability,
organizations identify and
address gaps in privacy
compliance,
management,
operational, and technical
controls by conducting
regular assessments

5.1, 5.3, 5.4 PA15 SGP PCI DSS v2.0

2.1.2.b
AAC-02.1 Do you allow tenants to view your SOC2/ISO 27001 or similar thirdparty audit or certification reports? AAC-02.2 Do you conduct network penetration tests of your cloud service infrastructure regularly as prescribed by industry best practices and guidance?
AAC-02.3 Do you conduct application penetration tests of your cloud infrastructure regularly as prescribed by industry best practices and guidance?
AAC-02.4 Do you conduct internal audits regularly as prescribed by industry best practices and guidance?
AAC-02.5 Do you conduct external audits regularly as prescribed by industry best practices and guidance?
AAC-02.6 Are the results of the penetration tests available to tenants at their request?
AAC-02.7 Are the results of internal and external audits available to tenants at their request?
AAC-02.8 Do you have an internal audit program that allows for crossfunctional audit of assessments? AAC-03.1 Do you have the ability to logically segment or encrypt customer data such that data may be produced for a single tenant only, without inadvertently accessing another tenant's data?
AAC-03.2 Do you have capability to recover data for a specific customer in the case of a failure or data loss?
AAC-03.3 Do you have the capability to restrict the storage of customer data to specific countries or geographic locations?
AAC-03.4 Do you have a program in place that includes the ability to monitor changes to the regulatory requirements in relevant jurisdictions, adjust your security program for changes to legal requirements, and ensure compliance with relevant regulatory requirements? BCR-01.1 Do you provide tenants with geographically resilient hosting options? BCR-01.2 Do you provide tenants with infrastructure service failover capability to other providers?
Business Continuity
Management &
Operational Resilience
Business Continuity
Testing
BCR-02 BCR-02.1 Business continuity and security incident response plans shall be subject to testing at planned intervals or upon significant organizational or environmental changes. Incident response plans shall involve impacted customers (tenant) and other business relationships that represent critical intra-supply chain business process dependencies.

Are business continuity plans subject to test at planned intervals or upon significant organizational or environmental changes to ensure continuing effectiveness?
A3.3 (A3.3) Procedures exist to provide for backup,
offsite storage, restoration, and disaster recovery
consistent with the entity’s defined system
availability and related security policies.

A1.2 K.1.3, K.1.4.3,
K.1.4.6,
K.1.4.7,
K.1.4.8,
K.1.4.9,
K.1.4.10,
K.1.4.11,
K.1.4.12
52 (B)
55 (A+)
RS-04 DSS04.04 BOSS >
Operational Risk
Management >
Business
Continuity
provider x Domain 7,
8 6.07.01. (b)

6.07.01. (j)

4.4 5.2(time limit)

6.3(whenever change
occurs)
PA15 SGP PCI DSS v2.0

12.9.2 12.9.2, 12.10.2
BCR-03.1 Do you provide tenants with documentation showing the transport route of their data between your systems?
BCR-03.2 Can tenants define how their data is transported and through which legal jurisdictions?
Business Continuity
Management &
Operational Resilience
Documentation
BCR-04 BCR-04.1 Information system documentation (e.g., administrator and user guides, and architecture diagrams) shall be made available to authorized personnel to ensure the following:
• Configuring, installing, and operating the information system • Effectively using the system’s security features
Are information system documents (e.g., administrator and user guides, architecture diagrams, etc.) made available to authorized personnel to ensure configuration, installation and operation of the information system?
S3.11.0
A.2.1.0
(S3.11.0) Procedures exist to provide that
personnel responsible for the design,
development, implementation, and operation of
systems affecting security have the qualifications
and resources to fulfill their responsibilities.
(A.2.1.0) The entity has prepared an objective
description of the system and its boundaries and
communicated such description to authorized
users.

CC1.3
CC1.4
CC2.1
G.1.1 56 (B)
57 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
OP-02 COBIT 4.1 DS 9,
DS 13.1
BAI08
BAI10
DSS01.01
312.8 and 312.10 SRM > Policies
and Standards >
Job Aid Guidelines
shared x Domain 7,
8 Article 17 NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-10
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-9 (1)
NIST SP 800-53 R3 CP-9 (3)
NIST SP 800-53 R3 CP-10
NIST SP 800-53 R3 CP-10 (2)
NIST SP 800-53 R3 CP-10 (3)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)

1.2.6 Clause 4.3.3
A.10.7.4
Clause 9.2(g) Commandment #1
Commandment #2
Commandment #4
Commandment #5
Commandment
#11
CIP-005-
3a - R1.3
CIP-007-3 -
R9
CP-9
CP-10
SA-5
SA-10
SA-11

10.5 13.5

17.1 PCI DSS v2.0

12.1 PCI DSS v2.0

12.2 PCI DSS v2.0

12.3 PCI DSS v2.0

12.4 1.1.2, 1.1.3, 2.2,

12.3 12.6
Business Continuity
Management &
Operational Resilience
Environmental Risks
BCR-05 BCR-05.1 Physical protection against damage from natural causes and disasters, as well as deliberate attacks, including fire, flood, atmospheric electrical discharge, solar induced geomagnetic storm, wind, earthquake, tsunami, explosion, nuclear accident, volcanic activity, biological hazard, civil unrest, mudslide, tectonic activity, and other forms of natural or man-made disaster shall be anticipated, designed, and have countermeasures applied.

Is physical protection against damage (e.g., natural causes, natural disasters, deliberate attacks) anticipated and designed with countermeasures applied?
A3.1.0
A3.2.0
(A3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system availability commitments
and (2) assess the risks associated with the
identified threats.
(A3.2.0) Measures to prevent or mitigate threats
have been implemented consistent with the risk
assessment when commercially practicable.

CC3.1
A1.1
A1.2
F.1 F.2.9,
F.1.2.21,
F.5.1, F.1.5.2,
F.2.1, F.2.7,
F.2.8
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RS-05 DSS01.03
DSS01.04
DSS01.05
Infra Services >
Facility Security >
Environmental
Risk
Management
provider x Domain 7,
8 6.07. (d)

6.08. (a)

6.09. (a)

6.09. (b)

6.09. (d)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-18

8.2.4 45 CFR 164.308
(a)(7)(i)
45 CFR
164.310(a)(2)(ii)
(New)
A.9.1.4
A.9.2.1
A11.1.4,
A11.2.1
Commandment #1
Commandment #2
Commandment #3
CIP-004-3
R3.2
PE-1
PE-13
PE-14
PE-15
PE-18

8.1 8.4
PA15 SGP 3.5.2, 3.6.3, 3.7,

5.1, 5.2, 5.3,

6.1, 6.2,

7.1, 7.2,

9.1, 9.2, 9.3, 9.4,

9.5, 9.6,

9.7, 9.8, 9.9,

12.2 Business Continuity
Management &
Operational Resilience
Equipment Location
BCR-06 BCR-06.1 To reduce the risks from environmental threats, hazards, and opportunities for unauthorized access, equipment shall be kept away from locations subject to high probability environmental risks and supplemented by redundant equipment located at a reasonable distance.

Are any of your data centers located in places that have a high probability/occurrence of high-impact environmental risks (floods, tornadoes, earthquakes, hurricanes, etc.)?
A3.1.0
A3.2.0
(A3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system availability commitments
and (2) assess the risks associated with the
identified threats.
(A3.2.0) Measures to prevent or mitigate threats
have been implemented consistent with the risk
assessment when commercially practicable.

CC3.1
A1.1
A1.2
F.1 F.2.9,
F.1.2.21,
F.5.1, F.1.5.2,
F.2.1, F.2.7,
F.2.8
53 (A+)
75 (C+,
A+)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RS-06 DSS01.04
DSS01.05
312.8 and 312.10 Infra Services >
Facility Security >
Environmental
Risk
Management
provider x Domain 7,
8 6.07. (d)

6.08. (a)

6.09. (a)

6.09. (b)

8.1 PA15 SGP PCI DSS v2.0

9.1.3 PCI DSS v2.0

9.5 PCI DSS v2.0

9.6 PCI DSS v2.0

9.9 PCI DSS v2.0

9.9.1 9.1.3

9.5 9.6

9.9 9.9.1, 12.2
BCR-07.1 If using virtual infrastructure, does your cloud solution include independent hardware restore and recovery capabilities? BCR-07.2 If using virtual infrastructure, do you provide tenants with a capability to restore a Virtual Machine to a previous state in time? BCR-07.3 If using virtual infrastructure, do you allow virtual machine images to be downloaded and ported to a new cloud provider?
BCR-07.4 If using virtual infrastructure, are machine images made available to the customer in a way that would allow the customer to replicate those images in their own off-site storage location?
BCR-07.5 Does your cloud solution include software/provider independent restore and recovery capabilities?
Business Continuity
Management &
Operational Resilience
Equipment Power
Failures
BCR-08 BCR-08.1 Protection measures shall be put into place to react to natural and man-made threats based upon a geographically-specific Business Impact Assessment
Are security mechanisms and redundancies implemented to protect equipment from utility service outages (e.g., power failures, network disruptions, etc.)?
A3.2.0 (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk
assessment when commercially practicable.

A1.1
A1.2
F.1 F.1.6, F.1.6.1,
F.1.6.2,
F.1.9.2,
F.2.10, F.2.11,
F.2.12
54 (A+) Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RS-07 DSS01.04
DSS01.05
DSS04.01
DSS04.02
DSS04.03
312.8 and 312.10 Infra Services >
Facility Security >
Environmental
Risk
Management
provider x Domain 7,
8 6.08. (a)

6.09. (e)

8.1 8.2

8.3 8.4
PA15 SGP
BCR-09.1 Do you provide tenants with ongoing visibility and reporting of your operational Service Level Agreement (SLA) performance?
BCR-09.2 Do you make standards-based information security metrics (CSA, CAMM, etc.) available to your tenants?
BCR-09.3 Do you provide customers with ongoing visibility and reporting of your SLA performance?
Business Continuity
Management &
Operational Resilience
Policy
BCR-10 BCR-10.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for appropriate IT governance and service management to ensure appropriate planning, delivery and support of the organization's IT capabilities supporting business functions, workforce, and/or customers based on industry acceptable standards (i.e., ITIL v4 and COBIT 5). Additionally, policies and procedures shall include defined roles and responsibilities supported by regular workforce training.

Are policies and procedures established and made available for all personnel to adequately support services operations’ roles? S2.3.0 (S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality of data,
processing integrity, system security and related
security policies and changes and updates to those
policies are communicated to entity personnel
responsible for implementing them.

CC3.2 G.1.1 45 (B) OP-01 COBIT 4.1 DS13.1 APO01
APO07.01
APO07.03
APO09.03
DSS01.01
SRM > Policies
and Standards >
Operational
Security Baselines
shared x Domain 7,
8 6.03. (c) NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-4 (1)
NIST SP 800-53 R3 MA-4 (2)
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)
NIST SP 800-53 R3 SA-12

8.2.1 Clause 5.1
A 8.1.1
A.8.2.1
A 8.2.2
A.10.1.1
Clause 5.1(h)
A.6.1.1
A.7.2.1
A.7.2.2
A.12.1.1
Commandment #1
Commandment #2
Commandment #3
Commandment #6
Commandment #7
CM-2
CM-3
CM-4
CM-5
CM-6
CM-9
MA-4
SA-3
SA-4
SA-5
SA-8
SA-10
SA-11
SA-12
PCI DSS v2.0

12.1 PCI DSS v2.0

12.2 PCI DSS v2.0

12.3 PCI DSS v2.0

12.4 4.3, 10.8,

11.1.2,

12.1 12.2

12.3 12.4

12.5, 12.5.3,

12.6, 12.6.2,

12.10 BCR-11.1 Do you have technical control capabilities to enforce tenant data retention policies?
BCR-11.2 Do you have a documented procedure for responding to requests for tenant data from governments or third parties?
BCR-11.4 Have you implemented backup or redundancy mechanisms to ensure compliance with regulatory, statutory, contractual or business requirements?
BCR-11.5 Do you test your backup or redundancy mechanisms at least annually?
CCC-01.1 Are policies and procedures established for management authorization for development or acquisition of new applications, systems, databases, infrastructure, services, operations and facilities?
CCC-01.2 Is documentation available that describes the installation, configuration and use of products/services/features?
CCC-02.1 Do you have controls in place to ensure that standards of quality are being met for all software development?
CCC-02.2 Do you have controls in place to detect source code security defects for any outsourced software development activities?
Consensus Assessment Answers Notes

4.1.1, 4.2, 4.3

11.2 11.3

6.3.2, 6.6

11.2.1, 11.2.2,

11.2.3, 11.3.1,

11.3.2, 12.1.2.b,

12.8.4 3.1

12.9.1 12.9.3

12.9.4 12.9.6

4.1, 4.1.1, 9.1, 9.2

10.8, 11.6

3.1 3.1.a

3.2 9.9.1

9.5. 9.5.1

9.6. 9.7, 9.8

10.7, 12.10.1

6.3.2, 12.3.4

2.1, 2.2.4, 2.3, 2.5

3.3, 3.4, 3.6

4.1, 4.2

6.3.1, 6.3.2, 6.4.2,

6.4.3, 6.4.4,

6.4.5.2 6.7

7.1, 7.1.3, 7.1.4

8.3, 8.5.1, 8.7

9.1 9.1.2

9.2 10.5

11.5 12.3

12.8 BSGP
SGP
PA17 SGP
ODCA UM: PA R2.0
PA17
PA31
SGP
BSGP
PA18 GP
PA15 SGP
PA8
PA15
BSGP
SGP
PA8
PA15

14.5 14.6

9.2 6.1

1.2 2.2

3.3 5.2

6.4 10.1

10.2 10.3

10.4 10.5

10.6 3.3

12.1 12.5

14.5 (software)

6.4 6.4

13.1 12.1

2.2 4.1
AR-7 The organization
designs information
systems to support
privacy by automating
privacy controls.

AP-1 The organization
determines and
documents the legal
authority that permits the
collection, use,
maintenance, and
sharing of personally
identifiable information
(PII), either generally or
in support of a specific
program or information
system need.

AR-4. Privacy Auditing
and Monitoring. These
assessments can be selfassessments or third
party audits that result in
reports on compliance
gaps identified in
programs, projects, and
information systems.

UL-2 INFORMATION

SHARING WITH THIRD
PARTIES - a. Shares
personally identifiable
information (PII)
externally, only for the
authorized purposes
identified in the Privacy
Act and/or described in its
notice(s) or for a purpose
that is compatible with
those purposes; b. Where
appropriate, enters into
Memoranda of
Understanding,
Memoranda of
Agreement, Letters of
Intent, Computer
Matching Agreements, or
similar agreements, with
third parties that
specifically describe the
PII covered and
specifically enumerate
the purposes for which
the PII may be used; c.

Monitors, audits, and
trains its staff on the
authorized sharing of PII
with third parties and on
the consequences of
unauthorized use or
sharing of PII; and d.

Evaluates any proposed
new instances of sharing
PII with third parties to
assess whether the
sharing is authorized and
whether additional or
new public notice is
required.

FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

Technical security
measures to prevent
unauthorized access
include encryption in the
transmission and storage
of data; limits on access
through use of
passwords; and the
storage of data on secure
servers or computers . -
http://www.ftc.gov/repo
rts/privacy3/fairinfo.sht
m
ITOS > IT
Operation >
Architecture
Governance
shared x
CSA Enterprise Architecture (formerly the Trusted
Cloud Initiative)
Application
Services >
Development
Process >
Software Quality
Assurance
shared x
BOSS > Legal
Services >
Contracts
shared x
BOSS >
Compliance >
Independent
Audits
shared x
BOSS >
Compliance >
Information
System
Regulatory
Mapping
shared x
BOSS >
Operational Risk
Management >
Business
Continuity
provider x
Infra Services >
Facility Security >
Environmental
Risk
Management
x
312.8 and 312.10
312.3, 312.8 and
312.10
Title 16 Part 312
312.4
312.8 and 312.10
312.3
APO09.03
APO13.01
BAI03.01
BAI03.02
BAI03.03
BAI03.05
MEA03.01
MEA03.02
APO09.01
APO09.02
APO09.03
APO13.01
BAI02
DSS05
APO12.04
APO12.05
DSS05.07
MEA02.06
MEA02.07
MEA02.08
MEA03.01
APO12.01
APO12.02
APO12.03
MEA03.01
DSS04.01
DSS04.02
DSS04.03
DSS04.05
DSS01.03
DSS01.04
DSS01.05
DSS04.03
BAI03.10
BAI04.03
BAI04.04
DSS03.05
BAI06.01
BAI10.01
BAI10.02
BAI10.03
DSS04.01
DSS04.02
BAI09.01
BAI09.02
BAI09.03
DSS04.01
DSS04.02
DSS04.03
DSS04.04
DSS04.07
MEA03.01
APO01.02
APO01.06
BAI02.04
BAI06.01
APO07.06
APO09.03
APO09.04
APO10.01
APO10.04
APO10.05
APO11.01
APO11.02
APO11.04
APO11.05
CC5.1
CC4.1
CC3.1
CC3.1
A1.2
A1.3
A1.1
A1.2
A1.3
A1.1
A1.2
CC4.1
CC3.1
A1.2
A1.3
A1.2
A1.3
I3.21
CC7.2
CC7.1
CC7.4
CC7.1
CC7.4
ITOS > IT
Operation >
Architecture
Governance
shared PCI DSS v2.0

6.3.2 Change Control &
Configuration
Management
Outsourced
Development
CCC-02 External business partners shall adhere to the same policies and procedures for change management, release, and testing as internal developers within the organization (e.g. ITIL service management processes).

S3.10.0
S3.13
(S3.10.0) Design, acquisition, implementation,
configuration, modification, and management of
infrastructure and software are consistent with
defined system availability, confidentiality of data,
processing integrity, systems security and related
security policies.
(S3.13) Procedures exist to provide that only
authorized, tested, and documented changes are
made to the system.

C.2
I.1
I.2
I.4
C.2.4, G.4, G6,
I.1, I.4.4, I.4.5,
I.2.7.2, I.2.8,
I.2.9, I.2.15,
I.2.18,
I.2.22.6,
I.2.7.1, I.2.13,
I.2.14, I.2.17,
I.2.20,
I.2.22.2,
I.2.22.4,
I.2.22.7,
I.2.22.8,
I.2.22.9,
I.2.22.10,
I.2.22.11,
I.2.22.12,
I.2.22.13,
I.2.22.14, I.3,
J.1.2.10, L.7,
L.9, L.10
27 (B) Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RM-04 None NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)
NIST SP 800-53 R3 SA-12
1 (B)
Commandment #1
Commandment #2
Commandment #3
SA-4
SA-5
SA-8
SA-9
SA-10
SA-11
SA-12
SA-13
PCI DSS v2.0

3.6.7 PCI DSS v2.0

6.4.5.2 PCI DSS v2.0

7.1.3 PCI DSS v2.0

8.5.1 PCI DSS v2.0

9.1 PCI DSS v2.0

9.1.2 PCI DSS v2.0

9.2b
PCI DSS v2.0

9.3.1 PCI DSS v2.0

10.5.2 PCI DSS v2.0

11.5 PCI DSS v2.0

12.3.1 PCI DSS v2.0

12.3.3 Chapter II
Article 11, 13
CIP-003-3 -
R4.1
CP-2
CP-6
CP-7
CP-8
CP-9
SI-12
AU-11
PCI DSS v2.0

3.1 PCI DSS v2.0

3.1.1 PCI DSS v2.0

3.2 PCI DSS v2.0

9.9.1 PCI DSS v2.0

9.5 PCI DSS v2.0

9.6 PCI DSS v2.0

10.7 Change Control &
Configuration
Management
New Development /
Acquisition
CCC-01 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to ensure the development and/or acquisition of new data, physical or virtual applications, infrastructure network and systems components, or any corporate, operations and/or datacenter facilities have been preauthorized by the organization's business leadership or other accountable business role or function.

S3.12.0
S3.10.0
S3.13.0
(S3.12.0) Procedures exist to maintain system
components, including configurations consistent
with the defined system security policies.
(S3.10.0) Design, acquisition, implementation,
configuration, modification, and management of
infrastructure and software are consistent with
defined system security policies.
(S3.13.0) Procedures exist to provide that only
authorized, tested, and documented changes are
made to the system.

I.2 I.1.1, I.1.2, I.2.

7.2, I.2.8,
I.2.9, I.2.10,
I.2.13, I.2.14,
I.2.15, I.2.18,
I.2.22.6, L.5
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RM-01 COBIT 4.1 A12, A

16.1 None 6.03. (a) NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)

1.2.6 BOSS > Data
Governance >
Data Retention
Rules
Business Continuity shared x
Management &
Operational Resilience
Retention Policy
BCR-11 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining and adhering to the retention period of any critical asset as per established policies and procedures, as well as applicable legal, statutory, or regulatory compliance obligations. Backup and recovery measures shall be incorporated as part of business continuity planning and tested accordingly for effectiveness.

A3.3.0
A3.4.0
I3.20.0
I3.21.0
(A3.3.0) Procedures exist to provide for backup,
offsite storage, restoration, and disaster recovery
consistent with the entity’s defined system
availability and related security policies.
(A3.4.0) Procedures exist to provide for the
integrity of backup data and systems maintained
to support the entity’s defined system availability
and related security policies.
(I3.20.0) Procedures exist to provide for
restoration and disaster recovery consistent with
the entity’s defined processing integrity policies.
(I3.21.0) Procedures exist to provide for the
completeness, accuracy, and timeliness of backup
data and systems.

D.2.2.9 36 (B) Schedule 1
(Section 5) 4.5 -
Limiting Use,
Disclosure and
Retention, Subsec.

4.5.2 DG-04 COBIT 4.1 DS 4.1,
DS 4.2, DS 4.5,
DS 4.9, DS 11.6
Domain 5 6.03. (h)

6.07.01. (c)
Article 6(1) e NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 CP-2 (1)
NIST SP 800-53 R3 CP-2 (2)
NIST SP 800-53 R3 CP-6
NIST SP 800-53 R3 CP-6 (1)
NIST SP 800-53 R3 CP-6 (3)
NIST SP 800-53 R3 CP-7
NIST SP 800-53 R3 CP-7 (1)
NIST SP 800-53 R3 CP-7 (2)
NIST SP 800-53 R3 CP-7 (3)
NIST SP 800-53 R3 CP-7 (5)
NIST SP 800-53 R3 CP-8
NIST SP 800-53 R3 CP-8 (1)
NIST SP 800-53 R3 CP-8 (2)
NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-9 (1)
NIST SP 800-53 R3 CP-9 (3)

5.1.0 5.1.1

5.2.2 8.2.6
CIP-007-3 -
R6.1 -
R6.2 -
R6.3 -
R6.4
MA-2
MA-3
MA-4
MA-5
MA-6
A11.2.4
A.17.1.1
A.17.1.2
Clauses

9.2(g)

7.5.3(b)

5.2 (c)

7.5.3(d)

5.3(a)

5.3(b)

8.1 8.3
A.12.3.1
A.8.2.3
Commandment #1
Commandment #2
Commandment #3
CA-1
CM-1
CM-9
PL-1
PL-2
SA-1
SA-3
SA-4
45 CFR 164.308
(a)(7)(ii)(E)

ISO/IEC
27001:2005
A.14.1.2
A 14.1.4
Commandment #1
Commandment #2
Commandment #3
CIP-007-3 -
R8 - R8.1 -
R8.2 -
R8.3
RA-3
A.6.1.4
A.6.2.1
A.12.1.1
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.5
A.15.1.3
A.15.1.4
45 CFR 164.308
(a)(7)(ii)(A)
45 CFR 164.310
(d)(2)(iv)
45 CFR
164.308(a)(7)(ii)
(D) (New)
45 CFR
164.316(b)(2)(i)
(New)
Clause 4.3.3
A.10.5.1
A.10.7.3
EAR 15 §
762.6
Period of
Retention
EAR 15
CFR §
786.2
Recordke
eping
Commandment
#11
Commandment #2
Commandment #5
Commandment
#11
45 CFR 164.310
(a)(2)(iv)
A.9.2.4
BSGP
SGP
PA10
PA29
COBIT 4.1 A13.3 Domain 7,
8 6.09. (h) Article 17 (1) NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-2 (1)
NIST SP 800-53 R3 MA-3
NIST SP 800-53 R3 MA-3 (1)
NIST SP 800-53 R3 MA-3 (2)
NIST SP 800-53 R3 MA-3 (3)
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-4 (1)
NIST SP 800-53 R3 MA-4 (2)
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 MA-6

5.2.3 8.2.2

8.2.3 8.2.4

8.2.5 8.2.6

8.2.7 Business Continuity
Management &
Operational Resilience
Impact Analysis
BCR-09 There shall be a defined and documented method for determining the impact of any disruption to the organization (cloud provider, cloud consumer) that must incorporate the following:
• Identify critical products and services
• Identify all dependencies, including processes, applications, business partners, and third party service providers
• Understand threats to critical products and services
• Determine impacts resulting from planned or unplanned disruptions and how these vary over time
• Establish the maximum tolerable period for disruption • Establish priorities for recovery
• Establish recovery time objectives for resumption of critical products and services within their maximum tolerable period of disruption
• Estimate the resources required for resumption
A3.1.0
A3.3.0
A3.4.0
(A3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system availability commitments
and (2) assess the risks associated with the
identified threats.
(A3.3.0) Procedures exist to provide for backup,
offsite storage, restoration, and disaster recovery
consistent with the entity’s defined system
availability and related security policies.
(A3.4.0) Procedures exist to provide for the
integrity of backup data and systems maintained
to support the entity’s defined system availability
and related security policies.

K.2 RS-02 Domain 7,
8 6.02. (a)

6.03.03. (c)

6.07. (a)

6.07. (b)

6.07. (c)
Article 17 (1), (2) NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 RA-3
Infra Services >
Equipment
Maintenance >
provider x
ITOS > Service
Delivery >
Information
Technology
Resiliency -
Resiliency
Analysis
A3.2.0
A4.1.0
(A3.2.0) Measures to prevent or mitigate threats
have been implemented consistent with the risk
assessment when commercially practicable.
(A4.1.0) The entity’s system availability and
security performance is periodically reviewed and
compared with the defined system availability and
related security policies.

F.2.19
PCI DSS v2.0

3.1.1 PCI DSS v2.0

3.1 45 CFR 164.308
(a)(7)(i)
45 CFR 164.308
(a)(7)(ii)(B)
45 CFR 164.308
(a)(7)(ii)(C)
45 CFR 164.308
(a)(7)(ii)(E)
45 CFR 164.310
(a)(2)(i)
45 CFR 164.312
(a)(2)(ii)
Clause 5.1
A.6.1.2
A.14.1.3
A.14.1.4
Commandment #1
Commandment #2
Commandment #3

ISO/IEC
27001:2005
Clause 4.2.1 b)
2)
Clause 4.2.1 c)
1)
Clause 4.2.1 g)
Clause 4.2.3 d)
6)
Clause 4.3.3
Clause 5.2.1 a - f
Clause 7.3 c) 4)
A.7.2.1
A.15.1.1
A.15.1.3
A.15.1.4
A.15.1.6
Clauses

4.2(b),

4.4,

5.2(c),

5.3(ab),

6.1.2,

6.1.3,

6.1.3(b),

7.5.3(b),

7.5.3(d),

8.1,

8.3 9.2(g),

9.3,

9.3(b),

9.3(f),

10.2,
A.8.2.1,
Clause 5.1(h)
A.17.1.2
A.17.1.2
A11.2.2,
A11.2.3
CP-1
CP-2
CP-3
CP-4
CP-6
CP-7
CP-8
CP-9
CP-10
PE-17
PCI DSS v2.0

12.9.1 PCI DSS v2.0

12.9.3 PCI DSS v2.0

12.9.4 PCI DSS v2.0

12.9.6 PE-1
PE-4
PE-13
Commandment #1
Commandment #2
Commandment #3
Commandment #4
Commandment #9
Commandment
#11
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2
(1)
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 RA-5
Business Continuity
Management &
Operational Resilience
Power /
Telecommunications
BCR-03 Datacenter utilities services and environmental conditions (e.g., water, power, temperature and humidity controls,
telecommunications,and internet connectivity) shall be secured, monitored, maintained, and tested for continual effectiveness at planned intervals to ensure protection from unauthorized interception or damage, and designed with automated fail-over or other redundancies in the event of planned or unplanned disruptions.

A3.2.0
A3.4.0
(A3.2.0) Measures to prevent or mitigate threats
have been implemented consistent with the risk
assessment when commercially practicable.
(A3.4.0) Procedures exist to protect against
unauthorized access to system resource.

F.1 F.1.6, F.1.6.1,
F.1.6.2,
F.1.9.2,
F.2.10, F.2.11,
F.2.12
9 (B)
10 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RS-08 Domain 7,
8 6.08. (a)

6.09. (c)

6.09. (f)

1.2.7 4.2.1

8.2.7 10.2.3

10.2.5 6.03.01. (c) Article: 27 (3) NIST SP 800-53 R3 SC-5 NIST SP 800-53 R3 SC-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-14
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SC-2
NIST SP 800-53 R3 SC-4
NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SC-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SC-10
NIST SP 800-53 R3 SC-11
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-12 (2)
NIST SP 800-53 R3 SC-12 (5)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-14
NIST SP 800-53 R3 SC-17
NIST SP 800-53 R3 SC-18

1.2.6 Audit Assurance &
Compliance
Independent Audits
Domain 10
Business Continuity
Management &
Operational Resilience
Business Continuity
Planning
BCR-01 A consistent unified framework for business continuity planning and plan development shall be established, documented and adopted to ensure all business continuity plans are consistent in addressing priorities for testing, maintenance, and information security requirements. Requirements for business continuity plans include the following:
• Defined purpose and scope, aligned with relevant dependencies • Accessible to and understood by those who will use them • Owned by a named person(s) who is responsible for their review, update, and approval
• Defined lines of communication, roles, and responsibilities • Detailed recovery procedures, manual work-around, and reference information
• Method for plan invocation
A3.1.0
A3.3.0
A3.4.0
(A3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system availability commitments
and (2) assess the risks associated with the
identified threats.
(A3.3.0) Procedures exist to provide for backup,
offsite storage, restoration, and disaster recovery
consistent with the entity’s defined system
availability and related security policies.
(A3.4.0) Procedures exist to provide for the
integrity of backup data and systems maintained
to support the entity’s defined system availability
and related security policies.

K.1.2.3.

K.1.2.4,
K.1.2.5,
K.1.2.6,
K.1.2.7,
K.1.2.11,
K.1.2.13,
K.1.2.15
RS-03 Domain 7,
8 6.07. (a)

6.07. (b)

S4.1.0
S4.2.0
(S4.1.0) The entity’s system security is periodically
reviewed and compared with the defined system
security policies.
(S4.2.0) There is a process to identify and address
potential impairments to the entity’s ongoing
ability to achieve its objectives in accordance with
its defined system security policies.

L.2, L.4, L.7,
L.9, L.11
58 (B)
59 (B)
61 (C+,
A+)
76 (B)
77 (B)
CC7.1 COBIT 4.1 AI2.4
CCM v3.0.1 Compliance Mapping
45 CFR 6, 6.5
164.312(e)(2)(i)
A.11.5.6
A.11.6.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.5.2
A.12.5.4
A.12.5.5
A.12.6.1
A.15.2.1
Commandment #1
Commandment #2
Commandment #4
Commandment #5
Commandment
#11
CIP-007-3 -
R5.1
SC-2
SC-3
SC-4
SC-5
SC-6
SC-7
SC-8
SC-9
SC-10
SC-11
SC-12
SC-13
SC-14
SC-17
SC-18
SC-20
SC-21
SC-22
SC-23
PCI DSS v2.0

6.5 Application & Interface
Security
Customer Access
Requirements
AIS-02 Prior to granting customers access to data, assets, and information systems, (removed all) identified security, contractual, and regulatory requirements for customer access shall be addressed.

Commandment #1
Commandment #2
Commandment #3
Chapter VI, Section 1
Article 39, I. and VIII.

Chapter 8
Article 59
CIP-003-3 -
R1.3 -
R4.3
CIP-004-3
R4 - R4.2
CIP-005-
3a - R1 -
R1.1 -
R1.2
CA-1
CA-2
CA-6
RA-5
PCI DSS v2.0

11.2 PCI DSS v2.0

11.3 PCI DSS v2.0

6.6 PCI DSS v2.0

12.1.2.b
COBIT 4.1 DS5.5,
ME2.5, ME 3.1
PO 9.6
Domain 2,
4 6.03. (e)

6.07.01. (m)

6.07.01. (n)
A9.4.2
A9.4.1,

8.1*Partial,
A14.2.3,

8.1*partial,
A.14.2.7
A12.6.1,
A18.2.2
A9.1.1.

Clauses

4.3(a),

4.3(b),

5.1(e),

5.1(f),

9.1,

9.2,

9.3(f),
A18.2.1
Schedule 1 SA-01
(Section 5) 4.1
Accountability,
Subs. 4.1.3
Control Group CGID CID Control Specification Consensus Assessment Questions Application & Interface
Security
Application Security
AIS-01 Applications and programming interfaces (APIs) shall be designed, developed, deployed and tested in accordance with leading industry standards (e.g., OWASP for web applications) and adhere to applicable legal, statutory, or regulatory compliance obligations.

S3.10.0 (S3.10.0) Design, acquisition, implementation,
configuration, modification, and management of
infrastructure and software are consistent with
defined system security policies to enable
authorized access and to prevent unauthorized
access.
(S3.10.0) Design, acquisition, implementation,
configuration, modification, and management of
infrastructure and software are consistent with
defined processing integrity and related security
policies.

I.4 G.16.3, I.3 Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-04
C.2.1, C.2.3,
C.2.4, C.2.6.1,
H.1
10 (B)
11 (A+)
(S3.2.a) a. Logical access security measures to
restrict access to information resources not
deemed to be public.

CO-02
Audit Assurance &
Compliance
Information System
Regulatory Mapping
AAC03Organizations shall create and maintain a control framework which captures standards, regulatory, legal, and statutory requirements relevant for their business needs. The control framework shall be reviewed at least annually to ensure changes that could affect the business processes are reflected.

Business Continuity
Management &
Operational Resilience
Equipment
Maintenance
BCR-07 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for equipment maintenance ensuring continuity and availability of operations and support personnel.

OP-04

CONSENSUS ASSESSMENTS INITIATIVE
QUESTIONNAIRE v3.0.1
Commandment #6
Commandment #7
Commandment #8
CA-1
CA-2
CA-5
CA-6
A.6.2.1
A.6.2.2
A.11.1.1

1.2.2 1.2.6

6.2.1 6.2.2
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2
(1)
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
Domain 10 Article 17 (1), (2)
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 RA-5 (1)
NIST SP 800-53 R3 RA-5 (2)
NIST SP 800-53 R3 RA-5 (3)
NIST SP 800-53 R3 RA-5 (6)
NIST SP 800-53 R3 RA-5 (9)
S3.2a
45 CFR 164.308
(a)(8)
45 CFR
164.308(a)(1)(ii)
(D)
Clause 4.2.3e
Clause 5.1 g
Clause 5.2.1 d)
Clause 6
A.6.1.8
provider x
A.9.2.2
A.9.2.3
A.6.1.8
A.6.2.1
A.6.2.3
A.10.1.4
A.10.2.1
A.10.2.2
A.10.2.3
A.10.3.2
A.12.1.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.1
A.12.5.2
A.12.5.3
A.12.5.5
A.12.6.1
A.13.1.2
A.15.2.1
A.15.2.2
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5

8.1* (partial)
A.14.2.7
A.18.1.3
A.18.1.4
A18.2.1
A.15.1.2
A.12.1.4

8.1* (partial)

8.1* (partial)
A.15.2.1

8.1* (partial)
A.15.2.2
A.14.2.9
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5

8.1* (partial)
A.14.2.2

8.1* (partial)
A.14.2.3

8.1* (partial)
A.14.2.4

8.1* (partial)
A.14.2.7
A.12.6.1
A.16.13
A.18.2.2
A.18.2.3
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 281
#2..
- 325 -
CCC-03.1 Do you provide your tenants with documentation that describes your quality assurance process?
CCC-03.2 Is documentation describing known issues with certain products/services available?
CCC-03.3 Are there policies and procedures in place to triage and remedy reported bugs and security vulnerabilities for product and service offerings?
CCC-03.4 Are mechanisms in place to ensure that all debugging and test code elements are removed from released software versions?
Change Control &
Configuration
Management
Unauthorized Software
Installations
CCC-04 CCC-04.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

Do you have controls in place to restrict and monitor the installation of unauthorized software onto your systems?
A3.6.0
S3.5.0
S3.13.0
(A3.6.0) Procedures exist to restrict physical access
to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.
(S3.5.0) Procedures exist to protect against
infection by computer viruses, malicious code, and
unauthorized software.
(S3.13.0) Procedures exist to provide that only
authorized, tested, and documented changes are
made to the system.

CC5.5
CC5.8
CC7.4
G.1
I.2
G.2.13,
G.20.2,G.20.4,
G.20.5, G.7,
G.7.1, G.12.11,
H.2.16,
I.2.22.1,
I.2.22.3,
I.2.22.6, I.2.23
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RM-05 APO13.01
BAI06.01
BAI10
DSS05.03
DSS05.04
DSS05.05
DSS05.07
DSS06.03
312.8 and 312.10 ITOS > Service
Support >
Configuration
Management ->
Software
Mangement
shared x None NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-8
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 CM-8
NIST SP 800-53 R3 CM-8 (1)
NIST SP 800-53 R3 CM-8 (3)
NIST SP 800-53 R3 CM-8 (5)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)

3.2.4 8.2.2
A.10.1.3
A.10.4.1
A.11.5.4
A.11.6.1
A.12.4.1
A.12.5.3
A.6.1.2
A.12.2.1
A.9.4.4
A.9.4.1
A.12.5.1

8.1* (partial)
A.14.2.4
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment
#11
CM-1
CM-2
CM-3
CM-5
CM-7
CM-8
CM-9
SA-6
SA-7
SI-1
SI-3
SI-4
SI-7
FTC Fair Information
Principles
Involves both managerial
and technical measures
to protect against loss
and the unauthorized
access, destruction, use,
or disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

14.1 1.3.3

2.1, 2.2.2

3.6 4.1

5.1, 5.2, 5.3, 5.4

6.2 7.1

9.1 9.1.1

9.1.2 9.1.3

9.2 9.3

9.4 9.4.1

9.4.2 9.4.3

10.1, 10.2, 10.3,

10.4, 10.5, 10.6,

10.7 11.1, 11.4, 11.5

12.3 Change Control &
Configuration
Management
Production Changes
CCC-05 CCC-05.1 Policies and procedures shall be established for managing the risks associated with applying changes to business-critical or customer (tenant) impacting (physical and virtual) application and systemsystem interface (API) designs and configurations, as well as infrastructure network and systems components. Technical measures shall be implemented to provide assurance that, prior to deployment, all changes directly correspond to a registered change request, business-critical or customer (tenant) , and/or authorization by, the customer (tenant) as per agreement (SLA).

Do you provide tenants with documentation that describes your production change management procedures and their
roles/rights/responsibilities within it?
A3.16.0
S3.13.0
(A3.16.0, S3.13.0) Procedures exist to provide that
only authorized, tested, and documented changes
are made to the system.

CC7.4
CC7.4
I.2.17, I.2.20,
I.2.22
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RM-02 COBIT 4.1 A16.1,
A17.6
BAI06.01
BAI06.02
BAI06.03
BAI06.04
BAI07.01
BAI07.03
BAI07.04
BAI07.05
BAI07.06
ITOS > Service
Support > Release
Management
shared x None 6.03. (a) NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 PL-5
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 PL-5
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-6
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)

1.2.6 45 CFR 164.308
(a)(5)(ii)(C)
45 CFR 164.312
(b)
A.10.1.4
A.12.5.1
A.12.5.2
A.12.1.4

8.1* (partial)
A.14.2.2

8.1* (partial)
A.14.2.3
Commandment #1
Commandment #2
Commandment #3
Commandment
#11
CIP-003-3 -
R6
CA-1
CA-6
CA-7
CM-2
CM-3
CM-5
CM-6
CM-9
PL-2
PL-5
SI-2
SI-6
SI-7
AR- 4. Privacy Monitoring
and Auditing.

The organization Senior
Agency Official for
Privacy (SAOP)/Chief
Privacy Officer (CPO)
coordinates monitoring
and auditing efforts with
information security

12.1 12.4
PA14 SGP PCI DSS v2.0

1.1.1 PCI DSS v2.0

6.3.2 PCI DSS v2.0

6.4 PCI DSS v2.0

6.1 1.1.1

6.3.2 6.4.5
DSI-01.1 Do you provide a capability to identify virtual machines via policy tags/metadata (e.g., tags can be used to limit guest operating systems from booting/instantiating/transporting data in the wrong country)?
DSI-01.2 Do you provide a capability to identify hardware via policy tags/metadata/hardware tags (e.g., TXT/TPM, VN-Tag, etc.)? DSI-01.3 Do you have a capability to use system geographic location as an authentication factor?
DSI-01.4 Can you provide the physical location/geography of storage of a tenant’s data upon request?
DSI-01.5 Can you provide the physical location/geography of storage of a tenant's data in advance?
DSI-01.6 Do you follow a structured data-labeling standard (e.g., ISO 15489, Oasis XML Catalog Specification, CSA data type guidance)? DSI-01.7 Do you allow tenants to define acceptable geographical locations for data routing or resource instantiation?
DSI-02.1 Do you inventory, document, and maintain data flows for data that is resident (permanent or temporary) within the services' applications and infrastructure network and systems?
DSI-02.2 Can you ensure that data does not migrate beyond a defined geographical residency?
DSI-03.1 Do you provide open encryption methodologies (3.4ES, AES, etc.) to tenants in order for them to protect their data if it is required to move through public networks (e.g., the Internet)?
DSI-03.2 Do you utilize open encryption methodologies any time your infrastructure components need to communicate with each other via public networks (e.g., Internet-based replication of data from one environment to another)?
DSI-04.1 Are policies and procedures established for labeling, handling and the security of data and objects that contain data?
DSI-04.2 Are mechanisms for label inheritance implemented for objects that act as aggregate containers for data?
Data Security &
Information Lifecycle
Management
Nonproduction Data
DSI-05 DSI-05.1 Production data shall not be replicated or used in non-production environments.

Do you have procedures in place to ensure production data shall not be replicated or used in non-production environments?
C3.5.0
S3.4.0
C3.21.0
(C3.5.0) The system procedures provide that
confidential information is disclosed to parties only
in accordance with the entity’s defined
confidentiality and related security policies.
(S3.4.0) Procedures exist to protect against
unauthorized access to system resources.
(C3.21.0) Procedures exist to provide that
confidential information is protected during the
system development, testing, and change
processes in accordance with defined system
confidentiality and related security policies.

C1.3
CC5.6
C1.1
I.2.18 DG-06 APO01.06
BAI01.01
BAI03.07
BAI07.04
SRM > Policies
and Standards >
Technical
Standard (Data
Management
Security
Standard)
shared x Domain 5 6.03. (d) NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)

1.2.6 45 CFR
164.308(a)(4)(ii)
(B)
A.7.1.3
A.10.1.4
A.12.4.2
A.12.5.1
A.8.1.3
A.12.1.4
A.14.3.1

8.1* (partial)
A.14.2.2.

Commandment #9
Commandment
#10
Commandment
#11
CIP-003-3 -
R6
SA-11
CM-04
DM-1 Minimization of
Personally Identifiable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII
used in Testing, Training,
and Research. SE-1

INVENTORY OF

PERSONALLY

IDENTIFIABLE

INFORMATION

17.8 PCI DSS v2.0

6.4.3 6.4.3
Data Security &
Information Lifecycle
Management
Ownership /
Stewardship
DSI-06 DSI-06.1 All data shall be designated with stewardship, with assigned responsibilities defined, documented, and communicated.

Are the responsibilities regarding data stewardship defined, assigned, documented and communicated?
S2.2.0
S2.3.0
S3.8.0
(S2.2.0) The security obligations of users and the
entity’s security commitments to users are
communicated to authorized users.
(S2.3.0) Responsibility and accountability for the
entity’s system security policies and changes and
updates to those policies are communicated to
entity personnel responsible for implementing
them.
(S3.8.0) Procedures exist to classify data in
accordance with classification policies and
periodically monitor and update such
classifications as necessary
CC2.3
CC3.1
C.2.5.1,
C.2.5.2, D.1.3,
L.7
Schedule 1
(Section 5) 4.5 -
Limiting Use,
Disclosure and
Retention, Subsec.

4.1.3 DG-01 COBIT 4.1 DS5.1,
PO 2.3
APO01.06
APO03.02
APO13.01
APO13.03
312.4 BOSS > Data
Governance >
Data Ownership /
Stewardship
shared x Domain 5 Article 4 NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2
(1)
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-2

6.2.1 45 CFR 164.308
(a)(2)
A.6.1.3
A.7.1.2
A.15.1.4
A.6.1.1
A.8.1.2
A.18.1.4
Commandment #6
Commandment
#10
Chapter IV
Article 30
CIP-007-3 -
R1.1 -
R1.2
CA-2
PM-5
PS-2
RA-2
SA-2
AP-1 AUTHORITY TO
COLLECT. AP-2 PURPOSE
SPECIFICATION.

3.4 3.7

12.5.5 12.10.4
DSI-07.1 Do you support secure deletion (e.g., degaussing/cryptographic wiping) of archived and backed-up data as determined by the tenant?
DSI-07.2 Can you provide a published procedure for exiting the service arrangement, including assurance to sanitize all computing resources of tenant data once a customer has exited your environment or has vacated a resource?
DCS-01.1 Do you maintain a complete inventory of all of your critical assets that includes ownership of the asset?
DCS-01.2 Do you maintain a complete inventory of all of your critical supplier relationships?
Datacenter Security
Controlled Access
Points
DCS02DCS-02.1 Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) shall be implemented to safeguard sensitive data and information systems.

Are physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks and security patrols) implemented? A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.

12.3 APO13.01
DSS01.01
DSS01.05
DSS05.05
DSS06.03
DSS06.06
312.8 and 312.10 Infra Services >
Facility Security >
Controlled
Physical Access
provider x Domain 8 6.08. (a)

6.09. (i)
Article 17 NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-8
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-6 (1)
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-7 (1)
NIST SP 800-53 R3 PE-8
NIST SP 800-53 R3 PE-18

99.31.a.1.ii 8.2.3 A.9.1.1 A.11.1.1
A.11.1.2
Commandment #1
Commandment #2
Commandment #3
Commandment #5
CIP-006-
3c R1.2 -
R1.3 -
R1.4 -
R1.6 -
R1.6.1 -
R2 - R2.2
PE-2
PE-3
PE-6
PE-7
PE-8
PE-18

8.1 8.2
PA4 BSGP PCI DSS v2.0

9.1 9.1

9.1.1 9.1.2, 9.1.3

9.2, 9.3, 9.4, 9.4.1,

9.4.2, 9.4.3, 9.4.4
Datacenter Security
Equipment
Identification
DCS03DCS-03.1 Automated equipment identification shall be used as a method of connection authentication. Location-aware technologies may be used to validate connection authentication integrity based on known equipment location.

Is automated equipment identification used as a method to validate connection authentication integrity based on known equipment location?
S3.2.a (S3.2.a) a. Logical access security measures to
restrict access to information resources not
deemed to be public.

CC5.1 D.1 D.1.1, D.1.3 Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-13 COBIT 4.1 DS5.7 APO13.01
DSS05.02
DSS05.03
312.3, 312.8 and
312.10
> > Domain 8 6.05. (a) NIST SP 800-53 R3 IA-4 NIST SP 800-53 R3 IA-3 NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-4 (4)
A.11.4.3 Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment #8
IA-3
IA-4
PA22
PA33
GP
SGP
Datacenter Security
Offsite Authorization
DCS04DCS-04.1 Authorization must be obtained prior to relocation or transfer of hardware, software, or data to an offsite premises.

Do you provide tenants with documentation that describes scenarios in which data may be moved from one physical location to another? (e.g., offsite backups, business continuity failovers, replication) S3.2.f
C3.9.0
(S3.2.f) f. Restriction of access to offline storage,
backup data, systems, and media.
(C3.9.0) Procedures exist to restrict physical access
to the defined system including, but not limited to:
facilities, backup media, and other system
components such as firewalls, routers, and
servers.

CC5.1
CC5.5
F.2.18, F.2.19, Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.5
FS-06 EDM05.02
APO01.02
APO03.02
BAI02.03
BAI02.04
BAI03.09
BAI06.01
312.8 and 312.10 SRM > Facility
Security > Asset
Handling
provider x Domain 8 6.08. (a)

12.5 19.1
PA4 BSGP PCI DSS v2.0

9.8 PCI DSS v2.0

9.9 9.6.3
Datacenter Security
Offsite equipment
DCS05DCS-05.1 Policies and procedures shall be established for the secure disposal of equipment (by asset type) used outside the organization's premise. This shall include a wiping solution or destruction process that renders recovery of information impossible. The erasure shall consist of a full write of the drive to ensure that the erased drive is released to inventory for reuse and deployment or securely stored until it can be destroyed.

Can you provide tenants with evidence documenting your policies and procedures governing asset management and repurposing of equipment?
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

CC5.6 D.1 D.1.1, D.2.1.

D.2.2,
Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.5
FS-07 APO09.03
APO10.04
APO10.05
APO13.01
DSS01.02
312.8 and 312.10 BOSS > Data
Governance >
Secure Disposal
of Data
provider x Domain 8 6.05. (a)

6.05. (b)

6.05. (c)
Article 17 NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 CM-8 (1)
NIST SP 800-53 R3 CM-8 (3)
NIST SP 800-53 R3 CM-8 (5)
NIST SP 800-53 R3 SC-30
45 CFR 164.310
(c )
45 CFR 164.310
(d)(1) (New)
45 CFR 164.310
(d)(2)(i) (New)
A.9.2.5
A.9.2.6
A.8.1.1
A.8.1.2
Commandment #6
Commandment #7
Commandment #8
CM-8 12.6 PA4 BSGP PCI DSS v2.0

9.8 PCI DSS v2.0

9.9 PCI DSS v2.0

9.10 9.8, 9.8.1, 9.8.2

12.3 DCS-06.1 Can you provide evidence that policies, standards and procedures have been established for maintaining a safe and secure working environment in offices, rooms, facilities and secure areas? DCS-06.2 Can you provide evidence that your personnel and involved third parties have been trained regarding your documented policies, standards and procedures?
Datacenter Security
Secure Area
Authorization
DCS07DCS-07.1 Ingress and egress to secure areas shall be constrained and monitored by physical access control mechanisms to ensure that only authorized personnel are allowed access.

Do you allow tenants to specify which of your geographic locations their data is allowed to move into/out of (to address legal jurisdictional considerations based on where data is stored vs. accessed)?
A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.

CC5.5 F.2 F.1.2.3,
F.1.2.4,
F.1.2.5,
F.1.2.6,
F.1.2.8, F.1.2.
9, F.1.2.10,
F.1.2.11,
F.1.2.12,
F.1.2.13,
F.1.2.14,
F.1.2.15,
F.1.2.24,
F.1.3, F.1.4.2,
F1.4.6,
F.1.4.7, F.1.6,
F.1.7,F.1.8,
F.2.13, F.2.14,
F.2.15, F.2.16,
F.2.17, F.2.18
7 (B) Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-04 DS 12.2, DS 12.3 APO13.01
APO13.02
DSS05.05
312.8 and 312.10 SRM > Policies
and Standards >
Information
Security Policy
(Facility Security
Policy)
provider x Domain 8 6.08. (a)

6.09. (i)
Article 17 NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-7 (1)
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-18

99.31.a.1.ii 8.2.3 A.9.1.1
A.9.1.2
A.11.1.6 Commandment #1
Commandment #2
Commandment #3
Commandment #5
CIP-006-
3c R1.2 -
R1.3 -
R1.4
PE-7
PE-16
PE-18

8.2 8.1
PA4 BSGP PCI DSS v2.0

9.1 PCI DSS v2.0

9.1.1 PCI DSS v2.0

9.1.2 PCI DSS v2.0

9.1.3 PCI DSS v2.0

9.2 9.1

9.1.1 9.1.3
Datacenter Security
Unauthorized Persons
Entry
DCS08DCS-08.1 Ingress and egress points such as service areas and other points where unauthorized personnel may enter the premises shall be monitored, controlled and, if possible, isolated from data storage and processing facilities to prevent unauthorized data corruption, compromise, and loss.

Are ingress and egress points, such as service areas and other points where unauthorized personnel may enter the premises, monitored, controlled and isolated from data storage and process?
A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.

CC5.5 G.21 F.2.18 Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-05 COBIT 4.1 DS

12.3 APO13.01
APO13.02
DSS05.05
DSS06.03
312.8 and 312.10 SRM > Policies
and Standards >
Information
Security Policy
(Facility Security
Policy)
provider x Domain 8 6.08. (a)

6.09. (j)
Article 17 NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-2 (1)
NIST SP 800-53 R3 PE-16

99.31.a.1.ii 8.2.5

8.2.6 A.9.1.6 A.11.2.5

8.1* (partial)
A.12.1.2
Commandment #6
Commandment #7
MA-1
MA-2
PE-16

8.1 8.2

8.3 8.4
PA4 BSGP 9.1

9.1.1 9.1.2

9.2 9.3

9.4 9.4.1

9.4.2 9.4.3 Datacenter Security
User Access
DCS09DCS-09.1 Physical access to information assets and functions by users and support personnel shall be restricted.

Do you restrict physical access to information assets and functions by users and support personnel?
A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.

CC5.5 F.2 F.1.2.3,
F.1.2.4,
F.1.2.5,
F.1.2.6,
F.1.2.8, F.1.2.
9, F.1.2.10,
F.1.2.11,
F.1.2.12,
F.1.2.13,
F.1.2.14,
F.1.2.15,
F.1.2.24,
F.1.3, F.1.4.2,
F1.4.6,
F.1.4.7, F.1.6,
F.1.7,F.1.8,
F.2.13, F.2.14,
F.2.15, F.2.16,
F.2.17, F.2.18
7 (B)
10 (B)
Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-02 APO13.01
APO13.02
DSS05.04
DSS05.05
DSS06.03
312.8 and 312.10 Infra Services >
Facility Security >
Domain 8 6.08. (a)

6.09. (i)
Article 17 NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-6 (1)
NIST SP 800-53 R3 PE-18

99.31.a.1.ii 8.2.3 45 CFR
164.310(a)(1)
(New)
45 CFR
164.310(a)(2)(ii)
(New)
45 CFR
164.310(b)
(New)
45 CFR 164.310
( c) (New)
A.9.1.1
A.9.1.2
A.11.1.1 Commandment #1
Commandment #2
Commandment #3
Commandment #5
Chapter II,
Article 19
CIP-006-
3c R1.2 -
R1.3 -
R1.4 -
R1.6 -
R1.6.1 -
R2 - R2.2
PE-2
PE-3
PE-6
PE-18

8.1 8.2
PA4
PA13
PA24
BSGP
SGP
P
PCI DSS v2.0

9.1 9.1

9.1.1 9.1.2

9.2 9.3

9.4 9.4.1

9.4.2 9.4.3

9.4.4 9.5

9.5.1 Encryption & Key
Management
Entitlement
EKM01EKM-01.1 Keys must have identifiable owners (binding keys to identities) and there shall be key management policies.

Do you have key management policies binding keys to identifiable owners?
APO01.06
APO13.01
DSS05.04
DSS05.06
DSS06.03
SRM >
Cryptographic
Services > Key
Management
Annex
A.10.1
A.10.1.1
A.10.1.2
PA36 3.5, 7.1.3

8.1 8.1.1

8.2.2 EKM-02.1 Do you have a capability to allow creation of unique encryption keys 8.5 per tenant?
EKM-02.2 Do you have a capability to manage encryption keys on behalf of tenants?
EKM-02.3 Do you maintain key management procedures?
EKM-02.4 Do you have documented ownership for each stage of the lifecycle of encryption keys?
EKM-02.5 Do you utilize any third party/open source/proprietary frameworks to manage encryption keys?
EKM-03.1 Do you encrypt tenant data at rest (on disk/storage) within your environment?
EKM-03.2 Do you leverage encryption to protect data and virtual machine images during transport across and between networks and hypervisor instances?
EKM-03.3 Do you support tenant-generated encryption keys or permit tenants to encrypt data to an identity without access to a public key certificate (e.g. identity-based encryption)?
EKM-03.4 Do you have documentation establishing and defining your encryption management policies, procedures and guidelines? EKM-04.1 Do you have platform and data appropriate encryption that uses open/validated formats and standard algorithms?
EKM-04.2 Are your encryption keys maintained by the cloud consumer or a trusted key management provider?
EKM-04.3 Do you store encryption keys in the cloud?
EKM-04.4 Do you have separate key management and key usage duties? GRM01.1Do you have documented information security baselines for every component of your infrastructure (e.g., hypervisors, operating systems, routers, DNS servers, etc.)?
GRM01.2Do you have a capability to continuously monitor and report the compliance of your infrastructure against your information security baselines?
GRM01.3Do you allow your clients to provide their own trusted virtual machine image to ensure conformance to their own internal standards?
GRM02.1Do you provide security control health data in order to allow tenants to implement industry standard Continuous Monitoring (which allows continual tenant validation of your physical and logical control status)?
GRM02.2Do you conduct risk assessments associated with data governance requirements at least once a year?
Governance and Risk
Management
Management
Oversight
GRM03GRM03.1Managers are responsible for maintaining awareness of, and complying with, security policies, procedures and standards that are relevant to their area of responsibility.

Are your technical, business, and executive managers responsible for maintaining awareness of and compliance with security policies, procedures, and standards for both themselves and their employees as they pertain to the manager and employees' area of
responsibility?
S1.2.f
S2.3.0
(S1.2.f) f. Assigning responsibility and
accountability for system availability,
confidentiality, processing integrity and related
security.
(S2.3.0) Responsibility and accountability for the
entity’s system security policies and changes and
updates to those policies are communicated to
entity personnel responsible for implementing
them.

CC3.2
E.1 E.4 5 (B)
65 (B)
Schedule 1
(Section 5) 4.1
Accountability; 4.7
Safeguards, Sub

4.7.4 IS-14 COBIT 4.1 DS5.3
COBIT 4.1 DS5.4
COBIT 4.1 DS5.5
APO01.03
APO01.04
APO01.08
DSS01.01
312.8 and 312.10 BOSS > Human
Resources
Security > Roles
and
Responsibilities
shared x Domain 3,
9 NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)

1.1.2 8.2.1
Clause 5.2.2
A.8.2.1
A.8.2.2
A 11.2.4
A.15.2.1
Clause 7.2(a,b)
A.7.2.1
A.7.2.2
A.9.2.5
A.18.2.2
Commandment #6
Commandment #7
Commandment #8
AT-2
AT-3
CA-1
CA-5
CA-6
CA-7
PM-10
AR-1 Governance and
Privacy Program

3.2 PCI DSS v2.0

12.6.1 PCI DSS v2.0

12.6.2 12.6, 7.3, 8.8, 9.10

6.1 6.2

6.3 6.4

6.5 6.6

6.7 3.1

9.6.1, 9.7.1

9.10 12.3

1.1.3 12.3.3

2.1.1 3.1

4.1 4.1.1

4.2 9.5, 9.5.1

9.6 9.7

9.8 9.9

3.1.1 9.8, 9.8.1, 9.8.2,

3.1 9.7.1

9.9 9.9.1

9.1 9.1.1

9.1.2 9.2

9.3 9.4

9.4.1 9.4.2

9.4.3 9.4.4

3.4.1 3.5

3.5.1 3.5.2

3.6 3.6.1

3.6.2 3.6.3

3.6.4 3.6.5

3.6.6 3.6.7

3.6.8,

4.1 6.5.3

8.2.1 8.2.2

2.1.1 2.3

3.3 3.4

3.4.1 4.1

4.1.1 4.2

4.3 6.5.3

6.5.4 8.2.1

3.5.2, 3.5.3

3.6.1, 3.6.3

1.1 1.1.1

1.1.2 1.1.3

1.1.4 1.1.5

1.1.6 2.2

2.2.1 2.2.2

2.2.3 2.2.4

12.2 PA4
PA8
PA37
PA38
BSGP
BSGP
SGP
SGP
PA4 BSGP
PA36
PA25 GP
PA10
PA18
BSGP
GP
PA10 SGP
PA25
PA21
PA5
GP
GP
BSGP
PA10
PA39
PA34
PA40
BSGP
SGP
SGP
SGP

12.1 14.1

14.2 13.1

13.4 13.5

12.3 4.2

8.1 16.2

16.1 4.4

5.1 3.3

4.3 8.4
AR-1 Governance and
Privacy Program. TR-1
PRIVACY NOTICE. TR-3

DISSEMINATION OF

PRIVACY PROGRAM

INFORMATION
DM-1 Minimization of
Personsally Identifidable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII
used in Testing, Training,
and Research.

TR-2 SYSTEM OF

RECORDS NOTICES AND

PRIVACY ACT

STATEMENTS
TR-2 SYSTEM OF

RECORDS NOTICES AND

PRIVACY ACT

STATEMENTS
DM-1 Minimization of
Personally Identifiable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII
used in Testing, Training,
and Research. SE-1

INVENTORY OF

PERSONALLY

IDENTIFIABLE

INFORMATION
DM-2 DATA RETENTION

AND DISPOSAL

99.31.(a)(1)(ii)
ITOS > Service
Support >
Configuration
Management -
Physical
Inventory
provider x
SRM > Policies
and Standards >
Information
Security Policies
(Facility Security
Policy)
provider x
SRM >
Cryptographic
Services > Key
Management
shared x
SRM > Data
Protection >
Cryptographic
Services - Data-AtRest Encryption,
Cryptographic
Services - Data-inTransit Encryption
shared x
SRM >
Cryptographic
Services > Key
Management
shared x
SRM >
Governance Risk
& Compliance >
Technical
Standards
BOSS >
Operational Risk
Management >
Independent Risk
Management
shared x
ITOS > Service
Support > Release
Management
shared x
BOSS > Data
Governance >
Data
Classification
shared x
BOSS > Data
Governance >
Handling /
Labeling /
Security Policy
x
BOSS > Data
Governance >
Handling /
Labeling /
Security Policy
shared x
shared x
312.3
312.8 and 312.10
312.2
312.3
312.8 and 312.10
312.8 and 312.10
312.1
APO11.01
APO11.02
APO11.04
APO11.05
BAI02.04
BAI03.06
BAI03.08
BAI07.03
BAI07.05
APO01.06
APO03.02
APO08.01
APO09.03
APO13.01
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
DSS05.05
DSS06.06
APO01.06
APO03.01
APO03.02
APO09.01
APO09.01
BAI06.03
BAI09.01
BAI10.01
BAI10.02
BAI10.03
BAI10.04
BAI10.05
APO01.06
APO03.02
APO08.01
APO13.01
APO13.02
DSS05
DSS06
APO01.06
APO03.02
APO08.01
APO09.03
APO13.01
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
DSS05.05
DSS06.06
APO01.06
APO13.01
BAI09.03
DSS01.01
APO01.06
APO03.02
APO08.01
APO09.03
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
DSS05.05
DSS06.06
APO13.01
DSS01.04
DSS01.05
DSS04.01
DSS04.03
APO13.01
APO13.02
APO09.03
BAI06.01
BAI09.01
BAI09.02
BAI09.03
APO13.01
DSS05.02
DSS05.03
DSS06.06
APO01.06
BAI09.02
BAI09.03
APO01.06
APO03.02
APO13.01
APO13.02
BAI02.01
BAI02.03
BAI02.04
BAI06.01
BAI10.01
BAI10.02
MEA02.01
CC3.2
CC3.1
CC3.1
CC7.1
CC7.1
CC7.1
CC7.1
CC7.4
CC3.1
CC3.1
CC5.7
PI1.5
CC5.1
C1.3
CC5.6
CC3.1
CC3.1
Domain 5
CC5.5
CC5.7
CC5.6
CC5.7
CC5.6
CA-3
RA-2
RA-3
MP-8
PM-9
SI-12
PCI DSS v2.0

12.1 PCI DSS v2.0

12.1.2 EDM03.02
APO01.03
APO12.01
APO12.02
APO12.03
APO12.04
BAI09.01
AR-2 Privacy Impact and
Risk Assessment
A.12.1.1
A.15.2.2
Commandment #2
Commandment #4
Commandment #5
Commandment
#11
Chapter II, Article 19 and
Chapter VI, Section I, Article
39 312.8 and 312.10 shared x CM-2
SA-2
SA-4
PCI DSS v1.2

1.1 PCI DSS v1.2

1.1.1 PCI DSS v1.2

1.1.2 PCI DSS v1.2

1.1.3 PCI DSS v1.2

1.1.4 PCI DSS v1.2

1.1.5 PCI DSS v1.2

1.1.6 PCI DSS v1.2

2.2 PCI DSS v1.2

2.2.1 PCI DSS v1.2

2.2.2 PCI DSS v1.2

2.2.3 PCI DSS v1.2

2.2.4 Governance and Risk
Management
Risk Assessments
GRM02Risk assessments associated with data governance requirements shall be conducted at planned intervals and shall consider the following:
• Awareness of where sensitive data is stored and transmitted across applications, databases, servers, and network infrastructure • Compliance with defined retention periods and end-of-life disposal requirements
• Data classification and protection from unauthorized use, access, loss, destruction, and falsification
S3.1.0
C3.14.0
S1.2.b-c
(S3.1.0) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(C3.14.0) Procedures exist to provide that system
data are classified in accordance with the defined
confidentiality and related security policies.
(S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to
define protection requirements, access rights and
access restrictions, and retention and destruction
policies.
c. Assessing risks on a periodic basis.

L.4, L.5, L.6,
L.7
34 (B) Schedule 1
(Section 5), 4.7 -
Safeguards
DG-08 COBIT 4.1 PO

9.1, PO 9.2, PO

9.4, DS 5.7
Domain 5 6.01. (d)

6.04.03. (a)
Article 6, Article 8, Article 17
(1)
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SI-12
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SI-12

1.2.4 8.2.1
45 CFR
164.308(a)(1)(ii)
(A) (New)
45 CFR
164.308(a)(8)
(New)
Clause 4.2.1 c) &
g)
Clause 4.2.3 d)
Clause 4.3.1 &

4.3.3 Clause 7.2 & 7.3
A.7.2
A.15.1.1
A.15.1.3
A.15.1.4
EAR 15
CFR
§736.2 (b)
Commandment #1
Commandment #2
Commandment #3
Commandment #6
Commandment #7
Commandment #9
Commandment
#10
Commandment
#11
45 CFR 164.312
(a)(2)(iv)
45 CFR 164.312
(e)(1)
45 CFR 164.312
(e)(2)(ii)
A.10.6.1
A.10.8.3
A.10.8.4
A.10.9.2
A.10.9.3
A.12.3.1
A.15.1.3
A.15.1.4
Commandment #4
Commandment #5
Commandment #9
Commandment
#10
Commandment
#11
Encryption & Key
Management
Key Generation
EKM02Policies and procedures shall be established for the management of cryptographic keys in the service's cryptosystem (e.g., lifecycle management from key generation to revocation and replacement, public key infrastructure, cryptographic protocol design and algorithms used, access controls in place for secure key generation, and exchange and storage including segregation of keys used for encrypted data or sessions). Upon request, provider shall inform the customer (tenant) of changes within the cryptosystem, especially if the customer (tenant) data is used as part of the service, and/or the customer (tenant) has some shared responsibility over
implementation of the control.

CIP-003-3 -
R4.2
AC-18
IA-3
IA-7
SC-7
SC-8
SC-9
SC-13
SC-16
SC-23
SI-8
PCI-DSS v2.0

2.1.1 PCI-DSS v2.0

3.4 PCI-DSS v2.0

3.4.1 PCI-DSS v2.0

4.1 PCI-DSS v2.0

4.1.1 PCI DSS v2.0

4.2 Encryption & Key
Management
Storage and Access
EKM04Platform and data appropriate encryption (e.g., AES-256) in open/validated formats and standard algorithms shall be required.

Keys shall not be stored in the cloud (i.e. at the cloud provider in question), but maintained by the cloud consumer or trusted key management provider. Key management and key usage shall be separated duties.

Governance and Risk
Management
Baseline Requirements
GRM01Baseline security requirements shall be established for developed or acquired, organizationally-owned or managed, physical or virtual, applications and infrastructure system and network components that comply with applicable legal, statutory and regulatory compliance obligations. Deviations from standard baseline configurations must be authorized following change management policies and procedures prior to deployment, provisioning, or use.

Compliance with security baseline requirements must be reassessed at least annually unless an alternate frequency has been established and established and authorized based on business need.

S1.1.0
S1.2.0(ai)
(S1.1.0) The entity’s security policies are
established and periodically reviewed and
approved by a designated individual or group.
(S1.2.0(a-i)) The entity's security policies include,
but may not be limited to, the following matters:

L.2 L.2, L.5, L.7
L.8, L.9, L.10
12 (B)
14 (B)
13 (B)
15 (B)
16 (C+,
A+)
21 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards
IS-04 COBIT 4.1 AI2.1
COBIT 4.1 AI2.2
COBIT 4.1 AI3.3
COBIT 4.1 DS2.3
COBIT 4.1 DS11.6
Domain 2 6.03.01. (a)

6.03.04. (a)

6.03.04. (b)

6.03.04. (c)

6.03.04. (e)

6.07.01. (o)
Article 17 NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SC-30

1.2.6 8.2.1

8.2.7 Encryption & Key
Management
Encryption
EKM03Policies and procedures shall be established, and supporting business processes and technical measures implemented, for the use of encryption protocols for protection of sensitive data in storage (e.g., file servers, databases, and end-user workstations) and data in transmission (e.g., system interfaces, over public networks, and electronic messaging) as per applicable legal, statutory, and regulatory compliance obligations.

C3.12.0
S3.6.0
S3.4
(C3.12.0, S3.6.0) Encryption or other equivalent
security techniques are used to protect
transmissions of user authentication and other
confidential information passed over the Internet
or other public networks.
(S3.4) Procedures exist to protect against
unauthorized access to system resources.

G.4
G.15
I.3
G.10.4, G.11.1,
G.11.2, G.12.1,
G.12.2, G.12.4,
G.12.10,
G.14.18,
G.14.19,
G.16.2,
G.16.18,
G.16.19,
G.17.16,
G.17.17,
G.18.13,
G.18.14,
G.19.1.1,
G.20.14
23 (B)
24 (B)
25 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-18 COBIT 4.1 DS5.8
COBIT 4.1 DS5.10
COBIT 4.1 DS5.11
Domain 2 6.04.05. (a)

6.04.05. (c)
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-23
NIST SP 800-53 R3 SC-28
NIST SP 800-53 R3 SI-8

8.1.1 8.2.1

8.2.5 45 CFR 164.310
(a)(1)
45 CFR 164.310
(a)(2)(ii)
45 CFR
164.308(a)(3)(ii)
(A) (New)
45 CFR 164.310
(a)(2)(iii) (New)
A.5.1.1
A.9.1.3
A.9.1.5
Commandment #1
Commandment #2
Commandment #3
Commandment #5
CIP-006-
3c R1.2 -
R1.3 -
R1.4 -R2 -
R2.2
PE-2
PE-3
PE-4
PE-5
PE-6
PCI DSS v2.0

9.1 PCI DSS v2.0

9.2 PCI DSS v2.0

9.3 PCI DSS v2.0

9.4 (S3.6.0) Encryption or other equivalent security
techniques are used to protect transmissions of
user authentication and other confidential
information passed over the Internet or other
public networks.
(S3.4) Procedures exist to protect against
unauthorized access to system resources.

L.6 38 (B)
39 (C+)
IS-19 COBIT 4.1 DS5.8 Domain 2 6.04.04. (a)

6.04.04. (b)

6.04.04. (c)

6.04.04. (d)

6.04.04. (e)

6.04.05. (d)

6.04.05. (e)

6.04.08.02. (b)
Article 17 NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-12 (2)
NIST SP 800-53 R3 SC-12 (5)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-17

8.1.1 8.2.1

8.2.5 45 CFR 164.312
(a)(2)(iv)
45 CFR
164.312(e)(1)
(New)
Clause 4.3.3
A.10.7.3
A.12.3.2
A.15.1.6
Commandment #9
Commandment
#10
Commandment
#11
SC-12
SC-13
SC-17
SC-28
PCI-DSS v2.0

3.4.1 PCI-DSS v2.0

3.5 PCI-DSS v2.0

3.5.1 PCI-DSS v2.0

3.5.2 PCI-DSS v2.0

3.6 PCI-DSS v2.0

3.6.1 PCI-DSS v2.0

3.6.2 PCI-DSS v2.0

3.6.3 PCI-DSS v2.0

3.6.4 PCI-DSS v2.0

3.6.5 PCI-DSS v2.0

3.6.6 PCI-DSS v2.0

3.6.7 PCI-DSS v2.0

3.6.8 Datacenter Security 99.31.a.1.ii
Policy
DCS06Policies and procedures shall be established, and supporting business processes implemented, for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas.

A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.

H.6 F.1.2.3,
F.1.2.4,
F.1.2.5,
F.1.2.6,
F.1.2.8, F.1.2.
9, F.1.2.10,
F.1.2.11,
F.1.2.12,
F.1.2.13,
F.1.2.14,
F.1.2.15,
F.1.2.24,
F.1.4.2,
F1.4.6,
F.1.4.7, F.1.7,
F.1.8, F.2.13,
F.2.14, F.2.15,
F.2.16, F.2.17,
F.2.18
7 (B) Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-01 COBIT 4.1 DS5.7,
DS 12.1, DS 12.4
DS 4.9
Domain 8 6.08. (a)

6.09. (i)
Article 17 NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-4
NIST SP 800-53 R3 PE-5
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-6 (1)

8.2.1 8.2.2

8.2.3 CIP-007-3 -
R7 - R7.1 -
R7.2 R7.3
MP-6
PE-1
PCI DSS v2.0

3.1.1 PCI DSS v2.0

9.10 PCI DSS v2.0

9.10.1 PCI DSS v2.0

9.10.2 PCI DSS v2.0

3.1 Datacenter Security
Asset Management
DCS01Assets must be classified in terms of business criticality, service-level expectations, and operational continuity requirements. A complete inventory of business-critical assets located at all sites and/or geographical locations and their usage over time shall be maintained and updated regularly, and assigned ownership y defined roles and responsibilities.

S3.1.0
C3.14.0
S1.2.b-c
(S3.1.0) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(C3.14.0) Procedures exist to provide that system
data are classified in accordance with the defined
confidentiality and related security policies.
(S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to
define protection requirements, access rights and
access restrictions, and retention and destruction
policies.
c. Assessing risks on a periodic basis.

Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-08 Domain 8 Article 17 45 CFR 164.310
(d)(2)(iii)
A.7.1.1
A.7.1.2
Data Security &
Information Lifecycle
Management
Secure Disposal
DSI-07 Any use of customer data in non-production environments requires explicit, documented approval from all customers whose data is affected, and must comply with all legal and regulatory requirements for scrubbing of sensitive data elements.

PCI DSS v2.0

9.9.1 PCI DSS v2.0

12.3.3 PCI DSS v2.0

12.3.4 NIST SP800-53 R3 CM-8
BOSS > Data
Governance >
Secure Disposal
of Data
C3.5.0
S3.4.0
(C3.5.0) The system procedures provide that
confidential information is disclosed to parties only
in accordance with the entity’s defined
confidentiality and related security policies.
(S3.4.0) Procedures exist to protect against
unauthorized access to system resources.

D.2.2.10,
D.2.2.11,
D.2.2.14,
37 (B) Schedule 1
(Section 5) 4.5 -
Limiting Use,
Disclosure and
Retention, Subsec.

4.7.5 and 4.5.3
DG-05 COBIT 4.1 DS

11.4 Domain 5 6.03. (h) Article 16
Article 17
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 MP-6 (4)
NIST SP 800-53 R3 PE-1

5.1.0 5.2.3
AC-14
AC-21
AC-22
IA-8
AU-10
SC-4
SC-8
SC-9
PCI-DSS v2.0

2.1.1 PCI-DSS v2.0

4.1 PCI-DSS v2.0

4.1.1 PCI DSS v2.0

4.2 A.7.2.2
A.10.7.1
A.10.7.3
A.10.8.1
Commandment #8
Commandment #9
Commandment
#10
Chapter II
Article 8, 9, 11, 12, 14, 18, 19,
20, 21
CIP-003-3 -
R4 - R4.1
AC-16
MP-1
MP-3
PE-16
SI-12
SC-9
PCI DSS v2.0

9.5 PCI DSS v2.0

9.6 PCI DSS v2.0

9.7.1 PCI DSS v2.0

9.7.2 PCI DSS v2.0

9.10 SRM >
Cryptographic
Services > Data in
Transit Encryption
shared
45 CFR 164.310
(d)(2)(i)
45 CFR 164.310
(d)(2)(ii)
A.9.2.6
A.10.7.2
Commandment
#11
Data Security &
Information Lifecycle
Management
Handling / Labeling /
Security Policy
DSI-04 Policies and procedures shall be established for labeling, handling, and the security of data and objects which contain data.

Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data.

S3.2.a (S3.2.a) a. Logical access security measures to
restrict access to information resources not
deemed to be public.

G.13 D.2.2 DG-03 COBIT 4.1 PO

2.3, DS 11.6
Domain 5 6.03.05. (b) Article 22
Article 23
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-12
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-16
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-3
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-12

1.1.2 5.1.0

7.1.2 8.1.0

8.2.5 8.2.6
Data Security &
Information Lifecycle
Management
Data Inventory / Flows
DSI-02 Policies and procedures shall be established to inv entory , document, and maintain data f lows f or data that is resident (permanently or temporarily ) within the serv ice's applications and inf rastructure network and sy stems. In particular, prov iders shall ensure that data that is subject to geographic residency requirements not be migrated bey ond its def ined bounds.

Data Security &
Information Lifecycle
Management
eCommerce
Transactions
DSI-03 Data related to electronic commerce (e-commerce) that traverses public networks shall be appropriately classified and protected from fraudulent activity, unauthorized disclosure, or modification in such a manner to prevent contract dispute and compromise of data.

S3.6
I13.3.a-e
I3.4.0
(S3.6) Encryption or other equivalent security
techniques are used to protect transmissions of
user authentication and other confidential
information passed over the Internet or other
public networks.
(I13.3.a-e) The procedues related to
completeness, accuracy, timeliness, and
authorization of system processing, including error
correction and database management, are
consistent with documented system processing
integrity policies.
(I3.4.0) The procedures related to completeness,
accuracy, timeliness, and authorization of outputs
are consistent with the documented system
processing integrity policies.

G.4
G.11
G.16
G.18
I.3
I.4
G.19.1.1,
G.19.1.2,
G.19.1.3,
G.10.8, G.9.11,
G.14, G.15.1
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-28 COBIT 4.1 DS

5.10 5.11
Domain 2 Article 17
PCI DSS v2.0

1.1.1 PCI DSS v2.0

6.1 PCI DSS v2.0

6.4 Data Security &
Information Lifecycle
Management
Classification
DSI-01 Data and objects containing data shall be assigned a classification by the data owner based on data type, value, sensitivity, and criticality to the organization.

S3.8.0
C3.14.0
(S3.8.0) Procedures exist to classify data in
accordance with classification policies and
periodically monitor and update such
classifications as necessary.
(C3.14.0) Procedures exist to provide that system
data are classified in accordance with the defined
confidentiality and related security policies.

D.1.3, D.2.2 DG-02 COBIT 4.1 PO

2.3, DS 11.6
Domain 5 6.04.03. (a) Article 4 (1),
Article 12, Article 17
NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 AC-4

1.2.3 1.2.6

4.1.2 8.2.1

8.2.5 8.2.6
A.7.2.1 Commandment #9
Change Control &
Configuration
Management
Quality Testing
CCC-03 Organization shall follow a defined qualty change control and testing process (e.g. ITIL Service Management) with established baselines, testing and release standards which focus on system availability, confidentiality and integrity of systems and services
General Provisions, Article 3,
V. and VI.

CIP-003-3 -
R4 - R5
RA-2
AC-4
PCI DSS v2.0

9.7.1 PCI DSS v2.0

9.10 PCI DSS v2.0

12.3 None 6.03.01. (b)

6.03.01. (d)
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)

9.1.0 9.1.1

9.2.1 9.2.2
A.6.1.3
A.10.1.1
A.10.1.4
A.10.3.2
A.12.1.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.1
A.12.5.2
A.12.5.3
A.12.6.1
A.13.1.2
A.15.2.1
A.15.2.2
Commandment #1
Commandment #2
Commandment #3
Domain 11
A.6.1.1
A.12.1.1
A.12.1.4
A.14.2.9
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5

8.1* partial
A.14.2.2

8.1* partial
A.14.2.3

8.1* partial
A.14.2.4
A.12.6.1
A.16.1.3
A.18.2.2
A.18.2.3
A.8.2.1
Clause

4.2 5.2,

7.5,

8.1 A.8.2.1
A.13.1.1
A.13.1.2
A.14.1.2
A.14.1.3
A.18.1.4
A.8.2.2
A.8.3.1
A.8.2.3
A.13.2.1
A.11.2.7
A.8.3.2
Annex A.8
A.11.1.1
A.11.1.2
Clauses

5.2(c)

5.3(a)

5.3(b)

7.5.3(b)

7.5.3(d)

8.1 8.3

9.2(g)
A.8.2.3
A.10.1.2
A.18.1.5
A.13.1.1
A.8.3.3
A.13.2.3
A.14.1.3
A.14.1.2
A.10.1.1
A.18.1.3
A.18.1.4
Annex
A.10.1
A.10.1.1
A.10.1.2
A3.13.0
C3.16.0
I3.14.0
S3.10.0
S3.13
(A3.13.0, C3.16.0, I3.14.0, S3.10.0) Design,
acquisition, implementation, configuration,
modification, and management of infrastructure
and software are consistent with defined system
availability, confidentiality of data, processing
integrity, systems security and related security
policies.
(S3.13) Procedures exist to provide that only
authorized, tested, and documented changes are
made to the system.

C.1.7, G.1, G.6,
I.1, I.4.5,
I.2.18, I.22.1,
I.22.3, I.22.6,
I.2.23,
I.2.22.2,
I.2.22.4,
I.2.22.7.

I.2.22.8,
I.2.22.9,
I.2.22.10,
I.2.22.11,
I.2.22.12,
I.2.22.13,
I.2.22.14,I.2.2
0, I.2.17,
I.2.7.1, I.3,
J.2.10, L.9
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RM-03 COBIT 4.1 PO 8.1
A.14.1.1
A.18.2.3
Clauses

5.2(c)

5.3(a)

5.3(b)

6.1.2 6.1.2(a)(2)

6.1.3(b)

7.5.3(b)

7.5.3(d)

8.1 8.2

8.3 9.2(g)
A.18.1.1
A.18.1.3
A.18.1.4
A.8.2.2
CM-1
CM-2
SA-3
SA-4
SA-5
SA-8
SA-10
SA-11
SA-13
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-22
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AC-22
NIST SP 800-53 R3 AU-10
NIST SP 800-53 R3 AU-10 (5)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)

3.2.4 4.2.3

7.1.2 7.2.1

7.2.2 8.2.1

8.2.5 45 CFR
164.312(e)(1)
45 CFR
164.312(e)(2)(i)
A.7.2.1
A.10.6.1
A.10.6.2
A.10.9.1
A.10.9.2
A.15.1.4
Commandment #4
Commandment #5
Commandment #9
Commandment
#10
Commandment
#11
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 282
#2..
- 326 -
GRM04.1
An Information Security Management Program (ISMP) shall be developed, documented, approved, and implemented that includes administrative, technical, and physical safeguards to protect assets and data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. The security program shall include, but not be limited to, the following areas insofar as they relate to the characteristics of the business:
• Risk management
• Security policy
• Organization of information security
• Asset management
• Human resources security
• Physical and environmental security
• Communications and operations management
• Access control
• Information systems acquisition, development, and maintenance Do you provide tenants with documentation describing your Information Security Management Program (ISMP)?
GRM04.2Do you review your Information Security Management Program (ISMP) least once a year?
Governance and Risk
Management
Management Support
/ Involvement
GRM05GRM05.1Executive and line management shall take formal action to support information security through clearly-documented direction and commitment, and shall ensure the action has been assigned.

Do you ensure your providers adhere to your information security and privacy policies?
S1.3.0 (S1.3.0) Responsibility and accountability for
developing and maintaining the entity’s system
security policies, and changes and updates to
those policies, are assigned.

The entity has prepared an objective description of
the system and its boundaries and communicated
such description to authorized users
The security obligations of users and the entity’s
security commitments to users are communicated
CC1.2 C.1 5 (B) Schedule 1
(Section 5), 4.1
Safeguards,
Subsec. 4.1.1
IS-02 COBIT 4.1 DS5.1 APO01.02
APO01.03
APO01.04
APO01.08
APO13.01
APO13.02
APO13.03
312.8 and 312.10 SRM >
Governance Risk
& Compliance >
Compliance
Management
shared x Domain 2 Article 17 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-1 8.2.1 45 CFR 164.316 (b)(2)(ii)
45 CFR 164.316
(b)(2)(iii)
Clause 5
A.6.1.1
All in section 5
plus clauses

4.4 4.2(b)

6.1.2(a)(1)

6.2 6.2(a)

6.2(d)

7.1 7.4

9.3 Commandment #3
Commandment #6
Chapter VI, Section I, Article
39 CIP-003-3 -
R1 - R1.1
CM-1
PM-1
PM-11

4.1 PCI DSS v2.0

12.5 12.4
GRM06.1Do your information security and privacy policies align with industry standards (ISO-27001, ISO-22307, CoBIT, etc.)?
GRM06.2Do you have agreements to ensure your providers adhere to your information security and privacy policies?
GRM06.3Can you provide evidence of due diligence mapping of your controls, architecture and processes to regulations and/or standards? GRM06.4Do you disclose which controls, standards, certifications and/or regulations you comply with?
GRM07.1Is a formal disciplinary or sanction policy established for employees who have violated security policies and procedures?
GRM07.2Are employees made aware of what actions could be taken in the event of a violation via their policies and procedures? Governance and Risk
Management
Business / Policy
Change Impacts
GRM08GRM08.1Risk assessment results shall include updates to security policies, procedures, standards, and controls to ensure that they remain relevant and effective.

Do risk assessment results include updates to security policies, procedures, standards and controls to ensure they remain relevant and effective?
B.2
G.21
L.2
B.1.1, B.1.2,
B.1.6, B.1.7.2,
G.2, L.9, L.10
Schedule 1
(Section 5), 4.7 -
Safeguards
RI-04 COBIT 4.1 PO 9.6 APO12
APO13.01
APO13.03
312.8 and 312.10 BOSS >
Operational Risk
Management >
Risk
Management
Framework
shared x Domain 2,
4 6.03. (a) Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
Clause 4.2.3
Clause 4.2.4
Clause 4.3.1
Clause 5
Clause 7
A.5.1.2
A.10.1.2
A.10.2.3
A.14.1.2
A.15.2.1
A.15.2.2
Clause

4.2.1 a,

4.2(b)

4.3 c,

4.3(a&b)

4.4 5.1(c)

5.1(d)

5.1(e)

5.1(f)

5.1(g)

5.1(h)

5.2 5.2 e,

5.2(f)

5.3 6.1.1(e)(2),

6.1.2(a)(1)

6.2 CIP-009-3 -
R2
CP-2
RA-2
RA-3
AR-2 Privacy Impact and
Risk Assessment

4.3 PCI DSS v2.0

12.1.3 12.2
GRM09.1Do you notify your tenants when you make material changes to your information security and/or privacy policies?
GRM09.2Do you perform, at minimum, annual reviews to your privacy and security policies?
GRM10.1Are formal risk assessments aligned with the enterprise-wide framework and performed at least annually, or at planned intervals, determining the likelihood and impact of all identified risks, using qualitative and quantitative methods?
GRM10.2Is the likelihood and impact associated with inherent and residual risk determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance)?
GRM11.1Do you have a documented, organization-wide program in place to manage risk?
GRM11.2Do you make available documentation of your organization-wide risk management program?
HRS-01.1 Are systems in place to monitor for privacy breaches and notify tenants expeditiously if a privacy event may have impacted their data?
HRS-01.2 Is your Privacy Policy aligned with industry standards? Human Resources
Background Screening
HRS02HRS-02.1 Pursuant to local laws, regulations, ethics, and contractual constraints, all employment candidates, contractors, and third parties shall be subject to background verification proportional to the data classification to be accessed, the business requirements, and acceptable risk.

Pursuant to local laws, regulations, ethics and contractual constraints, are all employment candidates, contractors and involved third parties subject to background verification? S3.11.0 (S3.11.0) Procedures exist to help ensure that
personnel responsible for the design,
development, implementation, and operation of
systems affecting confidentiality and security have
the qualifications and resources to fulfill their
responsibilities.

CC1.3
CC1.4
E.2 E.2 63 (B)
HR-01
Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
COBIT 4.1 PO 7.6 APO07.01
APO07.05
APO07.06
312.8 and 312.10 BOSS > Human
Resources
Security >
Background
Screening
shared x None 6.01. (a) Article 17 NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-3
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-3

1.2.9 A.8.1.2 A.7.1.1 ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #2
Commandment #3
Commandment #6
Commandment #9
CIP-004-3 -
R2.2
PS-2
PS-3

9.29 PA27 BSGP PCI DSS v2.0

12.7 PCI DSS v2.0

12.8.3 12.7

12.8.3 HRS-03.1 Do you specifically train your employees regarding their specific role and the information security controls they must fulfill? HRS-03.2 Do you document employee acknowledgment of training they have completed?
HRS-03.3 Are all personnel required to sign NDA or Confidentiality Agreements as a condition of employment to protect customer/tenant information?
HRS-03.4 Is successful and timed completion of the training program considered a prerequisite for acquiring and maintaining access to sensitive systems?
HRS-03.5 Are personnel trained and provided with awareness programs at least once a year?
HRS-04.1 Are documented policies, procedures and guidelines in place to govern change in employment and/or termination?
HRS-04.2 Do the above procedures and guidelines account for timely revocation of access and return of assets?
Human Resources
Portable / Mobile
Devices
HRS05HRS-05.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to manage business risks associated with permitting mobile device access to corporate resources and may require the implementation of higher assurance compensating controls and acceptable-use policies and procedures (e.g., mandated security training, stronger identity, entitlement and access controls, and device monitoring).

Are policies and procedures established and measures implemented to strictly limit access to your sensitive data and tenant data from portable and mobile devices (e.g. laptops, cell phones and personal digital assistants (PDAs)), which are generally higher-risk than nonportable devices (e.g., desktop computers at the provider organization’s facilities)?
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

CC5.6 G.11, G12,
G.20.13,
G.20.14
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-32 COBIT 4.1 DS5.11
COBIT 4.1 DS5.5
APO01.08
APO13.01
APO13.02
DSS05.01
DSS05.02
DSS05.03
DSS05.07
DSS06.03
DSS06.06
312.8 and 312.10 Presentation
Services >
Presentation
Platform >
Endpoints -
Mobile Devices -
Mobile Device
Management
shared x Domain 2 Article 17 NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-19
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-17 (1)
NIST SP 800-53 R3 AC-17 (2)
NIST SP 800-53 R3 AC-17 (3)
NIST SP 800-53 R3 AC-17 (4)
NIST SP 800-53 R3 AC-17 (5)
NIST SP 800-53 R3 AC-17 (7)
NIST SP 800-53 R3 AC-17 (8)
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 AC-19
NIST SP 800-53 R3 AC-19 (1)
NIST SP 800-53 R3 AC-19 (2)
NIST SP 800-53 R3 AC-19 (3)
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-2 (1)
NIST SP 800-53 R3 MP-4
NIST SP 800-53 R3 MP-4 (1)
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 MP-6 (4)

1.2.6 3.2.4

19.1 19.2

19.3 PA33
PA34
SGP
SGP
PCI DSS v2.0

9.7 PCI DSS v2.0

9.7.2 PCI DSS v2.0

9.8 PCI DSS v2.0

9.9 PCI DSS v2.0

11.1 PCI DSS v2.0

12.3 11.1

12.3 Human Resources
Nondisclosure
Agreements
HRS06HRS-06.1 Requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details shall be identified, documented, and reviewed at planned intervals.

Are requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details identified, documented and reviewed at planned intervals?
S4.1.0 (S4.1.0) The entity’s system availability,
confidentiality, processing integrity and security
performance is periodically reviewed and
compared with the defined system availability and
related security policies.

CC4.1 C.2.5 Schedule 1
(Section 5), 4.7 -
Safeguards
LG-01 APO01.02
APO01.03
APO01.08
APO07.06
APO09.03
APO10.04
APO13.01
APO13.03
312.8 and 312.10 BOSS >
Compliance >
Intellectual
Property
Protection
shared x Domain 3 Article 16 NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)

1.2.5 ISO/IEC
27001:2005
Annex A.6.1.5
A.13.2.4 ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #6
Commandment #7
Commandment #8
Commandment #9
PL-4
PS-6
SA-9
DI-2 DATA INTEGRITY

AND DATA INTEGRITY
BOARD
a. Documents processes
to ensure the integrity of
personally identifiable
information (PII) through
existing security controls;
and
PA7 BSGP PCI DSS v2.0

12.8.2 PCI DSS v2.0

12.8.3 PCI DSS v2.0

12.8.4 Human Resources
Roles / Responsibilities
HRS07HRS-07.1 Roles and responsibilities of contractors, employees, and third-party users shall be documented as they relate to information assets and security.

Do you provide tenants with a role definition document clarifying your administrative responsibilities versus those of the tenant? S1.2.f (S1.2.f) f. Assigning responsibility and
accountability for system availability,
confidentiality, processing integrity and related
security.

B.1 B.1.5,
D.1.1,D.1.3.3,
E.1, F.1.1,
H.1.1, K.1.2
5 (B) Schedule 1
(Section 5) 4.1
Accountability
IS-13 COBIT 4.1 DS5.1 APO01.02
APO01.03
APO01.08
APO07.06
APO09.03
APO10.04
APO13.01
APO13.03
312.3, 312.8 and
312.10
BOSS > Human
Resources
Security > Roles
and
Responsibilities
shared x Domain 2 Article 17 NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7

99.31(a)(1)(ii) 1.2.9

8.2.1 Clause 5.1 c)
A.6.1.2
A.6.1.3
A.8.1.1
Clause 5.3
A.6.1.1
A.6.1.1
Commandment #6
Commandment #7
Commandment #8
AT-3
PL-4
PM-10
PS-1
PS-6
PS-7
AR-1 GOVERNANCE AND

PRIVACY PROGRAM
Control: The organization:

Supplemental Guidance:

The development and
implementation of a
comprehensive
governance and privacy
program demonstrates
organizational
accountability for and
commitment to the
protection of individual

2.2 PA9
PA24
BSGP 12.8.5
HRS-08.1 Do you provide documentation regarding how you may or access tenant data and metadata?
HRS-08.2 Do you collect or create metadata about tenant data usage through inspection technologies (search engines, etc.)?
HRS-08.3 Do you allow tenants to opt out of having their data/metadata accessed via inspection technologies?
HRS-09.1 Do you provide a formal, role-based, security awareness training program for cloud-related access and data management issues (e.g., multi-tenancy, nationality, cloud delivery model segregation of duties implications and conflicts of interest) for all persons with access to tenant data?
HRS-09.2 Are administrators and data stewards properly educated on their legal responsibilities with regard to security and data integrity? HRS-10.1 Are users made aware of their responsibilities for maintaining awareness and compliance with published security policies, procedures, standards and applicable regulatory requirements? HRS-10.2 Are users made aware of their responsibilities for maintaining a safe and secure working environment?
HRS-10.3 Are users made aware of their responsibilities for leaving unattended equipment in a secure manner?
HRS-11.1 Do your data management policies and procedures address tenant and service level conflicts of interests?
HRS-11.2 Do your data management policies and procedures include a tamper audit or software integrity function for unauthorized access to tenant data?
HRS-11.3 Does the virtual machine management infrastructure include a tamper audit or software integrity function to detect changes to the build/configuration of the virtual machine?
IAM-01.1 Do you restrict, log and monitor access to your information security management systems? (E.g., hypervisors, firewalls, vulnerability scanners, network sniffers, APIs, etc.)
IAM-01.2 Do you monitor and log privileged access (administrator level) to information security management systems?
IAM-02.1 Do you have controls in place ensuring timely removal of systems access that is no longer required for business purposes? IAM-02.2 Do you provide metrics to track the speed with which you are able to remove systems access that is no longer required for business purposes?
Identity & Access
Management
Diagnostic /
Configuration Ports
Access
IAM03IAM-03.1 User access to diagnostic and configuration ports shall be restricted to authorized individuals and applications.

Do you use dedicated secure networks to provide management access to your cloud service infrastructure?
S3.2.g (S3.2.g) g. Restriction of access to system
configurations, superuser functionality, master
passwords, powerful utilities, and security devices
(for example, firewalls).

CC5.1 H1.1, H1.2,
G.9.15
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-30 COBIT 4.1 DS5.7 APO13.01
DSS05.02
DSS05.03
DSS05.05
DSS06.06
312.8 and 312.10 SRM > Privilege
Management
Infrastructure >
Privilege Usage
Management -
Resource
Protection
provider x Domain 2 NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)

8.2.2 A.10.6.1
A.11.1.1
A.11.4.4
A.11.5.4
A.13.1.1
A.9.1.1
A.9.4.4
Commandment #3
Commandment #4
Commandment #5
Commandment #6
Commandment #7
Commandment #8
CIP-007-3 -
R2
CM-7
MA-3
MA-4
MA-5

15.4 PCI-DSS v2.0

9.1.2 1.2.2

7.1 7.1.2

7.1.3 7.2

7.2.3 9.1.2

9.1.3 IAM-04.1 Do you manage and store the identity of all personnel who have access to the IT infrastructure, including their level of access? IAM-04.2 Do you manage and store the user identity of all personnel who have network access, including their level of access?

9.3 12.3

12.6 12.4

8.1.8 10.5

7.1.2 7.1.4

7.2 8.1

8.1.5 8.5

3.5.1, 7.0

8.0 12.5.4

7.3 8.8

9.10 7.3, 8.8, 9.10, 12.1

12.2 12.1.1

12.2 12.2
PA27 BSGP
PA27 BSGP
BSGP
PA28 BSGP
PA30 BSGP
PA2
PA15
BSGP
SGP

1.1 3.3

5.1 5.2

5.3 5.4

7.1 12.2

17.7 18.1

18.3 3.2 (responsibility)

3.3 3.4

4.1 4.3

5.2 (residual Risk)

2.2 9.2

2.2 5.2

4.2 9.1

9.1 8.1

15.4 15.1

15.2 4.2

4.3 4.4

4.5 4.1

6.1 AR-2 Privacy Impact and
Risk Assessment
AR-5 PRIVACY

AWARENESS AND

TRAINING
Control: The organization:
a. Develops, implements,
and updates a
comprehensive training
and awareness strategy
aimed at ensuring that
personnel understand
privacy responsibilities
and procedures;
b. Administers basic
privacy training
[Assignment:
organization-defined
frequency, at least
annually] and targeted,
role-based privacy
training for personnel
having responsibility for
personally identifiable
information (PII) or for
activities that involve PII
[Assignment:
organization-defined
frequency, at least
annually]; and
c. Ensures that personnel
certify (manually or
electronically) acceptance
of responsibilities for
privacy requirements
[Assignment:

UL-1 INTERNAL USE
Control: The organization
uses personally
identifiable information
(PII) internally only for
the authorized purpose(s)
identified in the Privacy
Act and/or in public
notices.

99.31(a)(i)(ii)

99.31(a)(1)(ii)
SRM > Privilege
Management
Infrastructure >
Privilege Usage
Management
shared x
SRM > Policies
and Standards >
shared x
BOSS > Human
Resources
Security >
Employee
Awareness
shared x
BOSS > Data
Governance >
Clear Desk Policy
shared x
SRM > Policies
and Standards >
Information
Security Policies
SRM > InfoSec
Management >
Capabilitiy
Mapping
SRM > Policies
and Standards >
Information
Security Policies
shared x
SRM >
Governance Risk
& Compliance >
shared x
SRM >
Governance Risk
& Compliance >
Policy
Management
shared x
shared x
BOSS >
Operational Risk
Management >
Risk
Management
Framework
shared x
SRM > Policies
and Standards >
Information
Security Policies
shared x
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
APO01.02
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.04
DSS05.05
DSS05.06
DSS06.03
DSS06.06
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.02
DSS05.04
DSS06.06
APO01.03
APO01.08
APO07.04
APO12
APO13.01
APO13.03
MEA03.01
MEA03.02
APO12
EDM03.02
APO01.03
APO12
APO01.03
APO13.01
APO07.06
APO09.03
APO10.01
APO01.02
APO07.05
APO07.06
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.04
DSS06.06
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.03
DSS05.05
CC3.2
CC1.2
CC2.3
CC6.2
CC2.5
CC3.2
CC3.1
CC3.3
CC3.1
CC5.6
CC2.2
CC2.3
CC5.4
CC3.2
CC6.2
CC2.2
CC2.3
CC5.1
CC5.5
CC5.6
45 CFR 164.308
(a)(3)(i)
45 CFR 164.312
(a)(1)
45 CFR 164.312
(a)(2)(ii)
45 CFR
164.308(a)(4)(ii)
(B) (New)
45 CFR
164.308(a)(4)(ii)
(c ) (New)
A.11.1.1
A.11.2.1
A.11.2.4
A.11.4.1
A.11.5.2
A.11.6.1
S3.2.g Commandment #6
Commandment #7
Commandment #8
CIP-007-3 -
R5.1 -
R5.1.2
AC-1
IA-1
PCI DSS v2.0

3.5.1 PCI DSS v2.0

8.5.1 PCI DSS v2.0

12.5.4 Identity & Access
Management
Policies and Procedures
IAM04Policies and procedures shall be established to store and manage identity information about every person who accesses IT infrastructure and to determine their level of access. Policies shall also be developed to control access to network resources based on user identity.

Identity & Access
Management
User Access Policy
IAM02User access policies and procedures shall be established, and supporting business processes and technical measures
implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and customer (tenant) users with access to data and organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and measures must incorporate the following:
• Procedures and supporting roles and responsibilities for provisioning and de-provisioning user account entitlements following the rule of least privilege based on job function (e.g., internal employee and contingent staff personnel changes, customercontrolled access, suppliers' business relationships, or other thirdparty business relationships) • Business case considerations for higher levels of assurance and multi-factor authentication secrets (e.g., management interfaces, key generation, remote access, segregation of duties, emergency access, large-scale provisioning or geographically-distributed deployments, and personnel redundancy for critical systems) • Access segmentation to sessions and data in multi-tenant architectures by any third party (e.g., provider and/or other customer (tenant))
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or re-use when feasible
• Authentication, authorization, and accounting (AAA) rules for access to data and sessions (e.g., encryption and strong/multifactor, expireable, non-shared authentication secrets) • Permissions and supporting capabilities for customer (tenant) controls over authentication, authorization, and accounting (AAA) rules for access to data and sessions
• Adherence to applicable legal, statutory, or regulatory compliance requirements
S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to,
the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations,
superuser functionality, master passwords,
powerful utilities, and security devices (for
example, firewalls).

B.1 B.1.8, B.1.21,
B.1.28, E.6.2,
H.1.1, K.1.4.5,
8 (B)
40 (B)
41 (B)
42 (B)
43 (B)
44 (C+)
Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4; 4.7
Safeguards, Subs.

4.7.4 IS-07 COBIT 4.1 DS 5.4 Domain 2 6.01. (b)

6.01. (d)

6.02. (e)

6.03. (b)

6.03.04. (b)

6.03.04. (c)

6.03.05. (b)

6.03.05. (d)

6.03.06. (b)

6.04.01. (c)

6.04.01. (f)

6.04.02. (a)

6.04.02. (b)

6.04.02. (c)

6.04.03. (b)

6.04.06. (a)

6.04.08. (a)

6.04.08. (b)

6.04.08. (c)

6.04.08.03. (a)

6.04.08.03. (b)
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-7
NIST SP 800-53 R3 AC-14
NIST SP 800-53 R3 IA-1
Identity & Access
Management
Audit Tools Access
IAM01Access to, and use of, audit tools that interact with the organization's information systems shall be appropriately segmented and restricted to prevent compromise and misuse of log data.

S3.2.g (S3.2.g) g. Restriction of access to system
configurations, superuser functionality, master
passwords, powerful utilities, and security devices
(for example, firewalls).

Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-29 COBIT 4.1 DS 5.7 Domain 2 6.03. (i)

6.03. (j)
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-7
NIST SP 800-53 R3 AC-10
NIST SP 800-53 R3 AC-14
NIST SP 800-53 R3 IA-1

8.1.0 NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-9 (2)

8.2.1 A.15.3.2 Commandment #2
Commandment #5
Commandment
#11
CIP-003-3 -
R5.2
AU-9
AU-11
AU-14
PCI DSS v2.0

10.5.5 AT-2
AT-3
AT-4
PL-4
PCI DSS v2.0

8.5.7 PCI DSS v2.0

12.6.1 Human Resources
Workspace
HRS11Policies and procedures shall be established to require that unattended workspaces do not have openly visible (e.g., on a desktop) sensitive documents and user computing sessions had been disabled after an established period of inactivity.

S3.3.0
S3.4.0
(S3.3.0) Procedures exist to restrict physical access
to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.
(S3.4.0) Procedures exist to protect against
unauthorized access to system resources.

E.1 E.4 Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-17 Domain 2 NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-2

8.2.3 Clause 5.2.2
A.8.2.2
A.9.1.5
A.11.3.1
A.11.3.2
A.11.3.3
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #5
Commandment #6
Commandment #7
Commandment
#11
Human Resources
User Responsibility
HRS10All personnel shall be made aware of their roles and responsibilities for:
• Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations.
• Maintaining a safe and secure working environment
S2.3.0 (S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality,
processing integrity and security policies and
changes and updates to those policies are
communicated to entity personnel responsible for
implementing them.

E.1 E.4 65 (B)
66 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.4
IS-16 COBIT 4.1 PO 4.6 Domain 2 Article 17 NIST SP 800-53 R3 AT-2 NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 AC-11
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-2 (1)
NIST SP 800-53 R3 MP-3
NIST SP 800-53 R3 MP-4
NIST SP 800-53 R3 MP-4 (1)
CC3.2 APO01.02
APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
APO01.02
APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
DSS05.03
DSS06.06
312.8 and 312.10
312.8 and 312.10
45 CFR 164.308
(a)(5)(i)
45 CFR 164.308
(a)(5)(ii)(A)
Clause 5.2.2
A.8.2.2
Commandment #3
Commandment #6
SRM > GRC > shared x
AC-11
MP-2
MP-3
MP-4
Chapter VI, Section I, Article
39 and Chapyer VI, Section II,
Article 41
CIP-004-3 -
R1 - R2 -
R2.1
AT-1
AT-2
AT-3
AT-4
PCI DSS v2.0

12.6 PCI DSS v2.0

12.6.1 PCI DSS v2.0

12.6.2 1.2.10

8.2.1 45 CFR 164.308
(a)(5)(ii)(D)
Clause 5.2.2
A.8.2.2
A.11.3.1
A.11.3.2
Commandment #5
Commandment #6
Commandment #7
Chapter VI, Section I, Article
39 and Chapter VI, Section II,
Article 41
Human Resources
Training / Awareness
HRS09A security awareness training program shall be established for all contractors, third-party users, and employees of the organization and mandated when appropriate. All individuals with access to organizational data shall receive appropriate awareness training and regular updates in organizational procedures, processes, and policies relating to their professional function relative to the organization.

S1.2.k
S2.2.0
(S1.2.k) The entity's security policies include, but
may not be limited to, the following matters:
k. Providing for training and other resources to
support its system security policies
(S2.2.0) The security obligations of users and the
entity’s security commitments to users are
communicated to authorized users.

E.1 E.4 65 (B) Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4; 4.7
Safeguards, Subs.

4.7.4 IS-11 COBIT 4.1 PO 7.4 Domain 2 6.01. (c)

6.02. (e)
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4

1.2.10 8.2.1
APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
312.8 and 312.10
Human Resources
Acceptable Use
HRS08Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining allowances and conditions for permitting usage of organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. Additionally, defining allowances and conditions to permit usage of personal mobile devices and associated applications with access to corporate resources (i.e., BYOD) shall be considered and incorporated as appropriate.

S1.2
S3.9
(S1.2) The entity’s security policies include, but
may not be limited to, the following matters:
(S3.9) Procedures exist to provide that issues of
noncompliance with security policies are promptly
addressed and that corrective measures are taken
on a timely basis.

B.3 B.1.7, D.1.3.3,
E.3.2, E.3.5.1,
E.3.5.2
Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4
IS-26 COBIT 4.1 DS 5.3 Domain 2 Article 5, Article 6
Article 7
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-8
NIST SP 800-53 R3 AC-20
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 AC-8
NIST SP 800-53 R3 AC-20
NIST SP 800-53 R3 AC-20 (1)
NIST SP 800-53 R3 AC-20 (2)
NIST SP 800-53 R3 PL-4

8.1.0 45 CFR 164.310
(b)
A.7.1.3 Commandment #1
Commandment #2
Commandment #3
Human Resources
Employment
Termination
HRS04Roles and responsibilities for performing employment termination or change in employment procedures shall be assigned, documented, and communicated.

AC-8
AC-20
PL-4
PCI-DSS v2.0

12.3.5 312.8 and 312.10
312.4, 312.8 and
312.10
BOSS > Human
Resources
Security > Roles
and
Responsibilities
S3.2.d
S3.8.e
(S3.2.d) Procedures exist to restrict logical access
to the system and information resources
maintained in the system including, but not limited
to, the following matters:
d. The process to make changes and updates to
user profiles
(S3.8.e) e. Procedures to prevent customers,
groups of individuals, or other entities from
accessing confidential information other than their
own
E.6 HR-03 COBIT 4.1 PO 7.8 None Article 17 NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-8
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-8

8.2.2 10.2.5
GRM11Organizations shall develop and maintain an enterprise risk management framework to mitigate risk to an acceptable level. 45 CFR 164.308
(a)(3)(ii)(C)
A.8.3.1 Commandment #6
Commandment #7
312.3, 312.8 and
312.10
312.3, 312.8 and
312.10
BOSS > Human
Resources
Security >
Employee
Termination
provider x
BOSS > Human
Resources
Security >
Employee Code
of Conduct
shared x
shared x
45 CFR 164.308
(a)(3)(ii)(C)
A.7.1.1
A.7.1.2
A.8.3.2
Governance and Risk
Management
Program
PS-4
Human Resources
Employment
Agreements
HRS03Employment agreements shall incorporate provisions and/or terms for adherence to established information governance and security policies and must be signed by newly hired or on-boarded workforce personnel (e.g., full or part-time employee or contingent staff) prior to granting workforce personnel user access to corporate facilities, resources, and assets.

S2.2.0 (S2.2.0) The security obligations of users and the entity's security commitments to users are
communicated to authorized users
C.1 E.3.5 66 (B) Schedule 1
(Section 5) 4.7
Safeguards,
Subsec. 4.7.4
HR-02 COBIT DS 2.1 None Article 17 NIST SP 800-53 R3 PS1 NIST SP 800-53 R3 PS2
NIST SP 800-53 R3 PS6
NIST SP 800-53 R3 PS7
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7

1.2.9 8.2.6
45 CFR
164.310(a)(1)
(New)
45 CFR
164.308(a)(4)(i)
(New)
A.6.1.5
A.8.1.3
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #6
Commandment #7
PL-4
PS-6
PS-7
Human Resources
Asset Returns
HRS01Upon termination of workforce personnel and/or expiration of external business relationships, all organizationally-owned assets shall be returned within an established period.

S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

D.1 E.6.4 Schedule 1
(Section 5) 4.5
Limiting Use,
Disclosure and
Retention; 4.7
Safeguards, Subs.

4.7.5 IS-27 Domain 2 Article 17 NIST SP 800-53 R3 PS-4 NIST SP 800-53 R3 PS-4 5.2.3

7.2.2 8.2.1

8.2.6 APO01.08
APO07.06
APO13.01
BAI09.03
45 CFR 164.308
(a)(1)(ii)(A)
Clause 4.2.1 c)
through g)
Clause 4.2.3 d)
Clause 5.1 f)
Clause 7.2 & 7.3
A.6.2.1
A.12.5.2
A.12.6.1
A.14.1.2
A.15.1.1
A.15.2.1
A.15.2.2
CIP-002-3 -
R1.1 -
R1.2
CIP-005-
3a - R1 -
R1.2
CIP-009-3 -
R.1.1
PL-5
RA-2
RA-3
PCI DSS v2.0

12.1.2 BOSS >
Operational Risk
Management >
Risk
Management
Framework
S3.1
x3.1.0
(S3.1) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(x3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system [availability, processing
integrity, confidenitality] commitments and (2)
assess the risks associated with the identified
threats.

L.2 A.1, L.1 Schedule 1
(Section 5), 4.7 -
Safeguards
RI-01 COBIT 4.1 PO 9.1 Domain 2,
4 Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 CM-1
312.8 and 312.10 1.2.4 45 CFR 164.308
(a)(8)
45 CFR
164.308(a)(1)(ii)
(B) (New)
Clause 4.2.1 c)
through g)
Clause 4.2.2 b)
Clause 5.1 f)
Clause 7.2 & 7.3
A.6.2.1
A.12.6.1
A.14.1.2
A.15.2.1
A.15.2.2
Chapter II
Article 19
CIP-009-3 -
R4
AC-4
CA-2
CA-6
PM-9
RA-1
PCI DSS v2.0

12.1.2 Governance and Risk
Management
Assessments
GRM10Aligned with the enterprise-wide framework, formal risk assessments shall be performed at least annually or at planned intervals, (and in conjunction with any changes to information systems) to determine the likelihood and impact of all identified risks using qualitative and quantitative methods. The likelihood and impact associated with inherent and residual risk shall be determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance).

S3.1
x3.1.0
S4.3.0
(S3.1) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(x3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system [availability, processing
integrity, confidenitality] commitments and (2)
assess the risks associated with the identified
threats.
(S4.3.0) Environmental, regulatory, and
technological changes are monitored, and their
effect on system availability, confidentiality of
data, processing integrity, and system security is
assessed on a timely basis; policies are updated
for that assessment.

I.1
I.4
C.2.1, I.4.1,
I.5, G.15.1.3,
I.3
46 (B)
74 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards
RI-02 COBIT 4.1 PO 9.4 Domain 2,
4 6.03. (a)

6.08. (a)
Article 17 (1), (2) NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-30

1.2.4 1.2.5
312.8 and 312.10
PL-4
PS-1
PS-8
Governance and Risk
Management
Policy Reviews
GRM09The organization's business leadership (or other accountable business role or function) shall review the information security policy at planned intervals or as a result of changes to the organization to ensure its continuing alignment with the security strategy, effectiveness, accuracy, relevance, and applicability to legal, statutory, or regulatory compliance obligations.

S1.1.0 (S1.1.0) The entity’s security policies are
established and periodically reviewed and
approved by a designated individual or group.

B.2 B.1.33. B.1.34, IS-05 COBIT 4.1 DS 5.2
DS 5.4
Domain 2 Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5
(1)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

1.2.1 8.2.7

10.2.3 45 CFR 164.316
(b)(2)(iii)
45 CFE
164.306(e)
(New)
Clause 4.2.3 f)
A.5.1.2
Commandment #1
Commandment #2
Commandment #3
PCI DSS v2.0

12.1.3 CIP-003-3 -
R3.2 -
R3.3 -
R1.3
R3 - R3.1 -
R3.2 -
R3.3
AC-1
AT-1
AU-1
CA-1
CM-1
CP-1
IA-1
IA-5
IR-1
MA-1
MP-1
PE-1
PL-1
PM-1
PS-1
RA-1
SA-1
SC-1
SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

8.1.0 8.1.1
45 CFR 164.316
(a)
45 CFR 164.316
(b)(1)(i)
45 CFR 164.316
(b)(2)(ii)
45 CFR
164.308(a)(2)
(New)
Clause 4.2.1
Clause 5
A.5.1.1
A.8.2.2
Commandment #1
Commandment #2
Commandment #3
Chapter VI, Section I, Article
39 CIP-003-3 -
R1 -R1.1 -
R1.2 - R2 -
R2.1 -
R2.2 -
R2.3
AC-1
AT-1
AU-1
CA-1
CM-1
IA-1
IR-1
MA-1
MP-1
MP-1
PE-1
PL-1
PS-1
SA-1
SC-1
SI-1
PCI DSS v2.0

12.1 PCI DSS v2.0

12.2 Governance and Risk
Management
Policy Enforcement
GRM07A formal disciplinary or sanction policy shall be established for employees who have violated security policies and procedures.

Employees shall be made aware of what action might be taken in the event of a violation, and disciplinary measures must be stated in the policies and procedures.

S3.9
S2.4.0
(S3.9) Procedures exist to provide that issues of
noncompliance with security policies are promptly
addressed and that corrective measures are taken
on a timely basis.
(S2.4.0) The security obligations of users and the
entity’s security commitments to users are
communicated to authorized users.

B.1.5 Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4
IS-06 COBIT 4.1 PO 7.7 Domain 2 Article 17 NIST SP 800-53 R3 PL-4 NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-8
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-8

10.2.4 45 CFR 164.308
(a)(1)(ii)(C)
A.8.2.3 Commandment #6
Commandment #7
Chapter X, Article 64
Governance and Risk
Management
Management Program
GRM04x1.2. (x1.2.) The entity’s system [availability,
processing integrity, confidentiality and related]
security policies include, but may not be limited to,
the following matters:

A.1, B.1 2 (B)
3 (B)
5 (B)
IS-01 COBIT 4.1 R2
DS5.2
COBIT 4.1 R2
DS5.5
Domain 2
Governance and Risk
Management
Policy
GRM06Information security policies and procedures shall be established and made readily available for review by all impacted personnel and external business relationships. Information security policies must be authorized by the organization's business leadership (or other accountable business role or function) and supported by a strategic business plan and an information security management program inclusive of defined information security roles and responsibilities for business leadership.

S1.1.0
S1.3.0
S2.3.0
(S1.1.0) The entity's security policies are
established and periodically reviewed and
approved by a designated individual or group.
(S1.3.0) Responsibility and accountability for
developing and maintaining the entity’s system
security policies, and changes and updates to
those policies, are assigned.
(S2.3.0) Responsibility and accountability for the
entity's system security policies and changes and
updates to those policies are communicated to
entity personnel responsible for implementing
them.

B.1 Schedule 1
(Section 5) 4.1
Accountability,
Subsec 4.1.4
IS-03 COBIT 4.1 DS5.2 APO01.03 Domain 2 6.02. (e)
APO01.04
APO13.01
APO13.02
Schedule 1
(Section 5), 4.1 -
Accountability; 4.7
Safeguards
Clause 8.1
A.5.1.2
Clause

4.2(b),

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 9.3(a),

9.3(b)

9.3(b)(f)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)
A.8.1.1
A.8.1.2
A.8.1.4
A.13.2.4
A.7.1.2
A.7.3.1
A.8.1.3
PCI DSS v2.0

12.4 PCI DSS v2.0

12.8.2 PS-4
PS-5
Clause 7.2(a),

7.2(b)
A.7.2.2
Clause 7.2(a),

7.2(b)
A.7.2.2
A.9.3.1
A.11.2.8
Clause 7.2(a),

7.2(b)
A.7.2.2
A.11.1.5
A.9.3.1
A.11.2.8
A.11.2.9
A.9.1.1
A.9.2.1,
A.9.2.2
A.9.2.5
A.9.1.2
A.9.4.1
Annex
A.9.2
A.9.2.1
A.9.2.2
A.9.2.3,
A.9.2.4,
A.9.2.5,
A.9.2.6
Commandment #1
Commandment #2
Chapter II, Article 19 CIP-001-
1a - R1 -
R2
CIP-003-3 -
R1 - R1.1 -
R4
CIP-006-
3c R1
PM-1
PM-2
PM-3
PM-4
PM-5
PM-6
PM-7
PM-8
PM-9
PM-10
PM-11
AR-1 Governance and
Privacy Program
Article 17 99.31.(a)(1)(ii) 8.2.1 45 CFR 4.1 PA8
164.308(a)(1)(i)
45 CFR
164.308(a)(1)(ii)
(B)
45 CFR
164.316(b)(1)(i)
45 CFR
164.308(a)(3)(i)
(New)
45 CFR
164.306(a)
(New)
Clause 4.2
Clause 5
A.6.1.1
A.6.1.2
A.6.1.3
A.6.1.4
A.6.1.5
A.6.1.6
A.6.1.7
A.6.1.8
All in sections 4,
5, 6, 7, 8, 9, 10.

A.6.1.1
A.13.2.4
A.6.1.3
A.6.1.4
A.18.2.1
PCI DSS v2.0

12.1 PCI DSS v2.0

12.2 12.1

12.2 Domain 12
Clause 4.3
Clause 5

4.4 4.2(b)

6.1.2(a)(1)

6.2 6.2(a)

6.2(d)

7.1 7.4

9.3 10.2

7.2(a)

7.2(b)

7.2(c)

7.2(d)

7.3(b)

7.3(c)
A5.1.1
A7.2.3
APO13.01
APO13.02
APO13.03
312.8 and 312.10 shared x
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 283
#2..
- 327 -
Identity & Access
Management
Segregation of Duties
IAM05IAM-05.1 User access policies and procedures shall be established, and supporting business processes and technical measures
implemented, for restricting user access as per defined segregation of duties to address business risks associated with a user-role conflict of interest.

Do you provide tenants with documentation on how you maintain segregation of duties within your cloud service offering? S3.2.a (S3.2.a) a. Logical access security measures to
restrict access to information resources not
deemed to be public.

CC5.1 Schedule 1
(Section 5) 4.7
Safeguards, Subs.

4.7.3(b)
IS-15 COBIT 4.1 DS 5.4 APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
312.8 and 312.10 ITOS > Resource
Management >
Segregation of
Duties
shared x Domain 2 6.04.01. (d)

6.04.08.02. (a)
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)

99.31(a)(1)(ii) 8.2.2 45 CFR 164.308
(a)(1)(ii)(D)
45 CFR 164.308
(a)(3)(ii)(A)
45 CFR
164.308(a)(4)(ii)
(A) (New)
45 CFR 164.308
(a)(5)(ii)(C)
45 CFR 164.312
(b)
A.10.1.3 A.6.1.2 Commandment #6
Commandment #7
Commandment #8
Commandment
#10
CIP-007-3
R5.1.1
AC-1
AC-2
AC-5
AC-6
AU-1
AU-6
SI-1
SI-4

3.0 3.1

3.2 3.3

3.4 3.5
PA24 P PCI DSS v2.0

6.4.2 6.4.2, 7.3

8.8 9.10
IAM-06.1 Are controls in place to prevent unauthorized access to your application, program or object source code, and assure it is restricted to authorized personnel only?
IAM-06.2 Are controls in place to prevent unauthorized access to tenant application, program or object source code, and assure it is restricted to authorized personnel only?
IAM-07.1 Do you provide multi-failure disaster recovery capability? IAM-07.2 Do you monitor service continuity with upstream providers in the event of provider failure?
IAM-07.3 Do you have more than one provider for each service you depend on?
IAM-07.4 Do you provide access to operational redundancy and continuity summaries, including the services you depend on?
IAM-07.5 Do you provide the tenant the ability to declare a disaster? IAM-07.6 Do you provided a tenant-triggered failover option? IAM-07.7 Do you share your business continuity and redundancy plans with your tenants?
IAM-08.1 Do you document how you grant and approve access to tenant data?
IAM-08.2 Do you have a method of aligning provider and tenant data classification methodologies for access control purposes? IAM-09.1 Does your management provision the authorization and restrictions for user access (e.g. employees, contractors, customers (tenants), business partners and/or suppliers) prior to their access to data and any owned or managed (physical and virtual) applications, infrastructure systems and network components?
IAM-09.2 Do your provide upon request user access (e.g. employees, contractors, customers (tenants), business partners and/or suppliers) to data and any owned or managed (physical and virtual) applications, infrastructure systems and network components? IAM-10.1 Do you require at least annual certification of entitlements for all system users and administrators (exclusive of users maintained by your tenants)?
IAM-10.2 If users are found to have inappropriate entitlements, are all remediation and certification actions recorded?
IAM-10.3 Will you share user entitlement remediation and certification reports with your tenants, if inappropriate access may have been allowed to tenant data?
IAM-11.1 Is timely deprovisioning, revocation or modification of user access to the organizations systems, information assets and data
implemented upon any change in status of employees, contractors, customers, business partners or involved third parties? IAM-11.2 Is any change in user access status intended to include termination of employment, contract or agreement, change of employment or transfer within the organization?
IAM-12.1 Do you support use of, or integration with, existing customer-based Single Sign On (SSO) solutions to your service?
IAM-12.2 Do you use open standards to delegate authentication capabilities to your tenants?
IAM-12.3 Do you support identity federation standards (SAML, SPML, WSFederation, etc.) as a means of authenticating/authorizing users? IAM-12.4 Do you have a Policy Enforcement Point capability (e.g., XACML) to enforce regional legal and policy constraints on user access? IAM-12.5 Do you have an identity management system (enabling classification of data for a tenant) in place to enable both role-based and context-based entitlement to data?
IAM-12.6 Do you provide tenants with strong (multifactor) authentication options (digital certs, tokens, biometrics, etc.) for user access? IAM-12.7 Do you allow tenants to use third-party identity assurance services? IAM-12.8 Do you support password (minimum length, age, history, complexity) and account lockout (lockout threshold, lockout duration) policy enforcement?
IAM-12.9 Do you allow tenants/customers to define password and account lockout policies for their accounts?
IAM12.10Do you support the ability to force password changes upon first logon?
IAM12.11Do you have mechanisms in place for unlocking accounts that have been locked out (e.g., self-service via email, defined challenge questions, manual unlock)?
IAM-13.1 Are utilities that can significantly manage virtualized partitions (e.g., shutdown, clone, etc.) appropriately restricted and monitored? IAM-13.2 Do you have a capability to detect attacks that target the virtual infrastructure directly (e.g., shimming, Blue Pill, Hyper jumping, etc.)?
IAM-13.3 Are attacks that target the virtual infrastructure prevented with technical controls?
IVS-01.1 Are file integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation by root cause analysis and response to incidents?
IVS-01.2 Is physical and logical user access to audit logs restricted to authorized personnel?
IVS-01.3 Can you provide evidence that due diligence mapping of regulations and standards to your controls/architecture/processes has been done?
IVS-01.4 Are audit logs centrally stored and retained?
IVS-01.5 Are audit logs reviewed on a regular basis for security events (e.g., with automated tools)?
IVS-02.1 Do you log and alert any changes made to virtual machine images regardless of their running state (e.g. dormant, off or running)? IVS-02.2 Are changes made to virtual machines, or moving of an image and subsequent validation of the image's integrity, made immediately available to customers through electronic methods (e.g. portals or alerts)?
Infrastructure &
Virtualization Security
Clock Synchronization
IVS-03 IVS-03.1 A reliable and mutually agreed upon external time source shall be used to synchronize the system clocks of all relevant information processing systems to facilitate tracing and reconstitution of activity timelines.

Do you use a synchronized time-service protocol (e.g., NTP) to ensure all systems have a common time reference?
S3.7 (S3.7) Procedures exist to identify, report, and act upon system security breaches and other
incidents.

CC6.2 G.7
G.8
G.13, G.14.8,
G.15.5, G.16.8,
G.17.6, G.18.3,
G.19.2.6,
G.19.3.1
20 (B)
28 (B)
30 (B)
35 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-12 COBIT 4.1 DS5.7 APO01.08
APO13.01
APO13.02
BAI03.05
DSS01.01
312.8 and 312.10 Infra Services >
Network Services
> Authoritative
Time Source
provider x Domain 10 6.03. (k) NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8
NIST SP 800-53 R3 AU-8 (1)
A.10.10.1
A.10.10.6
A.12.4.1
A.12.4.4
AU-1
AU-8
PCI DSS v2.0

10.4 10.4
IVS-04.1 Do you provide documentation regarding what levels of system (network, storage, memory, I/O, etc.) oversubscription you maintain and under what circumstances/scenarios?
IVS-04.2 Do you restrict use of the memory oversubscription capabilities present in the hypervisor?
IVS-04.3 Do your system capacity requirements take into account current, projected and anticipated capacity needs for all systems used to provide services to the tenants?
IVS-04.4 Is system performance monitored and tuned in order to continuously meet regulatory, contractual and business requirements for all the systems used to provide services to the tenants?
Infrastructure &
Virtualization Security
Management -
Vulnerability
Management
IVS-05 IVS-05.1 Implementers shall ensure that the security v ulnerability assessment tools or serv ices accommodate the v irtualization technologies used (e.g. v irtualization aware).

Do security vulnerability assessment tools or services accommodate the virtualization technologies being used (e.g. virtualization aware)?
APO01.08
APO04.02
APO04.03
APO04.04
DSS05.03
DSS06.06
SRM > Threat and
Vulnerability
Management >
Vulnerability
Management
provider x Domain 1,
13 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
PA36 6.1
IVS-06.1 For your IaaS offering, do you provide customers with guidance on how to create a layered security architecture equivalence using your virtualized solution?
IVS-06.2 Do you regularly update network architecture diagrams that include data flows between security domains/zones?
IVS-06.3 Do you regularly review for appropriateness the allowed access/connectivity (e.g., firewall rules) between security domains/zones within the network?
IVS-06.4 Are all firewall access control lists documented with business justification?
Infrastructure &
Virtualization Security
OS Hardening and Base
Conrols
IVS-07 IVS-07.1 Each operating system shall be hardened to provide only necessary ports, protocols, and services to meet business needs and have in place supporting technical controls such as: antivirus, file integrity monitoring, and logging as part of their baseline operating build standard or template.

Are operating systems hardened to provide only the necessary ports, protocols and services to meet business needs using technical controls (i.e antivirus, file integrity monitoring and logging) as part of their baseline build standard or template?
APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
DSS05.01
DSS05.03
DSS06.06
SRM > Policies
and Standards >
Operational
Security Baselines
shared x Annex
A.12.1.4
A.12.2.1
A.12.4.1
A.12.6.1

2.1 2.2

2.5 5.1
IVS-08.1 For your SaaS or PaaS offering, do you provide tenants with separate environments for production and test processes? IVS-08.2 For your IaaS offering, do you provide tenants with guidance on how to create suitable production and test environments?
IVS-08.3 Do you logically and physically segregate production and nonproduction environments? IVS-09.1 Are system and network environments protected by a firewall or virtual firewall to ensure business and customer security IVS-09.2 requirements? Are system and network environments protected by a firewall or virtual firewall to ensure compliance with legislative, regulatory and contractual requirements?
IVS-09.3 Are system and network environments protected by a firewall or virtual firewall to ensure separation of production and nonproduction environments? IVS-09.4 Are system and network environments protected by a firewall or virtual firewall to ensure protection and isolation of sensitive data? IVS-10.1 Are secured and encrypted communication channels used when migrating physical servers, applications or data to virtual servers? IVS-10.2 Do you use a network segregated from production-level networks when migrating physical servers, applications or data to virtual servers?
Infrastructure &
Virtualization Security
VMM Security -
Hypervisor Hardening
IVS-11 IVS-11.1 Access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems shall be restricted to personnel based upon the principle of least privilege and supported through technical controls (e.g., two-factor
authentication, audit trails, IP address filtering, firewalls, and TLS encapsulated communications to the administrative consoles).

Do you restrict personnel access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems based on the principle of least privilege and supported through technical controls (e.g. two-factor authentication, audit trails, IP address filtering, firewalls and TLS-encapsulated communications to the administrative consoles)?
APO13.01
APO13.02
DSS05.02
DSS05.04
DSS06.03
DSS06.06
SRM > Privilege
Management
Infrastructure >
Privilege Use
Management -
Hypervisor
Governance and
Compliance
provider X Domain 1,
13 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

3.5.1, 3.6.6
IVS-12.1 Are policies and procedures established and mechanisms configured and implemented to protect the wireless network environment perimeter and to restrict unauthorized wireless traffic? IVS-12.2 Are policies and procedures established and mechanisms implemented to ensure wireless security settings are enabled with strong encryption for authentication and transmission, replacing vendor default settings? (e.g., encryption keys, passwords, SNMP community strings)
IVS-12.3 Are policies and procedures established and mechanisms implemented to protect wireless network environments and detect the presence of unauthorized (rogue) network devices for a timely disconnect from the network?
IVS-13.1 Do your network architecture diagrams clearly identify high-risk environments and data flows that may have legal compliance impacts?
IVS-13.2 Do you implement technical measures and apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling and blackholing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denialof-service (DDoS) attacks? Interoperability &
Portability
APIs
IPY-01 IPY-01 The provider shall use open and published APIs to ensure support for interoperability between components and to facilitate migrating applications.

Do you publish a list of all APIs available in the service and indicate which are standard and which are customized?
- BAI02.04
BAI03.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
Application
Services >
Programming
Interfaces >
provider X Domain 6 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2), Interoperability &
Portability
Data Request
IPY-02 IPY-02 All structured and unstructured data shall be available to the customer and provided to them upon request in an industrystandard format (e.g., .doc, .xls, .pdf, logs, and flat files) Is unstructured customer data available on request in an industrystandard format (e.g., .doc, .xls, or .pdf)?- APO01.03 APO01.06
APO03.01
APO08.01
APO09.03
DSS04.07
Information
Services >
Reporting
Services >
provider Domain 6 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c) IPY-03.1 Do you provide policies and procedures (i.e. service level agreements) governing the use of APIs for interoperability between your service and third-party applications?

5.0 7.1

7.1.2 7.2

10.1 10.2

10.3 10.4

10.5 10.6

10.7, 10.8

11.4, 11.5, 11.6

12.5.2 10.5.5, 12.10.5

1.1 1.1.2

1.1.3 1.1.5

1.1.6 1.2

1.2.1 1.2.2

1.2.3 1.3

2.2.2 2.2.3

2.2.4 2.5

4.1 6.4.1

6.4.2 1.1

1.2 1.2.1

1.2.3 1.3

1.4 2.1.1

2.2.3 2.2.4

2.3 6.4.1

6.4.2, 7.1

7.1.1 7.1.2

7.1.3 7.1.4

7.2 7.2.2

7.3 12.8

12.2 7.1

7.1.1 7.1.2

7.1.3 7.1.4

7.2 7.1

7.1.1 7.1.2

7.1.3 7.1.4

12.5.4 8.1.4

4.1 1.2.3

2.1.1 4.1

4.1.1 11.1, 11.1.a,

11.1.b, 11.1.c,

11.1.d, 11.1.1,

11.1.2 9.1.3

1.1 1.1.2

1.1.3 1.1.5

1.1.6 1.2

1.2.1 1.2.2

1.2.3 1.3

2.2.2 2.2.3

2.2.4 2.5

4.1 8.1.3

8.1.4 8.1.5, 12.5.4

8.0 10.1,

12.3 BSGP
BSGP
P
GP
PA11
PA12
PA13
PA24
BSGP
SGP
SGP
P
PA16 SGP
PA3
PA5
PA16
PA19
PA18
BSGP
BSGP
SGP
GP
SGP
PA3 BSGP
PA3
PA5
PA16
PA20
BSGP
BSGP
SGP
GP
PA3
PA5
PA16
PA19
PA18
BSGP
BSGP
SGP
GP
SGP
PA3
PA6
PA16
PA20
PA25
PA32
PA33
BSGP
BSGP
SGP
GP
P
BSGP
SGP
PA24 GP

12.2 14.2

17.6 3.3

17.1 17.2

14.5 17.6

18.1 18.4

11.1 17.3

17.1 17.2

9.4 14.1

14.2 19.1

2.2 4.3

3.2 9.2

15.2 9.2

15.2 9.2
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

SHARING WITH THIRD

PARTIES
AP-1 The organization
determines and
documents the legal
authority that permits the
collection, use,
maintenance, and
sharing of personally
identifiable information
(PII), either generally or
in support of a specific
program or information
system need.
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

99.31(a)(1)(ii)

99.3 99.31(a)(1)(ii)
SRM >
Governance Risk
& Compliance >
Vendor
Management
shared x
Information
Services > User
Directory Services
> Active Directory
Services,
LDAP
Repositories,
X.500
Repositories,
DBMS
Repositories,
Meta Directory
Services,
Virtual Directory
Services
shared x
SRM > Policies
and Standards >
Technical Security
Standards
shared x
SRM > Privilege
Management
Infrastructure >
Privilege Usage
Management -
Resource
Protection
shared x
X
SRM >
Infrastructure
Protection
Services >
Network -
Wireless
Protection
provider X
ITOS > Service
Support > Release
Management -
Source Code
Management
shared x
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
APO01.03
APO01.08
APO07.06
APO10.04
APO13.02
DSS05.04
DSS05.07
DSS06.03
DSS06.06
APO01.03
APO01.08
APO10.04
APO13.02
DSS05.04
DSS06.03
DSS06.06
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
APO13.01
APO13.02
DSS05.05
APO13.01
APO13.02
BAI10.01
BAI10.02
BAI10.03
DSS01.03
DSS02.01
DSS05.07
DSS06.05
APO08.04
APO13.01
BAI06.01
BAI06.02
BAI10.03
BAI10.04
APO01.03
APO01.08
BAI04.01
BAI04.04
BAI04.05
BAI10.01
BAI10.02
APO01.08
APO13.01
APO13.02
DSS02.02
DSS05.02
DSS05.03
DSS05.04
DSS05.05
DSS05.07
DSS06.03
DSS06.06
APO03.01
APO03.02
APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
DSS05.02
DSS06.06
CC3.1
CC3.3
CC5.3
CC5.1
CC6.2
A1.1
A1.2
CC4.1
CC5.6
CC5.6
CC5.6
CC5.6
CC5.6
CC7.4
IVS-02 The provider shall ensure the integrity of all virtual machine images at all times. Any changes made to virtual machine images must be logged and an alert raised regardless of their running state (e.g. dormant, off, or running). The results of a change or move of an image and the subsequent validation of the image's integrity must be immediately available to customers through electronic methods (e.g. portals or alerts).
45 CFR 164.308
(a)(1)(ii)(D)
45 CFR 164.312
(b)
45 CFR
164.308(a)(5)(ii)
(c) (New)
A.10.10.1
A.10.10.2
A.10.10.3
A.10.10.4
A.10.10.5
A.11.2.2
A.11.5.4
A.11.6.1
A.13.1.1
A.13.2.3
A.15.2.2
A.15.1.3
Commandment #6
Commandment #7
Commandment
#11
CIP-007-3 -
R6.5
AU-1
AU-2
AU-3
AU-4
AU-5
AU-6
AU-7
AU-9
AU-11
AU-12
AU-14
SI-4
PCI DSS v2.0

10.1 PCI DSS
v2.0 10.2

PCI DSS
v2.010.3
PCI DSS v2.0

10.5 PCI DSS
v2.010.6
PCI DSS v2.0

10.7 PCI DSS v2.0

11.4 PCI DSS v2.0

12.5.2 PCI DSS
v2.0 12.9.5
Infrastructure &
Virtualization Security
Change Detection
Infrastructure &
Virtualization Security
Network Architecture
IVS-13 Network architecture diagrams shall clearly identify high-risk environments and data flows that may have legal compliance impacts. Technical measures shall be implemented and shall apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling, and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denial-of-service (DDoS) attacks.

Infrastructure &
Virtualization Security
VM Security - vMotion
Data Protection
IVS-10 Secured and encrypted communication channels shall be used when migrating physical servers, applications, or data to virtualized servers and, where possible, shall use a network segregated from production-level networks for such migrations.

PCI DSS v2.0

1.2.3 PCI DSS v2.0

2.1.1 PCI DSS v2.0

4.1 PCI DSS v2.0

4.1.1 PCI DSS
v2.011.1
PCI DSS v2.0

9.1.3 Interoperability &
Portability
Policy & Legal
IPY-03 Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage and integrity persistence.

CIP-004-3
R3
AC-4
SC-2
SC-3
SC-7
PCI DSS v2.0

1.1 PCI DSS v2.0

1.2 PCI DSS v2.0

1.2.1 PCI DSS v2.0

1.3 PCI DSS v2.0

1.4 Infrastructure &
Virtualization Security
Wireless Security
IVS-12 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to protect wireless network environments, including the following:
• Perimeter firewalls implemented and configured to restrict unauthorized traffic
• Security settings enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, and SNMP community strings)
• User access to wireless network devices restricted to authorized personnel
• The capability to detect the presence of unauthorized (rogue) wireless network devices for a timely disconnect from the network S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

D.1
B.3
F.1
G.4
G.15
G.17
G.18
E.3.1, F.1.2.4,
F.1.2.5,
F.1.2.6,
F.1.2.8, F.1.2.
9, F.1.2.10,
F.1.2.11,
F.1.2.12,
F.1.2.13,
F.1.2.14,
F.1.2.15,
F.1.2.24,
F.1.3, F.1.4.2,
F1.4.6,
F.1.4.7, F.1.6,
F.1.7,F.1.8,
F.2.13, F.2.14,
F.2.15, F.2.16,
F.2.17, F.2.18
G.9.17, G.9.7,
G.10, G.9.11,
G.14.1, G.15.1,
G.9.2, G.9.3,
G.9.13
40 (B)
44 (C+)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-10 COBIT 4.1 DS5.5
COBIT 4.1 DS5.7
COBIT 4.1 DS5.8
COBIT 4.1 DS5.10
Domain 10 Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 PE-4
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)

8.2.5 45 CFR 164.312
(e)(1)(2)(ii)
45 CFR
164.308(a)(5)(ii)
(D) (New)
45 CFR
164.312(e)(1)
(New)
45 CFR
164.312(e)(2)(ii)
(New)
A.7.1.1
A.7.1.2
A.7.1.3
A.9.2.1
A.9.2.4
A.10.6.1
A.10.6.2
A.10.8.1
A.10.8.3
A.10.8.5
A.10.10.2
A.11.2.1
A.11.4.3
A.11.4.5
A.11.4.6
A.11.4.7
A.12.3.1
A.12.3.2
Commandment #1
Commandment #2
Commandment #3
Commandment #4
Commandment #5
Commandment #9
Commandment
#10
Commandment
#11
CIP-004-3
R3
CIP-007-3 -
R6.1
AC-1
AC-18
CM-6
PE-4
SC-3
SC-7
A.8.1.1
A.8.1.2
A.8.1.3
A.11.2.1
A.11.2.4
A.13.1.1
A.13.1.2
A.13.2.1
A.8.3.3
A.12.4.1
A.9.2.1, A.9.2.2
A.13.1.3
A.10.1.1
A.10.1.2
Infrastructure &
Virtualization Security
Network Security
A.10.1.4
A.10.3.2
A.11.1.1
A.12.5.1
A.12.5.2
A.12.5.3
Commandment #1
Commandment
#10
Commandment
#11
SC-2 PCI DSS v2.0

6.4.1 PCI DSS v2.0

6.4.2 Infrastructure &
Virtualization Security
Segmentation
IVS-09 Multi-tenant organizationally-owned or managed (physical and virtual) applications, and infrastructure system and network components, shall be designed, developed, deployed and
configured such that provider and customer (tenant) user access is appropriately segmented from other tenant users, based on the following considerations:
• Established policies and procedures
• Isolation of business critical assets and/or sensitive user data and sessions that mandate stronger internal controls and high levels of assurance
• Compliance with legal, statutory and regulatory compliance obligations
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

G.17 G.9.2, G.9.3,
G.9.13
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-09 COBIT 4.1 DS5.10 Domain 10 6.03.03. (b)

6.03.05. (a)

6.03.05. (b)

6.04.01. (a)

6.04.01. (g)

6.04.03. (c)

6.04.08.02. (a)

6.04.08.02. (b)

6.05. (c)
Article 17 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 AC-4 NIST SP 800-53 R3 SC-2
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
45 CFR 164.308
(a)(4)(ii)(A)
A.11.4.5
A.11.6.1
A.11.6.2
A.15.1.4
Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment
#10
Commandment
#11
Infrastructure &
Virtualization Security
Production /
Nonproduction
Environments
IVS-08 Production and non-production environments shall be separated to prevent unauthorized access or changes to information assets.

Separation of the environments may include: stateful inspection firewalls, domain/realm authentication sources, and clear segregation of duties for personnel accessing these environments as part of their job duties.

S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

B.1 I.2.7.1, I.2.20,
I.2.17,
I.2.22.2,
I.2.22.4,
I.2.22.10-14,
H.1.1
22 (B) Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-06 COBIT 4.1 DS5.7 Information Domain 10 6.03. (d) NIST SP 800-53 R3 SC-2 1.2.6 Services > Data
Governance >
Data Segregation
APO03.01 shared x
APO03.02
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
312.8 and 312.10
SA-4
IVS-06 Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections, these configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, and ports, and compensating controls.

S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

G.2
G.4
G.15
G.16
G.17
G.18
I.3
G.9.17, G.9.7,
G.10, G.9.11,
G.14.1, G.15.1,
G.9.2, G.9.3,
G.9.13
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-08 Domain 10 6.03.03. (a)

6.03.03. (d)

6.03.04. (d)

6.04.07. (a)

6.07.01. (c)
Article 17 NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-20
(1)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-20 (1)
NIST SP 800-53 R3 SC-21
NIST SP 800-53 R3 SC-22
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SC-32

8.2.5 A.10.6.1
A.10.6.2
A.10.9.1
A.10.10.2
A.11.4.1
A.11.4.5
A.11.4.6
A.11.4.7
A.15.1.4
Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment
#10
Commandment
#11
CIP-004-3
R2.2.4
SC-7 PCI DSS v2.0

1.1 PCI DSS v2.0

1.1.2 PCI DSS v2.0

1.1.3 PCI DSS v2.0

1.1.5 PCI DSS v2.0

1.1.6 PCI DSS v2.0

1.2 PCI DSS v2.0

1.2.1 PCI DSS v2.0

2.2.2, PCI DSS
v2.0 2.2.3
A.10.3.1 Commandment #1
Commandment #2
Commandment #3
Infrastructure &
Virtualization Security
Capacity / Resource
Planning
IVS-04 The av ailability , quality , and adequate capacity and resources shall be planned, prepared, and measured to deliv er the required sy stem perf ormance in accordance with legal, statutory , and regulatory compliance obligations. Projections of f uture capacity requirements shall be made to mitigate the risk of sy stem ov erload.

A3.2.0
A4.1.0
(A3.2.0) Measures to prevent or mitigate threats
have been implemented consistent with the risk
assessment when commercially practicable.
(A4.1.0) The entity’s system availability and
security performance is periodically reviewed and
compared with the defined system availability and
related security policies.

G.5 OP-03 COBIT 4.1 DS 3 Domain 7,
8 6.03.07. (a)

6.03.07. (b)

6.03.07. (c)

6.03.07. (d)
Article 17 (1) NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
312.8 and 312.10 ITOS > Service 1.2.4
Delivery >
Information
Technology
Resiliency -
Capacity Planning
provider x
PCI DSS v2.0

7.1.2 Infrastructure &
Virtualization Security
Audit Logging /
Intrusion Detection
IVS-01 Higher levels of assurance are required for protection, retention, and lifecyle management of audit logs, adhering to applicable legal, statutory or regulatory compliance obligations and providing unique user access accountability to detect potentially suspicious network behaviors and/or file integrity anomalies, and to support forensic investigative capabilities in the event of a security breach.

S3.7 (S3.7) Procedures exist to identify, report, and act upon system security breaches and other
incidents.

G.7
G.8
G.9
J.1
L.2
G.14.7, G.14.8,
G.14.9,
G.14.10,G.14.1
1, G.14.12,
G.15.5, G.15.7,
G.15.8, G.16.8,
G.16.9,
G.16.10,
G.15.9, G.17.5,
G.17.7, G.17.8,
G.17.6, G.17.9,
G.18.2, G.18.3,
G.18.5, G.18.6,
G.19.2.6,
G.19.3.1,
G.9.6.2,
G.9.6.3,
G.9.6.4,
G.9.19, H.2.16,
H.3.3, J.1, J.2,
L.5, L.9, L.10
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-14 COBIT 4.1 DS5.5
COBIT 4.1 DS5.6
COBIT 4.1 DS9.2
Domain 10 6.03. (i)

6.03. (j)

6.03.03. (a)

6.03.03. (d)

6.03.04. (e)

6.04.07. (a)

6.07.01. (a)

8.2.1 8.2.2
312.8 and 312.10
312.3, 312.8 and
312.10
BOSS > Security
Monitoring
Services > SIEM
shared x
Identity & Access
Management
Utility Programs Access
IAM13Utility programs capable of potentially overriding system, object, network, virtual machine, and application controls shall be restricted.

S3.2.g (S3.2.g) g. Restriction of access to system
configurations, superuser functionality, master
passwords, powerful utilities, and security devices
(for example, firewalls).

H.2.16 Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-34 COBIT 4.1 DS5.7 Domain 2 NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 AC-6 NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
CIP-004-3
R2.2.3
CIP-007-3 -
R5.1.3 -
R5.2.1 -
R5.2.3
AC-2
PS-4
PS-5
A.11.4.1
A 11.4.4
A.11.5.4
Commandment #1
Commandment #5
Commandment #6
Commandment #7
CIP-007-3 -
R2.1 -
R2.2 -
R2.3
AC-5
AC-6
CM-7
SC-3
SC-19
PCI DSS v2.0

8.5.4 PCI DSS v2.0

8.5.5 Identity & Access
Management
User ID Credentials
IAM12Internal corporate or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures:
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and Federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or re-use when feasible
• Adherence to industry acceptable and/or regulatory compliant authentication, authorization, and accounting (AAA) rules (e.g., strong/multi-factor, expireable, non-shared authentication secrets) S3.2.b (S3.2.b) b. Identification and authentication of users.

B.1
H.5
E.6.2, E.6.3,
H.1.1, H.1.2,
H.2, H.3.2,
H.4, H.4.1,
H.4.5, H.4.8
6 (B) Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-02 COBIT 4.1 DS5.3
COBIT 4.1 DS5.4
Domain 10 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.04.05. (b)
Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2
(1)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5
(1)
NIST SP 800-53 R3 IA-6
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AC-11
NIST SP 800-53 R3 AC-11 (1)
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-2 (3)
NIST SP 800-53 R3 AU-2 (4)
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-2 (2)
NIST SP 800-53 R3 IA-2 (3)
NIST SP 800-53 R3 IA-2 (8)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-6
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 SC-10
45 CFR
164.308(a)(5)(ii)
(c) (New)
45 CFR 164.308
(a)(5)(ii)(D)
45 CFR 164.312
(a)(2)(i)
45 CFR 164.312
(a)(2)(iii)
45 CFR 164.312
(d)
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.3
A.11.2.4
A.11.5.5
Commandment #6
Commandment #7
Commandment #8
Commandment #9
CIP-004-3
R2.2.3
CIP-007-3 -
R5.2 -
R5.3.1 -
R5.3.2 -
R5.3.3
AC-1
AC-2
AC-3
AC-11
AU-2
AU-11
IA-1
IA-2
IA-5
IA-6
IA-8
SC-10
PCI DSS v2.0

8.1 PCI DSS v2.0

8.2,
PCI DSS v2.0

8.3 PCI DSS v2.0

8.4 PCI DSS v2.0

8.5 PCI DSS v2.0

10.1,
PCI DSS v2.0

12.2,
PCI DSS v2.0

12.3.8 SRM > Privilege
Management
Infrastructure >
Identity
Management -
Identity
Provisioning
shared x 9.2

15.1 15.2
PA9
PA6
PA24
PA22

8.2.1 8.2.7
45 CFR 164.308
(a)(3)(ii)(B)
45 CFR 164.308
(a)(4)(ii)(C)
A.11.2.4 Commandment #6
Commandment #7
Commandment #8
Commandment
#10
CIP-004-3
R2.2.2
CIP-007-3 -
R5 - R.1.3
AC-2
AU-6
PM-10
PS-6
PS-7
Identity & Access
Management
User Access Revocation
IAM11Timely de-provisioning (revocation or modification) of user access to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components, shall be implemented as per established policies and procedures and based on user's change in status (e.g., termination of employment or other business relationship, job change or transfer). Upon request, provider shall inform customer (tenant) of these changes, especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to,
the following matters:
d. The process to make changes to user profiles.
g. Restriction of access to system configurations,
superuser functionality, master passwords,
powerful utilities, and security devices (for
example, firewalls).

H.2 E.6.2, E.6.3 Schedule 1
(Section 5), 4.7 -
Safeguards
IS-09 COBIT 4.1 DS 5.4 Domain 2 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.03.06. (a)

6.04.02. (b)
Article 17 NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 SC-30

8.2.1 45 CFR
164.308(a)(3)(ii)
(C)

ISO/IEC
27001:2005
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.2
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
Commandment #6
Commandment #7
Commandment #8
Identity & Access
Management
User Access
Authorization
IAM09Provisioning user access (e.g., employees, contractors, customers (tenants), business partners and/or supplier relationships) to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components shall be authorized by the organization's management prior to access being granted and appropriately restricted as per established policies and procedures. Upon request, provider shall inform customer (tenant) of this user access, especially if customer (tenant) data is used as part of the service and/or customer (tenant) has some shared responsibility over implementation of control.

Identity & Access
Management
User Access Reviews
IAM10User access shall be authorized and revalidated for entitlement appropriateness, at planned intervals, by the organization's business leadership or other accountable business role or function supported by evidence to demonstrate the organization is adhering to the rule of least privilege based on job function. For identified access violations, remediation must follow established user access policies and procedures.

H.2.6, H.2.7,
H.2.9,
41 (B) Schedule 1
(Section 5), 4.7 -
Safeguards
IS-10 COBIT 4.1 DS5.3
COBIT 4.1 DS5.4
45 CFR 164.308
(a)(3)(i)
45 CFR 164.308
(a)(3)(ii)(A)
45 CFR 164.308
(a)(4)(i)
45 CFR 164.308
(a)(4)(ii)(B)
45 CFR 164.308
(a)(4)(ii)(C)
45 CFR 164.312
(a)(1)
A.11.2.1
A.11.2.2
A.11.4.1
A 11.4.2
A.11.6.1
Identity & Access
Management
User Access Restriction
/ Authorization
IAM08Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business necessary.

IS-08
IS-12
COBIT 4.1 DS5.4 Domain 12
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
NIST SP800-53 R3 AC-3
NIST SP800-53 R3 AC-5
NIST SP800-53 R3 AC-6
NIST SP800-53 R3 IA-2
NIST SP800-53 R3 IA-4
NIST SP800-53 R3 IA-5
NIST SP800-53 R3 IA-8
NIST SP800-53 R3 MA-5
NIST SP800-53 R3 PS-6
NIST SP800-53 R3 SA-7
NIST SP800-53 R3 SI-9
PCI DSS v2.0

7.1 PCI DSS v2.0

7.1.1 PCI DSS v2.0

7.1.2 PCI DSS v2.0

7.1.3 PCI DSS v2.0

7.2.1 PCI DSS v2.0

7.2.2 PCI DSS v2.0

8.5.1 PCI DSS v2.0

12.5.4 "FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

H.2.4, H.2.5, 35 (B)
40 (B)
41 (B)
42 (B)
44 (C+)
Schedule 1
(Section 5)
Safeguards, Subs.

4.7.2 and 4.7.3
IS-08 DS5.4 Domain 2 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.03.06. (a)

6.03.06. (b)

6.04.01. (a)

6.04.01. (b)

6.04.01. (d)

6.04.01. (e)

6.04.01. (g)

6.04.03. (c)

6.04.08.02. (a)
APO01.03 Article 17
APO01.08
APO07.06
APO10.04
APO13.02
DSS05.04
DSS06.03
DSS06.06
SRM > Privilege
Management
Infrastructure >
Identity
Management -
Identity
Provisioning
shared x
SRM > Privilege
Management
Infrastructure >
Authorization
Services -
Entitlement
Review
shared x NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
S3.2.0
S4.3.0
(S3.2.0) Procedures exist to restrict logical access
to the defined system including, but not limited to,
the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations,
superuser functionality, master passwords,
powerful utilities, and security devices (for
example, firewalls).
(S4.3.0) Environmental, regulatory, and
technological changes are monitored, and their
effect on system availability, confidentiality,
processing integrity and security is assessed on a
timely basis; policies are updated for that
assessment.

Clause 4.3.3
A.12.4.3
A.15.1.3
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #6
Commandment #7
Commandment #9
Commandment
#10
CM-5
CM-6
PCI-DSS v2.0

6.4.1 PCI-DSS v2.0

6.4.2 Identity & Access
Management
Third Party Access
IAM07The identification, assessment, and prioritization of risks posed by business processes requiring third-party access to the organization's information systems and data shall be followed by coordinated application of resources to minimize, monitor, and measure likelihood and impact of unauthorized or inappropriate access.

Compensating controls derived from the risk analysis shall be implemented prior to provisioning access.

S3.1
x3.1.0
(S3.1) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(x3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system [availability, processing
integrity, confidenitality] commitments and (2)
assess the risks associated with the identified
threats.

B.1
H.2
B.1.1, B.1.2,
D.1.1, E.1,
F.1.1, H.1.1,
K.1.1, E.6.2,
E.6.3
Schedule 1
(Section 5), 4.7 -
Safeguards
RI-05 COBIT 4.1 DS 2.3 Domain 2,
4 6.02. (a)

6.02. (b)

6.03. (a)
Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5
(1)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

7.1.1 7.1.2

7.2.1 7.2.2

7.2.3 7.2.4
A.6.2.1
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.4
CA-3
MA-4
RA-3
PCI DSS v2.0

12.8.1 PCI DSS v2.0

12.8.2 PCI DSS v2.0

12.8.3 PCI DSS v2.0

12.8.4 Identity & Access
Management
Source Code Access
Restriction
IAM06Access to the organization's own developed applications, program, or object source code, or any other form of intellectual property (IP), and use of proprietary software shall be appropriately restricted following the rule of least privilege based on job function as per established user access policies and procedures.

S3.13.0 (S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are
made to the system.

I.2.7.2, I.2.9,
I.2.10, I.2.15
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-33 Domain 2 Article 17 NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)

1.2.6 6.2.1
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

G.2
G.4
G.15
G.16
G.17
G.18
I.3
G.9.17, G.9.7,
G.10, G.9.11,
G.14.1, G.15.1,
G.9.2, G.9.3,
G.9.13
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-08 Domain 10 6.03.03. (a)

6.03.03. (d)

6.03.04. (d)

6.04.07. (a)

6.07.01. ©
Article 17 NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-20
(1)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-20 (1)
NIST SP 800-53 R3 SC-21
NIST SP 800-53 R3 SC-22
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SC-32

8.2.5 6.04.03. (b)

6.04.08. (a)

6.04.08. (b)

6.06. (a)

6.06. (b)

6.06. (c)

6.06. (d)

6.06. (e)

6.06. (f)
APO01.08 provider Domain 3
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
SRM >
Infrastructure
Protection
Services >
Network
provider x
Information
Technology
Operation
Services > Service
Delivery > Service
Level
Management -
External SLA's
A.10.6.1
A.10.6.2
A.10.9.1
A.10.10.2
A.11.4.1
A.11.4.5
A.11.4.6
A.11.4.7
A.15.1.4
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2
(1)
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5
(1)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-7

7.1 7.1.1

7.1.2 7.1.3

7.2.1 7.2.2

8.5.1 12.5.4
AC-3
AC-5
AC-6
IA-2
IA-4
IA-5
IA-8
MA-5
PS-6
SA-7
SI-9
CIP-003-3 -
R5.1.1 -
R5.3
CIP-004-3
R2.3
CIP-007-3
R5.1 -
R5.1.2
A.11.2.1
A.11.2.2
A.11.4.1
A 11.4.2
A.11.6.1
45 CFR 164.308
(a)(3)(i)
45 CFR 164.308
(a)(3)(ii)(A)
45 CFR 164.308
(a)(4)(i)
45 CFR 164.308
(a)(4)(ii)(B)
45 CFR 164.308
(a)(4)(ii)(C)
45 CFR 164.312
(a)(1)
NIST SP 800-53 R3 AC-3 8.2.2
NIST SP 800-53 R3 AC-3 (3)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-2 (2)
NIST SP 800-53 R3 IA-2 (3)
NIST SP 800-53 R3 IA-2 (8)
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-4 (4)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SC-30
Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment
#10
Commandment
#11
A.13.1.1
A.13.1.2
A.14.1.2
A.12.4.1
A.9.1.2
A.13.1.3
A.18.1.4
A.12.1.4
A.14.2.9
A.9.1.1

8.1,partial,
A.14.2.2

8.1,partial,
A.14.2.3

8.1,partial,
A.14.2.4
A.13.1.3
A.9.4.1
A.18.1.4
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),
CIP-004-3
R2.2.4

1.1 1.1.2

1.1.3 1.1.5

1.1.6 1.2

1.2.1 2.2.2

2.2.3 Clause

5.2(c)

5.3(a),

5.3(b),

7.5.3(b)

7.5.3(d)

8.1,

8.3 9.2(g)
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.5
Annex
A.9.2,
A.9.2.1,
A.9.2.2,
A.9.2.3,
A.9.2.4,
A.9.2.5,
A.9.2.6,
A.9.3.1,
A.9.4.1,
A.9.4.2,
A.9.4.3,
A.9.4.5
A.9.2.1, A.9.2.2
A.9.2.3
A.9.1.2
A.9.4.1
A.9.2.5
Annex A
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.3
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.4
A.9.2.5
A.9.4.2
A.9.1.2
Deleted
A.9.4.4
A.12.4.1
A.12.4.1
A.12.4.2,
A.12.4.3
A.12.4.3
A.12.4.1
A.9.2.3
A.9.4.4
A.9.4.1
A.16.1.2
A.16.1.7
A.18.2.3
A.18.1.3
Annex
A.12.1.2
A.12.4,
A.12.4.1,
A.12.4.2,
A.12.4.3,
A.12.6.1,
A.12.6.2,
A.16.1.1,
A.16.1.2,
A.16.1.3,
A.16.1.4,
A.16.1.5,
A.16.1.6,
A.12.1.3
SRM > Privilege
Management
Infrastructure >
Privileged Usage
Management ->
Hypervisor
Governance and
Compliance
PA35 GP
Domain 1,
13 APO03.01
APO03.02
APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
DSS05.02
DSS06.06
APO03.01
APO03.02
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
APO03.01
APO03.02
APO03.04
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
312.8 and 312.10
312.8 and 312.10
SRM >
Infrastructure
Protection
Services >
Network
provider x
SRM >
Infrastructure
Protection
Services >
Network -
Firewall
provider x
SRM >
Cryptographic
Services > Data-intransit Encryption
provider
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),
A.13.1.1
A.13.1.2
A.14.1.2
A.12.4.1
A.9.1.2
A.13.1.3
A.18.1.4
-
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 284
#2..
- 328 -
IPY-03.2 Do you provide policies and procedures (i.e. service level agreements) governing the migration of application data to and from your service?
IPY-04.1 Can data import, data export and service management be conducted over secure (e.g., non-clear text and authenticated), industry accepted standardized network protocols?
IPY-04.2 Do you provide consumers (tenants) with documentation detailing the relevant interoperability and portability network protocol standards that are involved?
IPY-05.1 Do you use an industry-recognized virtualization platform and standard virtualization formats (e,g., OVF) to help ensure interoperability?
IPY-05.2 Do you have documented custom changes made to any hypervisor in use, and all solution-specific virtualization hooks available for customer review?
Mobile Security
Anti-Malware
MOS01MOS-01 Anti-malware awareness training, specific to mobile devices, shall be included in the provider's information security awareness training.

Do you provide anti-malware training specific to mobile devices as part of your information security awareness training?
- APO01.03
APO13.01
APO07.03
APO07.06
APO09.03
SRM >
Governance Risk
& Compliance >
Technical
Awareness and
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1) Mobile Security
Application Stores
MOS02MOS-02 A documented list of approved application stores has been communicated as acceptable for mobile devices accessing or storing provider managed data.

Do you document and make available lists of approved application stores for mobile devices accessing or storing company data and/or company systems?
- APO01.04
APO01.08
APO04.02
APO13.01
APO13.02
APO13.03
SRM > Policies
and Standards >
Technical
Securitry
Standards
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

4.1.1 Mobile Security
Approved Applications
MOS03MOS-03 The company shall have a documented policy prohibiting the installation of non-approved applications or approved applications not obtained through a pre-identified application store.

Do you have a policy enforcement capability (e.g., XACML) to ensure that only approved applications and those from approved application stores be loaded onto a mobile device?
- APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
ITOS > Service
Support >
Configuration
Management -
Software
Management
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2), Mobile Security
Approved Software for
BYOD
MOS04MOS-04 The BYOD policy and supporting awareness training clearly states the approved applications, application stores, and application extensions and plugins that may be used for BYOD usage.

Does your BYOD policy and training clearly state which applications and applications stores are approved for use on BYOD devices? - APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
SRM > Policies
and Standards >
Technical
Securitry
Standards
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Mobile Security 6.1.2(b)
Awareness and
Training
MOS05MOS-05 The provider shall have a documented mobile device policy that includes a documented definition for mobile devices and the acceptable usage and requirements for all mobile devices. The provider shall post and communicate the policy and requirements through the company's security awareness and training program.

Do you have a documented mobile device policy in your employee training that clearly defines mobile devices and the accepted usage and requirements for mobile devices?
- APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
SRM > Policies
and Standards >
Technical
Securitry
Standards
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

4.3 Mobile Security
Cloud Based Services
MOS06MOS-06 All cloud-based services used by the company's mobile devices or BYOD shall be pre-approved for usage and the storage of company business data.

Do you have a documented list of pre-approved cloud based services that are allowed to be used for use and storage of company business data via a mobile device?
- APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
SRM >
Governance Risk
& Compliance >
Vendor
Management
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2), Mobile Security
Compatibility
MOS07MOS-07 The company shall have a documented application validation process to test for mobile device, operating system, and application compatibility issues.

Do you have a documented application validation process for testing device, operating system and application compatibility issues? - APO01.03
APO01.08
APO13.01
APO13.02
BAI03.07
BAI03.08
ITOS > Service
Support >
Configuration
Management -
Software
Management
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Device Eligibility
MOS08MOS-08 The BYOD policy shall define the device and eligibility requirements to allow for BYOD usage.

Do you have a BYOD policy that defines the device(s) and eligibility requirements allowed for BYOD usage?
- APO01.03
APO01.08
APO13.01
APO13.02
BAI02.01
SRM > Policies
and Standards >
Information
Security Policies
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security
Device Inventory
MOS09MOS-09 An inventory of all mobile devices used to store and access company data shall be kept and maintained. All changes to the status of these devices, (i.e., operating system and patch levels, lost or decommissioned status, and to whom the device is assigned or approved for usage (BYOD), will be included for each device in the inventory.

Do you maintain an inventory of all mobile devices storing and accessing company data which includes device status (os system and patch levels, lost or decommissioned, device assignee)? - BAI06.01
BAI06.02
BAI06.04
BAI10.01
BAI10.02
BAI10.03
SRM >
Infrastructure
Protection
Services > End
Point - Inventory
Control
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),
Mobile Security 6.1.2(c)(2)
Device Management
MOS10MOS-10 A centralized, mobile device management solution shall be deployed to all mobile devices permitted to store, transmit, or process customer data.

Do you have a centralized mobile device management solution deployed to all mobile devices that are permitted to store, transmit, or process company data?
- APO03.01
APO03.02
APO04.02
APO13.01
APO13.02
BAI02.01
Presentation
Services >
Presentation
Platform > EndPoints-Mobile
Devices-Mobile
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Encryption
MOS11MOS-11 The mobile device policy shall require the use of encryption either for the entire device or for data identified as sensitive on all mobile devices and shall be enforced through technology controls.

Does your mobile device policy require the use of encryption for either the entire device or for data identified as sensitive enforceable through technology controls for all mobile devices?
- APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
DSS06.06
SRM > Data
Protection >
Cryptographic
Services - Data-AtRest Encryption
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
PA32 BSGP 4.1
MOS12.1Does your mobile device policy prohibit the circumvention of built-in security controls on mobile devices (e.g., jailbreaking or rooting)? MOS12.2Do you have detective and preventative controls on the device or via a centralized device management system which prohibit the circumvention of built-in security controls?
MOS13.1Does your BYOD policy clearly define the expectation of privacy, requirements for litigation, e-discovery and legal holds? MOS13.2Do you have detective and preventative controls on the device or via a centralized device management system which prohibit the circumvention of built-in security controls?
Mobile Security
Lockout Screen
MOS14MOS-14 BYOD and/or company owned devices are configured to require an automatic lockout screen, and the requirement shall be enforced through technical controls.

Do you require and enforce via technical controls an automatic lockout screen for BYOD and company owned devices?
- DSS05.03
DSS05.05
Presentation
Services >
Presentation
Platform > EndPoints-Mobile
sharedX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security
Operating Systems
MOS15MOS-15 Changes to mobile device operating systems, patch levels, and/or applications shall be managed through the company's change management processes.

Do you manage all changes to mobile device operating systems, patch levels and applications via your company's change management processes?
- APO01.03
APO13.01
APO13.02
BAI06
ITOS > Service
Support -Change
Management >
Planned Changes
sharedX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
MOS- 6.1.2(a)(2),

16.1 Do you have password policies for enterprise issued mobile devices and/or BYOD mobile devices?
MOS16.2Are your password policies enforced through technical controls (i.e.

MDM)?
MOS16.3Do your password policies prohibit the changing of authentication requirements (i.e. password/PIN length) via a mobile device? MOS17.1Do you have a policy that requires BYOD users to perform backups of specified corporate data?
MOS17.2Do you have a policy that requires BYOD users to prohibit the usage of unapproved application stores?
MOS17.3Do you have a policy that requires BYOD users to use anti-malware software (where supported)?
MOS18.1Does your IT provide remote wipe or corporate data wipe for all company-accepted BYOD devices?
MOS18.2Does your IT provide remote wipe or corporate data wipe for all company-assigned mobile devices?
MOS19.1Do your mobile devices have the latest available security-related patches installed upon general release by the device manufacturer or carrier?
MOS19.2Do your mobile devices allow for remote validation to download the latest security patches by company IT personnel?
MOS20.1Does your BYOD policy clarify the systems and servers allowed for use or access on the BYOD-enabled device?
MOS20.2Does your BYOD policy specify the user roles that are allowed access via a BYOD-enabled device?
Security Incident
Management, EDiscovery & Cloud
Forensics
Contact / Authority
Maintenance
SEF-01 SEF-01.1 Points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities shall be maintained and regularly updated (e.g., change in impactedscope and/or a change in any compliance obligation) to ensure direct compliance liaisons have been established and to be prepared for a forensic investigation requiring rapid engagement with law enforcement.

Do you maintain liaisons and points of contact with local authorities in accordance with contracts and appropriate regulations? CC3.3 APO01.01
APO01.02
APO01.03
APO01.08
MEA03.01
MEA03.02
MEA03.03
312.4 BOSS >
Compliance >
Contact/Authority
Maintenance
sharedx A.6.1.6
A.6.1.7
A.6.1.3
A.6.1.4
Chapter VI,
Article 44.

Chapter II,
Article 16, part I

3.2 12.5.3

12.10.1 SEF-02.1 Do you have a documented security incident response plan? SEF-02.2 Do you integrate customized tenant requirements into your security incident response plans?
SEF-02.3 Do you publish a roles and responsibilities document specifying what you vs. your tenants are responsible for during security incidents? SEF-02.4 Have you tested your security incident response plans in the last year?
SEF-03.1 Does your security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting? SEF-03.2 Does your logging and monitoring framework allow isolation of an incident to specific tenants?
SEF-04.1 Does your incident response plan comply with industry standards for legally admissible chain-of-custody management processes and controls?
SEF-04.2 Does your incident response capability include the use of legally admissible forensic data collection and analysis techniques? SEF-04.3 Are you capable of supporting litigation holds (freeze of data from a specific point in time) for a specific tenant without freezing other tenant data?
SEF-04.4 Do you enforce and attest to tenant data separation when producing data in response to legal subpoenas?
SEF-05.1 Do you monitor and quantify the types, volumes and impacts on all information security incidents?

4.1 12.1

12.10.1 PA8
PA11
BSGP
PA8 BSGP
SGP

4.1 4.2

4.6 7.1

7.2 7.3

7.2 7.3
IP-4 COMPLAINT
MANAGEMENT. SE-2

PRIVACY INCIDENT

RESPONSE
IP-4 COMPLAINT
MANAGEMENT. SE-2

PRIVACY INCIDENT

RESPONSE

99.31(a)(1)(i)
34 CFR 99.32(a)
BOSS >
Operational Risk
Management >
Key Risk
Indicators
sharedx
Infrastructure
Services > Virtual
Infrastructure >
Server
Virtualization
providerXX
Presentation
Services >
Presentation
Platform > EndPoints-Mobile
Devices-Mobile
Device
Management
sharedX
SRM >
Infrastructure
Protection
Services-
>Network > Link
Layer Network
Security
sharedX
SRM > Policies
and Standards >
Technical Security
Standards
sharedX
ITOS > Service
Support >
Security Incident
Management
sharedx
shared
sharedX
SRM > Data
Protection >
Cryptographic
Services - Data-InTransit Encryption
providerx
312.8 and 312.10
312.3, 312.8 and
312.10
312.8 and 312.10
312.8 and 312.10
APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
APO01.03
APO13.01
APO13.02
DSS05.03
APO01.03
APO13.01
APO13.02
CC5.5
CC6.2
CC2.3
CC2.5
C1.4
C1.5
CC2.5
CC6.2
CC6.2
CC4.1
Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Response
Metrics
SEF-05 Domain 2 6.07.01. (a)

6.07.01. (i)
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-4 (1)
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8

1.2.7 1.2.10
IR-2
IR-6
IR-7
SI-4
SI-5
45 CFR 164.308
(a)(1)(ii)(D)
A.13.2.2 CIP-008-3 -
R1.1
IR-4
IR-5
IR-8
PCI DSS v2.0

12.9.6 APO01.03
APO07.06
APO07.03
APO13.01
APO13.02
DSS02.01
APO01.03
APO13.01
APO13.02
DSS01.03
DSS02.01
DSS02.02
DSS02.04
DSS02.05
DSS02.06
DSS04.07
PA11 BSGP
PA11 BSGP
PCI-DSS v2.0

12.5.2 PCI-DSS v2.0

12.5.3 Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Response
Legal Preparation
SEF-04 Proper forensic procedures, including chain of custody, are required for the presentation of evidence to support potential legal action subject to the relevant jurisdiction after an information security incident. Upon notification, customers and/or other external business partners impacted by a security breach shall be given the opportunity to participate as is legally permissible in the forensic investigation.

S2.4.0
C3.15.0
(S2.4.0) The process for informing the entity about
system availability issues, confidentiality issues,
processing integrity issues, security issues and
breaches of the system security and for submitting
complaints is communicated to authorized users.
(C3.15.0) Procedures exist to provide that issues of
noncompliance with defined confidentiality and
related security policies are promptly addressed
and that corrective measures are taken on a
timely basis.

J.1
E.1
J.1.1, J.1.2,
E.4
IS-24 COBIT 4.1 DS5.6 Domain 2 6.04.07. (b)

6.07.01. (f)

6.07.01. (h)
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 AU-7
NIST SP 800-53 R3 AU-7 (1)
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-9 (2)
NIST SP 800-53 R3 AU-10
NIST SP 800-53 R3 AU-10 (5)
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 MP-5
NIST SP 800-53 R3 MP-5 (2)
NIST SP 800-53 R3 MP-5 (4)

1.2.7 45 CFR 164.308
(a)(6)(ii)
Clause 4.3.3
Clause 5.2.2
A.8.2.2
A.8.2.3
A.13.2.3
A.15.1.3
BOSS > Legal
Services >
Incident
Response Legal
Preparation
sharedx CIP-004-3
R3.3
AU-6
AU-7
AU-9
AU-11
IR-5
IR-7
IR-8
BOSS > Human
Resources
Security >
Employee
Awareness
sharedx
Commandment #2
Commandment #6
Commandment #8
Chapter II, Article 20 CIP-007-3 -
R6.1
CIP-008-3 -
R1
IR-1
IR-2
IR-3
IR-4
IR-5
IR-7
IR-8
PCI-DSS v2.0

12.9 PCI-DSS v2.0

12.9.1 PCI-DSS v2.0

12.9.2 PCI-DSS v2.0

12.9.3 PCI-DSS v2.0

12.9.4 PCI-DSS v2.0

12.9.5 PCI-DSS v2.0

12.9.6 Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Reporting
SEF-03 Workforce personnel and external business relationships shall be informed of their responsibility and, if required, shall consent and/or contractually agree to report all information security events in a timely manner. Information security events shall be reported through predefined communications channels in a timely manner adhering to applicable legal, statutory, or regulatory compliance obligations.

A2.3.0
C2.3.0
I2.3.0
S2.3.0
S2.4
(A2.3.0, C2.3.0, I2.3.0, S2.3.0) Responsibility and
accountability for the entity’s system availability,
confidentiality of data, processing integrity and
related security policies and changes and updates
to those policies are communicated to entity
personnel responsible for implementing them.
(S2.4) The process for informing the entity about
breaches of the system security and for submitting
J.1
E.1
J.1.1, E.4 5 (B)
46 (B)
48 (A+)
49 (B)
50 (B)
Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.3
IS-23 COBIT 4.1 DS5.6 Domain 2 6.07.01. (a) Article 17 NIST SP 800-53 R3 IR-2 NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-6 (1)
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)

1.2.7 1.2.10

7.1.2 7.2.2

7.2.4 10.2.4
45 CFR 164.312
(a)(6)(ii)
16 CFR 318.3 (a)
(New)
16 CFR 318.5 (a)
(New)
45 CFR 160.410
(a)(1) (New)
Clause 4.3.3
Clause 5.2.2
A.6.1.3
A.8.2.1
A.8.2.2
A.13.1.1
A.13.1.2
A.13.2.1
ITAR 22
CFR §
127.12
Commandment #2
Commandment #6
Commandment #8
Chapter II, Article 20 CIP-003-3 -
R4.1
CIP-004-3
R3.3
IS3.7.0
S3.9.0
(IS3.7.0) Procedures exist to identify, report, and
act upon system security breaches and other
incidents.
(S3.9.0) Procedures exist to provide that issues of
noncompliance with system availability,
confidentiality of data, processing integrity and
related security policies are promptly addressed
and that corrective measures are taken on a
timely basis.

J.1 J.1.1, J.1.2 1.2.4

1.2.7 7.1.2

7.2.2 7.2.4

10.2.1 10.2.4
45 CFR 164.308
(a)(1)(i)
45 CFR 164.308
(a)(6)(i)
Clause 4.3.3
A.13.1.1
A.13.2.1
ITAR 22
CFR §
127.12
Mobile Security
Passwords
MOS16Password policies, applicable to mobile devices, shall be documented and enforced through technical controls on all company devices or devices approved for BYOD usage, and shall prohibit the changing of password/PIN lengths and authentication requirements.

Mobile Security
Policy
MOS17The mobile device policy shall require the BYOD user to perform backups of data, prohibit the usage of unapproved application stores, and require the use of anti-malware software (where supported).

Mobile Security
Remote Wipe
MOS18All mobile devices permitted for use through the company BYOD program or a company-assigned mobile device shall allow for remote wipe by the company's corporate IT or shall have all company-provided data wiped by the company's corporate IT.

Mobile Security
Security Patches
MOS19Mobile devices connecting to corporate networks or storing and accessing company information shall allow for remote software version/patch validation. All mobile devices shall have the latest available security-related patches installed upon general release by the device manufacturer or carrier and authorized IT personnel shall be able to perform these updates remotely.

Mobile Security
Users
MOS20The BYOD policy shall clarify the systems and servers allowed for use or access on a BYOD-enabled device.

Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Management
SEF-02 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to triage security-related events and ensure timely and thorough incident management, as per established IT service management policies and procedures.

APO01.03
APO13.01
APO13.02
DSS05.01
DSS05.03
APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
DSS05.06
APO01.03
APO13.01
APO13.02
APO01.03
APO13.01
APO13.02
DSS01.03
DSS02.01
DSS02.02
DSS02.04
DSS02.05
DSS02.06
Interoperability &
Portability
Policy & Legal
IPY-03 Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage and integrity persistence.

Interoperability &
Portability
Standardized Network
Protocols
IPY-04 The provider shall use secure (e.g., non-clear text and authenticated) standardized network protocols for the import and export of data and to manage the service, and shall make available a document to consumers (tenants) detailing the relevant interoperability and portability standards that are involved.

Interoperability &
Portability
Virtualization
IPY-05 The provider shall use an industry-recognized virtualization platform and standard virtualization formats (e.g., OVF) to help ensure interoperability, and shall have documented custom changes made to any hypervisor in use, and all solution-specific virtualization hooks, available for customer review.

Mobile Security
Jailbreaking and
Rooting
MOS12The mobile device policy shall prohibit the circumvention of built-in security controls on mobile devices (e.g. jailbreaking or rooting) and isenforced through detective and preventative controls on the device or through a centralized device management system (e.g. mobile device management).

Mobile Security
Legal
MOS13The BYOD policy includes clarifying language for the expectation of privacy, requirements for litigation, e-discovery, and legal holds.

The BYOD policy shall clearly state the expectations over the loss of non-company data in the case a wipe of the device is required.

IS-25 - Domain 6
46 (B) Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4; 4.8
Openness, Subs.

4.8.2 IS-22 COBIT 4.1 DS5.6 Domain 2 6.04.07. (b)

6.07.01. (a)

6.07.01. (d)

6.07.01. (e)

6.07.01. (f)

6.07.01. (g)

6.07.01. (h)
Article 17 NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-3
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-4 (1)
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 IR-8
Mechanisms shall be put in place to monitor and quantify the types, volumes, and costs of information security incidents.

S3.9.0
C4.1.0
(S3.9.0) Procedures exist to provide that issues of
noncompliance with security policies are promptly
addressed and that corrective measures are taken
on a timely basis.
(C4.1.0) The entity’s system security, availability,
system integrity, and confidentiality is periodically
reviewed and compared with the defined system
security, availability, system integrity, and
confidentiality policies.

J.1.2 47 (B) COBIT 4.1 DS 4.9 - None
(Mobile
Guidance)
- Domain 6
None
(Mobile
Guidance)
BOSS > Data
Governance >
Secure Disposal
of Data
- None
(Mobile
Guidance)
APO01.03
APO13.01
APO13.02
DSS05.03
- None
(Mobile
Guidance)
APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
DSS05.06
PA34
SRM > Policies
and Standards >
Technical Security
Standards
sharedX
None
(Mobile
Guidance)
None
(Mobile
Guidance)
- None
(Mobile
Guidance)
Presentation
Services >
Presentation
Platform > EndPoints-Mobile
Devices-Mobile
Device
Management
providerX
SRM > Policies
and Standards >
Information
Security Services

6.04.03. (b)

6.04.08. (a)

6.04.08. (b)

6.06. (a)

6.06. (b)

6.06. (c)

6.06. (d)

6.06. (e)

6.06. (f)
APO01.08 provider Domain 3
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
Information
Technology
Operation
Services > Service
Delivery > Service
Level
Management -
External SLA's
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
-
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)
Clause

5.3 (a),

5.3 (b),

7.5.3(b),

5.2 (c),

7.5.3(d),

8.1,

8.3,

9.2(g),
Annex
A.16.1.1
A.16.1.2
Clause

5.2 (c),

5.3 (a),

5.3 (b),

7.2(a),

7.2(b),

7.2(c),

7.2(d),

7.3(b),
Clause

5.2 (c),

5.3 (a),

5.3 (b),

7.2(a),

7.2(b),

7.2(c),

7.2(d),

7.3(b),

7.3(c)

7.5.3(b),

7.5.3(d),

8.1,

8.3,

9.2(g)
Annex
A.7.2.2,
A.7.2.3,
A.16.1.7,
A.16.1.6
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 285
#2..
- 329 -
SEF-05.2 Will you share statistical information for security incident data with your tenants upon request?
STA-01.1 Do you inspect and account for data quality errors and associated risks, and work with your cloud supply-chain partners to correct them?
STA-01.2 Do you design and implement controls to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privileged access for all personnel within your supply chain?
Supply Chain
Management,
Transparency and
Accountability
Incident Reporting
STA02STA-02.1 The provider shall make security incident information available to all affected customers and providers periodically through electronic methods (e.g. portals).

Do you make security incident information available to all affected customers and providers periodically through electronic methods (e.g. portals)?
APO09.03
APO09.04
APO10.04
APO10.05
DSS02.07
ITOS > Service
Support ->
Incident
Management >
Cross Cloud
Incident
Response
prov ider Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
STA-03.1 Do you collect capacity and use data for all relevant components of 6.1.2(b) your cloud service offering?
STA-03.2 Do you provide tenants with capacity planning and use reports? Supply Chain
Management,
Transparency and
Accountability
Provider Internal
Assessments
STA04STA-04.1 The provider shall perform annual internal assessments of conformance and effectiveness of its policies, procedures, and supporting measures and metrics.

Do you perform annual internal assessments of conformance and effectiveness of your policies, procedures, and supporting measures and metrics?
MEA01
MEA02
SRM >
Governance Risk
& Compliance >
Vendor
Management
provider x Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

12.1.1 STA-05.1 Do you select and monitor outsourced providers in compliance with laws in the country where the data is processed, stored and transmitted?
STA-05.2 Do you select and monitor outsourced providers in compliance with laws in the country where the data originates?
STA-05.3 Does legal counsel review all third-party agreements? STA-05.4 Do third-party agreements include provision for the security and protection of information and assets?
STA-05.5 Do you provide the client with a list and copies of all subprocessing agreements and keep this updated?
Supply Chain
Management,
Transparency and
Accountability
Supply Chain
Governance Reviews
STA06STA-06.1 Providers shall review the risk management and governance processes of their partners so that practices are consistent and aligned to account for risks inherited from other members of that partner's cloud supply chain.

Do you review the risk management and governanced processes of partners to account for risks inherited from other members of that partner's supply chain?
APO10.04
APO10.05
MEA01
SRM >
Governance Risk
& Compliance >
Vendor
Management
provider x Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

12.8.4 STA-07.1 Are policies and procedures established, and supporting business processes and technical measures implemented, for maintaining complete, accurate and relevant agreements (e.g., SLAs) between providers and customers (tenants)?
STA-07.2 Do you have the ability to measure and address non-conformance of provisions and/or terms across the entire supply chain
(upstream/downstream)?
STA-07.3 Can you manage service-level conflicts or inconsistencies resulting from disparate supplier relationships?
STA-07.4 Do you review all agreements, policies and processes at least annually?
Supply Chain
Management,
Transparency and
Accountability
Third Party Assessment
STA08STA-08.1 Providers shall assure reasonable information security across their information supply chain by performing an annual review. The review shall include all partners/third party providers upon which their information supply chain depends on.

Do you assure reasonable information security across your information supply chain by performing an annual review? STA-8.2 Does your annual review include all partners/third-party providers upon which your information supply chain depends?
STA-09.1 Do you permit tenants to perform independent vulnerability assessments?
STA-09.2 Do you have external third party services conduct vulnerability scans and periodic penetration tests on your applications and networks? TVM01.1Do you have anti-malware programs that support or connect to your cloud service offerings installed on all of your systems? TVM01.2Do you ensure that security threat detection systems using signatures, lists or behavioral patterns are updated across all infrastructure components within industry accepted time frames? TVM02.1Do you conduct network-layer vulnerability scans regularly as prescribed by industry best practices?
TVM02.2Do you conduct application-layer vulnerability scans regularly as prescribed by industry best practices?
TVM02.3Do you conduct local operating system-layer vulnerability scans regularly as prescribed by industry best practices?
TVM02.4Will you make the results of vulnerability scans available to tenants at their request?
TVM02.5Do you have a capability to rapidly patch vulnerabilities across all of your computing devices, applications and systems?
TVM02.6Will you provide your risk-based systems patching time frames to your tenants upon request?
TVM03.1Is mobile code authorized before its installation and use, and the code configuration checked, to ensure that the authorized mobile code operates according to a clearly defined security policy? TVM03.2Is all unauthorized mobile code prevented from executing?

2.4 12.8.2

12.8.3 12.8.4
Appendix A

1.4, 5.0

2.2 6.1

6.2 6.3.2

6.4.5 6.5

6.6 11.2

11.2.1 11.2.2

11.2.3 PA2
PA8
BSGP
PA3
PA8
PA16
BSGP
BSGP
SGP
PA1 BSGP

7.2 7.3

17.1 5.2

2.2 5.4

14.1 17.6

12.4 14.1
3 3.1

3.2 3.3

3.4 3.5
BOSS >
Compliance >
Third-Party Audits
shared x
SRM >
Infrastructure
Protection
Services > AntiVirus
shared x
SRM > Threat and
Vulnerability
Management >
Vulnerability
Management
shared x
SRM >
Infrastructure
Protection
Services > End
Point - White
Listing
shared x
BOSS >
Operational Risk
Management >
Key Risk
Indicators
shared x
SRM >
Governance Risk
& Compliance >
Vendor
Management
prov ider X
provider x
BOSS > Legal
Services >
Contracts
shared x
ITOS > Service
Delivery > Service
Level
Management -
Vendor
Management
provider x
SRM >
Governance Risk
& Compliance >
Vendor
Management
provider x
312.8 and 312.10
312.8 and 312.10
312.2(a) and
312.3 (Prohibition
on Disclosure)
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
APO01.03
APO09.03
APO09.04
APO09.05
APO10.01
APO10.03
APO10.04
APO09.03
MEA01
MEA02
APO01.08
APO10.05
MEA02.01
APO01.03
APO13.01
APO13.02
DSS05.01
APO01.03
APO13.01
APO13.02
BAI06.01
BAI06.02
BAI06.03
BAI06.04
DSS01.01
DSS01.02
DSS01.03
DSS03.05
DSS05.01
DSS05.03
DSS05.07
APO01.03
APO13.01
APO13.02
DSS05.01
DSS05.02
DSS05.03
DSS05.04
APO09.03
APO09.05
CC5.6
CC7.1
CC6.2
CC4.1
CC2.2
CC2.3
CC2.2
CC2.3
CC5.5
C1.4
C1.5
CC7.1 CM-3
CM-4
CP-10
RA-5
SA-7
SI-1
SI-2
SI-5
PCI-DSS v2.0

2.2 PCI-DSS v2.0

6.1 PCI-DSS v2.0

6.2 PCI-DSS v2.0

6.3.2 PCI-DSS v2.0

6.4.5 PCI-DSS v2.0

6.5.X
PCI-DSS v2.0

6.6 PCI-DSS v2.0

11.2 PCI-DSS v2.0

11.2.1 PCI-DSS v2.0

11.2.2 PCI-DSS v2.0

11.2.3 Threat and Vulnerbility
Management
Mobile Code
TVM03Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of unauthorized mobile code, defined as software transferred between systems over a trusted or untrusted network and executed on a local system without explicit installation or execution by the recipient, on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

S3.4.0
S3.10.0
(S3.4.0) Procedures exist to protect against
infection by computer viruses, malicious code, and
unauthorized software.
(S3.10.0) Design, acquisition, implementation,
configuration, modification, and management of
infrastructure and software are consistent with
defined system security policies to enable
authorized access and to prevent unauthorized
access.

G.20.12, I.2.5 SA-15 Domain 10 6.03. (g) Article 17 A.10.4.2 A.12.2.2
A.12.5.1
A.12.5.2
A.12.6.1
Commandment #4
Commandment #5
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment
#11
SC-18
CIP-007-3 -
R4 - R4.1 -
R4.2
SA-7
SC-5
SI-3
SI-5
SI-7
SI-8
PCI-DSS v2.0

5.1 PCI-DSS v2.0

5.1.1 PCI-DSS v2.0

5.2 Threat and Vulnerbility
Management
Vulnerability / Patch
Management
TVM02Policies and procedures shall be established, and supporting processes and technical measures implemented, for timely detection of vulnerabilities within organizationally-owned or managed applications, infrastructure network and system components (e.g. network vulnerability assessment, penetration testing) to ensure the efficiency of implemented security controls. A risk-based model for prioritizing remediation of identified vulnerabilities shall be used. Changes shall be managed through a change management process for all vendor-supplied patches, configuration changes, or changes to the organization's internally developed software. Upon request, the provider informs customer (tenant) of policies and procedures and identified weaknesses especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

I.4 G.15.2, I.3 32 (B)
33 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-20 COBIT 4.1 AI6.1
COBIT 4.1 AI3.3
COBIT 4.1 DS5.9
Domain 2 6.03.02. (a)

6.03.02. (b)

6.03.05. (c)

6.07.01. (o)
Article 17 NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 RA-5 (1)
NIST SP 800-53 R3 RA-5 (2)
NIST SP 800-53 R3 RA-5 (3)
NIST SP 800-53 R3 RA-5 (6)
NIST SP 800-53 R3 RA-5 (9)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-5
45 CFR 164.308
(a)(1)(i)(ii)(A)
45 CFR 164.308
(a)(1)(i)(ii)(B)
45 CFR 164.308
(a)(5)(i)(ii)(B)
CIP-004-3
R4 - 4.1 -

4.2 CIP-005-
3a - R1 -
R1.1
CIP-007-3 -
R3 - R3.1 -
R8.4

1.2.6 8.2.7

8.1*partial,
A.14.2.2,

8.1*partial,
A.14.2.3
A.12.6.1
A.12.2.1
AC-1
AT-1
AU-1
CA-1
CM-1
CP-1
IA-1
IA-7
IR-1
MA-1
MP-1
PE-1
PL-1
PM-1
PS-1
RA-1
RA-2
SA-1
SA-6
SC-1
SC-13
SI-1
PCI DSS v2.0

2.4 PCI DSS v2.0

12.8.2 PCI DSS v2.0

12.8.3 PCI DSS v2.0

12.8.4 Appendix A

8.2.2 45 CFR 164.308
(a)(5)(ii)(B)
A.10.4.1 Commandment #4
Commandment #5
Threat and Vulnerbility
Management
Antivirus / Malicious
Software
TVM01Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of malware on organizationally-owned or managed user end-point devices (i.e., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

S3.5.0 (S3.5.0) Procedures exist to protect against
infection by computer viruses, malicious codes,
and unauthorized software.

G.7 17 (B) Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-21 COBIT 4.1 DS5.9 Domain 2 6.03. (f) Article 17 NIST SP 800-53 R3 SC-5 NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)
NIST SP 800-53 R3 SI-8
A.15.1.2

8.1* partial,

8.1* partial,
A.15.2.1
A.13.1.2
A.12.2.1
CC2.2
CC2.3
C1.4
C1.5
CC5.8
Commandment #1
Commandment #4
Commandment #5
Commandment #6
Commandment #7
Commandment #8
Chapter II
Article 14.

CA-3
MP-5
PS-7
SA-6
SA-7
SA-9
PCI DSS v2.0

2.4 PCI DSS v2.0

12.8.2 Supply Chain
Management,
Transparency and
Accountability
Supply Chain Metrics
STA07Policies and procedures shall be implemented to ensure the consistent review of service agreements (e.g., SLAs) between providers and customers (tenants) across the relevant supply chain (upstream/downstream).

Supply Chain
Management,
Transparency and
Accountability
Third Party Audits
STA09Third-party service providers shall demonstrate compliance with information security and confidentiality, access control, service definitions, and delivery level agreements included in third-party contracts. Third-party reports, records, and services shall undergo audit and review at least annually to govern and maintain compliance with the service delivery agreements.

S3.1.0
x3.1.0
(S3.1.0) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(x3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operations that
would impair system [availability, processing
integrity, confidentiality] commitments and (2)
assess the risks associated with the identified
threats.

L.1, L.2, L.4,
L.7, L.9
76 (B)
77 (B)
78 (B)
83 (B)
84 (B)
85 (B)
CO-05 COBIT 4.1 ME

2.6, DS 2.1, DS

2.4 Domain 2,
4 6.10. (a)

6.10. (b)

6.10. (c)

6.10. (d)

6.10. (e)

6.10. (f)

6.10. (g)

6.10. (h)

6.10. (i)
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-1

1.2.2 1.2.4

1.2.6 1.2.11

3.2.4 5.2.1
45 CFR
164.308(b)(1)
(New)
45 CFR 164.308
(b)(4)
A.6.2.3
A.10.2.1
A.10.2.2
A.10.6.2
Commandment #1
Commandment #2
Commandment #3
Chapter II
Article 14, 21
Chapter III
Article 25
Chapter V
Article 36
A.6.2.3
A.10.6.2
Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Response
Metrics
SEF-05
Commandment #6
Commandment #7
Commandment #8
SC-20
SC-21
SC-22
SC-23
SC-24
ITOS > Service
Delivery > Service
Level
Management
Supply Chain
Management,
Transparency and
Accountability
Third Party Agreements
STA05Supply chain agreements (e.g., SLAs) between providers and customers (tenants) shall incorporate at least the following mutuallyagreed upon provisions and/or terms:
• Scope of business relationship and services offered (e.g., customer (tenant) data acquisition, exchange and usage, feature sets and functionality, personnel and infrastructure network and systems components for service delivery and support, roles and responsibilities of provider and customer (tenant) and any subcontracted or outsourced business relationships, physical geographical location of hosted services, and any known regulatory compliance considerations)
• Information security requirements, provider and customer (tenant) primary points of contact for the duration of the business relationship, and references to detailed supporting and relevant business processes and technical measures implemented to enable effectively governance, risk management, assurance and legal, statutory and regulatory compliance obligations by all impacted business relationships
• Notification and/or pre-authorization of any changes controlled by the provider with customer (tenant) impacts
• Timely notification of a security incident (or confirmed breach) to all customers (tenants) and other business relationships impacted (i.e., up- and down-stream impacted supply chain)
• Assessment and independent verification of compliance with agreement provisions and/or terms (e.g., industry-acceptable certification, attestation audit report, or equivalent forms of assurance) without posing an unacceptable business risk of exposure to the organization being assessed
• Expiration of the business relationship and treatment of customer (tenant) data impacted
• Customer (tenant) service-to-service application (API) and data interoperability and portability requirements for application development and information exchange, usage, and integrity persistence
S2.2.0
A3.6.0
C3.6.0
(S2.2.0) The availability, confidentiality of data,
processing integrity, system security and related
security obligations of users and the entity’s
availability and related security commitments to
users are communicated to authorized users.
(A3.6.0) Procedures exist to restrict physical access
to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.
(C3.6.0) The entity has procedures to obtain
assurance or representation that the
confidentiality policies of third parties to whom
information is transferred and upon which the
entity relies are in conformity with the entity’s
defined system confidentiality and related security
policies and that the third party is in compliance
with its policies.

C.2 C.2.4, C.2.6,
G.4.1, G.16.3
74 (B)
75 (C+,
A+)
45 (B)
75 (C+,
A+)
79 (B)
4 (C+, A+)
Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.3
LG-02 COBIT 4.1 DS5.11 Domain 3 6.02. (e)

6.10. (h)

6.10. (i)
Article 17 (3) NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 MP-5
NIST SP 800-53 R3 MP-5 (2)
NIST SP 800-53 R3 MP-5 (4)
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
312.3, 312.8 and 1.2.5
312.10
A.6.2.3
A10.2.1
A.10.8.2
A.11.4.6
A.11.6.1
A.12.3.1
A.12.5.4
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Supply Chain
Management,
Transparency and
Accountability
Network /
Infrastructure Services
STA03Business-critical or customer (tenant) impacting (physical and virtual) application and system-system interface (API) designs and configurations, and infrastructure network and systems
components, shall be designed, developed, and deployed in accordance with mutually agreed-upon service and capacity-level expectations, as well as IT governance and service management policies and procedures.

C2.2.0 (C2.2.0) The system security, availability, system integrity, and confidentiality and related security
obligations of users and the entity’s system
security, availability, system integrity, and
confidentiality and related security commitments
to users are communicated to authorized users.

C.2 C.2.6, G.9.9 45 (B)
74 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-31 COBIT 4.1 DS5.10 Domain 2 6.02. (c)

6.03.07. (a)

6.03.07. (b)

6.03.07. (c)

6.03.07. (d)
Article 17 NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 CP-6
NIST SP 800-53 R3 CP-6 (1)
NIST SP 800-53 R3 CP-6 (3)
NIST SP 800-53 R3 CP-7
NIST SP 800-53 R3 CP-7 (1)
NIST SP 800-53 R3 CP-7 (2)
NIST SP 800-53 R3 CP-7 (3)
NIST SP 800-53 R3 CP-7 (5)
NIST SP 800-53 R3 CP-8
NIST SP 800-53 R3 CP-8 (1)
NIST SP 800-53 R3 CP-8 (2)
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SC-30

8.2.2 8.2.5
APO01.03
APO03.01
APO03.02
APO09.03
BAI02.01
BAI02.04
BAI07.05
Domain 2 6.07.01. (a)

6.07.01. (i)
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-4 (1)
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8

1.2.7 1.2.10
45 CFR 164.308
(a)(1)(ii)(D)
A.13.2.2 CIP-008-3 -
R1.1
IR-4
IR-5
IR-8
PCI DSS v2.0

12.9.6 Supply Chain
Management,
Transparency and
Accountability
Data Quality and
Integrity
STA01Providers shall inspect, account for, and work with their cloud supplychain partners to correct data quality errors and associated risks.

Providers shall design and implement controls to mitigate and contain data security risks through proper separation of duties, rolebased access, and least-privilege access for all personnel within their supply chain.

DSS04.07
APO10
APO11
DSS05.04
DSS06.03
DSS06.06
IS-25 PA11 BSGP
© Copyright 2014 Cloud Security Alliance - All rights reserved. You may download, store, display on your computer, view, print, and link to the Cloud Security Alliance “Consensus Assessments Initiative Questionnaire CAIQ Version

3.0.1” at http://www.cloudsecurityalliance.org subject to the following: (a) the Consensus Assessments Initiative Questionnaire v3.0.1 may be used solely for your personal, informational, non-commercial use; (b) the Consensus Assessments Initiative Questionnaire v3.0.1 may not be modified or altered in any way; (c) the Consensus Assessments Initiative Questionnaire v3.0.1 may not be redistributed; and (d) the trademark, copyright or other notices may not be removed. You may quote portions of the Consensus Assessments Initiative Questionnaire v3.0.1 as permitted by the Fair Use provisions of the United States Copyright Act, provided that you attribute the portions to the Cloud Security Alliance Cloud Consensus Assessments Initiative Questionnaire 3.0.1 (2014). If you are interested in obtaining a license to this material for other usages not addresses in the copyright notice, please contact [email protected].

Mechanisms shall be put in place to monitor and quantify the types, volumes, and costs of information security incidents.

J.1.2 47 (B) COBIT 4.1 DS 4.9
Domain 2
51 (B) Domain 3 6.02. (c)

6.02. (d)

6.07.01. (k)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.15.1.2
A.13.1.2
A.15.1.2,

8.1* partial,
A.13.2.2,
A.9.4.1
A.10.1.1
Domain 2
A.16.1.6
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 286
#2..
- 330 -
CONSENSUS ASSESSMENTS INITIATIVE QUESTIONNAIRE (CAIQ) V3.0.1 GUIDING DOCUMENT PRINCIPLES INTENT OF THIS TAB: To assist reviewers/users of document to understand both the intent and structure of CAIQ GUIDING PRINCIPLES:
 Questionnaire is organized using CSA 16 governing & operating domains divided into “control areas” within CSA’s Controls Matrix structure  Questions are to assist both cloud providers in general principles of cloud security and clients in vetting cloud providers on the security of their offering and company security profile
 CAIQ is not intended to duplicate or replace existing industry security assessments but to contain questions unique or critical to the cloud computing model in each control area
 Each question should be able to be answered yes or no  If a question can’t be answered yes or no then it was separated into two or more questions to allow yes or no answers.  Questions are intended to foster further detailed questions to provider by client specific to client’s cloud security needs. This was done to limit number of questions to make the assessment feasible and since each client may have unique follow-on questions or may not be concerned with all follow-on questions
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 287
#2..
- 331 -
CLOUD CONTROLS MATRIX VERSION 3.0.1
Scope
Applicability
Phys Network Compute Storage App Data SaaS PaaS IaaS Service Provider
Tenant /
Consumer
AICPA
2009 TSC Map
AICPA
Trust Service Criteria (SOC 2SM Report)
AICPA
2014 TSC
BITS Shared Assessments
AUP v5.0
BITS Shared Assessments
SIG v6.0 BSI Germany Canada PIPEDA CCM V1.X COBIT 4.1 COBIT 5.0 COPPA CSA Guidance V3.0 ENISA IAF 95/46/EC - European Union Data Protection Directive FedRAMP Security Controls
(Final Release, Jan 2012)
--LOW IMPACT LEVEL--
FedRAMP Security Controls
(Final Release, Jan 2012)
--MODERATE IMPACT LEVEL--
FERPA GAPP (Aug 2009) HIPAA / HITECH Act ISO/IEC 27001-2005 ISO/IEC 27001-2013 ITAR Jericho Forum Domain > Container > Capability Public Priv ate
Application & Interface
Security
Application Security
AIS-01 Applications and programming interfaces (APIs) shall be designed, developed, deployed, and tested in accordance with leading industry standards (e.g., OWASP for web
applications) and adhere to applicable legal, statutory, or regulatory compliance obligations.

X X X X X X X X S3.10.0
S3.10.0
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies to enable authorized access and to prevent unauthorized access.
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined processing integrity and related security policies.

CC7.1 I.4 G.16.3, I.3 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-04 AI2.4 APO09.03 APO13.01
BAI03.01
BAI03.02
BAI03.03
BAI03.05
MEA03.01
MEA03.02
312.8 and
312.10
Application Services > Development
Process > Software Quality
Assurance
shared x Domain 10 6.03.01. (c) Article: 27 (3) NIST SP 800-53 R3 SC-5 NIST SP 800-53 R3 SC-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-14
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SC-2
NIST SP 800-53 R3 SC-4
NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SC-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SC-10
NIST SP 800-53 R3 SC-11
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-12 (2)
NIST SP 800-53 R3 SC-12 (5)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-14
NIST SP 800-53 R3 SC-17
NIST SP 800-53 R3 SC-18

1.2.6 45 CFR 164.312(e)(2)(i) A.11.5.6
A.11.6.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.5.2
A.12.5.4
A.12.5.5
A.12.6.1
A.15.2.1
A9.4.2
A9.4.1,

8.1*Partial, A14.2.3,

8.1*partial, A.14.2.7
A12.6.1,
A18.2.2
Commandment #1
Commandment #2
Commandment #4
Commandment #5
Commandment #11
Application & Interface
Security
Customer Access
Requirements
AIS-02 Prior to granting customers access to data, assets, and information systems, identified security, contractual, and regulatory requirements for customer access shall be
addressed.

X X X X X X X X X X X X S3.2.a (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public.

CC5.1 C.2.1, C.2.3, C.2.4, C.2.6.1, H.1 10 (B)
11 (A+)
Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.3 SA-01 APO09.01 APO09.02
APO09.03
APO13.01
BAI02
DSS05
312.3,
312.8 and
312.10
BOSS > Legal Services > Contracts shared x Domain 10 Article 17 (1), (2) NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6

1.2.2 1.2.6

6.2.1 6.2.2
A.6.2.1
A.6.2.2
A.11.1.1
A9.1.1. Commandment #6
Commandment #7
Commandment #8
Application & Interface
Security
Data Integrity
AIS-03 Data input and output integrity routines (i.e., reconciliation and edit checks) shall be implemented for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse.

X X X X X X X X X X I3.2.0
I3.3.0
I3.4.0
I3.5.0
(I3.2.0) The procedures related to completeness, accuracy, timeliness, and authorization of inputs are consistent with the documented system processing integrity policies.
(I3.3.0) The procedures related to completeness, accuracy, timeliness, and authorization of system processing, including error correction and database management, are consistent with documented system processing integrity policies.
(I3.4.0) The procedures related to completeness, accuracy, timeliness, and authorization of outputs are consistent with the documented system processing integrity policies.
(I3.5.0) There are procedures to enable tracing of information inputs from their source to their final disposition and vice versa.

PI1.2
PI1.3
PI1.5
I.4 G.16.3, I.3 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-05 DSS06.02 DSS06.04
312.8 and
312.10
Application Services >
Programming Interfaces > Input
Validation
shared x Domain 10 NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SI-6
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)
NIST SP 800-53 R3 SI-9
NIST SP 800-53 R3 SI-10
NIST SP 800-53 R3 SI-11

1.2.6 45 CFR 164.312 (c)(1)
45 CFR 164.312 (c)(2)
45 CFR 164.312(e)(2)(i)
A.10.9.2
A.10.9.3
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.6.1
A.15.2.1
A13.2.1,
A13.2.2,
A9.1.1,
A9.4.1,
A10.1.1
A18.1.4
Commandment #1
Commandment #9
Commandment #11
Application & Interface
Security
Data Security / Integrity
AIS-04 Policies and procedures shall be established and maintained in support of data security to include (confidentiality, integrity and availability) across multiple system interfaces,
jurisdictions and business functions to prevent improper disclosure, alteration, or destruction.

X X X X X X X X X X S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 B.1 G.8.2.0.2, G.8.2.0.3, G.12.1,
G.12.4, G.12.9, G.12.10, G.16.2,
G.19.2.1, G.19.3.2, G.9.4, G.17.2,
G.17.3, G.17.4, G.20.1
6 (B)
26 (A+)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-03 DS5.11 APO09.01 APO09.02
APO09.03
APO13.01
DSS05.02
DSS06.06
MEA03.01
MEA03.02
312.8 and
312.10
BOSS > Data Governance > Rules
for Information Leakage Prevention
shared x Domain 10 6.02. (b)

1.1.0 1.2.2

1.2.6 4.2.3

5.2.1 7.1.2

7.2.1 7.2.2

7.2.3 7.2.4

8.2.1 8.2.2

8.2.3 8.2.5

9.2.1 A.10.8.1
A.10.8.2
A.11.1.1
A.11.6.1
A.11.4.6
A.12.3.1
A.12.5.4
A.15.1.4
A13.2.1,
A13.2.2,
A9.1.1,
A9.4.1,
A10.1.1
A18.1.4
All
Audit Assurance &
Compliance
Audit Planning
AAC-01 Audit plans shall be developed and maintained to address business process disruptions. Auditing plans shall focus on reviewing the effectiveness of the implementation of security operations. All audit activities must be agreed upon prior to executing any audits.

X X X X X X X X X X X S4.1.0
S4.2.0
(S4.1.0) The entity’s system security is periodically reviewed and compared with the defined system security policies.
(S4.2.0) There is a process to identify and address potential impairments to the entity’s ongoing ability to achieve its objectives in accordance with its defined system security policies.

CC4.1 L.1, L.2, L.7, L.9, L.11 58 (B) CO-01 ME 2.1
ME 2.2
PO 9.5
PO 9.6
APO12.04
APO12.05
APO12.06
MEA02.01
MEA02.02
Title 16
Part 312
BOSS > Compliance > Audit
Planning
shared x Domain 2, 4 6.01. (d) NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)
NIST SP 800-53 R3 PL-6

10.2.5 45 CFR 164.312(b) Clause 4.2.3 e)
Clause 4.2.3b
Clause 5.1 g
Clause 6
A.15.3.1
Clauses

4.3(a),

4.3(b),

5.1(e),

5.1(f),

6.2(e),

9.1,

9.1(e),

9.2,
Commandment #1
Commandment #2
Commandment #3
Audit Assurance &
Compliance
Independent Audits
AAC-02 Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards,
procedures, and compliance obligations.

X X X X X X X X X X X X S4.1.0
S4.2.0
(S4.1.0) The entity’s system security is periodically reviewed and compared with the defined system security policies.
(S4.2.0) There is a process to identify and address potential impairments to the entity’s ongoing ability to achieve its objectives in accordance with its defined system security policies.

CC4.1 L.2, L.4, L.7, L.9, L.11 58 (B)
59 (B)
61 (C+, A+)
76 (B)
77 (B)
CO-02 DS5.5
ME2.5
ME 3.1
PO 9.6
APO12.04
APO12.05
DSS05.07
MEA02.06
MEA02.07
MEA02.08
MEA03.01
Title 16
Part 312
BOSS > Compliance > Independent
Audits
shared x Domian 2, 4 6.03. (e)

6.07.01. (m)

6.07.01. (n)
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 RA-5 (1)
NIST SP 800-53 R3 RA-5 (2)
NIST SP 800-53 R3 RA-5 (3)
NIST SP 800-53 R3 RA-5 (6)
NIST SP 800-53 R3 RA-5 (9)

1.2.5 1.2.7

4.2.1 8.2.7

10.2.3 10.2.5
45 CFR 164.308 (a)(8)
45 CFR 164.308(a)(1)(ii)(D)
Clause 4.2.3e
Clause 5.1 g
Clause 5.2.1 d)
Clause 6
A.6.1.8
Clauses

4.3(a),

4.3(b),

5.1(e),

5.1(f),

9.1,

9.2,

9.3(f),
A18.2.1
Commandment #1
Commandment #2
Commandment #3
Audit Assurance &
Compliance
Information System
Regulatory Mapping
AAC-03 Organizations shall create and maintain a control framework which captures standards, regulatory, legal, and statutory requirements relevant for their business needs. The control framework shall be reviewed at least annually to ensure changes that could affect the business processes are
reflected.

X X X X X X X X X X X X S3.1.0
x3.1.0
(S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operations that would impair system [availability, processing integrity, confidentiality] commitments and (2) assess the risks associated with the identified threats.

CC3.1 L.1, L.2, L.4, L.7, L.9 76 (B)
77 (B)
78 (B)
83 (B)
84 (B)
85 (B)
Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.1.3
CO-05 ME 3.1 APO12.01
APO12.02
APO12.03
MEA03.01
312.4 BOSS > Compliance > Information
System Regulatory Mapping
shared x Domain 2, 4 6.10. (a)

6.10. (b)

6.10. (c)

6.10. (d)

6.10. (e)

6.10. (f)

6.10. (g)

6.10. (h)

1.2.2 1.2.4

1.2.6 1.2.11

3.2.4 5.2.1
ISO/IEC 27001:2005
Clause 4.2.1 b) 2)
Clause 4.2.1 c) 1)
Clause 4.2.1 g)
Clause 4.2.3 d) 6)
Clause 4.3.3
Clause 5.2.1 a - f
Clause 7.3 c) 4)
A.7.2.1
A.15.1.1
A.15.1.3
A.15.1.4
A.15.1.6
Clauses

4.2(b),

4.4,

5.2(c),

5.3(ab),

6.1.2,

6.1.3,

6.1.3(b),

7.5.3(b),

7.5.3(d),

8.1,

8.3 9.2(g),

9.3,

9.3(b),

9.3(f),

10.2,
A.8.2.1,
A.18.1.1,
A.18.1.3,
A.18.1.4,
A.18.1.5
Commandment #1
Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Business Continuity
Planning
BCR-01 A consistent unified framework for business continuity planning and plan
development shall be established, documented and adopted to ensure all
business continuity plans are consistent in addressing
priorities for
testing, maintenance, and information security requirements.

Requirements for business continuity plans include the
following:
• Defined purpose and scope, aligned with relevant
dependencies
• Accessible to and understood by those who will use them • Owned by a named person(s) who is responsible for their review, update, and approval
• Defined lines of communication, roles, and responsibilities • Detailed recovery procedures, manual work-around, and reference information
• Method for plan invocation
X X X X X X X X X X X X A3.1.0
A3.3.0
A3.4.0
(A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.
(A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.
(A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies.

CC3.1
A1.2
A1.3
K.1.2.3. K.1.2.4, K.1.2.5, K.1.2.6,
K.1.2.7, K.1.2.11, K.1.2.13,
K.1.2.15
RS-03 DSS04.01
DSS04.02
DSS04.03
DSS04.05 BOSS > Operational Risk Management > Business Continuity provider x Domain 7, 8 6.07. (a)

6.07. (b)

6.07. (c)
Article 17 (1), (2) NIST SP800-53 R3 CP-1
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-9
NIST SP800-53 R3 CP-10
NIST SP800-53 R3 CP-1
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-2 (1)
NIST SP800-53 R3 CP-2 (2)
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-4 (1)
NIST SP800-53 R3 CP-6
NIST SP800-53 R3 CP-6 (1)
NIST SP800-53 R3 CP-6 (3)
NIST SP800-53 R3 CP-7
NIST SP800-53 R3 CP-7 (1)
NIST SP800-53 R3 CP-7 (2)
NIST SP800-53 R3 CP-7 (3)
NIST SP800-53 R3 CP-7 (5)
NIST SP800-53 R3 CP-8
NIST SP800-53 R3 CP-8 (1)
NIST SP800-53 R3 CP-8 (2)
NIST SP800-53 R3 CP-9
NIST SP800-53 R3 CP-9 (1)
NIST SP800-53 R3 CP-9 (3)
NIST SP800-53 R3 CP-10
NIST SP800-53 R3 CP-10 (2)
NIST SP800-53 R3 CP-10 (3)
NIST SP800-53 R3 PE-17
45 CFR 164.308 (a)(7)(i)
45 CFR 164.308 (a)(7)(ii)(B)
45 CFR 164.308 (a)(7)(ii)(C)
45 CFR 164.308 (a)(7)(ii)(E)
45 CFR 164.310 (a)(2)(i)
45 CFR 164.312 (a)(2)(ii)
Clause 5.1
A.6.1.2
A.14.1.3
A.14.1.4
Clause 5.1(h)
A.17.1.2
A.17.1.2
Commandment #1
Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Business Continuity
Testing
BCR-02 Business continuity and security incident response plans shall be subject to testing at planned intervals or upon significant organizational or environmental changes. Incident response plans shall involve impacted customers (tenant) and other business relationships that represent critical intra-supply chain business process dependencies.

X X X X X X X X X X X X A3.3 (A3.3) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.

A1.2 K.1.3, K.1.4.3, K.1.4.6, K.1.4.7,
K.1.4.8, K.1.4.9, K.1.4.10,
K.1.4.11, K.1.4.12
52 (B)
55 (A+)
RS-04 DSS04.04 BOSS > Operational Risk Management > Business Continuity provider x Domain 7, 8 6.07.01. (b)

6.07.01. (j)

6.07.01. (l)
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-2 (1)
NIST SP800-53 R3 CP-2 (2)
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-4 (1)
45 CFR 164.308 (a)(7)(ii)(D) A.14.1.5 A17.3.1 Commandment #1 Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Datacenter Utilities /
Environmental
Conditions
BCR-03 Datacenter utilities services and environmental conditions (e.g., water, power, temperature and humidity controls, telecommunications,and internet connectivity) shall be
secured, monitored, maintained, and tested for continual effectiveness at planned intervals to ensure protection from unauthorized interception or damage, and designed with
automated fail-over or other redundancies in the event of planned or unplanned disruptions.

X X X X X X A3.2.0
A3.4.0
(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.
(A3.4.0) Procedures exist to protect against unauthorized access to system resource.

A1.1
A1.2
A1.3
F.1 F.1.6, F.1.6.1, F.1.6.2, F.1.9.2,
F.2.10, F.2.11, F.2.12
9 (B)
10 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RS-08 DSS01.03 DSS01.04
DSS01.05
DSS04.03 312.8 and 312.10 Infra Services > Facility Security > Environmental Risk Management provider x Domain 7, 8 6.08. (a)

6.09. (c)

6.09. (f)

6.09. (g)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-4
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
A.9.2.2
A.9.2.3
A11.2.2,
A11.2.3
Commandment #1
Commandment #2
Commandment #3
Commandment #4
Commandment #9
Commandment #11
Business Continuity
Management &
Operational Resilience
Documentation
BCR-04 Information system documentation (e.g., administrator and user guides, and architecture diagrams) shall be made
available to authorized personnel to ensure the following:
• Configuring, installing, and operating the information system
• Effectively using the system’s security features
X X X X X X X X X X S3.11.0
A.2.1.0
(S3.11.0) Procedures exist to provide that personnel responsible for the design, development, implementation, and operation of systems affecting security have the qualifications and resources to fulfill their responsibilities.
(A.2.1.0) The entity has prepared an objective description of the system and its boundaries and communicated such description to authorized users.

CC1.3
CC1.4
CC2.1
G.1.1 56 (B)
57 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 OP-02 DS 9 DS 13.1
BAI08
BAI10
DSS01.01
312.8 and 312.10 SRM > Policies and Standards >
Job Aid Guidelines
shared x Domain 7, 8 Article 17 NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-10
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-9 (1)
NIST SP 800-53 R3 CP-9 (3)
NIST SP 800-53 R3 CP-10
NIST SP 800-53 R3 CP-10 (2)
NIST SP 800-53 R3 CP-10 (3)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)

1.2.6 Clause 4.3.3
A.10.7.4
Clause 9.2(g) Commandment #1
Commandment #2
Commandment #4
Commandment #5
Commandment #11
Business Continuity
Management &
Operational Resilience
Environmental Risks
BCR-05 Physical protection against damage from natural causes and disasters, as well as deliberate attacks, including fire, flood, atmospheric electrical discharge, solar induced geomagnetic storm, wind, earthquake, tsunami, explosion, nuclear accident, volcanic activity, biological hazard, civil unrest, mudslide, tectonic activity, and other forms of natural or man-made disaster shall be anticipated, designed, and have
countermeasures applied.

X X X X X X A3.1.0
A3.2.0
(A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.
(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.

CC3.1
A1.1
A1.2
F.1 F.2.9, F.1.2.21, F.5.1, F.1.5.2,
F.2.1, F.2.7, F.2.8
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RS-05 DSS01.03 DSS01.04
DSS01.05 Infra Services > Facility Security > Environmental Risk Management provider x Domain 7, 8 6.07. (d)

6.08. (a)

6.09. (a)

6.09. (b)

8.2.4 45 CFR 164.308 (a)(7)(i)
45 CFR 164.310(a)(2)(ii)
A.9.1.4
A.9.2.1
A11.1.4,
A11.2.1
Commandment #1
Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Equipment Location
BCR-06 To reduce the risks from environmental threats, hazards, and opportunities for unauthorized access, equipment shall be kept away from locations subject to high probability
environmental risks and supplemented by redundant
equipment located at a reasonable distance.

CC3.1
A1.1
A1.2
F.1 F.2.9, F.1.2.21, F.5.1, F.1.5.2,
F.2.1, F.2.7, F.2.8
53 (A+)
75 (C+, A+)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RS-06 DSS01.04 DSS01.05 312.8 and
312.10
Infra Services > Facility Security > Environmental Risk Management provider x Domain 7, 8 6.07. (d)

6.08. (a)

6.09. (a)

6.09. (b)

6.09. (d)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-5
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-18
45 CFR 164.310 (c) A.9.2.1 A11.2.1 Commandment #1
Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Equipment
Maintenance
BCR-07 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for equipment maintenance ensuring continuity and availability of operations and support personnel.

X X X X X X X X X X X A3.2.0
A4.1.0
(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.
(A4.1.0) The entity’s system availability and security performance is periodically reviewed and compared with the defined system availability and related security policies.

A1.1
A1.2
CC4.1
F.2.19 1 (B) OP-04 A13.3 BAI03.10
BAI04.03
BAI04.04
DSS03.05
Infra Services > Equipment
Maintenance >
provider x Domain 7, 8 6.09. (h) Article 17 (1) NIST SP 800-53 R3 MA-2 NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-2 (1)
NIST SP 800-53 R3 MA-3
NIST SP 800-53 R3 MA-3 (1)
NIST SP 800-53 R3 MA-3 (2)
NIST SP 800-53 R3 MA-3 (3)
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-4 (1)
NIST SP 800-53 R3 MA-4 (2)
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 MA-6

5.2.3 8.2.2

8.2.3 8.2.4

8.2.5 8.2.6

8.2.7 45 CFR 164.310 (a)(2)(iv) A.9.2.4 A11.2.4 Commandment #2 Commandment #5
Commandment #11
Business Continuity
Management &
Operational Resilience
Equipment Power
Failures
BCR-08 Protection measures shall be put into place to react to natural and man-made threats based upon a geographically-specific Business Impact Assessment
X X X X X X X X A3.2.0 (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.

A1.1
A1.2
F.1 F.1.6, F.1.6.1, F.1.6.2, F.1.9.2,
F.2.10, F.2.11, F.2.12
54 (A+) Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RS-07 DSS01.04 DSS01.05
DSS04.01
DSS04.02
DSS04.03 312.8 and 312.10 Infra Services > Facility Security > Environmental Risk Management provider x Domain 7, 8 6.08. (a)

6.09. (e)

6.09. (f)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-12
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 CP-8
NIST SP800-53 R3 CP-8 (1)
NIST SP800-53 R3 CP-8 (2)
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-9
NIST SP800-53 R3 PE-10
NIST SP800-53 R3 PE-11
NIST SP800-53 R3 PE-12
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
NIST SP800-53 R3 PE-14
A.9.2.2
A.9.2.3
A 9.2.4
A.11.2.2,
A.11.2.3,
A.11.2.4
Commandment #1
Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Impact Analysis
BCR-09 There shall be a defined and documented method for determining the impact of any disruption to the organization (cloud provider, cloud consumer) that must incorporate the following:
• Identify critical products and services
• Identify all dependencies, including processes, applications, business partners, and third party service providers
• Understand threats to critical products and services
• Determine impacts resulting from planned or unplanned disruptions and how these vary over time
• Establish the maximum tolerable period for disruption • Establish priorities for recovery
• Establish recovery time objectives for resumption of critical products and services within their maximum tolerable period of disruption
• Estimate the resources required for resumption
X X X X X X X X X X X X A3.1.0
A3.3.0
A3.4.0
(A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.
(A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.
(A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies.

CC3.1
A1.2
A1.3
K.2 RS-02 BAI06.01
BAI10.01
BAI10.02
BAI10.03
DSS04.01
DSS04.02 ITOS > Service Delivery > Information Technology Resiliency - Resiliency Analysis provider x Domain 7, 8 6.02. (a)

6.03.03. (c)

6.07. (a)

6.07. (b)

6.07. (c)
Article 17 (1), (2) NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 RA-3
45 CFR 164.308 (a)(7)(ii)(E) ISO/IEC 27001:2005
A.14.1.2
A 14.1.4
A.17.1.1
A.17.1.2
Commandment #1
Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Policy
BCR-10 Policies and procedures shall be established, and supporting business
processes and technical measures implemented, for
appropriate IT
governance and service management to ensure appropriate planning,
delivery and support of the organization's IT capabilities supporting
business functions, workforce, and/or customers based on industry
acceptable standards (i.e., ITIL v4 and COBIT 5). Additionally, policies
and procedures shall include defined roles and
responsibilities
supported by regular workforce training.

X X X X X X S2.3.0 (S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality of data, processing integrity, system security and related security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.

CC3.2 G.1.1 45 (B) OP-01 DS13.1 APO01
APO07.01
APO07.03
APO09.03
DSS01.01
SRM > Policies and Standards >
Operational Security Baselines
shared x Domain 7, 8 6.03. (c) NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-4 (1)
NIST SP 800-53 R3 MA-4 (2)
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)
NIST SP 800-53 R3 SA-12

8.2.1 Clause 5.1
A 8.1.1
A.8.2.1
A 8.2.2
A.10.1.1
Clause 5.1(h)
A.6.1.1
A.7.2.1
A.7.2.2
A.12.1.1
Commandment #1
Commandment #2
Commandment #3
Commandment #6
Commandment #7
Business Continuity
Management &
Operational Resilience
Retention Policy
BCR-11 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining and adhering to the retention period of any critical asset as per established policies and procedures, as well as applicable legal, statutory, or regulatory compliance
obligations. Backup and recovery measures shall be
incorporated as part of business continuity planning and tested accordingly for effectiveness.

X X X X X X X X X X A3.3.0
A3.4.0
I3.20.0
I3.21.0
(A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.
(A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies.
(I3.20.0) Procedures exist to provide for restoration and disaster recovery consistent with the entity’s defined processing integrity policies.
(I3.21.0) Procedures exist to provide for the completeness, accuracy, and timeliness of backup data and systems.

A1.2
A1.3
I3.21
D.2.2.9 36 (B) Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.5.2
DG-04 DS 4.1
DS 4.2
DS 4.5
DS 4.9
DS 11.6
BAI09.01
BAI09.02
BAI09.03
DSS04.01
DSS04.02
DSS04.03
DSS04.04
DSS04.07
MEA03.01
312.3 BOSS > Data Governance > Data
Retention Rules
shared x Domain 5 6.03. (h)

5.1.0 5.1.1

5.2.2 8.2.6
45 CFR 164.308 (a)(7)(ii)(A)
45 CFR 164.310 (d)(2)(iv)
45 CFR 164.308(a)(7)(ii)(D)
45 CFR 164.316(b)(2)(i) (New)
Clause 4.3.3
A.10.5.1
A.10.7.3
Clauses

9.2(g)

7.5.3(b)

5.2 (c)

7.5.3(d)

5.3(a)

5.3(b)

8.1 8.3
A.12.3.1
A.8.2.3
EAR 15 §
762.6 Period
of Retention
EAR 15
CFR § 786.2
Recordkeepi
ng
Commandment #11
Change Control &
Configuration
Management
New Development /
Acquisition
CCC-01 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to ensure the development and/or acquisition of new data,
physical or virtual applications, infrastructure network and systems components, or any corporate, operations and/or datacenter facilities have been pre-authorized by the
organization's business leadership or other accountable business role or function.

X X X X X X X X X X S3.12.0
S3.10.0
S3.13.0
(S3.12.0) Procedures exist to maintain system components, including configurations consistent with the defined system security policies.
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies.
(S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.2
CC7.1
CC7.4
I.2 I.1.1, I.1.2, I.2. 7.2, I.2.8, I.2.9,
I.2.10, I.2.13, I.2.14, I.2.15, I.2.18,
I.2.22.6, L.5
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RM-01 A12 A16.1
APO01.02
APO01.06
BAI02.04
BAI06.01
ITOS > IT Operation > Architecture
Governance
shared x None 6.03. (a) NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)

1.2.6 A.6.1.4
A.6.2.1
A.12.1.1
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.5
A.15.1.3
A.15.1.4
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5

8.1* (partial) A.14.2.7
A.18.1.3
A.18.1.4
Commandment #1
Commandment #2
Commandment #3
Change Control &
Configuration
Management
Outsourced
Development
CCC-02 External business partners shall adhere to the same policies and procedures for change management, release, and testing as internal developers within the organization (e.g. ITIL service management processes).

X X X X X X X X X X S3.10.0
S3.13
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system availability, confidentiality of data, processing integrity, systems security and related security policies. (S3.13) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.1
CC7.4
C.2
I.1
I.2
I.4
C.2.4, G.4, G6, I.1, I.4.4, I.4.5,
I.2.7.2, I.2.8, I.2.9, I.2.15, I.2.18,
I.2.22.6, I.2.7.1, I.2.13, I.2.14,
I.2.17, I.2.20, I.2.22.2, I.2.22.4,
I.2.22.7, I.2.22.8, I.2.22.9,
I.2.22.10, I.2.22.11, I.2.22.12,
I.2.22.13, I.2.22.14, I.3, J.1.2.10,
L.7, L.9, L.10
27 (B) Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RM-04 APO07.06 APO09.03
APO09.04
APO10.01
APO10.04
APO10.05
APO11.01
APO11.02
APO11.04
APO11.05 ITOS > IT Operation > Architecture Governance shared x None NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)
NIST SP 800-53 R3 SA-12
A.6.1.8
A.6.2.1
A.6.2.3
A.10.1.4
A.10.2.1
A.10.2.2
A.10.2.3
A.10.3.2
A.12.1.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.1
A.12.5.2
A.12.5.3
A.12.5.5
A.12.6.1
A.13.1.2
A.15.2.1
A.15.2.2
A18.2.1
A.15.1.2
A.12.1.4

8.1* (partial)

8.1* (partial) A.15.2.1

8.1* (partial) A.15.2.2
A.14.2.9
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5

8.1* (partial) A.14.2.2

8.1* (partial) A.14.2.3

8.1* (partial) A.14.2.4

8.1* (partial) A.14.2.7
A.12.6.1
A.16.13
A.18.2.2
A.18.2.3
Commandment #1
Commandment #2
Commandment #3
Change Control &
Configuration
Management
Quality Testing
CCC-03 Organization shall follow a defined quality change control and testing process (e.g. ITIL Service Management) with
established baselines, testing, and release standards that focus on system availability, confidentiality, and integrity of systems and services.

X X X X X X X X X A3.13.0
C3.16.0
I3.14.0
S3.10.0
S3.13
(A3.13.0, C3.16.0, I3.14.0, S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system availability, confidentiality of data, processing integrity, systems security and related security policies.
(S3.13) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.1
CC7.1
CC7.1
CC7.1
CC7.4
C.1.7, G.1, G.6, I.1, I.4.5, I.2.18,
I.22.1, I.22.3, I.22.6, I.2.23,
I.2.22.2, I.2.22.4, I.2.22.7. I.2.22.8,
I.2.22.9, I.2.22.10, I.2.22.11,
I.2.22.12, I.2.22.13,
I.2.22.14,I.2.20, I.2.17, I.2.7.1, I.3,
J.2.10, L.9
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RM-03 PO 8.1 APO11.01 APO11.02
APO11.04
APO11.05
BAI02.04
BAI03.06
BAI03.08
BAI07.03
BAI07.05
ITOS > Service Support > Release
Management
shared x None 6.03.01. (b)

9.1.0 9.1.1

9.2.1 9.2.2
A.6.1.3
A.10.1.1
A.10.1.4
A.10.3.2
A.12.1.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.1
A.12.5.2
A.12.5.3
A.12.6.1
A.13.1.2
A.15.2.1
A.15.2.2
A.6.1.1
A.12.1.1
A.12.1.4
A.14.2.9
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5

8.1* partial A.14.2.2

8.1* partial A.14.2.3

8.1* partial A.14.2.4
A.12.6.1
A.16.1.3
A.18.2.2
A.18.2.3
Commandment #1
Commandment #2
Commandment #3
Change Control &
Configuration
Management
Unauthorized Software
Installations
CCC-04 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on
organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

X X X X X X X X A3.6.0
S3.5.0
S3.13.0
(A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. (S3.5.0) Procedures exist to protect against infection by computer viruses, malicious code, and unauthorized software.
(S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC5.5
CC5.8
CC7.4
G.1
I.2
G.2.13, G.20.2,G.20.4, G.20.5,
G.7, G.7.1, G.12.11, H.2.16,
I.2.22.1, I.2.22.3, I.2.22.6, I.2.23
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RM-05 APO13.01 BAI06.01
BAI10
DSS05.03
DSS05.04
DSS05.05
DSS05.07
DSS06.03 312.8 and 312.10 ITOS > Service Support > Configuration Management -> Software Mangement shared x None NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-8
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 CM-8
NIST SP 800-53 R3 CM-8 (1)
NIST SP 800-53 R3 CM-8 (3)
NIST SP 800-53 R3 CM-8 (5)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)

3.2.4 8.2.2
A.10.1.3
A.10.4.1
A.11.5.4
A.11.6.1
A.12.4.1
A.12.5.3
A.6.1.2
A.12.2.1
A.9.4.4
A.9.4.1
A.12.5.1

8.1* (partial) A.14.2.4
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment #11
Change Control &
Configuration
Management
Production Changes
CCC-05 Policies and procedures shall be established for managing the risks associated with applying changes to:
• business-critical or customer (tenant)-impacting (physical and virtual) applications and system-system interface (API) designs and configurations
• infrastructure network and systems components
Technical measures shall be implemented to provide
assurance that all changes directly correspond to a
registered change request, business-critical or customer (tenant) , and/or authorization by, the customer (tenant) as per agreement (SLA) prior to deployment.

X X X X X X X X X X X A3.16.0
S3.13.0
(A3.16.0, S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.4
CC7.4
I.2.17, I.2.20, I.2.22 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RM-02 A16.1 A17.6
BAI06.01
BAI06.02
BAI06.03
BAI06.04
BAI07.01
BAI07.03
BAI07.04
BAI07.05
BAI07.06
ITOS > Service Support > Release
Management
shared x None 6.03. (a) NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 PL-5
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 PL-5
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-6
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)

1.2.6 45 CFR 164.308 (a)(5)(ii)(C)
45 CFR 164.312 (b)
A.10.1.4
A.12.5.1
A.12.5.2
A.12.1.4

8.1* (partial) A.14.2.2

8.1* (partial) A.14.2.3
Commandment #1
Commandment #2
Commandment #3
Commandment #11
Data Security &
Information Lifecycle
Management
Classification
DSI-01 Data and objects containing data shall be assigned a classification by the data owner based on data type, value, sensitivity, and criticality to the organization.

X X X X X X X X X X S3.8.0
C3.14.0
(S3.8.0) Procedures exist to classify data in accordance with classification policies and periodically monitor and update such classifications as necessary.
(C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies.

CC3.1
CC3.1
D.1.3, D.2.2 DG-02 PO 2.3
DS 11.6
APO01.06
APO03.02
APO08.01
APO09.03
APO13.01
BAI09.01
BAI09.02
BAI09.03
312.3 BOSS > Data Governance > Data
Classification
shared x Domain 5 6.04.03. (a) Article 4 (1),
Article 12, Article 17
NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 AC-4

1.2.3 1.2.6

4.1.2 8.2.1

8.2.5 8.2.6
A.7.2.1 A.8.2.1 Commandment #9
Data Security &
Information Lifecycle
Management
Data Inventory / Flows
DSI-02 Policies and procedures shall be established to inventory, document, and maintain data flows for data that is resident (permanently or temporarily) within the service's applications and infrastructure network and systems. In particular,
providers shall ensure that data that is subject to geographic residency requirements not be migrated beyond its defined bounds.
-- APO01.06
APO03.01
APO03.02
APO09.01
APO09.01
BAI06.03
BAI09.01
BAI10.01
BAI10.02
BAI10.03
BAI10.04
BAI10.05
BOSS > Data Governance >
Handling / Labeling / Security Policy
Domain 5 6.10. (a)

6.10. (b)

6.10. (c)

6.10. (d)

6.10. (e)
NIST SP 800-53 R3 SC-30 Clause

4.2 5.2,

7.5,

8.1 Data Security &
Information Lifecycle
Management
eCommerce
Transactions
DSI-03 Data related to electronic commerce (e-commerce) that traverses public networks shall be appropriately classified and protected from fraudulent activity, unauthorized disclosure, or modification in such a manner to prevent contract dispute and compromise of data.

X X X X X X X S3.6
I13.3.a-e
I3.4.0
(S3.6) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks. (I13.3.a-e) The procedues related to completeness, accuracy, timeliness, and authorization of system processing, including error correction and database management, are consistent with documented system processing integrity policies.
(I3.4.0) The procedures related to completeness, accuracy, timeliness, and authorization of outputs are consistent with the documented system processing integrity policiies.

CC5.7
PI1.5
G.4
G.11
G.16
G.18
I.3
I.4
G.19.1.1, G.19.1.2, G.19.1.3,
G.10.8, G.9.11, G.14, G.15.1
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-28 DS 5.10 5.11 APO01.06 APO03.02
APO08.01
APO13.01
APO13.02
DSS05
DSS06
312.8 and
312.10
SRM > Cryptographic Services >
Data in Transit Encryption
shared x Domain 2 Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-22
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AC-22
NIST SP 800-53 R3 AU-10
NIST SP 800-53 R3 AU-10 (5)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)

3.2.4 4.2.3

7.1.2 7.2.1

7.2.2 8.2.1

8.2.5 45 CFR 164.312(e)(1)
45 CFR 164.312(e)(2)(i)
A.7.2.1
A.10.6.1
A.10.6.2
A.10.9.1
A.10.9.2
A.15.1.4
A.8.2.1
A.13.1.1
A.13.1.2
A.14.1.2
A.14.1.3
A.18.1.4
Commandment #4
Commandment #5
Commandment #9
Commandment #10
Commandment #11
Data Security &
Information Lifecycle
Management
Handling / Labeling /
Security Policy
DSI-04 Policies and procedures shall be established for the labeling, handling, and security of data and objects which contain data.

Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data.

X X X X X X X X X X S3.2.a (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public.

CC5.1 G.13 D.2.2 DG-03 PO 2.3
DS 11.6
APO01.06
APO03.02
APO08.01
APO09.03
APO13.01
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
312.2 BOSS > Data Governance >
Handling / Labeling / Security Policy
shared x Domain 5 6.03.05. (b) Article 22
Article 23
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-12
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-16
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-3
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-12

99.31.(a)(1)(ii) 1.1.2

5.1.0 7.1.2

8.1.0 8.2.5

8.2.6 A.7.2.2
A.10.7.1
A.10.7.3
A.10.8.1
A.8.2.2
A.8.3.1
A.8.2.3
A.13.2.1
Commandment #8
Commandment #9
Commandment #10
Data Security &
Information Lifecycle
Management
Non-Production Data
DSI-05 Production data shall not be replicated or used in nonproduction environments.X X X X X X X C3.5.0 S3.4.0
C3.21.0
(C3.5.0) The system procedures provide that confidential information is disclosed to parties only in accordance with the entity’s defined confidentiality and related security policies.
(S3.4.0) Procedures exist to protect against unauthorized access to system resources.
(C3.21.0) Procedures exist to provide that confidential information is protected during the system development, testing, and change processes in accordance with defined system confidentiality and related security policies.

C1.3
CC5.6
C1.1
I.2.18 DG-06 APO01.06
BAI01.01
BAI03.07
BAI07.04 SRM > Policies and Standards > Technical Standard (Data Management Security Standard) shared x Domain 5 6.03. (d) NIST SP 800-53 R3 SA-11 NIST SP 800-53 R3 SA-11 (1)

1.2.6 45 CFR 164.308(a)(4)(ii)(B) A.7.1.3
A.10.1.4
A.12.4.2
A.12.5.1
A.8.1.3
A.12.1.4
A.14.3.1

8.1* (partial) A.14.2.2.

Commandment #9
Commandment #10
Commandment #11
Data Security &
Information Lifecycle
Management
Ownership /
Stewardship
DSI-06 All data shall be designated with stewardship, with assigned responsibilities defined, documented, and communicated.

X X X X X X X X X S2.2.0
S2.3.0
S3.8.0
(S2.2.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users. (S2.3.0) Responsibility and accountability for the entity’s system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.
(S3.8.0) Procedures exist to classify data in accordance with classification policies and periodically monitor and update such classifications as necessary
CC2.3
CC3.1
C.2.5.1, C.2.5.2, D.1.3, L.7 Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.1.3
DG-01 DS5.1
PO 2.3
APO01.06
APO03.02
APO13.01
APO13.03
312.4 BOSS > Data Governance > Data
Ownership / Stewadship
shared x Domain 5 Article 4 NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-2

6.2.1 45 CFR 164.308 (a)(2) A.6.1.3
A.7.1.2
A.15.1.4
A.6.1.1
A.8.1.2
A.18.1.4
Commandment #6
Commandment #10
Data Security &
Information Lifecycle
Management
Secure Disposal
DSI-07 Any use of customer data in non-production environments requires explicit, documented approval from all customers whose data is affected, and must comply with all legal and regulatory requirements for scrubbing of sensitive data elements.

X X X X X X X X X C3.5.0
S3.4.0
(C3.5.0) The system procedures provide that confidential information is disclosed to parties only in accordance with the entity’s defined confidentiality and related security policies.
(S3.4.0) Procedures exist to protect against unauthorized access to system resources.

C1.3
CC5.6
D.2.2.10, D.2.2.11, D.2.2.14, 37 (B) Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.7.5 and 4.5.3
DG-05 DS 11.4 APO01.06
APO13.01
BAI09.03
DSS01.01
312.3 BOSS > Data Governance > Secure
Disposal of Data
shared x Domain 5 6.03. (h) Article 16
Article 17
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 MP-6 (4)
NIST SP 800-53 R3 PE-1

5.1.0 5.2.3
45 CFR 164.310 (d)(2)(i)
45 CFR 164.310 (d)(2)(ii)
A.9.2.6
A.10.7.2
A.11.2.7
A.8.3.2
Commandment #11
Datacenter Security
Asset Management
DCS-01 Assets must be classified in terms of business criticality, service-level expectations, and operational continuity
requirements. A complete inventory of business-critical assets located at all sites and/or geographical locations and their usage over time shall be maintained and updated
regularly, and assigned ownership by defined roles and
responsibilities.

X X X X X S3.1.0
C3.14.0
S1.2.b-c
(S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies.
(S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to define protection requirements, access rights and access restrictions, and retention and destruction policies.
c. Assessing risks on a periodic basis.

CC3.1
CC3.1
Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 FS-08 APO01.06 APO03.02
APO08.01
APO09.03
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
DSS05.05
DSS06.06 ITOS > Service Support > Configuration Management - Physical Inventory provider x Domain 8 Article 17 Annex A.8 Datacenter Security
Controlled Access
Points
DCS-02 Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) shall be implemented to safeguard sensitive data and information systems.

X X X X X A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers.

CC5.5 F.2 F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6,
F.1.2.8, F.1.2. 9, F.1.2.10,
F.1.2.11, F.1.2.12, F.1.2.13,
F.1.2.14, F.1.2.15, F.1.2.24,
F.1.3, F.1.4.2, F1.4.6, F.1.4.7,
F.1.6, F.1.7,F.1.8, F.2.13, F.2.14,
F.2.15, F.2.16, F.2.17, F.2.18
7 (B) Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 FS-03 DS 12.2 DS 12.3
APO13.01
DSS01.01
DSS01.05
DSS05.05
DSS06.03
DSS06.06
312.8 and 312.10 Infra Services > Facility Security >
Controlled Physical Access
provider x Domain 8 6.08. (a)

99.31.a.1.ii 8.2.3 A.9.1.1
A.9.1.2
A.11.1.1
A.11.1.2
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Datacenter Security
Equipment Identification
DCS-03 Automated equipment identification shall be used as a method of connection authentication. Location-aware technologies may be used to validate connection authentication integrity based on known equipment location.

X X X X X S3.2.a (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public.

CC5.1 D.1 D.1.1, D.1.3 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-13 DS5.7 APO13.01 DSS05.02
DSS05.03
312.3,
312.8 and
312.10
> > Domain 10 6.05. (a) Article 17 NIST SP 800-53 R3 IA-4 NIST SP 800-53 R3 IA-3 NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-4 (4)
A.11.4.3 Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment #8
Datacenter Security
Off-Site Authorization
DCS-04 Authorization must be obtained prior to relocation or transfer of hardware, software, or data to an offsite premises.

X X X X X X X X S3.2.f
C3.9.0
(S3.2.f) f. Restriction of access to offline storage, backup data, systems, and media.
(C3.9.0) Procedures exist to restrict physical access to the defined system including, but not limited to: facilities, backup media, and other system components such as firewalls, routers, and servers.

CC5.1
CC5.5
F.2.18, F.2.19, Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.5 FS-06 EDM05.02 APO01.02
APO03.02
BAI02.03
BAI02.04
BAI03.09
BAI06.01 312.8 and
312.10
SRM > Facility Security > Asset Handlingprovider x Domain 8 6.08. (a)

6.09. (j)
Article 17 NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-17 (1)
NIST SP 800-53 R3 AC-17 (2)
NIST SP 800-53 R3 AC-17 (3)
NIST SP 800-53 R3 AC-17 (4)
NIST SP 800-53 R3 AC-17 (5)
NIST SP 800-53 R3 AC-17 (7)
NIST SP 800-53 R3 AC-17 (8)
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-17
45 CFR 164.310 (c )
45 CFR 164.310 (d)(1)
45 CFR 164.310 (d)(2)(i)
A.9.2.5
A.9.2.6
A.11.2.6
A.11.2.7
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #4
Commandment #5
Commandment #11
Datacenter Security
Off-Site Equipment
DCS-05 Policies and procedures shall be established for the secure disposal of equipment (by asset type) used outside the
organization's premises. This shall include a wiping solution or destruction process that renders recovery of information impossible. The erasure shall consist of a full overwrite of the drive to ensure that the erased drive is released to inventory X X X X X X X X X X X X S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 D.1 D.1.1, D.2.1. D.2.2, Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.5 FS-07 APO09.03 APO10.04
APO10.05
APO13.01
DSS01.02 312.8 and
312.10
BOSS > Data Governance > Secure Disposal of Data provider x Domain 8 6.05. (a)

6.05. (b)

6.05. (c)
Article 17 NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 CM-8 (1)
NIST SP 800-53 R3 CM-8 (3)
NIST SP 800-53 R3 CM-8 (5)
NIST SP 800-53 R3 SC-30
45 CFR 164.310 (d)(2)(iii) A.7.1.1
A.7.1.2
A.8.1.1
A.8.1.2
Commandment #6
Commandment #7
Commandment #8
Datacenter Security
Policy
DCS-06 Policies and procedures shall be established, and supporting business processes implemented, for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas storing sensitive information.

X X X A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers.

CC5.5 H.6 F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6,
F.1.2.8, F.1.2. 9, F.1.2.10,
F.1.2.11, F.1.2.12, F.1.2.13,
F.1.2.14, F.1.2.15, F.1.2.24,
F.1.4.2, F1.4.6, F.1.4.7, F.1.7,
F.1.8, F.2.13, F.2.14, F.2.15,
F.2.16, F.2.17, F.2.18
7 (B) Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 FS-01 APO13.01 DSS01.04
DSS01.05
DSS04.01
DSS04.03 SRM > Policies and Standards > Information Security Policies (Facility Security Policy) provider x Domain 8 6.08. (a)

99.31.a.1.ii 8.2.1

8.2.2 8.2.3
45 CFR 164.310(a)(1)
45 CFR 164.310(a)(2)(ii)
45 CFR 164.310(b)
45 CFR 164.310 ( c) (New)
A.9.1.1
A.9.1.2
A.11.1.1
A.11.1.2
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Datacenter Security -
Secure Area
Authorization
DCS-07 Ingress and egress to secure areas shall be constrained and monitored by physical access control mechanisms to ensure that only authorized personnel are allowed access.

X X X X X X X X X X A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers.

CC5.5 F.2 F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6,
F.1.2.8, F.1.2. 9, F.1.2.10,
F.1.2.11, F.1.2.12, F.1.2.13,
F.1.2.14, F.1.2.15, F.1.2.24,
F.1.3, F.1.4.2, F1.4.6, F.1.4.7,
F.1.6, F.1.7,F.1.8, F.2.13, F.2.14,
F.2.15, F.2.16, F.2.17, F.2.18
7 (B) Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 FS-04 DS 12.3 APO13.01 APO13.02
DSS05.05
312.8 and 312.10 SRM > Policies and Standards >
Information Security Policy (Facility
Security Policy)
provider x Domain 8 6.08. (a)

6.09. (i)
Article 17 NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-7 (1)
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-18

99.31.a.1.ii 8.2.3 A.9.1.6 A.11.1.6 Commandment #1
Commandment #2
Commandment #3
Commandment #5
Datacenter Security
Unauthorized Persons
Entry
DCS-08 Ingress and egress points such as service areas and other points where unauthorized personnel may enter the premises shall be monitored, controlled and, if possible, isolated from data storage and processing facilities to prevent unauthorized data corruption, compromise, and loss.

X X X X X X X X A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers.

CC5.5 G.21 F.2.18 Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 FS-05 APO13.01 APO13.02
DSS05.05
DSS06.03 312.8 and
312.10
SRM > Policies and Standards > Information Security Policy (Facility Security Policy) provider x Domain 8 6.08. (a)

6.09. (j)
Article 17 NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-2 (1)
NIST SP 800-53 R3 PE-16

99.31.a.1.ii 8.2.5

8.2.6 45 CFR 164.310 (d)(1) A.9.2.7
A.10.1.2
A.11.2.5

8.1* (partial) A.12.1.2
Commandment #6
Commandment #7
Datacenter Security
User Access
DCS-09 Physical access to information assets and functions by users and support personnel shall be restricted.

CC5.5 F.2 F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6,
F.1.2.8, F.1.2. 9, F.1.2.10,
F.1.2.11, F.1.2.12, F.1.2.13,
F.1.2.14, F.1.2.15, F.1.2.24,
F.1.3, F.1.4.2, F1.4.6, F.1.4.7,
F.1.6, F.1.7,F.1.8, F.2.13, F.2.14,
F.2.15, F.2.16, F.2.17, F.2.18
7 (B)
10 (B)
Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 FS-02 DS 12.3 APO13.01 APO13.02
DSS05.04
DSS05.05
DSS06.03
312.8 and 312.10 Infra Services > Facility Security > Domain 8 6.08. (a)

99.31.a.1.ii 8.2.3 A.9.1.1 A.11.1.1 ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Encryption & Key
Management
Entitlement
EKM-01 Keys must have identifiable owners (binding keys to identities) and there shall be key management policies. APO01.06
APO13.01
DSS05.04
DSS05.06
DSS06.03
DSS06.06
SRM > Cryptographic Services >
Key Management
Annex
A.10.1
A.10.1.1
A.10.1.2
Encryption & Key
Management
Key Generation
EKM-02 Policies and procedures shall be established for the management of cryptographic keys in the service's
cryptosystem (e.g., lifecycle management from key generation to revocation and replacement, public key infrastructure, cryptographic protocol design and algorithms used, access controls in place for secure key generation, and exchange and storage including segregation of keys used for encrypted data or sessions). Upon request, provider shall inform the
customer (tenant) of changes within the cryptosystem,
especially if the customer (tenant) data is used as part of the service, and/or the customer (tenant) has some shared
responsibility over implementation of the control.

X X X X X X X X X S3.6.0
S3.4
(S3.6.0) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks. (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.7
CC5.6
L.6 38 (B)
39 (C+)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-19 DS5.8 APO13.01 APO13.02
APO09.03
BAI06.01
BAI09.01
BAI09.02
BAI09.03
312.8 and
312.10
SRM > Cryptographic Services >
Key Management
shared x Domain 2 6.04.04. (a)

6.04.04. (b)

6.04.04. (c)

6.04.04. (d)

6.04.04. (e)

6.04.05. (d)

6.04.05. (e)

8.1.1 8.2.1

8.2.5 45 CFR 164.312 (a)(2)(iv)
45 CFR 164.312(e)(1)
Clause 4.3.3
A.10.7.3
A.12.3.2
A.15.1.6
Clauses

5.2(c)

5.3(a)

5.3(b)

7.5.3(b)

7.5.3(d)

8.1 8.3

9.2(g)
A.8.2.3
A.10.1.2
A.18.1.5
Commandment #9
Commandment #10
Commandment #11
Architectural Relevance
Corp Gov
Relevance
Cloud Service Delivery Model
Applicability Supplier Relationship
CSA Enterprise Architecture
(formerly Trusted Cloud Initiative)
Control Domain CCM V3.0
Control ID Updated Control Specification
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 288
#2..
- 332 -
Encryption & Key
Management
Sensitive Data
Protection
EKM-03 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for the use of encryption protocols for protection of sensitive data in storage (e.g., file servers, databases, and end-user workstations), data in use (memory), and data in transmission (e.g., system interfaces, over public networks, and electronic messaging) as per applicable legal, statutory, and regulatory compliance obligations.

XXXXXXXXXX C3.12.0
S3.6.0
S3.4
(C3.12.0, S3.6.0) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks.
(S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.7
CC5.6
G.4
G.15
I.3
G.10.4, G.11.1, G.11.2, G.12.1,
G.12.2, G.12.4, G.12.10, G.14.18,
G.14.19, G.16.2, G.16.18,
G.16.19, G.17.16, G.17.17,
G.18.13, G.18.14, G.19.1.1,
G.20.14
23 (B)
24 (B)
25 (B)
Schedule 1 (Section 5) 4.7 Safeguards, Subs. 4.7.3 IS-18 DS5.8 DS5.10
DS5.11
APO13.01
DSS05.02
DSS05.03
DSS06.06
312.8 and
312.10
SRM > Data Protection >
Cryptographic Services - Data-AtRest Encryption,
Cryptographic Services - Data-inTransit Encryption
sharedx Domain 2 6.04.05. (a)

8.1.1 8.2.1

8.2.5 45 CFR 164.312 (a)(2)(iv)
45 CFR 164.312 (e)(1)
45 CFR 164.312 (e)(2)(ii)
A.10.6.1
A.10.8.3
A.10.8.4
A.10.9.2
A.10.9.3
A.12.3.1
A.15.1.3
A.15.1.4
A.13.1.1
A.8.3.3
A.13.2.3
A.14.1.3
A.14.1.2
A.10.1.1
A.18.1.3
A.18.1.4
Commandment #4
Commandment #5
Commandment #9
Commandment #10
Commandment #11
Encryption & Key
Management
Storage and Access
EKM-04 Platform and data-appropriate encryption (e.g., AES-256) in open/validated formats and standard algorithms shall be required. Keys shall not be stored in the cloud (i.e. at the cloud provider in question), but maintained by the cloud consumer or trusted key management provider. Key
management and key usage shall be separated duties.

XXXXXXX -- APO01.06
BAI09.02
BAI09.03
SRM > Cryptographic Services >
Key Management
sharedx Domain 11 Annex
A.10.1
A.10.1.1
A.10.1.2
Governance and Risk
Management
Baseline Requirements
GRM-01 Baseline security requirements shall be established for developed or acquired, organizationally-owned or managed, physical or virtual, applications and infrastructure system and network components that comply with applicable legal,
statutory and regulatory compliance obligations. Deviations from standard baseline configurations must be authorized following change management policies and procedures prior to deployment, provisioning, or use. Compliance with security baseline requirements must be reassessed at least annually unless an alternate frequency has been established and
authorized based on business need.

XXXXXXXXXXX S1.1.0
S1.2.0(a-i)
(S1.1.0) The entity’s security policies are established and periodically reviewed and approved by a designated individual or group.
(S1.2.0(a-i)) The entity's security policies include, but may not be limited to, the following matters:

CC3.2 L.2 L.2, L.5, L.7 L.8, L.9, L.10 12 (B)
14 (B)
13 (B)
15 (B)
16 (C+, A+)
21 (B)
Schedule 1 (Section 5), 4.7 - Safeguards IS-04 AI2.1
AI2.2
AI3.3
DS2.3
DS11.6
APO01.06
APO03.02
APO13.01
APO13.02
BAI02.01
BAI02.03
BAI02.04
BAI06.01
BAI10.01
BAI10.02
MEA02.01
312.8 and 312.10 SRM > Governance Risk &
Compliance > Technical Standards
sharedx Domain 2 6.03.01. (a)

6.03.04. (a)

6.03.04. (b)

6.03.04. (c)

6.03.04. (e)

1.2.6 8.2.1

8.2.7 A.12.1.1
A.15.2.2
A.14.1.1
A.18.2.3
Commandment #2
Commandment #4
Commandment #5
Commandment #11
Governance and Risk
Management
Data Focus Risk
Assessments
GRM-02 Risk assessments associated with data governance requirements shall be
conducted at planned intervals and shall consider the
following:
• Awareness of where sensitive data is stored and transmitted across
applications, databases, servers, and network infrastructure • Compliance with defined retention periods and end-of-life disposal requirements
• Data classification and protection from unauthorized use, access, loss, destruction, and falsification
XXXXXXXXXX S3.1.0
C3.14.0
S1.2.b-c
(S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies.
(S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to define protection requirements, access rights and access restrictions, and retention and destruction policies.
c. Assessing risks on a periodic basis.

CC3.1
CC3.1
L.4, L.5, L.6, L.7 34 (B) Schedule 1 (Section 5), 4.7 - Safeguards DG-08 PO 9.1 PO 9.2
PO 9.4
DS 5.7
EDM03.02
APO01.03
APO12.01
APO12.02
APO12.03
APO12.04
BAI09.01
312.1 BOSS > Operational Risk
Management > Independent Risk
Management
sharedx Domain 5 6.01. (d)

6.04.03. (a)
Article 6, Article 8, Article 17 (1) NIST SP 800-53 R3 CA-3 NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SI-12
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SI-12

1.2.4 8.2.1
45 CFR 164.308(a)(1)(ii)(A)
45 CFR 164.308(a)(8)
Clause 4.2.1 c) & g)
Clause 4.2.3 d)
Clause 4.3.1 & 4.3.3
Clause 7.2 & 7.3
A.7.2
A.15.1.1
A.15.1.3
A.15.1.4
Clauses

5.2(c)

5.3(a)

5.3(b)

6.1.2 6.1.2(a)(2)

6.1.3(b)

7.5.3(b)

7.5.3(d)

8.1 8.2

8.3 9.2(g)
A.18.1.1
A.18.1.3
EAR 15
CFR §736.2
(b)
Commandment #1
Commandment #2
Commandment #3
Commandment #6
Commandment #7
Commandment #9
Commandment #10
Commandment #11
Governance and Risk
Management
Management Oversight
GRM-03 Managers are responsible for maintaining awareness of, and complying with, security policies, procedures, and standards that are relevant to their area of responsibility.

XXXXXX S1.2.f
S2.3.0
(S1.2.f) f. Assigning responsibility and accountability for system availability, confidentiality, processing integrity and related security. (S2.3.0) Responsibility and accountability for the entity’s system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.

CC3.2 E.1 E.4 5 (B)
65 (B)
Schedule 1 (Section 5) 4.1 Accountability; 4.7 Safeguards, Sub 4.7.4 IS-14 DS5.3 DS5.4
DS5.5
APO01.03
APO01.04
APO01.08
DSS01.01
312.8 and 312.10 BOSS > Human Resources Security
> Roles and Responsibilities
sharedx Domain 3, 9 NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)

1.1.2 8.2.1
Clause 5.2.2
A.8.2.1
A.8.2.2
A 11.2.4
A.15.2.1
Clause 7.2(a,b)
A.7.2.1
A.7.2.2
A.9.2.5
A.18.2.2
Commandment #6
Commandment #7
Commandment #8
Governance and Risk
Management
Management Program
GRM-04 An Information Security Management Program (ISMP) shall be developed, documented, approved, and implemented that includes administrative, technical, and physical safeguards to protect assets and data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. The security program shall include, but not be limited to, the following areas insofar as they relate to the characteristics of the business:
• Risk management
• Security policy
• Organization of information security
• Asset management
• Human resources security
• Physical and environmental security
• Communications and operations management
• Access control
• Information systems acquisition, development, and
XXXXXXXXXXXX x1.2. (x1.2.) The entity’s system [availability, processing integrity, confidentiality and related] security policies include, but may not be limited to, the following matters:

A.1, B.1 2 (B)
3 (B)
5 (B)
Schedule 1 (Section 5), 4.1 - Accountability; 4.7 Safeguards IS-01 R2 DS5.2 R2 DS5.5
APO13.01
APO13.02
APO13.03
312.8 and
312.10
SRM > InfoSec Management >
Capabilitiy Mapping
sharedx Domain 2 Article 17 99.31.(a)(1)(ii) 8.2.1 45 CFR 164.308(a)(1)(i) 45 CFR 164.308(a)(1)(ii)(B)
45 CFR 164.316(b)(1)(i)
45 CFR 164.308(a)(3)(i) (New)
45 CFR 164.306(a) (New)
Clause 4.2
Clause 5
A.6.1.1
A.6.1.2
A.6.1.3
A.6.1.4
A.6.1.5
A.6.1.6
A.6.1.7
A.6.1.8
All in sections 4, 5, 6, 7, 8, 9, 10.

A.6.1.1
A.13.2.4
A.6.1.3
A.6.1.4
A.18.2.1
Commandment #1
Commandment #2
Governance and Risk
Management
Management
Support/Involvement
GRM-05 Executive and line management shall take formal action to support
information security through clearly-documented direction and commitment, and shall ensure the action has been assigned.

XXXXX S1.3.0 (S1.3.0) Responsibility and accountability for developing and maintaining the entity’s system security policies, and changes and updates to those policies, are assigned.

CC1.2 C.1 5 (B) Schedule 1 (Section 5), 4.1 Safeguards, Subsec. 4.1.1 IS-02 DS5.1 APO01.02 APO01.03
APO01.04
APO01.08
APO13.01
APO13.02
APO13.03
312.8 and
312.10
SRM > Governance Risk &
Compliance > Compliance
Management
sharedx Domain 2 Article 17 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-1 8.2.1 45 CFR 164.316 (b)(2)(ii) 45 CFR 164.316 (b)(2)(iii)
Clause 5
A.6.1.1
All in section 5 plus clauses

4.4 4.2(b)

6.1.2(a)(1)

6.2 6.2(a)

6.2(d)

7.1 7.4

9.3 10.2

7.2(a)
Commandment #3
Commandment #6
Governance and Risk
Management
Policy
GRM-06 Information security policies and procedures shall be established and
made readily available for review by all impacted personnel and external
business relationships. Information security policies must be authorized by the organization's business leadership (or other accountable business role or function) and supported by a strategic
business plan and an information security management
program inclusive of defined information security roles and responsibilities for business leadership.

XXXXXX S1.1.0
S1.3.0
S2.3.0
(S1.1.0) The entity's security policies are established and periodically reviewed and approved by a designated individual or group.
(S1.3.0) Responsibility and accountability for developing and maintaining the entity’s system security policies, and changes and updates to those policies, are assigned.
(S2.3.0) Responsibility and accountability for the entity's system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.

CC3.2
CC1.2
CC2.3
B.1 Schedule 1 (Section 5) 4.1 Accountability, Subsec 4.1.4 IS-03 DS5.2 APO01.03 APO01.04
APO13.01
APO13.02
312.8 and
312.10
SRM > Policies and Standards >
Information Security Policies
sharedx Domain 2 6.02. (e) Article 17 NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

8.1.0 8.1.1
45 CFR 164.316 (a)
45 CFR 164.316 (b)(1)(i)
45 CFR 164.316 (b)(2)(ii)
45 CFR 164.308(a)(2)
Clause 4.2.1
Clause 5
A.5.1.1
A.8.2.2
Clause 4.3
Clause 5

4.4 4.2(b)

6.1.2(a)(1)

6.2 6.2(a)

6.2(d)

7.1 7.4

9.3 10.2

7.2(a)

7.2(b)

7.2(c)

7.2(d)

7.3(b)
Commandment #1
Commandment #2
Commandment #3
Governance and Risk
Management
Policy Enforcement
GRM-07 A formal disciplinary or sanction policy shall be established for employees who have violated security policies and
procedures. Employees shall be made aware of what action might be taken in the event of a violation, and disciplinary measures must be stated in the policies and procedures.

XXXXXX S3.9
S2.4.0
(S3.9) Procedures exist to provide that issues of noncompliance with security policies are promptly addressed and that corrective measures are taken on a timely basis.
(S2.4.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users.

CC6.2
CC2.5
B.1.5 Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4 IS-06 PO 7.7 APO01.03 APO01.08
APO07.04
312.8 and
312.10
SRM > Governance Risk &
Compliance >
sharedx Domain 2 Article 17 NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-8
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-8

99.31(a)(i)(ii) 10.2.4 45 CFR 164.308 (a)(1)(ii)(C) A.8.2.3 A7.2.3 Commandment #6 Commandment #7
Governance and Risk
Management
Policy Impact on Risk
Assessments
GRM-08 Risk assessment results shall include updates to security policies,
procedures, standards, and controls to ensure that they remain relevant
and effective.

XXXXXXXXXXXX B.2
G.21
L.2
B.1.1, B.1.2, B.1.6, B.1.7.2, G.2,
L.9, L.10
Schedule 1 (Section 5), 4.7 - Safeguards RI-04 PO 9.6 APO12 APO13.01
APO13.03
312.8 and 312.10 BOSS > Operational Risk
Management > Risk Management
Framework
sharedx Domian 2, 4 6.03. (a) Article 17 (1), (2) NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
Clause 4.2.3
Clause 4.2.4
Clause 4.3.1
Clause 5
Clause 7
A.5.1.2
A.10.1.2
A.10.2.3
A.14.1.2
A.15.2.1
A.15.2.2
Clause

4.2.1 a,

4.2(b)

4.3 c,

4.3(a&b)

4.4 5.1(c)

5.1(d)

5.1(e)

5.1(f)

5.1(g)

5.1(h)

5.2 5.2 e,

5.2(f)

5.3 6.1.1(e)(2),

6.1.2(a)(1) Governance and Risk
Management
Policy Reviews
GRM-09 The organization's business leadership (or other accountable business
role or function) shall review the information security policy at planned intervals or as a result of changes to the organization to
ensure its continuing alignment with the security strategy, effectiveness, accuracy, relevance, and applicability to legal, statutory, or regulatory compliance obligations.

XXXXXX S1.1.0 (S1.1.0) The entity’s security policies are established and periodically reviewed and approved by a designated individual or group.

CC3.2 B.2 B.1.33. B.1.34, IS-05 DS 5.2
DS 5.4
APO12
APO13.01
APO13.03
MEA03.01
MEA03.02
312.8 and
312.10
SRM > Governance Risk &
Compliance > Policy Management
sharedx Domain 2 Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

1.2.1 8.2.7

10.2.3 45 CFR 164.316 (b)(2)(iii)
45 CFE 164.306€
Clause 4.2.3 f)
A.5.1.2
Clause 8.1
A.5.1.2
Commandment #1
Commandment #2
Commandment #3
Governance and Risk
Management
Risk Assessments
GRM-10 Aligned with the enterprise-wide framework, formal risk assessments shall be performed at least annually or at
planned intervals, (and in conjunction with any changes to information systems) to determine the likelihood and impact of all identified risks using qualitative and quantitative methods.

The likelihood and impact associated with inherent and
residual risk shall be determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance).

XXXXXXXXXXXX S3.1
x3.1.0
S4.3.0
(S3.1) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system [availability, processing integrity, confidenitality] commitments and (2) assess the risks associated with the identified threats. (S4.3.0) Environmental, regulatory, and technological changes are monitored, and their effect on system availability, confidentiality of data, processing integrity, and system security is assessed on a timely basis; policies are updated for that assessment.

CC3.1
CC3.3
I.1
I.4
C.2.1, I.4.1, I.5, G.15.1.3, I.3 46 (B)
74 (B)
Schedule 1 (Section 5), 4.7 - Safeguards RI-02 PO 9.4 APO12 312.8 and 312.10
BOSS > Operational Risk
Management > Risk Management
Framework
sharedx Domain 2, 4 6.03. (a)

1.2.4 1.2.5
45 CFR 164.308 (a)(1)(ii)(A) Clause 4.2.1 c) through g) Clause 4.2.3 d)
Clause 5.1 f)
Clause 7.2 & 7.3
A.6.2.1
A.12.5.2
A.12.6.1
A.14.1.2
A.15.1.1
A.15.2.1
A.15.2.2
Clause

4.2(b),

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1) Governance and Risk
Management
Risk Management
Framework
GRM-11 Risks shall be mitigated to an acceptable level. Acceptance levels based on risk criteria shall be established and
documented in accordance with reasonable resolution time frames and stakeholder approval.

XXXXXXXXXXXX S3.1
x3.1.0
(S3.1) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system [availability, processing integrity, confidenitality] commitments and (2) assess the risks associated with the identified threats.

CC3.1 L.2 A.1, L.1 Schedule 1 (Section 5), 4.7 - Safeguards RI-01 PO 9.1 EDM03.02 APO01.03
APO12
312.8 and
312.10
BOSS > Operational Risk
Management > Risk Management
Framework
sharedx Domain 2, 4 Article 17 (1), (2) NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 CM-1

1.2.4 45 CFR 164.308 (a)(8)
45 CFR 164.308(a)(1)(ii)(B)
Clause 4.2.1 c) through g)
Clause 4.2.2 b)
Clause 5.1 f)
Clause 7.2 & 7.3
A.6.2.1
A.12.6.1
A.14.1.2
A.15.2.1
A.15.2.2
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a) Human Resources
Asset Returns
HRS-01 Upon termination of workforce personnel and/or expiration of external business relationships, all organizationally-owned assets shall be returned within an established period.

XXXXXXXXXXXX S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 D.1 E.6.4 Schedule 1 (Section 5) 4.5 Limiting Use, Disclosure and Retention; 4.7 Safeguards, Subs. 4.7.5
IS-27 APO01.08
APO07.06
APO13.01
BAI09.03 312.3,
312.8 and
312.10
BOSS > Human Resources Security > Employee Termination provider x Domain 2 Article 17 NIST SP 800-53 R3 PS-4 NIST SP 800-53 R3 PS-4 5.2.3

7.2.2 8.2.1

8.2.6 45 CFR 164.308 (a)(3)(ii)(C) A.7.1.1
A.7.1.2
A.8.3.2
A.8.1.1
A.8.1.2
A.8.1.4
Human Resources
Background Screening
HRS-02 Pursuant to local laws, regulations, ethics, and contractual constraints, all employment candidates, contractors, and third parties shall be subject to background verification proportional to the data classification to be accessed, the business requirements, and acceptable risk.

XXXXXXX S3.11.0 (S3.11.0) Procedures exist to help ensure that personnel responsible for the design, development, implementation, and operation of systems affecting confidentiality and security have the qualifications and resources to fulfill their responsibilities.

CC1.3
CC1.4
E.2 E.2 63 (B) Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 HR-01 PO 7.6 APO07.01 APO07.05
APO07.06
312.8 and 312.10 BOSS > Human Resources Security
> Background Screening
sharedx None 6.01. (a) Article 17 NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-3
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-3

1.2.9 A.8.1.2 A.7.1.1 ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #2
Commandment #3
Commandment #6
Commandment #9
Human Resources
Employment
Agreements
HRS-03 Employment agreements shall incorporate provisions and/or terms for adherence to established information governance and security policies and must be signed by newly hired or onboarded workforce personnel (e.g., full or part-time employee or contingent staff) prior to granting workforce personnel user access to corporate facilities, resources, and assets.

XXXXXXXXXXXX S2.2.0 (S2.2.0) The security obligations of users and the entity's security commitments to users are communicated to authorized users CC2.2
CC2.3
C.1 E.3.5 66 (B) Schedule 1 (Section 5) 4.7 Safeguards, Subsec. 4.7.4 HR-02 DS 2.1 APO01.03 APO13.01
APO07.06
APO09.03
APO10.01
312.3,
312.8 and
312.10
BOSS > Human Resources Security
> Employee Code of Conduct
sharedx None Article 17 NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7

1.2.9 8.2.6
45 CFR 164.310(a)(1)
45 CFR 164.308(a)(4)(i)
A.6.1.5
A.8.1.3
A.13.2.4
A.7.1.2
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #6
Commandment #7
Human Resources
Employment
Termination
HRS-04 Roles and responsibilities for performing employment termination or change in employment procedures shall be assigned, documented, and communicated.

XXXXXX S3.2.d
S3.8.e
(S3.2.d) Procedures exist to restrict logical access to the system and information resources maintained in the system including, but not limited to, the following matters:
d. The process to make changes and updates to user profiles (S3.8.e) e. Procedures to prevent customers, groups of individuals, or other entities from accessing confidential information other than their own
CC5.4 E.6 HR-03 PO 7.8 APO01.02
APO07.05
APO07.06
312.8 and
312.10
BOSS > Human Resources Security
> Roles and Responsibilities
sharedx None Article 17 NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-8
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-8

8.2.2 10.2.5
45 CFR 164.308 (a)(3)(ii)(C) A.8.3.1 A.7.3.1 Commandment #6 Commandment #7
Human Resources
Mobile Device
Management
HRS-05 Policies and procedures shall be established, and supporting business
processes and technical measures implemented, to manage business risks associated with permitting mobile device access to corporate resources and may require the
implementation of higher assurance compensating controls and acceptable-use policies and procedures (e.g., mandated security training, stronger identity, entitlement and access controls, and device monitoring).

XXXXXXXXXXXX S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 G.11, G12, G.20.13, G.20.14 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-32 DS5.11 DS5.5
APO01.08
APO13.01
APO13.02
DSS05.01
DSS05.02
DSS05.03
DSS05.07
DSS06.03
DSS06.06
312.8 and
312.10
Presentation Servies > Presentation
Platform > Endpoints - Mobile
Devices - Mobile Device
Management
sharedx Domain 2 Article 17 NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-19
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-17 (1)
NIST SP 800-53 R3 AC-17 (2)
NIST SP 800-53 R3 AC-17 (3)
NIST SP 800-53 R3 AC-17 (4)
NIST SP 800-53 R3 AC-17 (5)
NIST SP 800-53 R3 AC-17 (7)
NIST SP 800-53 R3 AC-17 (8)
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 AC-19
NIST SP 800-53 R3 AC-19 (1)
NIST SP 800-53 R3 AC-19 (2)
NIST SP 800-53 R3 AC-19 (3)
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-2 (1)
NIST SP 800-53 R3 MP-4
NIST SP 800-53 R3 MP-4 (1)
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 MP-6 (4)

1.2.6 3.2.4

8.2.6 45 CFR 164.310 (d)(1) A.7.2.1
A.10.7.1
A.10.7.2
A.10.8.3
A.11.7.1
A.11.7.2
A.15.1.4
A.8.2.1
A.8.3.1
A.8.3.2
A.8.3.3
A.6.2.1
A.6.2.2
A.18.1.4
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
All
Human Resources
Non-Disclosure
Agreements
HRS-06 Requirements for non-disclosure or confidentiality agreements reflecting
the organization's needs for the protection of data and operational
details shall be identified, documented, and reviewed at XXXXXXX S4.1.0 (S4.1.0) The entity’s system availability, confidentiality, processing integrity and security performance is periodically reviewed and compared with the defined system availability and related security policies.

CC4.1 C.2.5 Schedule 1 (Section 5), 4.7 - Safeguards LG-01 APO01.02 APO01.03
APO01.08
APO07.06
APO09.03
APO10.04
APO13.01
APO13.03 312.8 and 312.10 BOSS > Compliance > Intellectual Property Protection shared x Domain 3 Article 16 NIST SP 800-53 R3 PL-4 NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)

1.2.5 ISO/IEC 27001:2005
Annex A.6.1.5
A.13.2.4 ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
Commandment #6
Commandment #7
Commandment #8
Commandment #9
Human Resources
Roles / Responsibilities
HRS-07 Roles and responsibilities of contractors, employees, and third-party
users shall be documented as they relate to information assets and
security.

XXXXXXXXXXXX S1.2.f (S1.2.f) f. Assigning responsibility and accountability for system availability, confidentiality, processing integrity and related security.

B.1 B.1.5, D.1.1,D.1.3.3, E.1, F.1.1,
H.1.1, K.1.2
5 (B) Schedule 1 (Section 5) 4.1 Accountability IS-13 DS5.1 APO01.02 APO01.03
APO01.08
APO07.06
APO09.03
APO10.04
APO13.01
312.3, 312.8 and 312.10 BOSS > Human Resources Security > Roles and Responsibilities
sharedx Domain 2 Article 17 NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7

99.31(a)(1)(ii) 1.2.9

8.2.1 Clause 5.1 c)
A.6.1.2
A.6.1.3
A.8.1.1
Clause 5.3
A.6.1.1
A.6.1.1
Commandment #6
Commandment #7
Commandment #8
Human Resources
Technology Acceptable
Use
HRS-08 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining allowances and conditions for permitting usage of organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. Additionally, defining allowances and conditions to permit usage of
personal mobile devices and associated applications with access to corporate resources (i.e., BYOD) shall be
considered and incorporated as appropriate.

XXXXXXXX S1.2
S3.9
(S1.2) The entity’s security policies include, but may not be limited to, the following matters:
(S3.9) Procedures exist to provide that issues of noncompliance with security policies are promptly addressed and that corrective measures are taken on a timely basis.

CC3.2
CC6.2
B.3 B.1.7, D.1.3.3, E.3.2, E.3.5.1,
E.3.5.2
Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4 IS-26 DS 5.3 APO01.03 APO01.08
APO13.01
APO13.02
DSS05.04
DSS06.06
312.4,
312.8 and
312.10
SRM > Policies and Standards >
Information Security Policies
sharedx Domain 2 Article 5, Article 6
Article 7
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-8
NIST SP 800-53 R3 AC-20
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 AC-8
NIST SP 800-53 R3 AC-20
NIST SP 800-53 R3 AC-20 (1)
NIST SP 800-53 R3 AC-20 (2)
NIST SP 800-53 R3 PL-4

8.1.0 45 CFR 164.310 (b) A.7.1.3 A.8.1.3 Commandment #1 Commandment #2
Commandment #3
Human Resources
Training / Awareness
HRS-09 A security awareness training program shall be established for all
contractors, third-party users, and employees of the
organization and
mandated when appropriate. All individuals with access to organizational
data shall receive appropriate awareness training and
regular updates
in organizational procedures, processes, and policies
XXXXXXXXXXXX S1.2.k
S2.2.0
(S1.2.k) The entity's security policies include, but may not be limited to, the following matters:
k. Providing for training and other resources to support its system security policies
(S2.2.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users.

CC2.2
CC2.3
E.1 E.4 65 (B) Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4; 4.7 Safeguards, Subs. 4.7.4
IS-11 PO 7.4 APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
312.8 and
312.10
SRM > GRC > sharedx Domain 2 6.01. (c)

6.02. (e)
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4

99.31(a)(1)(ii) 1.2.10

8.2.1 45 CFR 164.308 (a)(5)(i)
45 CFR 164.308 (a)(5)(ii)(A)
Clause 5.2.2
A.8.2.2
Clause 7.2(a), 7.2(b)
A.7.2.2
Commandment #3
Commandment #6
Human Resources
User Responsibility
HRS-10 All personnel shall be made aware of their roles and responsibilities for:
• Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations.
• Maintaining a safe and secure working environment
XXXXXXXXXXXX S2.3.0 (S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality, processing integrity and security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.

CC3.2 E.1 E.4 65 (B)
66 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.4 IS-16 PO 4.6 APO01.02 APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
312.8 and
312.10
BOSS > Human Resources Security
> Employee Awareness
sharedx Domain 2 Article 17 NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 PL-4

1.2.10 8.2.1
45 CFR 164.308 (a)(5)(ii)(D) Clause 5.2.2
A.8.2.2
A.11.3.1
A.11.3.2
Clause 7.2(a), 7.2(b)
A.7.2.2
A.9.3.1
A.11.2.8
Commandment #5
Commandment #6
Commandment #7
Human Resources
Workspace
HRS-11 Policies and procedures shall be established to require that unattended workspaces do not have openly visible (e.g., on a desktop) sensitive documents and user computing sessions are disabled after an established period of inactivity.

XXXXXXXX S3.3.0
S3.4.0
(S3.3.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. (S3.4.0) Procedures exist to protect against unauthorized access to system resources.

CC5.5
CC5.6
E.1 E.4 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-17 APO01.02 APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
DSS05.03
DSS06.06 312.8 and 312.10 BOSS > Data Governance > Clear Desk Policy sharedx Domain 2 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 AC-11
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-2 (1)
NIST SP 800-53 R3 MP-3
NIST SP 800-53 R3 MP-4
NIST SP 800-53 R3 MP-4 (1)

8.2.3 Clause 5.2.2
A.8.2.2
A.9.1.5
A.11.3.1
A.11.3.2
A.11.3.3
Clause 7.2(a), 7.2(b)
A.7.2.2
A.11.1.5
A.9.3.1
A.11.2.8
A.11.2.9
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #5
Commandment #6
Commandment #7
Commandment #11
Identity & Access
Management
Audit Tools Access
IAM-01 Access to, and use of, audit tools that interact with the organization's information systems shall be appropriately segmented and restricted to prevent compromise and misuse of log data.

XXXXXXXXXX S3.2.g (S3.2.g) g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

CC5.1 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-29 DS 5.7 APO01.03 APO01.08
APO13.01
APO13.02
DSS05.03
312.8 and 312.10 SRM > Privilege Management
Infrastructure > Privilege Usage
Management
sharedx Domain 2 6.03. (i)

6.03. (j)
NIST SP 800-53 R3 AU-9 NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-9 (2)

8.2.1 A.15.3.2 Commandment #2
Commandment #5
Commandment #11
Identity & Access
Management
Credential Lifecycle /
Provision Management
IAM-02 User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and
customer (tenant) users with access to data and
organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and
measures must incorporate the following:
• Procedures and supporting roles and responsibilities for provisioning and de-provisioning user account entitlements following the rule of least privilege based on job function (e.g., internal employee and contingent staff personnel changes, customer-controlled access, suppliers' business
relationships, or other third-party business relationships) • Business case considerations for higher levels of
assurance and multi-factor authentication secrets (e.g., management interfaces, key generation, remote access,
segregation of duties, emergency access, large-scale
provisioning or geographically-distributed deployments, and personnel redundancy for critical systems)
• Access segmentation to sessions and data in multi-tenant architectures by any third party (e.g., provider and/or other customer (tenant))
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or reuse when feasible • Authentication, authorization, and accounting (AAA) rules for access to data and sessions (e.g., encryption and
strong/multi-factor, expireable, non-shared authentication XXXXXXXXXXX S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

B.1 B.1.8, B.1.21, B.1.28, E.6.2,
H.1.1, K.1.4.5,
8 (B)
40 (B)
41 (B)
42 (B)
43 (B)
44 (C+)
Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4; 4.7 Safeguards, Subs. 4.7.4
IS-07 DS 5.4 APO01.02
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.04
DSS05.05
DSS05.06
DSS06.03
DSS06.06
312.8 and
312.10
SRM > Policies and Standards > sharedx Domain 2 6.01. (b)

6.01. (d)

6.02. (e)

6.03. (b)

6.03.04. (b)

6.03.04. (c)

6.03.05. (b)

6.03.05. (d)

6.03.06. (b)

6.04.01. (c)

6.04.01. (f)

6.04.02. (a)

6.04.02. (b)

6.04.02. (c)

6.04.03. (b)

6.04.06. (a)

6.04.08. (a)

6.04.08. (b)

6.04.08. (c)

6.04.08.03. (a)

6.04.08.03. (b)
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-7
NIST SP 800-53 R3 AC-14
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-7
NIST SP 800-53 R3 AC-10
NIST SP 800-53 R3 AC-14
NIST SP 800-53 R3 IA-1

8.1.0 45 CFR 164.308 (a)(3)(i)
45 CFR 164.312 (a)(1)
45 CFR 164.312 (a)(2)(ii)
45 CFR 164.308(a)(4)(ii)(B)
45 CFR 164.308(a)(4)(ii)(c )
A.11.1.1
A.11.2.1
A.11.2.4
A.11.4.1
A.11.5.2
A.11.6.1
A.9.1.1
A.9.2.1,
A.9.2.2
A.9.2.5
A.9.1.2
A.9.4.1
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #6
Commandment #7
Commandment #8
Identity & Access
Management
Diagnostic /
Configuration Ports
Access
IAM-03 User access to diagnostic and configuration ports shall be restricted to authorized individuals and applications.

XXXXXXX S3.2.g (S3.2.g) g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

CC5.1 H1.1, H1.2, G.9.15 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-30 DS5.7 APO13.01 DSS05.02
DSS05.03
DSS05.05
DSS06.06
312.8 and 312.10 SRM > Privilege Management
Infrastructure > Privilege Usage
Management - Resource Protection
providerx Domain 2 NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 MA-3
NIST SP 800-53 R3 MA-3 (1)
NIST SP 800-53 R3 MA-3 (2)
NIST SP 800-53 R3 MA-3 (3)
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-4 (1)
NIST SP 800-53 R3 MA-4 (2)
NIST SP 800-53 R3 MA-5
A.10.6.1
A.11.1.1
A.11.4.4
A.11.5.4
A.13.1.1
A.9.1.1
A.9.4.4
Commandment #3
Commandment #4
Commandment #5
Commandment #6
Commandment #7
Commandment #8
Identity & Access
Management
Policies and
Procedures
IAM-04 Policies and procedures shall be established to store and manage identity information about every person who accesses IT infrastructure and to determine their level of access.

Policies shall also be developed to control access to network resources based on user identity.
-- APO01.03
APO01.08
APO13.01
APO13.02
DSS05.02
DSS05.04
SRM > Policies and Standards >
Information Security Policies
Domain 12 Annex
A.9.2
A.9.2.1
A.9.2.2
A.9.2.3,
A.9.2.4, Identity & Access
Management
Segregation of Duties
IAM-05 User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for restricting user access as per defined segregation of duties to address business risks associated with a user-role conflict of interest.

XXXXXXXXXXX S3.2.a (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public.

CC5.1 G.2.13. G.3, G.20.1, G.20.2,
G.20.5
Schedule 1 (Section 5) 4.7 Safeguards, Subs. 4.7.3(b) IS-15 DS 5.4 APO01.03 APO01.08
APO13.02
DSS05.04
DSS06.03
312.8 and
312.10
ITOS > Resource Management >
Seggregation of Duties
sharedx Domain 2 6.04.01. (d)

99.31(a)(1)(ii) 8.2.2 45 CFR 164.308 (a)(1)(ii)(D)
45 CFR 164.308 (a)(3)(ii)(A)
45 CFR 164.308(a)(4)(ii)(A)
45 CFR 164.308 (a)(5)(ii)(C)
45 CFR 164.312 (b)
A.10.1.3 A.6.1.2 Commandment #6
Commandment #7
Commandment #8
Commandment #10
Identity & Access
Management
Source Code Access
Restriction
IAM-06 Access to the organization's own developed applications, program, or object source code, or any other form of
intellectual property (IP), and use of proprietary software shall be appropriately restricted following the rule of least privilege based on job function as per established user access policies and procedures.

XXXXXXXX S3.13.0 (S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.4 I.2.7.2, I.2.9, I.2.10, I.2.15 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-33 APO01.03 APO01.08
APO13.02
DSS05.04
DSS06.03 ITOS > Service Support > Release Management - Source Code Management shared x Domain 2 Article 17 NIST SP 800-53 R3 CM-5 NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)

1.2.6 6.2.1
Clause 4.3.3
A.12.4.3
A.15.1.3
Clause

5.2(c)

5.3(a),

5.3(b),

7.5.3(b)

7.5.3(d)
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #6
Commandment #7
Commandment #9
Commandment #10
Identity & Access
Management
Third Party Access
IAM-07 The identification, assessment, and prioritization of risks posed by
business processes requiring third-party access to the
organization's
information systems and data shall be followed by coordinated application of resources to minimize, monitor, and measure likelihood
and impact of unauthorized or inappropriate access.

Compensating
controls derived from the risk analysis shall be implemented prior to
provisioning access.

CC3.1 B.1
H.2
B.1.1, B.1.2, D.1.1, E.1, F.1.1,
H.1.1, K.1.1, E.6.2, E.6.3
Schedule 1 (Section 5), 4.7 - Safeguards RI-05 DS 2.3 APO01.03 APO01.08
APO07.06
APO10.04
APO13.02
DSS05.04
DSS05.07
DSS06.03
DSS06.06
312.8 and 312.10 SRM > Governance Risk &
Compliance > Vendor Management
sharedx Domain 2, 4 6.02. (a)

6.02. (b)

6.03. (a)
Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

7.1.1 7.1.2

7.2.1 7.2.2

7.2.3 7.2.4
A.6.2.1
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.4
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.5
Identity & Access
Management
Trusted Sources
IAM-08 Policies and procedures are established for permissible storage and
access of identities used for authentication to ensure identities are
only accessible based on rules of least privilege and
replication
limitation only to users explicitly defined as business necessary.

XXXXX S3.2.0
S4.3.0
(S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).
(S4.3.0) Environmental, regulatory, and technological changes are monitored, and their effect on system availability, confidentiality, processing integrity and security is assessed on a timely basis; policies are updated for that assessment.

CC3.3 IS-08
IS-12
APO01.03
APO01.08
APO10.04
APO13.02
DSS05.04
DSS06.03
DSS06.06
312.8 and
312.10
Information Services > User
Directory Services > Active
Directory Services,
LDAP Repositories,
X.500 Repositories,
DBMS Repositories,
Meta Directory Services,
Virtual Directory Services
sharedx Domain 12 Annex
A.9.2,
A.9.2.1,
A.9.2.2,
A.9.2.3,
A.9.2.4,
A.9.2.5,
A.9.2.6,
A.9.3.1,
A.9.4.1,
A.9.4.2,
A.9.4.3,
A.9.4.5
Identity & Access
Management
User Access
Authorization
IAM-09 Provisioning user access (e.g., employees, contractors, customers
(tenants), business partners and/or supplier relationships) to data and
organizationally-owned or managed (physical and virtual) applications,
infrastructure systems, and network components shall be authorized by
the organization's management prior to access being granted and
appropriately restricted as per established policies and procedures.

Upon request, provider shall inform customer (tenant) of this user
access, especially if customer (tenant) data is used as part the service
and/or customer (tenant) has some shared responsibility over implementation of control.

XXXXXXXXXX S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

H.2.4, H.2.5, 35 (B)
40 (B)
41 (B)
42 (B)
44 (C+)
Schedule 1 (Section 5) Safeguards, Subs. 4.7.2 and 4.7.3 IS-08 DS5.4 APO01.03 APO01.08
APO07.06
APO10.04
APO13.02
DSS05.04
DSS06.03
DSS06.06
312.8 and
312.10
SRM > Privilege Management
Infrastructure > Identity Management
- Identity Provisioning
sharedx Domain 2 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.03.06. (a)

6.03.06. (b)

6.04.01. (a)

6.04.01. (b)

6.04.01. (d)

6.04.01. (e)

6.04.01. (g)

6.04.03. (c)

6.04.08.02. (a)
Article 17 NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AC-3 (3)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-2 (2)
NIST SP 800-53 R3 IA-2 (3)
NIST SP 800-53 R3 IA-2 (8)
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-4 (4)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-9

8.2.2 45 CFR 164.308 (a)(3)(i)
45 CFR 164.308 (a)(3)(ii)(A)
45 CFR 164.308 (a)(4)(i)
45 CFR 164.308 (a)(4)(ii)(B)
45 CFR 164.308 (a)(4)(ii)(C)
45 CFR 164.312 (a)(1)
A.11.2.1
A.11.2.2
A.11.4.1
A 11.4.2
A.11.6.1
A.9.2.1, A.9.2.2
A.9.2.3
A.9.1.2
A.9.4.1
Commandment #6
Commandment #7
Commandment #8
Commandment #9
Commandment #10
Identity & Access
Management
User Access Reviews
IAM-10 User access shall be authorized and revalidated for entitlement appropriateness, at planned intervals, by the organization's business leadership or other accountable business role or function supported by evidence to
demonstrate the organization is adhering to the rule of least privilege based on job function. For identified access
violations, remediation must follow established user access policies and procedures.

XXXXXXXXXXX S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

H.2.6, H.2.7, H.2.9, 41 (B) Schedule 1 (Section 5), 4.7 - Safeguards IS-10 DS5.3 DS5.4
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
312.8 and
312.10
SRM > Privilege Management
Infrastructure > Authorization
Services - Entitlement Review
sharedx Domain 2 Article 17 NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7

99.31(a)(1)(ii) 8.2.1

8.2.7 45 CFR 164.308 (a)(3)(ii)(B)
45 CFR 164.308 (a)(4)(ii)(C)
A.11.2.4 A.9.2.5 ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #6
Commandment #7
Commandment #8
Commandment #10
Identity & Access
Management
User Access
Revocation
IAM-11 Timely de-provisioning (revocation or modification) of user access to
data and organizationally-owned or managed (physical and virtual)
applications, infrastructure systems, and network components, shall be
implemented as per established policies and procedures and based on
user's change in status (e.g., termination of employment or other
business relationship, job change or transfer). Upon request, XXXXXXXXXX S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

H.2 E.6.2, E.6.3 Schedule 1 (Section 5), 4.7 - Safeguards IS-09 DS 5.4 APO01.03 APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
312.8 and
312.10
SRM > Privilege Management
Infrastructure > Identity Management
- Identity Provisioning
sharedx Domain 2 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.03.06. (a)

99.31(a)(1)(ii) 8.2.1 45 CFR 164.308(a)(3)(ii)(C) ISO/IEC 27001:2005 A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.2
Annex A
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.3
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #6
Commandment #7
Commandment #8
Identity & Access
Management
User ID Credentials
IAM-12 Internal corporate or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures:
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and Federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or reuse when feasible • Adherence to industry acceptable and/or regulatory
compliant authentication, authorization, and accounting (AAA) rules (e.g., strong/multi-factor, expireable, non-shared authentication secrets)
XXXXXXXXX S3.2.b (S3.2.b) b. Identification and authentication of users. CC5.3 B.1 H.5
E.6.2, E.6.3, H.1.1, H.1.2, H.2,
H.3.2, H.4, H.4.1, H.4.5, H.4.8
6 (B) Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-02 DS5.3 DS5.4
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
312.8 and
312.10
SRM > Policies and Standards >
Technical Securitry Standards
sharedx Domain 10 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.04.05. (b)
Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-6
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AC-11
NIST SP 800-53 R3 AC-11 (1)
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-2 (3)
NIST SP 800-53 R3 AU-2 (4)
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-2 (2)
NIST SP 800-53 R3 IA-2 (3)
NIST SP 800-53 R3 IA-2 (8)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-6
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 SC-10

99.3 99.31(a)(1)(ii)
45 CFR 164.308(a)(5)(ii)(c)
45 CFR 164.308 (a)(5)(ii)(D)
45 CFR 164.312 (a)(2)(i)
45 CFR 164.312 (a)(2)(iii)
45 CFR 164.312 (d)
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.3
A.11.2.4
A.11.5.5
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.4
A.9.2.5
A.9.4.2
Commandment #6
Commandment #7
Commandment #8
Commandment #9
Identity & Access
Management
Utility Programs
Access
IAM-13 Utility programs capable of potentially overriding system, object, network, virtual machine, and application controls shall be restricted.

XXXXXXXXXX S3.2.g (S3.2.g) g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

CC5.1 H.2.16 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-34 DS5.7 APO13.01 APO13.02
DSS05.05
312.8 and 312.10 SRM > Privilege Management
Infrastructure > Privilege Usage
Management - Resource Protection
sharedx Domain 2 NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 AC-6 NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
A.11.4.1
A 11.4.4
A.11.5.4
A.9.1.2 Deleted
A.9.4.4
Commandment #1
Commandment #5
Commandment #6
Commandment #7
Infrastructure &
Virtualization Security
Audit Logging /
Intrusion Detection
IVS-01 Higher levels of assurance are required for protection, retention, and
lifecyle management of audit logs, adhering to applicable legal,
statutory or regulatory compliance obligations and providing unique user
access accountability to detect potentially suspicious network behaviors and/or file integrity anomalies, and to support forensic
investigative capabilities in the event of a security breach.

XXXXXXXXXXX S3.7 (S3.7) Procedures exist to identify, report, and act upon system security breaches and other incidents.

CC6.2 G.7
G.8
G.9
J.1
L.2
G.14.7, G.14.8, G.14.9,
G.14.10,G.14.11, G.14.12,
G.15.5, G.15.7, G.15.8, G.16.8,
G.16.9, G.16.10, G.15.9, G.17.5,
G.17.7, G.17.8, G.17.6, G.17.9,
G.18.2, G.18.3, G.18.5, G.18.6,
G.19.2.6, G.19.3.1, G.9.6.2,
G.9.6.3, G.9.6.4, G.9.19, H.2.16,
H.3.3, J.1, J.2, L.5, L.9, L.10
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-14 DS5.5 DS5.6
DS9.2
APO13.01
APO13.02
BAI10.01
BAI10.02
BAI10.03
DSS01.03
DSS02.01
DSS05.07
DSS06.05
312.3,
312.8 and
312.10
BOSS > Security Monitoring
Services > SIEM
sharedx Domain 10 6.03. (i)

6.03. (j)

6.03.03. (a)

6.03.03. (d)

6.03.04. (e)

6.04.07. (a)

6.07.01. (a)

6.07.01. (c)
Article 17 NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-3
NIST SP 800-53 R3 AU-4
NIST SP 800-53 R3 AU-5
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 AU-12
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-2 (3)
NIST SP 800-53 R3 AU-2 (4)
NIST SP 800-53 R3 AU-3
NIST SP 800-53 R3 AU-3 (1)
NIST SP 800-53 R3 AU-4
NIST SP 800-53 R3 AU-5
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 AU-7
NIST SP 800-53 R3 AU-7 (1)
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 AU-12
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SC-18

8.2.1 8.2.2
45 CFR 164.308 (a)(1)(ii)(D)
45 CFR 164.312 (b)
45 CFR 164.308(a)(5)(ii)©
A.10.10.1
A.10.10.2
A.10.10.3
A.10.10.4
A.10.10.5
A.11.2.2
A.11.5.4
A.11.6.1
A.13.1.1
A.13.2.3
A.15.2.2
A.15.1.3
A.12.4.1
A.12.4.1
A.12.4.2, A.12.4.3
A.12.4.3
A.12.4.1
A.9.2.3
A.9.4.4
A.9.4.1
A.16.1.2
A.16.1.7
A.18.2.3
A.18.1.3
Commandment #6
Commandment #7
Commandment #11
Infrastructure &
Virtualization Security
Change Detection
IVS-02 The provider shall ensure the integrity of all virtual machine images at all times. Any changes made to virtual machine images must be logged and an alert raised regardless of their running state (e.g. dormant, off, or running). The results of a change or move of an image and the subsequent
validation of the image's integrity must be immediately available to customers through electronic methods (e.g. portals or alerts).

APO08.04
APO13.01
BAI06.01
BAI06.02
BAI10.03
BAI10.04
SRM > Privilege Management
Infrastructure > Privileged Usage
Management -> Hypervisor
Governance and Compliance
Annex
A.12.1.2
A.12.4,
A.12.4.1,
A.12.4.2,
A.12.4.3,
A.12.6.1,
A.12.6.2, Infrastructure &
Virtualization Security
Clock Synchronization
IVS-03 A reliable and mutually agreed upon external time source shall be used to synchronize the system clocks of all relevant information processing systems to facilitate tracing and reconstitution of activity timelines.

XXXXXXX S3.7 (S3.7) Procedures exist to identify, report, and act upon system security breaches and other incidents.

CC6.2 G.7
G.8
G.13, G.14.8, G.15.5, G.16.8,
G.17.6, G.18.3, G.19.2.6,
G.19.3.1
20 (B)
28 (B)
30 (B)
35 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-12 DS5.7 APO01.08 APO13.01
APO13.02
BAI03.05
DSS01.01
312.8 and
312.10
Infra Services > Network Services >
Authoritative Time Source
providerx Domain 10 6.03. (k) NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8
NIST SP 800-53 R3 AU-8 (1)
A.10.10.1
A.10.10.6
A.12.4.1
A.12.4.4
Infrastructure &
Virtualization Security
Information System
Documentation
IVS-04 The availability, quality, and adequate capacity and resources shall be planned, prepared, and measured to deliver the required system performance in accordance with legal,
statutory, and regulatory compliance obligations. Projections of future capacity requirements shall be made to mitigate the risk of system overload.

XXXXXXXXX A3.2.0
A4.1.0
(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.
(A4.1.0) The entity’s system availability and security performance is periodically reviewed and compared with the defined system availability and related security policies.

A1.1
A1.2
CC4.1
G.5 OP-03 DS 3 APO01.03
APO01.08
BAI04.01
BAI04.04
BAI04.05
BAI10.01
BAI10.02
312.8 and 312.10 ITOS > Service Delivery >
Information Technology Resiliency -
Capacity Planning
providerx Domain 7, 8 6.03.07. (a)

6.03.07. (b)

6.03.07. (c)

6.03.07. (d)
Article 17 (1) NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)

1.2.4 A.10.3.1 A.12.1.3 Commandment #1
Commandment #2
Commandment #3
Infrastructure &
Virtualization Security
Management -
Vulnerability
Management
IVS-05 Implementers shall ensure that the security vulnerability assessment
tools or services accommodate the virtualization technologies used (e.g.
virtualization aware).

XXXXX -- APO01.08
APO04.02
APO04.03
APO04.04
DSS05.03
DSS06.06
SRM > Threat and Vulnerability
Management > Vulnerability
Management
providerx Domain 1, 13 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b) Infrastructure &
Virtualization Security
Network Security
IVS-06 Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, and ports, and by compensating controls.

XXXXXXXXXXX S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 G.2
G.4
G.15
G.16
G.17
G.18
I.3
G.9.17, G.9.7, G.10, G.9.11,
G.14.1, G.15.1, G.9.2, G.9.3,
G.9.13
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-08 APO03.01 APO03.02
APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
DSS05.02
DSS06.06
312.8 and
312.10
SRM > Infrastructure Protection
Services > Network
providerx Domain 10 6.03.03. (a)

6.03.03. (d)

6.03.04. (d)

6.04.07. (a)

6.07.01. (c)
Article 17 NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-20 (1)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-20 (1)
NIST SP 800-53 R3 SC-21
NIST SP 800-53 R3 SC-22
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SC-32

8.2.5 A.10.6.1
A.10.6.2
A.10.9.1
A.10.10.2
A.11.4.1
A.11.4.5
A.11.4.6
A.11.4.7
A.15.1.4
A.13.1.1
A.13.1.2
A.14.1.2
A.12.4.1
A.9.1.2
A.13.1.3
A.18.1.4
Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment #10
Commandment #11
Infrastructure &
Virtualization Security
OS Hardening and
Base Conrols
IVS-07 Each operating system shall be hardened to provide only necessary ports, protocols, and services to meet business needs and have in place supporting technical controls such as: antivirus, file integrity monitoring, and logging as part of their baseline operating build standard or template.

XXXXXXX -- APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
SRM > Policies and Standards >
Operational Security Baselines
sharedx Domain 1, 13 Annex
A.12.1.4
A.12.2.1
A.12.4.1
A.12.6.1
Infrastructure &
Virtualization Security
Production / NonProduction
Environments
IVS-08 Production and non-production environments shall be separated to prevent unauthorized access or changes to
information assets. Separation of the environments may
include: stateful inspection firewalls, domain/realm
authentication sources, and clear segregation of duties for personnel accessing these environments as part of their job duties.

XXXXXXXXXX S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 B.1 I.2.7.1, I.2.20, I.2.17, I.2.22.2,
I.2.22.4, I.2.22.10-14, H.1.1
22 (B) Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-06 DS5.7 APO03.01 APO03.02
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
312.8 and
312.10
Information Services > Data
Governance > Data Segregation
sharedx Domain 10 6.03. (d) NIST SP 800-53 R3 SC-2 1.2.6 A.10.1.4 A.10.3.2
A.11.1.1
A.12.5.1
A.12.5.2
A.12.5.3
A.12.1.4
A.14.2.9
A.9.1.1

8.1,partial, A.14.2.2

8.1,partial, A.14.2.3

8.1,partial, A.14.2.4
Commandment #1
Commandment #10
Commandment #11
Infrastructure &
Virtualization Security
Segmentation
IVS-09 Multi-tenant organizationally-owned or managed (physical and virtual) applications, and infrastructure system and network components, shall be designed, developed, deployed and configured such that provider and customer (tenant) user access is appropriately segmented from other tenant users, based on the following considerations:
• Established policies and procedures
• Isolation of business critical assets and/or sensitive user data, and sessions that mandate stronger internal controls and high levels of assurance
• Compliance with legal, statutory and regulatory compliance obligations
XXXXXXXXXXX S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 G.17 G.9.2, G.9.3, G.9.13 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-09 DS5.10 APO03.01 APO03.02
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
312.8 and
312.10
SRM > Infrastructure Protection
Services > Network - Firewall
providerx Domain 10 6.03.03. (b)

6.03.05. (a)

6.03.05. (b)

6.04.01. (a)

6.04.01. (g)

6.04.03. (c)

6.04.08.02. (a)

6.04.08.02. (b)

6.05. (c)
Article 17 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 AC-4 NIST SP 800-53 R3 SC-2
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
45 CFR 164.308 (a)(4)(ii)(A) A.11.4.5
A.11.6.1
A.11.6.2
A.15.1.4
A.13.1.3
A.9.4.1
A.18.1.4
Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment #10
Commandment #11
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 289
#2..
- 333 -
Infrastructure &
Virtualization Security
VM Security - vMotion
Data Protection
IVS-10 Secured and encrypted communication channels shall be used when
migrating physical servers, applications, or data to virtualized servers
and, where possible, shall use a network segregated from production-level networks for such migrations.

X X X X X -- APO03.01
APO03.02
APO03.04
APO13.01
APO13.02
DSS05.02
DSS05.05
SRM > Cryptographic Services >
Data-in-transit Encryption
provider X Domain 1, 13 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b) Infrastructure &
Virtualization Security
VMM Security -
Hypervisor Hardening
IVS-11 Access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems shall be restricted to personnel based upon the principle of least privilege and supported through technical controls (e.g., two-factor authentication, audit trails, IP address filtering, firewalls, and TLS encapsulated
communications to the administrative consoles).

X X X X X X X X X X -- APO13.01
APO13.02
DSS05.02
DSS05.04
DSS06.03
DSS06.06
SRM > Privilege Mangement
Infrastructure > Privilege Use
Management - Hypervisor
Governance and Compliance
provider X Domain 1, 13 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b) Infrastructure &
Virtualization Security
Wireless Security
IVS-12 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to protect wireless network environments, including the
following:
• Perimeter firewalls implemented and configured to restrict unauthorized traffic
• Security settings enabled with strong encryption for
authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, and SNMP
community strings)
• User access to wireless network devices restricted to authorized personnel
• The capability to detect the presence of unauthorized (rogue) wireless network devices for a timely disconnect from the network
X X X X X X X X X X X X S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 D.1
B.3
F.1
G.4
G.15
G.17
G.18
E.3.1, F.1.2.4, F.1.2.5, F.1.2.6,
F.1.2.8, F.1.2. 9, F.1.2.10,
F.1.2.11, F.1.2.12, F.1.2.13,
F.1.2.14, F.1.2.15, F.1.2.24,
F.1.3, F.1.4.2, F1.4.6, F.1.4.7,
F.1.6, F.1.7,F.1.8, F.2.13, F.2.14,
F.2.15, F.2.16, F.2.17, F.2.18
G.9.17, G.9.7, G.10, G.9.11,
G.14.1, G.15.1, G.9.2, G.9.3,
G.9.13
40 (B)
44 (C+)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-10 DS5.5 DS5.7
DS5.8
DS5.10
APO01.08
APO13.01
APO13.02
DSS02.02
DSS05.02
DSS05.03
DSS05.04
DSS05.05
DSS05.07
DSS06.03
DSS06.06
312.8 and
312.10
SRM > Infrastructure Protection
Services > Network - Wireless
Protection
provider X Domain 10 Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 PE-4
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)

8.2.5 45 CFR 164.312 (e)(1)(2)(ii)
45 CFR 164.308(a)(5)(ii)(D)
45 CFR 164.312(e)(1)
45 CFR 164.312(e)(2)(ii)
A.7.1.1
A.7.1.2
A.7.1.3
A.9.2.1
A.9.2.4
A.10.6.1
A.10.6.2
A.10.8.1
A.10.8.3
A.10.8.5
A.10.10.2
A.11.2.1
A.11.4.3
A.11.4.5
A.11.4.6
A.11.4.7
A.12.3.1
A.12.3.2
A.8.1.1
A.8.1.2
A.8.1.3
A.11.2.1
A.11.2.4
A.13.1.1
A.13.1.2
A.13.2.1
A.8.3.3
A.12.4.1
A.9.2.1, A.9.2.2
A.13.1.3
A.10.1.1
A.10.1.2
Commandment #1
Commandment #2
Commandment #3
Commandment #4
Commandment #5
Commandment #9
Commandment #10
Commandment #11
Infrastructure &
Virtualization Security
Network Architecture
IVS-13 Network architecture diagrams shall clearly identify high-risk environments and data flows that may have legal compliance impacts. Technical measures shall be implemented and shall apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling, and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denial-of-service (DDoS) attacks.

Interoperability &
Portability
APIs
IPY-01 The provider shall use open and published APIs to ensure support for interoperability between components and to
facilitate migrating applications.

X X X X X X X X X -- BAI02.04
BAI03.01
BAI03.02
BAI03.03
Application Services >
Programming Interfaces >
provider X Domain 6 Clause

6.1.1,

6.1.1(e)(2)
Interoperability & 6.1.2
Portability
Data Request
IPY-02 All structured and unstructured data shall be available to the customer and provided to them upon request in an industrystandard format (e.g., .doc, .xls, .pdf, logs, and flat files) X X X X X X X X X -- APO01.03
APO01.06
APO03.01
APO08.01
Information Services > Reporting
Services >
provider Domain 6 Clause

6.1.1,

6.1.1(e)(2)
Interoperability & 6.1.2
Portability
Policy & Legal
IPY-03 Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage, and integrity persistence.

X X X X X X X X X X X X --
APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
Information Technology Operation
Services > Service Delivery >
Service Level Management -
External SLA's provider
Domain 3 6.04.03. (b)

6.04.08. (a)

6.04.08. (b)

6.06. (a)

6.06. (b)

6.06. (c)

6.06. (d)

6.06. (e)

6.06. (f)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2) Interoperability &
Portability
Standardized Network
Protocols
IPY-04 The provider shall use secure (e.g., non-clear text and authenticated) standardized network protocols for the import and export of data and to manage the service, and shall make available a document to consumers (tenants) detailing the relevant interoperability and portability standards that are involved.

X X X X X X -- APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
SRM > Data Protection >
Cryptographic Services - Data-InTransit Encryption
provider x Domain 6 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2), Interoperability &
Portability
Virtualization
IPY-05 The provider shall use an industry-recognized virtualization platform and standard virtualization formats (e.g., OVF) to help ensure interoperability, and shall have documented custom changes made to any hypervisor in use and all solutionspecific virtualization hooks available for customer review.

X X X X X X X X X -- APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
Infrastructure Services > Virtual
Infrastructure > Server Virtualization
provider X Domain 6 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Anti-Malware
MOS-01 Anti-malware awareness training, specific to mobile devices, shall be included in the provider's information security awareness training.

X X X X X X -- APO01.03
APO13.01
APO07.03
APO07.06
SRM > Governance Risk &
Compliance > Technical Awareness
and Training
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Application Stores
MOS-02 A documented list of approved application stores has been defined as acceptable for mobile devices accessing or storing provider managed data.

X X X X X X -- APO01.04
APO01.08
APO04.02
APO13.01
APO13.02
SRM > Policies and Standards >
Technical Securitry Standards
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 Mobile Security 6.1.2(a)(1)
Approved Applications
MOS-03 The company shall have a documented policy prohibiting the installation of non-approved applications or approved
applications not obtained
through a pre-identified application store.

X X X X X X -- APO01.03
APO01.08
APO13.01
APO13.02
ITOS > Service Support >
Configuration Management -
Software Management
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Approved Software for
BYOD
MOS-04 The BYOD policy and supporting awareness training clearly states the approved applications, application stores, and application extensions and plugins that may be used for BYOD usage.

X X X X X X X -- APO01.03
APO01.08
APO13.01
APO13.02
SRM > Policies and Standards >
Technical Securitry Standards
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Awareness and
Training
MOS-05 The provider shall have a documented mobile device policy that includes a documented definition for mobile devices and the acceptable usage and requirements for all mobile devices.

The provider shall post and communicate the policy and
requirements through the company's security awareness and training program.

X X X X X X X -- APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
SRM > Policies and Standards >
Technical Securitry Standards
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Cloud Based Services
MOS-06 All cloud-based services used by the company's mobile devices or BYOD
shall be pre-approved for usage and the storage of company business
X X X X X X X -- APO01.03
APO01.08
APO13.01
APO13.02
SRM > Governance Risk &
Compliance > Vendor Management
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Compatibility
MOS-07 The company shall have a documented application validation process to test for mobile device, operating system, and application compatibility issues.

X X X X X X -- APO01.03
APO01.08
APO13.01
APO13.02
ITOS > Service Support >
Configuration Management -
Software Management
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Device Eligibility
MOS-08 The BYOD policy shall define the device and eligibility requirements to allow for BYOD usage.

X X X X X X -- APO01.03
APO01.08
APO13.01
SRM > Policies and Standards >
Information Security Policies
provider X None (Mobile
Guidance)
Clause

6.1.1,
Mobile Security 6.1.1(e)(2)
Device Inventory
MOS-09 An inventory of all mobile devices used to store and access company data shall be kept and maintained. All changes to the status of these devices (i.e., operating system and patch levels, lost or decommissioned status, and to whom the device is assigned or approved for usage (BYOD)) will be included for each device in the inventory.

X X X X X X -- BAI06.01
BAI06.02
BAI06.04
BAI10.01
BAI10.02
BAI10.03
SRM > Infrastructure Protection
Services > End Point - Inventory
Control
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Mobile Security 6.1.2(b)
Device Management
MOS-10 A centralized, mobile device management solution shall be deployed to all mobile devices permitted to store, transmit, or process customer data.

X X X X X X X X X X X -- APO03.01
APO03.02
APO04.02
APO13.01
Presentation Servies > Presentation
Platform > End-Points-Mobile
Devices-Mobile Device
Management
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Encryption
MOS-11 The mobile device policy shall require the use of encryption either for
the entire device or for data identified as sensitive on all mobile
X X X X X X -- APO01.03
APO13.01
APO13.02
DSS05.03
SRM > Data Protection >
Cryptographic Services - Data-AtRest Encryption
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Jailbreaking and
Rooting
MOS-12 The mobile device policy shall prohibit the circumvention of built-in security controls on mobile devices (e.g. jailbreaking or rooting) and shall enforce the prohibition through detective and preventative controls on the device or through a
centralized device management system (e.g. mobile device management).

X X X X X X X X X X X -- APO01.03
APO13.01
APO13.02
DSS05.03
Presentation Servies > Presentation
Platform > End-Points-Mobile
Devices-Mobile Device
Management
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Legal
MOS-13 The BYOD policy includes clarifying language for the expectation of privacy, requirements for litigation, e-discovery, and legal holds. The BYOD policy shall clearly state the expectations regarding the loss of non-company data in the case a wipe of the device is required.

X X X X X X X X X -- APO01.03
APO13.01
APO13.02
SRM > Policies and Standards >
Information Security Services
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Lockout Screen
MOS-14 BYOD and/or company-owned devices are configured to require an automatic lockout screen, and the requirement shall be enforced through technical controls.

X X X X X X X X -- DSS05.03
DSS05.05
Presentation Servies > Presentation
Platform > End-Points-Mobile
Devices-Mobile Device
Management
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Operating Systems
MOS-15 Changes to mobile device operating systems, patch levels, and/or applications shall be managed through the company's change management processes.

X X X X X X X X X -- APO01.03
APO13.01
APO13.02
BAI06
ITOS > Service Support -Change
Management > Planned Changes
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Passwords
MOS-16 Password policies, applicable to mobile devices, shall be documented and enforced through technical controls on all company devices or devices approved for BYOD usage, and shall prohibit the changing of password/PIN lengths and authentication requirements.

X X X X X X X X -- APO01.03
APO13.01
APO13.02
DSS05.03
Presentation Servies > Presentation
Platform > End-Points-Mobile
Devices-Mobile Device
Management
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Policy
MOS-17 The mobile device policy shall require the BYOD user to perform backups of data, prohibit the usage of unapproved application stores, and require the use of anti-malware software (where supported).

X X X X X X X X X -- APO01.03
APO13.01
APO13.02
DSS05.01
DSS05.03
SRM > Policies and Standards >
Technical Securitry Standards
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 Mobile Security 6.1.2(a)(1)
Remote Wipe
MOS-18 All mobile devices permitted for use through the company BYOD program or a company-assigned mobile device shall
allow for remote wipe by the company's corporate IT or shall have all company-provided data wiped by the company's
corporate IT.

X X X X X X X X X -- APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
BOSS > Data Governance > Secure
Disposal of Data
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 Mobile Security 6.1.2(a)(1)
Security Patches
MOS-19 Mobile devices connecting to corporate networks, or storing and accessing company information, shall allow for remote software version/patch validation. All mobile devices shall have the latest available security-related patches installed upon general release by the device manufacturer or carrier and authorized IT personnel shall be able to perform these
updates remotely.

X X X X X X X -- APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
DSS05.06
SRM > Infrastructure Protection
Services->Network > Link Layer
Network Security
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Mobile Security 6.1.2(b)
Users
MOS-20 The BYOD policy shall clarify the systems and servers allowed for use or access on a BYOD-enabled device.

X X X X X X X -- APO01.03
APO13.01
APO13.02
SRM > Policies and Standards >
Technical Security Standards
shared X None (Mobile
Guidance)
Clause

6.1.1,
Security Incident 6.1.1(e)(2)
Management, EDiscovery & Cloud
Forensics
Contact / Authority
Maintenance
SEF-01 Points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities shall be maintained and regularly updated (e.g., change in impacted-scope and/or a change in any compliance obligation) to ensure direct compliance liaisons have been established and to be prepared for a forensic investigation requiring rapid engagement with law enforcement.

X X X X X X X X X X X X S4.3.0
x4.4.0
(S4.3.0) Environmental, regulatory, and technological changes are monitored and their effect on system security is assessed on a timely basis and policies are updated for that assessment.
(x4.4.0) Environmental, regulatory, and technological changes are monitored, and their impact on system [availability, processing integrity, confidentiality] and security is assessed on a timely basis.

System [availability, processing integrity, confidentiality] policies and procedures are updated for such changes as required.

CC3.3 L1 CO-04 ME 3.1 APO01.01
APO01.02
APO01.03
APO01.08
MEA03.01
MEA03.02
MEA03.03
312.4 BOSS > Compliance >
Contact/Authority Maintenance
shared x Domain 2, 4 NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-6 (1)
NIST SP 800-53 R3 SI-5

1.2.7 10.1.1

10.2.4 A.6.1.6
A.6.1.7
A.6.1.3
A.6.1.4
Commandment #1
Commandment #2
Commandment #3
Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Management
SEF-02 Policies and procedures shall be established, and supporting business
processes and technical measures implemented, to triage security-related events and ensure timely and thorough
incident management, as per established IT service
management policies and procedures.

X X X X X X X X X X X X IS3.7.0
S3.9.0
(IS3.7.0) Procedures exist to identify, report, and act upon system security breaches and other incidents.
(S3.9.0) Procedures exist to provide that issues of noncompliance with system availability, confidentiality of data, processing integrity and related security policies are promptly addressed and that corrective measures are taken on a timely basis.

CC5.5
CC6.2
J.1 J.1.1, J.1.2 46 (B) Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4; 4.8 Openness, Subs. 4.8.2
IS-22 DS5.6 APO01.03
APO13.01
APO13.02
DSS01.03
DSS02.01
DSS02.02
DSS02.04
DSS02.05
DSS02.06
312.8 and
312.10
ITOS > Service Support > Security
Incident Management
shared x Domain 2 6.04.07. (b)

6.07.01. (a)

6.07.01. (d)

6.07.01. (e)

6.07.01. (f)

6.07.01. (g)

1.2.4 1.2.7

7.1.2 7.2.2

7.2.4 10.2.1

10.2.4 45 CFR 164.308 (a)(1)(i)
45 CFR 164.308 (a)(6)(i)
Clause 4.3.3
A.13.1.1
A.13.2.1
Clause

5.3 (a),

5.3 (b),

7.5.3(b),

5.2 (c),

7.5.3(d),

8.1,

8.3,

9.2(g),
Annex
A.16.1.1
ITAR 22
CFR §
127.12
Commandment #2
Commandment #6
Commandment #8
Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Reporting
SEF-03 Workforce personnel and external business relationships shall be informed of their responsibilities and, if required, shall consent and/or contractually agree to report all information security events in a timely manner. Information security events shall be reported through predefined communications
channels in a timely manner adhering to applicable legal, statutory, or regulatory compliance obligations.

X X X X X X X X X X X X A2.3.0
C2.3.0
I2.3.0
S2.3.0
S2.4
C3.6.0
(A2.3.0, C2.3.0, I2.3.0, S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality of data, processing integrity and related security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.
(S2.4) The process for informing the entity about breaches of the system security and for submitting complaints is communicated to authorized users.
(C3.6.0) The entity has procedures to obtain assurance or representation that the confidentiality policies of third parties to whom information is transferred and upon which the entity relies are in conformity with the entity’s defined system confidentiality and related security policies and that the third party is in compliance with its policies.

CC2.3
CC2.5
C1.4
C1.5
J.1
E.1
J.1.1, E.4 5 (B)
46 (B)
48 (A+)
49 (B)
50 (B)
Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.3 IS-23 DS5.6 APO01.03 APO07.06
APO07.03
APO13.01
APO13.02
DSS02.01
312.3,
312.8 and
312.10
BOSS > Human Resources Security
> Employee Awareness
shared x Domain 2 6.07.01. (a) Article 17 NIST SP 800-53 R3 IR-2 NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-6 (1)
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SI-5

99.31(a)(1)(i)
34 CFR 99.32(a)

1.2.7 1.2.10

7.1.2 7.2.2

7.2.4 10.2.4
45 CFR 164.312 (a)(6)(ii)
16 CFR 318.3 (a)
16 CFR 318.5 (a)
45 CFR 160.410 (a)(1)
Clause 4.3.3
Clause 5.2.2
A.6.1.3
A.8.2.1
A.8.2.2
A.13.1.1
A.13.1.2
A.13.2.1
Clause

5.2 (c),

5.3 (a),

5.3 (b),

7.2(a),

7.2(b),

7.2(c),

7.2(d),

7.3(b),

7.3(c)

7.5.3(b),

7.5.3(d),

8.1,

8.3,

9.2(g)
Annex
A.6.1.1
A.7.2.1,
ITAR 22
CFR §
127.12
Commandment #2
Commandment #6
Commandment #8
Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Response
Legal Preparation
SEF-04 Proper forensic procedures, including chain of custody, are required for the presentation of evidence to support potential legal action subject to the relevant jurisdiction after an information security incident. Upon notification, customers and/or other external business partners impacted by a security breach shall be given the opportunity to participate as is legally permissible in the forensic investigation.

X X X X X X X X X X X X S2.4.0
C3.15.0
(S2.4.0) The process for informing the entity about system availability issues, confidentiality issues, processing integrity issues, security issues and breaches of the system security and for submitting complaints is communicated to authorized users.
(C3.15.0) Procedures exist to provide that issues of noncompliance with defined confidentiality and related security policies are promptly addressed and that corrective measures are taken on a timely basis.

CC2.5
CC6.2
J.1
E.1
J.1.1, J.1.2, E.4 IS-24 DS5.6 APO01.03
APO13.01
APO13.02
DSS01.03
DSS02.01
DSS02.02
DSS02.04
DSS02.05
DSS02.06
312.8 and
312.10
BOSS > Legal Services > Incident
Response Legal Preparation
shared x Domain 2 6.04.07. (b)

6.07.01. (f)

1.2.7 45 CFR 164.308 (a)(6)(ii) Clause 4.3.3
Clause 5.2.2
A.8.2.2
A.8.2.3
A.13.2.3
A.15.1.3
Clause

5.2 (c),

5.3 (a),

5.3 (b),

7.2(a),

7.2(b),

7.2(c),

7.2(d),

7.3(b),

7.3(c)

7.5.3(b),

7.5.3(d),

8.1,

8.3,

9.2(g)
Annex
A.7.2.2,
A.7.2.3,
A.16.1.7, Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Response
Metrics
SEF-05 Mechanisms shall be put in place to monitor and quantify the types, volumes, and costs of information security incidents.

X X X X X X X X X X X X S3.9.0
C4.1.0
(S3.9.0) Procedures exist to provide that issues of noncompliance with security policies are promptly addressed and that corrective measures are taken on a timely basis.
(C4.1.0) The entity’s system security, availability, system integrity, and confidentiality is periodically reviewed and compared with the defined system security, availability, system integrity, and confidentiality policies.

CC6.2
CC4.1
J.1.2 47 (B) IS-25 DS 4.9 DSS04.07 312.8 and
312.10
BOSS > Operational Risk
Management > Key Risk Indicators
shared x Domain 2 6.07.01. (a)

6.07.01. (i)
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-4 (1)
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8

1.2.7 1.2.10
45 CFR 164.308 (a)(1)(ii)(D) A.13.2.2 A.16.1.6
Supply Chain
Management,
Transparency and
Accountability
Data Quality and
Integrity
STA-01 Providers shall inspect, account for, and work with their cloud supply-chain partners to correct data quality errors and associated risks. Providers shall design and implement
controls to mitigate and contain data security risks through proper separation of duties, role-based access, and leastprivilege access for all personnel within their supply chain. -- APO10
APO11
DSS05.04
DSS06.03
DSS06.06
SRM > Governance Risk &
Compliance > Vendor Management
provider X Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Supply Chain 6.1.2(b)
Management,
Transparency and
Accountability
Incident Reporting
STA-02 The provider shall make security incident information available to all affected customers and providers periodically through electronic methods (e.g. portals).
-- APO09.03
APO09.04
APO10.04
APO10.05
DSS02.07
ITOS > Service Support -> Incident
Management > Cross Cloud
Incident Response
provider Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Supply Chain 6.1.2(a)(2),
Management,
Transparency and
Accountability
Network / Infrastructure
Services
STA-03 Business-critical or customer (tenant) impacting (physical and virtual) application and system-system interface (API) designs and configurations, and infrastructure network and systems components, shall be designed, developed, and
deployed in accordance with mutually agreed-upon service and capacity-level expectations, as well as IT governance and service management policies and procedures.

X X X X X X X X X X X X C2.2.0 (C2.2.0) The system security, availability, system integrity, and confidentiality and related security obligations of users and the entity’s system security, availability, system integrity, and confidentiality and related security commitments to users are communicated to authorized users.

CC2.2
CC2.3
C.2 C.2.6, G.9.9 45 (B)
74 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-31 DS5.10 APO01.03 APO03.01
APO03.02
APO09.03
BAI02.01
BAI02.04
BAI07.05
312.8 and 312.10 ITOS > Service Delivery > Service
Level Management
provider x Domain 2 6.02. (c)

6.03.07. (a)

6.03.07. (b)

6.03.07. (c)

8.2.2 8.2.5
A.6.2.3
A.10.6.2
A.15.1.2
A.13.1.2
Commandment #6
Commandment #7
Commandment #8
Supply Chain
Management,
Transparency and
Accountability
Provider Internal
Assessments
STA-04 The provider shall perform annual internal assessments of conformance to, and effectiveness of, its policies, procedures, and supporting measures and metrics.

X X X X X X X X X X X -- MEA01
MEA02
SRM > Governance Risk &
Compliance > Vendor Management
provider x Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Supply Chain 6.1.2(b)
Management,
Transparency and
Accountability
Supply Chain
Agreements
STA-05 Supply chain agreements (e.g., SLAs) between providers and customers (tenants) shall incorporate at least the following mutually-agreed upon provisions and/or terms:
• Scope of business relationship and services offered (e.g., customer (tenant) data acquisition, exchange and usage, feature sets and functionality, personnel and infrastructure network and systems components for service delivery and support, roles and responsibilities of provider and customer (tenant) and any subcontracted or outsourced business
relationships, physical geographical location of hosted services, and any known regulatory compliance
considerations)
• Information security requirements, provider and customer (tenant) primary points of contact for the duration of the business relationship, and references to detailed supporting and relevant business processes and technical measures
implemented to enable effectively governance, risk
management, assurance and legal, statutory and regulatory compliance obligations by all impacted business relationships • Notification and/or pre-authorization of any changes
controlled by the provider with customer (tenant) impacts • Timely notification of a security incident (or confirmed breach) to all customers (tenants) and other business
relationships impacted (i.e., up- and down-stream impacted supply chain)
• Assessment and independent verification of compliance with agreement provisions and/or terms (e.g., industry-acceptable certification, attestation audit
report, or equivalent forms of assurance) without posing an unacceptable business risk of exposure to the organization being assessed
• Expiration of the business relationship and treatment of customer (tenant) data impacted
• Customer (tenant) service-to-service application (API) and X X X X X X X X X X X X S2.2.0
A3.6.0
C3.6.0
(S2.2.0) The availability, confidentiality of data, processing integrity, system security and related security obligations of users and the entity’s availability and related security commitments to users are communicated to authorized users.
(A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. (C3.6.0) The entity has procedures to obtain assurance or representation that the confidentiality policies of third parties to whom information is transferred and upon which the entity relies are in conformity with the entity’s defined system confidentiality and related security policies and that the third party is in compliance with its policies.

CC2.2
CC2.3
CC5.5
C1.4
C1.5
C.2 C.2.4, C.2.6, G.4.1, G.16.3 74 (B)
75 (C+, A+)
45 (B)
75 (C+, A+)
79 (B)
4 (C+, A+)
Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.3
LG-02 DS5.11
APO09.03
APO09.05
312.3,
312.8 and
312.10 BOSS > Legal Services > Contracts shared x
Domain 3 6.02. (e)

6.10. (h)

1.2.5 45 CFR 164.308 (a)(4)(ii)(A)
45 CFR 164.308 (b)(1)
45 CFR 164.308 (b)(2)(i)
45 CFR 164.308 (b)(2)(ii)
45 CFR 164.308 (b)(2)(iii)
45 CFR 164.308 (b)(3)
45 CFR 164.308 (b)(4)
45 CFR 164.312(e)(2)(i)
45 CFR 164.312 (c)(1)
45 CFR 164.312(e)(2)(ii)
45 CFR 164.314 (a)(1)(i)
45 CFR 164.314 (a)(1)(ii)(A)
45 CFR 164.314 (a)(2)(i)
45 CFR 164.314 (a)(2)(i)(A)
45 CFR 164.314 (a)(2)(i)(B)
45 CFR 164.314 (a)(2)(i)(C)
45 CFR 164.314 (a)(2)(i)(D)
45 CFR 164.314 (a)(2)(ii)(A)
45 CFR 164.314 (a)(2)(ii)(A)(1)
45 CFR 164.314 (a)(2)(ii)(A)(2)
45 CFR 164.314 (a)(2)(ii)(B)
45 CFR 164.314 (a)(2)(ii)(C)
45 CFR 164.314 (b)(1)
45 CFR 164.314 (b)(2)
45 CFR 164.314 (b)(2)(i)
45 CFR 164.314 (b)(2)(ii)
45 CFR 164.314 (b)(2)(iii)
45 CFR 164.314 (b)(2)(iv)
A.6.2.3
A10.2.1
A.10.8.2
A.11.4.6
A.11.6.1
A.12.3.1
A.12.5.4
A.15.1.2,

8.1* partial,
A.13.2.2,
A.9.4.1
A.10.1.1
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #1
Commandment #4
Commandment #5
Commandment #6
Commandment #7
Commandment #8
Supply Chain
Management,
Transparency and
Accountability
Supply Chain
Governance Reviews
STA-06 Providers shall review the risk management and governance processes of their partners so that practices are consistent and aligned to account for risks inherited from other members of that partner's cloud supply chain.

X X X X X X X X X X X --
APO10.04
APO10.05
MEA01
SRM > Governance Risk &
Compliance > Vendor Management provider x
Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Supply Chain 6.1.2(b)
Management,
Transparency and
Accountability
Supply Chain Metrics
STA-07 Policies and procedures shall be implemented to ensure the consistent review of service agreements (e.g., SLAs) between providers and customers (tenants) across the relevant supply chain (upstream/downstream).

Reviews shall performed at least annually and identity nonconformance to established agreements. The reviews should result in actions to address service-level conflicts or inconsistencies resulting from disparate supplier
X X X X X X X X X X X 51 (B) -- APO01.03
APO09.03
APO09.04
APO09.05
APO10.01
APO10.03
APO10.04 ITOS > Service Delivery > Service Level Management - Vendor Management provider x Domain 3 6.02. (c)

6.02. (d)

6.07.01. (k)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)
Supply Chain 6.1.2(c)(1),
Management,
Transparency and
Accountability
Third Party Assessment
STA-08 Providers shall assure reasonable information security across their information supply chain by performing an annual review.

The review shall include all partners/third party-providers upon which their information supply chain depends on.

X X X X X X X X X X X --
APO09.03
MEA01
MEA02
SRM > Governance Risk &
Compliance > Vendor Management provider x
Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Supply Chain 6.1.2(b)
Management,
Transparency and
Accountability
Third Party Audits
STA-09 Third-party service providers shall demonstrate compliance with information security and confidentiality, access control, service definitions, and delivery level agreements included in third-party contracts. Third-party reports, records, and services shall undergo audit and review at least annually to govern and maintain compliance with the service delivery agreements.

X X X X X X X X X X X S2.2.0
C2.2.0
C3.6
Note: third party service providers are addressed under either the carve-out method or the inclusive method as it relates to the assessment of controls.
(S2.2.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users. (C2.2.0) The system confidentiality and related security obligations of users and the entity’s confidentiality and related security commitments to users are communicated to authorized users before the confidential information is provided. This communication includes, but is not limited to, the following matters: (see sub-criteria on TSPC tab)
(C3.6) The entity has procedures to obtain assurance or representation that the confidentiality policies of third parties to whom information is transferred and upon which the entity relies are in conformity with the entity’s defined system confidentiality and related security policies and that the third party is in compliance with its policies.

CC2.2
CC2.3
C1.4
C1.5
C.2 C.2.4,C.2.6, G.4.1, G.4.2, L.2,
L.4, L.7, L.11
60 (B)
62 (C+, A+)
83 (B)
84 (B)
85 (B)
CO-03 ME 2.6
DS 2.1
DS 2.4
APO01.08
APO10.05
MEA02.01
312.2(a)
and 312.3
(Prohibiti
on on
Disclosur
e)
BOSS > Compliance > Third-Party
Audits shared x
Domain 2, 4 6.02. (b)

6.02. (d)
Article 17(2)
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SA-12
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)

1.2.11 4.2.3

7.2.4 10.2.3

10.2.4 45 CFR 164.308(b)(1)
45 CFR 164.308 (b)(4)
A.6.2.3
A.10.2.1
A.10.2.2
A.10.6.2
A.15.1.2

8.1* partial,

8.1* partial, A.15.2.1
A.13.1.2
Commandment #1
Commandment #2
Commandment #3
Threat and Vulnerability
Management
Anti-Virus / Malicious
Software
TVM-01 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of malware on organizationally-owned or managed user end-point devices (i.e., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

X X X X X X X X X S3.5.0 (S3.5.0) Procedures exist to protect against infection by computer viruses, malicious codes, and unauthorized software.

CC5.8 G.7 17 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-21 DS5.9
APO01.03
APO13.01
APO13.02
DSS05.01
312.8 and
312.10
SRM > Infrastructure Protection
Services > Anti-Virus shared x
Domain 2 6.03. (f)
Article 17
NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)
NIST SP 800-53 R3 SI-8

8.2.2 45 CFR 164.308 (a)(5)(ii)(B) A.10.4.1 A.12.2.1 Commandment #4 Commandment #5
Threat and Vulnerability
Management
Vulnerability / Patch
Management
TVM-02 Policies and procedures shall be established, and supporting processes and technical measures implemented, for timely detection of vulnerabilities within organizationally-owned or managed applications, infrastructure network and system components (e.g. network vulnerability assessment,
penetration testing) to ensure the efficiency of implemented security controls. A risk-based model for prioritizing
remediation of identified vulnerabilities shall be used.

Changes shall be managed through a change management
process for all vendor-supplied patches, configuration
changes, or changes to the organization's internally
developed software. Upon request, the provider informs
customer (tenant) of policies and procedures and identfied weaknesses especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

X X X X X X X X X S3.10.0 (S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies to enable authorized access and to prevent unauthorized access.

CC7.1 I.4 G.15.2, I.3 32 (B)
33 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-20 AI6.1
AI3.3
DS5.9 APO01.03
APO13.01
APO13.02
BAI06.01
BAI06.02
BAI06.03
BAI06.04
DSS01.01
DSS01.02
DSS01.03
DSS03.05
DSS05.01
DSS05.03
DSS05.07
312.8 and
312.10
SRM > Threat and Vulnerability
Management > Vulnerability
Management shared x
Domain 2 6.03.02. (a)

6.03.02. (b)

6.03.05. (c)

6.07.01. (o)
Article 17
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 RA-5 (1)
NIST SP 800-53 R3 RA-5 (2)
NIST SP 800-53 R3 RA-5 (3)
NIST SP 800-53 R3 RA-5 (6)
NIST SP 800-53 R3 RA-5 (9)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-5

1.2.6 8.2.7
45 CFR 164.308 (a)(1)(i)(ii)(A)
45 CFR 164.308 (a)(1)(i)(ii)(B)
45 CFR 164.308 (a)(5)(i)(ii)(B)
A.12.5.1
A.12.5.2
A.12.6.1

8.1*partial, A.14.2.2,

8.1*partial, A.14.2.3
A.12.6.1
Commandment #4
Commandment #5
Threat and Vulnerbility
Management
Mobile Code
TVM-03 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of unauthorized mobile code, defined as software transferred between systems over a trusted or
untrusted network and executed on a local system without explicit installation or execution by the recipient, on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

X X X X X X X X X S3.4.0
S3.10.0
(S3.4.0) Procedures exist to protect against infection by computer viruses, malicious code, and unauthorized software.
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies to enable authorized access and to prevent unauthorized access.

CC5.6
CC7.1
G.20.12, I.2.5 SA-15
APO01.03
APO13.01
APO13.02
DSS05.01
DSS05.02
DSS05.03
DSS05.04
312.8 and
312.10
SRM > Infrastructure Protection
Services > End Point - White Listing shared x
Domain 10 6.03. (g)
Article 17
A.10.4.2
A.12.2.2
A.12.2.1 Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment #11
© Copyright 2014 Cloud Security Alliance - All rights reserved. You may download, store, display on your computer, view, print, and link to the Cloud Security Alliance “Cloud Controls Matrix (CCM) Version

3.0.1” at http://www.cloudsecurityalliance.org subject to the following: (a) the Cloud Controls Matrix v3.0.1 may be used solely for your personal, informational, non-commercial use; (b) the Cloud Controls Matrix v3.0.1 may not be modified or altered in any way; (c) the Cloud Controls Matrix v3.0.1 may not be redistributed; and (d) the trademark, copyright or other notices may not be removed. You may quote portions of the Cloud Controls Matrix v3.0.1 as permitted by the Fair Use provisions of the United States Copyright Act, provided that you attribute the portions to the Cloud Security Alliance Cloud Controls Matrix Version

3.0.1 (2014). If you are interested in obtaining a license to this material for other usages not addresses in the copyright notice, please contact [email protected].

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 290
#2..
- 334 -
Mexico - Federal Law on Protection of Personal Data Held by Private Parties NERC CIP NIST SP800-53 R3 NIST SP800-53 R4 App J NZISM PCI DSS v2.0 PCI DSS v3.0 PA ID PA level
CIP-007-3 - R5.1 SC-2
SC-3
SC-4
SC-5
SC-6
SC-7
SC-8
SC-9
SC-10
SC-11
SC-12
SC-13
SC-14
SC-17
SC-18
SC-20
SC-21
SC-22
SC-23
AR-7 The organization
designs information
systems to support privacy
by automating privacy
controls.

14.5 14.6
PA17
PA31
SGP
BSGP

6.5 6, 6.5
CA-1
CA-2
CA-5
CA-6
AP-1 The organization
determines and documents
the legal authority that
permits the collection, use,
maintenance, and sharing
of personally identifiable

9.2 4.1.1, 4.2, 4.3
CIP-003-3 - R4.2 SI-10
SI-11
SI-2
SI-3
SI-4
SI-6
SI-7
SI-9
AR-7 The organization
designs information
systems to support privacy
by automating privacy
controls.

14.5 14.6
PA25 GP 6.3.1

6.3.2 6.3.1

6.3.2 AC-1
AC-4
SC-1
SC-16
AR-7 The organization
designs information
systems to support privacy
by automating privacy
controls.

16.5 16.8

17.4 PA20
PA25
PA29
GPP
SGP

2.3 3.4.1

4.1 4.1.1

6.1 6.3.2a

6.5c

8.3 10.5.5

11.5 2.3

3.4.1 4.1

4.1.1 6.1

6.3.2a

6.5c, 7.1, 7.2, 7.3, 8.1, 8.2,

8.3, 8.4, 8.5, 8.6, 8.7, 8.8

10.5.5, 10.8

11.5, 11.6
CA-2
CA-7
PL-6
AR-4 Privacy Auditing and
Monitoring. To promote
accountability,
organizations identify and
address gaps in privacy
compliance, management,
operational, and technical
controls by conducting
regular assessments

5.1, 5.3, 5.4 PA15 SGP 2.1.2.b
Chapter VI, Section 1
Article 39, I. and VIII.

Chapter 8
Article 59
CIP-003-3 - R1.3 - R4.3
CIP-004-3 R4 - R4.2
CIP-005-3a - R1 - R1.1 - R1.2
CA-1
CA-2
CA-6
RA-5
AR-4. Privacy Auditing and
Monitoring. These
assessments can be selfassessments or thirdparty
audits that result in reports
on compliance gaps
identified in programs,
projects, and information
systems.

6.1 PA18 GP 11.2

11.3 6.6

12.1.2.b

11.2 11.3

6.3.2, 6.6

11.2.1, 11.2.2, 11.2.3,

11.3.1, 11.3.2, 12.1.2.b,

12.8.4 AC-1
AT-1
AU-1
CA-1
CM-1
CP-1
IA-1
IA-7
IR-1
MA-1
MP-1
PE-1
PL-1
PM-1
PS-1
RA-1
RA-2
SA-1
SA-6
SC-1
SC-13
SI-1

1.2 2.2

3.3 5.2

3.1.1 3.1

3.1 CP-1
CP-2
CP-3
CP-4
CP-6
CP-7
CP-8
CP-9
CP-10
PE-17
UL-2 INFORMATION

SHARING WITH THIRD
PARTIES - a. Shares
personally identifiable
information (PII) externally,
only for the authorized
purposes identified in the
Privacy Act and/or
described in its notice(s)
or for a purpose that is
compatible with those
purposes; b. Where
appropriate, enters into
Memoranda of
Understanding,
Memoranda of Agreement,
Letters of Intent, Computer
Matching Agreements, or
similar agreements, with
third parties that
specifically describe the
PII covered and specifically
enumerate the purposes
for which the PII may be
used; c. Monitors, audits,
and trains its staff on the

6.4 12.9.1

12.9.3 12.9.4

12.9.6 12.9.1

12.9.3 12.9.4

12.9.6 CP-2
CP-3
CP-4

4.4 5.2(time limit)

6.3(whenever change occurs)
PA15 SGP 12.9.2 12.9.2, 12.10.2
PE-1
PE-4
PE-13

10.1 10.2

10.3 10.4

10.5 10.6
PA15 SGP 4.1, 4.1.1, 9.1, 9.2
CIP-005-3a - R1.3
CIP-007-3 - R9
CP-9
CP-10
SA-5
SA-10
SA-11

10.5 13.5

17.1 12.1

12.2 12.3

12.4 1.1.2, 1.1.3, 2.2, 12.3

12.6 CIP-004-3 R3.2 PE-1
PE-13
PE-14
PE-15
PE-18

8.1 8.4
PA15 SGP 3.5.2, 3.6.3, 3.7,

5.1, 5.2, 5.3,

6.1, 6.2,

7.1, 7.2,

9.1, 9.2, 9.3, 9.4, 9.5, 9.6,

9.7, 9.8, 9.9,

12.2 PE-1
PE-5
PE-14
PE-15
PE-18

8.1 PA15 SGP 9.1.3

9.5 9.6

9.9 9.9.1

9.1.3 9.5

9.6 9.9

9.9.1, 12.2
CIP-007-3 - R6.1 - R6.2 - R6.3 -
R6.4
MA-2
MA-3
MA-4
MA-5
MA-6

3.3 12.1

12.5 14.5 (software)
PA8
PA15
BSGP
SGP

10.8, 11.6
CP-8
PE-1
PE-9
PE-10
PE-11
PE-12
PE-13
PE-14

8.1 8.2

8.3 8.4
PA15 SGP
CIP-007-3 - R8 - R8.1 - R8.2 -
R8.3
RA-3 6.4 PA8
PA15
BSGP
SGP
CM-2
CM-3
CM-4
CM-5
CM-6
CM-9
MA-4
SA-3
SA-4
SA-5
SA-8
SA-10
SA-11
SA-12

12.1 12.2

12.3 12.4

4.3, 10.8,

11.1.2,

12.1 12.2

12.3 12.4

12.5, 12.5.3,

12.6, 12.6.2,

12.10 Chapter II
Article 11, 13
CIP-003-3 - R4.1 CP-2
CP-6
CP-7
CP-8
CP-9
SI-12
AU-11
FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the data.(49)
Managerial measures
include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do

6.4 13.1
PA10
PA29
BSGP
SGP

3.1 3.1.1

3.2 9.9.1

9.5 9.6

10.7 3.1

3.1.a

3.2 9.9.1

9.5. 9.5.1

9.6. 9.7, 9.8

10.7, 12.10.1
CA-1
CM-1
CM-9
PL-1
PL-2
SA-1
SA-3
SA-4

12.1 6.3.2 6.3.2, 12.3.4
SA-4
SA-5
SA-8
SA-9
SA-10
SA-11
SA-12
SA-13

2.2 4.1
PA17 SGP 3.6.7

6.4.5.2 7.1.3

8.5.1 9.1

9.1.2 9.2b

9.3.1 10.5.2

11.5 12.3.1

12.3.3 2.1, 2.2.4, 2.3, 2.5

3.3, 3.4, 3.6

4.1, 4.2

6.3.1, 6.3.2, 6.4.2, 6.4.3,

6.4.4, 6.4.5.2

6.7 7.1, 7.1.3, 7.1.4

8.3, 8.5.1, 8.7

9.1 9.1.2

9.2 10.5

11.5 12.3

12.8 CM-1
CM-2
SA-3
SA-4
SA-5
SA-8
SA-10
SA-11
SA-13

12.1 14.1

14.2 1.1.1

6.1 6.4

6.1 6.2

6.3 6.4

6.5 6.6

6.7 CM-1
CM-2
CM-3
CM-5
CM-7
CM-8
CM-9
SA-6
SA-7
SI-1
SI-3
SI-4
SI-7
FTC Fair Information
Principles
Involves both managerial
and technical measures to
protect against loss and
the unauthorized access,
destruction, use, or
disclosure of the data.(49)
Managerial measures
include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

14.1 1.3.3

2.1, 2.2.2

3.6 4.1

5.1, 5.2, 5.3, 5.4

6.2 7.1

9.1 9.1.1

9.1.2 9.1.3

9.2 9.3

9.4 9.4.1

9.4.2 9.4.3

10.1, 10.2, 10.3, 10.4, 10.5,

10.6, 10.7

11.1, 11.4, 11.5

12.3 CIP-003-3 - R6 CA-1
CA-6
CA-7
CM-2
CM-3
CM-5
CM-6
CM-9
PL-2
PL-5
SI-2
SI-6
SI-7
AR- 4. Privacy Monitoring
and Auditing.

Organizations also: (i)
implement technology to
audit for the security,
appropriate use, and loss
of PII; (ii) perform reviews
to ensure physical security
of documents containing
PII; (iii) assess contractor
compliance with privacy
requirements; and (iv)
ensure that corrective
actions identified as part of
the assessment process
are tracked and monitored
until audit findings are
corrected. The
organization Senior
Agency Official for Privacy
(SAOP)/Chief Privacy
Officer (CPO) coordinates
monitoring and auditing
efforts with information
security officials and

12.1 12.4
PA14 SGP 1.1.1

6.3.2 6.4

6.1 1.1.1

6.3.2 6.4.5
General Provisions, Article 3, V. and VI. CIP-003-3 - R4 - R5 RA-2 AC-4
DM-1 Minimization of
Personsally Identifidable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII used
in Testing, Training, and
Research.

PA10 SGP 9.7.1

9.10 12.3

3.1 9.6.1, 9.7.1

9.10 12.3
TR-2 SYSTEM OF

RECORDS NOTICES

AND PRIVACY ACT

STATEMENTS

1.1.3 12.3.3
AC-14
AC-21
AC-22
IA-8
AU-10
SC-4
SC-8
SC-9
TR-2 SYSTEM OF

RECORDS NOTICES

AND PRIVACY ACT

STATEMENTS
PA25
PA21
PA5
GP
GP
BSGP

2.1.1 4.1

4.1.1 4.2

2.1.1 3.1

4.1 4.1.1

4.2 Chapter II
Article 8, 9, 11, 12, 14, 18, 19, 20, 21 CIP-003-3 - R4 - R4.1 AC-16 MP-1
MP-3
PE-16
SI-12
SC-9
DM-1 Minimization of
Personsally Identifidable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII used
in Testing, Training, and
Research. SE-1

INVENTORY OF

PERSONALLY

IDENTIFIABLE

13.1 9.5

9.6 9.7.1

9.7.2 9.10

9.5, 9.5.1

9.6 9.7

9.8 9.9
CIP-003-3 - R6 SA-11
CM-04
DM-1 Minimization of
Personsally Identifidable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII used
in Testing, Training, and
Research.

17.8 6.4.3 6.4.3
Chapter IV
Article 30
CIP-007-3 - R1.1 - R1.2 CA-2
PM-5
PS-2
RA-2
SA-2
AP-1 AUTHORITY TO
COLLECT. AP-2

PURPOSE
SPECIFICATION.

3.4 3.7

12.5.5 12.10.4
CIP-007-3 - R7 - R7.1 - R7.2
R7.3
MP-6
PE-1
DM-2 DATA

RETENTION AND

DISPOSAL

13.4 13.5
PA10
PA39
PA34
PA40
BSGP
SGP
SGP
SGP

3.1.1 9.10

9.10.1 9.10.2

3.1 3.1.1

9.8, 9.8.1, 9.8.2, 3.1

12.3 PA4
PA8
PA37
PA38
BSGP
BSGP
SGP
SGP

9.7.1 9.9

9.9.1 CIP-006-3c R1.2 - R1.3 - R1.4 -
R1.6 - R1.6.1 - R2 - R2.2
PE-2
PE-3
PE-6
PE-7
PE-8
PE-18

8.1 8.2
PA4 BSGP 9.1

9.1.1 9.1.2

9.1.3 9.2

9.1 9.1.1

9.1.2, 9.1.3

9.2, 9.3, 9.4, 9.4.1, 9.4.2,

9.4.3, 9.4.4
IA-3
IA-4
PA22
PA33
GP
SGP
AC-17
MA-1
PE-1
PE-16
PE-17

12.5 19.1
PA4 BSGP 9.8

9.9 9.10

9.6.3 CM-8 12.6 PA4 BSGP 9.9.1

12.3.3 12.3.4

9.8, 9.8.1, 9.8.2

12.3 CIP-006-3c R1.2 - R1.3 - R1.4 -
R2 - R2.2
PE-2
PE-3
PE-4
PE-5
PE-6

4.2 8.1
PA4 BSGP 9.1 9.1

9.1.1 9.1.2

9.2 9.3

9.4 9.4.1

9.4.2 CIP-006-3c R1.2 - R1.3 - R1.4 PE-7 9.4.3
PE-16
PE-18

8.2 8.1
PA4 BSGP 9.1

9.1.1 9.1.3
MA-1
MA-2
PE-16

8.1 8.2

8.3 8.4
PA4 BSGP 9.8

9.9 9.1

9.1.1 9.1.2

9.2 9.3

9.4 Chapter II,
Article 19 CIP-006-3c R1.2 - R1.3 - R1.4 -
R1.6 - R1.6.1 - R2 - R2.2
PE-2
PE-3
PE-6
PE-18

8.1 8.2
PA4
PA13
PA24
BSGP
SGP P

9.1 9.1

9.1.1 9.1.2

9.2 9.3

9.4 9.4.1

9.4.2 9.4.3

9.4.4 PA36

3.5, 7.1.3

8.1 8.1.1

8.2.2 8.5

8.5.1 SC-12
SC-13
SC-17
SC-28

16.2 PA36 3.4.1

3.5 3.5.1

3.5.2 3.6

3.6.1 3.6.2

3.6.3 3.6.4

3.6.5 3.6.6

3.6.7 3.6.8

3.4.1 3.5

3.5.1 3.5.2

3.6 3.6.1

3.6.2 3.6.3

3.6.4 3.6.5

3.6.6 3.6.7

3.6.8,

4.1 ODCA UM: PA R2.0
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 291
#2..
- 335 -
CIP-003-3 - R4.2 AC-18
IA-3
IA-7
SC-7
SC-8
SC-9
SC-13
SC-16
SC-23
SI-8

16.1 PA25 GP 2.1.1

3.4 3.4.1

4.1 4.1.1

4.2 2.1.1

2.3 3.3

3.4 3.4.1

4.1 4.1.1

4.2 4.3

6.5.3 6.5.4

8.2.1 3.5.2, 3.5.3

3.6.1, 3.6.3
Chapter II, Article 19 and Chapter VI, Section I, Article 39 CM-2 SA-2
SA-4
AR-1 Governance and
Privacy Program. TR-1
PRIVACY NOTICE. TR-3

DISSEMINATION OF

PRIVACY PROGRAM

INFORMATION

4.4 5.1

1.1 1.1.1

1.1.2 1.1.3

1.1.4 1.1.5

1.1.6 2.2

2.2.1 2.2.2

2.2.3 2.2.4

1.1 1.1.1

1.1.2 1.1.3

1.1.4 1.1.5

1.1.6 2.2

2.2.1 2.2.2

2.2.3 2.2.4
CA-3
RA-2
RA-3
MP-8
PM-9
SI-12
AR-2 Privacy Impact and
Risk Assessment

3.3 4.3

8.4 PA10
PA18
BSGP
GP

12.1 12.1.2

12.2 AT-2
AT-3
CA-1
CA-5
CA-6
CA-7
PM-10
AR-1 Governance and
Privacy Program

3.2 12.6.1

12.6.2 12.6, 7.3, 8.8, 9.10
Chapter II, Article 19 CIP-001-1a - R1 - R2
CIP-003-3 - R1 - R1.1 - R4
CIP-006-3c R1
PM-1
PM-2
PM-3
PM-4
PM-5
PM-6
PM-7
PM-8
PM-9
PM-10
PM-11
AR-1 Governance and
Privacy Program

4.1 PA8 BSGP 12.1

12.2 12.1

12.2 Chapter VI, Section I, Article 39 CIP-003-3 - R1 - R1.1 CM-1 PM-1
PM-11

4.1 12.5 12.4
Chapter VI, Section I, Article 39 CIP-003-3 - R1 -R1.1 - R1.2 - R2 - R2.1 - R2.2 - R2.3
AC-1
AT-1
AU-1
CA-1
CM-1
IA-1
IR-1
MA-1
MP-1
MP-1
PE-1
PL-1
PS-1
SA-1
SC-1
SI-1

4.2 4.3

4.4 4.5
PA30 BSGP 12.1

12.2 7.3, 8.8, 9.10, 12.1

12.2 Chapter X, Article 64 PL-4
PS-1
PS-8
CIP-009-3 - R2 CP-2
RA-2
RA-3
AR-2 Privacy Impact and
Risk Assessment

4.3 12.1.3 12.2
CIP-003-3 - R3.2 - R3.3 - R1.3
R3 - R3.1 - R3.2 - R3.3
AC-1
AT-1
AU-1
CA-1
CM-1
CP-1
IA-1
IA-5
IR-1
MA-1
MP-1
PE-1
PL-1
PM-1
PS-1
RA-1
SA-1
SC-1
SI-1

4.1 6.1

12.1.3 12.1.1
CIP-002-3 - R1.1 - R1.2
CIP-005-3a - R1 - R1.2
CIP-009-3 - R.1.1
PL-5
RA-2
RA-3

1.1 3.3

5.1 5.2

5.3 5.4

7.1 12.2

17.7 18.1

18.3 PA2
PA15
BSGP
SGP

12.1.2 12.2
Chapter II
Article 19
CIP-009-3 - R4 AC-4
CA-2
CA-6
PM-9
RA-1
AR-2 Privacy Impact and
Risk Assessment

3.2 (responsibility)

3.3 3.4

4.1 4.3

5.2 (residual Risk)

12.1.2 12.2
PS-4 2.2 9.3
CIP-004-3 - R2.2 PS-2
PS-3

9.29 PA27 BSGP 12.7

12.8.3 12.7

12.8.3 PL-4
PS-6
PS-7

9.2 PA27 BSGP 12.4

12.8.2 PS-4
PS-5
PA27 BSGP
CIP-007-3 - R7.1 AC-17
AC-18
AC-19
MP-2
MP-4
MP-6

19.1 19.2

19.3 PA33
PA34
SGP
SGP

9.7 9.7.2

9.8 9.9

11.1 12.3

11.1 12.3
PL-4
PS-6
SA-9
DI-2 DATA INTEGRITY

AND DATA INTEGRITY
BOARD
a. Documents processes
to ensure the integrity of
PA7 BSGP 12.8.2

12.8.3 12.8.4
AT-3
PL-4
PM-10
PS-1
PS-6
PS-7
AR-1 GOVERNANCE

AND PRIVACY

PROGRAM
Control: The organization:

Supplemental Guidance:

The development and
implementation of a

2.2 PA9
PA24
BSGP 12.8.5
AC-8
AC-20
PL-4

2.2 5.2

4.2 12.3.5 12.3
Chapter VI, Section I, Article 39 and Chapyer VI, Section II, Article 41 CIP-004-3 - R1 - R2 - R2.1 AT-1 AT-2
AT-3
AT-4
AR-5 PRIVACY

AWARENESS AND

TRAINING
Control: The organization:
a. Develops, implements,
and updates a
comprehensive training
and awareness strategy
aimed at ensuring that

9.1 PA28 BSGP 12.6

12.6.1 12.6.2

12.6 Chapter VI, Section I, Article 39 and Chapyer VI, Section II, Article 41 AT-2 AT-3
AT-4
PL-4
UL-1 INTERNAL USE
Control: The organization
uses personally identifiable
information (PII) internally
only for the authorized
purpose(s) identified in the
Privacy Act and/or in public

9.1 8.5.7

12.6.1 12.4
AC-11
MP-2
MP-3
MP-4

8.1 8.1.8
CIP-003-3 - R5.2 AU-9
AU-11
AU-14

15.4 10.5.5 10.5

7.1.2 7.1.4

7.2 CIP-007-3 - R5.1 - R5.1.2 AC-1 8.1
IA-1

15.1 15.2

3.5.1 8.5.1

12.5.4 3.5.1, 7.0

8.0 12.5.4
CIP-007-3 - R2 CM-7
MA-3
MA-4
MA-5

15.4 9.1.2 1.2.2

7.1 7.1.2

7.1.3 7.2

7.2.3 9.1.2

9.1.3 7.3

8.8 9.10
CIP-007-3 R5.1.1 AC-1
AC-2
AC-5
AC-6
AU-1
AU-6
SI-1
SI-4

3.0 3.1

3.2 3.3

3.4 3.5
PA24P 6.4.2 6.4.2, 7.3

8.8 9.10
CM-5
CM-6

9.4 14.1

14.2 19.1

6.4.1 6.4.2

6.4.1 6.4.2, 7.1

7.1.1 7.1.2

7.1.3 CA-3 7.1.4
MA-4
RA-3
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the data.(49)
Managerial measures
include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

Technical security
measures to prevent
unauthorized access
include encryption in the
transmission and storage
of data; limits on access
through use of passwords;
and the storage of data on

2.2 4.3

12.8.1 12.8.2

12.8.3 12.8.4

12.8 12.2
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the data.(49)
Managerial measures
include internal
organizational measures
that limit access to data
and ensure that those

3.2 9.2

15.2 7.1

7.1.1 7.1.2

7.1.3 7.1.4

7.2 CIP-003-3 - R5.1.1 - R5.3
CIP-004-3 R2.3
CIP-007-3 R5.1 - R5.1.2
AC-3
AC-5
AC-6
IA-2
IA-4
IA-5
IA-8
MA-5
PS-6
SA-7
SI-9
AP-1 The organization
determines and documents
the legal authority that
permits the collection, use,
maintenance, and sharing
of personally identifiable
information (PII), either
generally or in support of a
specific program or
information system need.

9.2 15.2
PA24 GP 7.1

7.1.1 7.1.2

7.1.3 7.2.1

7.2.2 8.5.1

12.5.4 7.1

7.1.1 7.1.2

7.1.3 7.1.4

12.5.4 CIP-004-3 R2.2.2
CIP-007-3 - R5 - R.1.3
AC-2
AU-6
PM-10
PS-6
PS-7

9.2 8.1.4
CIP-004-3 R2.2.3
CIP-007-3 - R5.1.3 -R5.2.1 -
R5.2.3
AC-2
PS-4
PS-5
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the data.(49)
Managerial measures

9.2 8.5.4

8.5.5 8.1.3

8.1.4 8.1.5, 12.5.4
CIP-004-3 R2.2.3
CIP-007-3 - R5.2 - R5.3.1 -
R5.3.2 - R5.3.3
AC-1
AC-2
AC-3
AC-11
AU-2
AU-11
IA-1
IA-2
IA-5
IA-6
IA-8
SC-10
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the data.(49)
Managerial measures
include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

Technical security
measures to prevent
unauthorized access
include encryption in the
transmission and storage
of data; limits on access
through use of passwords;

15.1 15.2
PA9
PA6
PA24
PA22
BSGP
BSGP P
GP

8.1 8.2,

8.3 8.4

8.5 10.1,

12.2,

12.3.8 8.0

10.1,

12.3 CIP-007-3 - R2.1 - R2.2 - R2.3 AC-5
AC-6
CM-7
SC-3
SC-19

12.2 14.2

7.1.2 5.0

7.1 7.1.2

7.2 CIP-007-3 - R6.5 AU-1
AU-2
AU-3
AU-4
AU-5
AU-6
AU-7
AU-9
AU-11
AU-12
AU-14
SI-4

17.6 PA11
PA12
PA13
PA24
BSGP
SGP
SGP P

10.1 10.2

10.3 10.5

10.6 10.7

11.4 12.5.2

12.9.5 10.1

10.2 10.3

10.4 10.5

10.6 10.7, 10.8

11.4, 11.5, 11.6

12.5.2 PA35 GP 10.5.5, 12.10.5
AU-1
AU-8

10.4 10.4
SA-4 3.3 PA16 SGP
PA36 6.1
CIP-004-3 R2.2.4 SC-7 17.1

17.2 PA3
PA5
PA16
PA19
PA18
BSGP
BSGP
SGP
GP
SGP

1.1 1.1.2

1.1.3 1.1.5

1.1.6 1.2

1.2.1 2.2.2

2.2.3 1.1

1.1.2 1.1.3

1.1.5 1.1.6

1.2 1.2.1

1.2.2 1.2.3

1.3 2.2.2

2.2.3 2.2.4

2.5 4.1

2.1 2.2

2.5 5.1
SC-2 14.5 PA3 BSGP 6.4.1

6.4.2 6.4.1

6.4.2 CIP-004-3 R3 AC-4
SC-2
SC-3
SC-7

17.6 18.1

18.4 PA3
PA5
PA16
PA20
BSGP
BSGP
SGP
GP

1.1 1.2

1.2.1 1.3

1.4 1.1

1.2 1.2.1

1.2.3 1.3

1.4 2.1.1

2.2.3 2.2.4

2.3 State of Utah Bid CH16012
3/22/2016 4:23 PM p. 292
#2..
- 336 -

4.1 3.5.1, 3.6.6
CIP-004-3 R3
CIP-007-3 - R6.1
AC-1
AC-18
CM-6
PE-4
SC-3
SC-7

11.1 17.3
PA3
PA6
PA16
PA20
PA25
PA32
PA33
BSGP
BSGP
SGP
GP
P
BSGP
SGP

1.2.3 2.1.1

4.1 4.1.1

11.1 9.1.3

1.2.3 2.1.1

4.1 4.1.1

11.1, 11.1.a, 11.1.b, 11.1.c, 11.1.d, 11.1.1, 11.1.2

9.1.3 4.1

4.1.1 4.3
PA32 BSGP 4.1
PA34 SGP
Chapter VI,
Article 44.

Chatper II,
Article 16, part I
CIP-001-1a R3 - R4 AT-5
IR-6
SI-5

3.2 11.1.e

12.5.3 12.9

12.5.3 12.10.1
Chapter II, Article 20 CIP-007-3 - R6.1
CIP-008-3 - R1
IR-1
IR-2
IR-3
IR-4
IR-5
IR-7
IR-8
IP-4 COMPLAINT
MANAGEMENT. SE-2

PRIVACY INCIDENT

RESPONSE

4.1 4.2

4.6 7.1
PA8
PA11
BSGP 12.9

12.9.1 12.9.2

12.9.3 12.9.4

12.9.5 12.9.6

12.1 Chapter II, Article 20 CIP-003-3 - R4.1
CIP-004-3 R3.3
IR-2
IR-6
IR-7
SI-4
SI-5
IP-4 COMPLAINT
MANAGEMENT. SE-2

PRIVACY INCIDENT

RESPONSE

7.2 PA8 BSGP 12.5.2

12.5.3 12.10.1
CIP-004-3 R3.3 AU-6
AU-7
AU-9
AU-11
IR-5
IR-7
IR-8

7.3 PA11 BSGP
CIP-008-3 - R1.1 IR-4
IR-5
IR-8

7.2 7.3
PA11 BSGP 12.9.6
SC-20
SC-21
SC-22
SC-23
SC-24

17.1 PA3
PA8
PA16
BSGP
BSGP
SGP

12.1.1 Chapter II
Article 14.

CA-3
MP-5
PS-7
SA-6
SA-7
SA-9

5.2 2.2

2.4 12.8.2

12.8.4 Chapter II
Article 14, 21
Chapter III
Article 25
Chapter V
Article 36
CA-3
SA-9
SA-12
SC-7

5.4 2.4

12.8.2 12.8.3

12.8.4 Appendix A

2.4 12.8.2

12.8.3 12.8.4
Appendix A
CIP-007-3 - R4 - R4.1 - R4.2 SA-7
SC-5
SI-3
SI-5
SI-7
SI-8

14.1 17.6 PA1 BSGP

5.1 5.1.1

5.2 1.4, 5.0
CIP-004-3 R4 - 4.1 - 4.2
CIP-005-3a - R1 - R1.1
CIP-007-3 - R3 - R3.1 - R8.4
CM-3
CM-4
CP-10
RA-5
SA-7
SI-1
SI-2
SI-5

12.4 14.1
PA2
PA8 BSGP

2.2 6.1

6.2 6.3.2

6.4.5 6.5

6.6 11.2

11.2.1 11.2.2

11.2.3 2.2

6.1 6.2

6.3.2 6.4.5

6.5 6.6

11.2 11.2.1

11.2.2 11.2.3
SC-18
3 3.1

3.2 3.3

3.4 3.5
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 293
#2..
- 337 -
DRAFT: This document is intended to be a draft and should not be returned to the Division of Purchasing. Please return this document to the evaluation committee This document is not subject to GRAMA pursuant to Utah Administrative Code R33-7-702(2).

Score will be assigned as follows:
1 = Poor, fails to address the requirements in the RFP
2 = Fair, addresses the requirements in the RFP unsatisfactorily 3 = Good, addresses all requirements in the RFP satisfactorily 4 = Very Good, addresses all requirements in the RFP and may exceed some 5 = Superior, addresses all requirements in the RFP and exceeds them RFP
Section
Evaluation
(Pass/Fail)
1 5.1
2 5.2
3 5.3
4 5.4
5 5.5
6 Recertification 5.8
7 Business Profile 6.1
8 6.2
9 6.3
10 7.1
11 9.1
RFP
Section
Evaluator
Score (1-5)
Criteria
Weight
% of Tech
Criteria
Points
Possible
Points
Earned
Minimum
Required
6 1 6.1 5 1.9% 25.0 0.0
2 6.2 5 1.9% 25.0 0.0
3 6.4 5 1.9% 25.0 0.0
4 6.5 5 1.9% 25.0 0.0
5 6.6 5 1.9% 25.0 0.0
6 6.7 5 1.9% 25.0 0.0
7 1 7.1 5 1.9% 25.0 0.0
8 1 8.1 10 3.8% 50.0 0.0
2 8.2 10 3.8% 50.0 0.0
3 8.3 10 3.8% 50.0 0.0
4 8.4 10 3.8% 50.0 0.0
5 8.5 10 3.8% 50.0 0.0
6 8.6 10 3.8% 50.0 0.0
7 8.7 10 3.8% 50.0 0.0
8 8.8 10 3.8% 50.0 0.0
9 8.9 10 3.8% 50.0 0.0
10 8.10. 10 3.8% 50.0 0.0
11 8.11 10 3.8% 50.0 0.0
12 8.12 10 3.8% 50.0 0.0
13 8.13 10 3.8% 50.0 0.0
14 8.14 10 3.8% 50.0 0.0
15 Back up and DisaSter Plan 8.15 10 3.8% 50.0 0.0
16 Solution Administration 8.16 10 3.8% 50.0 0.0
17 Hosting and Provisioning 8.17 10 3.8% 50.0 0.0
18 Trial and Testing Periods 8.18 10 3.8% 50.0 0.0
19 Integration and Customization 8.19 10 3.8% 50.0 0.0
20 8.20. 10 3.8% 50.0 0.0
21 8.21 10 3.8% 50.0 0.0
Contract Manager
Best Practices
Scope of Experience
General Information
Billing and Pricing Practices
Serivce of Data Recovery
Data Protection
Performance Measures and Reporting
Service Provisioning
Marketing Plan
Scope and Variety of Cloud Solutions
Signature Page
Cost Proposal Submitted
Cover Letter
Acknowledgement of Amendments
Scoreable Technical Criteria
Financials
Contract Manager
Value-Added Services
TITLE OF PROJECT (to be inserted by the Division of Purchasing)

RFP EVALUATION SCORESHEET
Firm Name:

Evaluator:

Date:

Minimum Mandatory Requirements
SOLICITATION # (to be inserted by the Division of Purchasing ) Scope of Experience
Working with Purchasing Entities
Customer Service
Security of Information
Technical Requirements
Subcontractors

ORGANIZATION AND STAFFING
Data Disposal
Cloud Security Alliance Questionnaires
Migration and Redeployment Plan

TECHNICAL REQUIREMENTS
Executive Summary
General Requirements

BUSINESS INFORMATION
Business Profile
Service Level Agreements
Privacy and Security
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 294
#2..
- 338 -
22 8.22 10 3.8% 50.0 0.0
23 Alignment of Cloud Computing 8.24 10 3.8% 50.0 0.0
100.0% 1325.0 0.0 0.0
RFP
Section
Min
Percent
Min Points
Required
Points
Earned
Percent
Earned
Evaluation

4.3.2 70% 927.5 0.0 0.0%
RFP
Section
Low Cost
Option
Offered
Cost
Percent of
Total
Points
Possible Points Earned

4.3.3 10% 147.2 0.0
Percent of
Total
Points
Possible
Points
Earned
90% 1,325.0 0.0
10% 147.2 0.0
100% 1,472.2 0.0
Cost
Total Evaluation Points
Total Cost Evaluation Points
Total Technical Evaluation Points
Total Evaluation Points
* Purchasing will use the following cost formula: The points assigned to each offerors cost proposal will be based on the lowest proposal price.

The offeror with the lowest Proposed Price will receive 100% of the price points. All other offerors will receive a portion of the total cost points based on what percentage higher their Proposed Price is than the Lowest Proposed Price. An offeror whose Proposed Price is more than double (200%) the Lowest Proposed Price will receive no points. The formula to compute the points is: Cost Points x (2- Proposed Price/Lowest Proposed Price).

Cost
Required Technical Point Threshold
Supporting Infrastructure
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 295
#2..
- 339 -
ACKNOWLEDGEMENT OF AMENDMENTS TO RFP (SOLICITATION CH16012) This attachment represents that the Offeror has read, reviewed, and understands the totality of Solicitation CH16012, including the final RFP document posted on February 10, 2016.

By signing below, the Offeror attest to reviewing the documents listed above. ______________________________________________________
Offeror
______________________________________________________
Representative Signature
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 296
#2..
- 340 -
5 Question and Answers for Bid #CH16012 - NASPO ValuePoint Cloud Solutions Overall Bid Questions
Question 1
On page 105 of the RFP it states:

A successful Offeror will have the ability to provide cloud based services through the following deployment methods:
ï‚· Private cloud. The cloud infrastructure is provisioned for exclusive use by a single organization comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises.
ï‚· Community cloud. The cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be owned, managed, and operated by one or more of the organizations in the community, a third party, or some combination of them, and it may exist on or off premises.
ï‚· Public cloud. The cloud infrastructure is provisioned for open use by the general public. It may be owned, managed, and operated by a business, academic, or government organization, or some combination of them. It exists on the premises of the cloud provider. ï‚· Hybrid cloud. The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds) Does a vendor have to be able to provide all of these deployment methods-ie-private, hybrid etc. in order to respond to this RFP? Can we only respond to one type of deployment method? (Submitted: Dec 21, 2015 12:46:45 PM MST)
Answer
- An offeror can provide a response to all of the deployment methods or to one type of deployment method. (Answered: Jan 12, 2016 3:01:39 PM MST)
Question 2
Section 5.6.16 in the main RFP document references Attachment H. However, Attachment H was not provided in the bid documents. Can the State provide Attachment H? (Submitted: Dec 22, 2015 1:10:07 PM MST) Answer
- Solicitation CH16012 has been revised to include Attachment H. (Answered: Dec 22, 2015 4:00:29 PM MST) Question 3
Is it the intent of the State to exclude small businesses from this bid? The minimum D&B rating requirement is extremely exclusionary to small businesses and we would suggest that small businesses will offer the State the best opportunity for innovation in the fast moving cloud market. (Submitted: Dec 31, 2015 11:39:18 AM MST) Answer
- The participating states want some assurance that a vendor is financially stable and able to complete IT projects of this nature. States are putting significant amounts of tax payer dollars into a contractor to provide a solution. If a small business would like to participate on this effort and cannot qualify on their own, they may want to consider partnering with a larger firm in order to qualify. (Answered: Jan 13, 2016 12:28:55 PM MST) Question 4
Attachment B: Cloud Security Alliance Questionnaires, pp. 85-97 - there is a spreadsheet-like matrix in 2-point font size that is illegible when increased in size. Please provide the matrix as a separate document in a 10-point font or higher so that its contents may be read and answers to the questions inserted. (Submitted: Jan 4, 2016 3:30:06 PM MST)
Answer
- The Exhibits to Attachment B have been attached as separate documents. (Answered: Jan 5, 2016 1:01:30 PM MST) Question 5
(Attachment A, Section 16: Insurance): Under what circumstances will the state accept â€œClaims Madeâ€ coverage for professional/network security & privacy liability? (Submitted: Jan 5, 2016 12:17:45 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 13, 2016 1:30:25 PM MST)
Question 6
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 297
#2..
- 341 -
coverage for professional/network security & privacy liability? ( , )
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 13, 2016 1:30:25 PM MST)
Question 6
(Attachment A, Section 16: Insurance): Can vendors substitute notice from itself for insurer notice if our insurer wonâ€™t agree to the notice requirements? (Submitted: Jan 5, 2016 12:18:22 PM MST) Answer
- Yes. Contractor shall provide notice to a Participating Entity who is a state within five (5) business days after Contractor is first aware of expiration, cancellation or nonrenewal of such policy or is first aware that cancellation is threatened or expiration, nonrenewal or expiration otherwise may occur. (Answered: Jan 12, 2016 2:55:24 PM MST) Question 7
(Attachment A, Section 16: Insurance): Can vendors use a combination of policies to meet the limits requirements they have to satisfy the insurance requirements? (Submitted: Jan 5, 2016 12:18:41 PM MST) Answer
- Yes. Vendors can use an umbrella insurance coverage to meet the insurance requirements. (Answered: Jan 12, 2016 2:55:24 PM MST)
Question 8
RFP, p. 5, #2.5 and Attachment E - can an offeror choose not to agree to a participating state's terms (and not respond to RFQs from that participating state)? (Submitted: Jan 5, 2016 12:19:32 PM MST) Answer
- If an offeror is awarded a Master Agreement, and contract negotiations for the Master Agreement are successful, then the offeror will be free to negotiate with other eligible states to enter into Participating Addendums. An offeror does not need to agree to participating state's terms, but can negotiate the terms in the applicable Participating Addendum. (Answered: Jan 12, 2016 2:45:09 PM MST)
Question 9
RFP, p. 16, #3.16 - Erate participation. Is it possible to participate in the Erate program with NASPO if the Offeror does not have a SPIN but an Offeror's resellers do? (Submitted: Jan 5, 2016 12:19:50 PM MST) Answer
- If that is allowable under E-Rate program. (Answered: Jan 25, 2016 2:23:05 PM MST) Question 10
RFP, p. 25, #6.3 - Financials - is it acceptable to provide a link to the audited financial statements on our investor relations website due to the length of the financial statements document? (Submitted: Jan 5, 2016 12:20:09

PM MST)
Answer
- Yes. A link would be acceptable. (Answered: Jan 5, 2016 1:06:52 PM MST) Question 11
Clarification of ambiguity - RFP, p. 9, #3.4 - exceptions are to be submitted with the proposal response. RFP, p. 12,, #3.12 - exceptions are to be submitted as questions during Q&A. (Submitted: Jan 5, 2016 12:20:52 PM MST) Answer
- Section 3.4 only refers to the exceptions and/or additions to the Master Agreement Terms and Conditions. An offeror can redline the Master Agreement Terms and Conditions if it so chooses. While Section 3.12 refers to remaining part of the RFP document. "Any exceptions to the content of the RFP, excluding the Master Agreement Terms and Conditions contained in Attachment A, including the Exhibits to Attachment A, must be addressed within the Q&A period. The Offeror further acknowledges that it has read the RFP, along with the Exhibits, Attachments, and any attached or referenced documents, including the General Provisions." (Answered: Jan 5, 2016 1:06:16 PM MST)
Question 12
If a cloud service providerâ€™s (CSP) business model it to sell its solutions to end users via resellers, will the State/NASPO allow the CSP to add resellers under them on their contract for fulfillment of their product (i.e. same model Utah uses for the NASPO Data Communications Products and Services contract)? (Submitted: Jan 8, 2016 6:46:13 AM MST)
Answer
- Correct. The same model that is used in the NASPO Data Communication contracts can be used for this contract. (Answered: Jan 21, 2016 4:24:21 PM MST)
Question 13
If a cloud service provider can use resellers for fulfillment, are the resellers subject to section 8.2 of the RFP? (Submitted: Jan 8, 2016 6:46:38 AM MST)
Answer
- Yes. Resellers are subject to 8.2. (Answered: Jan 21, 2016 4:24:21 PM MST) Question 14
If providing multiple cloud offers, what specific sections in 8.1.1 must vendors submit for each cloud offer? State of Utah Bid CH16012
3/22/2016 4:23 PM p. 298
#2..
- 342 -
Question 13
If a cloud service provider can use resellers for fulfillment, are the resellers subject to section 8.2 of the RFP? (Submitted: Jan 8, 2016 6:46:38 AM MST)
Answer
- Yes. Resellers are subject to 8.2. (Answered: Jan 21, 2016 4:24:21 PM MST) Question 14
If providing multiple cloud offers, what specific sections in 8.1.1 must vendors submit for each cloud offer? (Submitted: Jan 8, 2016 6:47:11 AM MST)
Answer
- No. If a vendor offers multiple cloud offers then it only needs to provide one proposal. However, the proposal should provide details on the cloud offers it provides. (Answered: Jan 13, 2016 1:30:08 PM MST) Question 15
Is the state only accepting bids from cloud solution providers, or are the willing to accept bids from resellers and other parties? (Submitted: Jan 8, 2016 6:51:16 AM MST) Answer
- The state is willing to accept bids/proposals from all eligible offerors that are determined to be responsive and responsible. (Answered: Jan 21, 2016 4:24:21 PM MST)
Question 16
What service model would Unified Communications as a service (UCaSS) fall under? (Submitted: Jan 8, 2016 2:51:56 PM MST)
Answer
- It is the offerors responsibility to identify the service model.

When choosing between equally plausible service model sub-categories, Offerors should consider several factors:
1) Visibility to the Purchasing Entities. The service model sub-categories in the RFP exist to help Purchasing Entities match their requirements with service characteristics. Offerors should select the most intuitive and appropriate service model from the point of view of a Purchasing Entity. 2) Primary Focus of the Service. Services may offer a mix of capabilities that span service models in the strict technical sense. For example, a service may offer both IaaS capabilities for processing and storage with some PaaS capabilities for application deployment, or SaaS capabilities for specific applications. In a service mix situation the Offerors should select the service model that is their primary focus. 3) Purchasing Entity Role. Offerors should consider the operational role of the Purchasing Entityâ€™s primary actual consumer or operator of the service. For example services most often consumed by system managers are likely to fit best as IaaS; services most often consumed by application deployers or developers as PaaS, and services most often consumed by business users as SaaS. 4) Lowest Level of Configurability. Offerors can consider IaaS, PaaS and SaaS as an ascending hierarchy of complexity, and select the model with the lowest level of available Purchasing Entity interaction. As an example, virtual machines are an IaaS service often bundled with a range of operating systems, which are PaaS services.

The Purchasing Entity usually has access to configure the lower level IaaS service, and the overall service should be considered IaaS. In cases where the Purchasing Entity cannot configure the speed, memory, network configuration, or any other aspect of the IaaS component, consider categorizing as a PaaS service. (Answered: Jan 12, 2016 2:55:24 PM MST)
Question 17
To ensure that a vendor submitting a response is authorized to resell a particular cloud service providers offering(s), would the State consider requiring that any dealer, reseller, agent, distributor, etc. submitting a response, include a signed letter of authorization from the cloud service provider certifying their status? (Submitted:

Jan 11, 2016 6:21:06 PM MST)
Answer
- Yes. If a reseller is submitting a proposal then it should provide some confirmation that it is authorized to provide the specific cloud service. A signed letter would be the best method to demonstrate authorization.

The State reserves the right to clarify with any reseller that it is in fact authorized to provide a cloud service. (Answered: Jan 21, 2016 4:24:21 PM MST)
Question 18

1. Cloud Solicitation-2.8 states that the solicitation may be re-issued on a biannual basis. Do you mean biennial or biannual? Biannual would be 2x per year, and biennial is every 2 years. (Submitted: Jan 12, 2016 6:09:23

AM MST)
Answer
- Correct. The word in section 2.8 should be biennial. This will be corrected in the final version of the RFP document. (Answered: Jan 12, 2016 3:00:37 PM MST)
Question 19

2. Cloud Solicitation-9. Cost Proposal- states that we must provide a discount from a commercially available price list in paragraph 1, yet in paragraph 2 it states that the discount is to be from a government pricing catalog.

Many vendors do not have government price lists. Please confirm that we can use either commercial or government price lists to determine our discounts. (Submitted: Jan 12, 2016 6:10:05 AM MST) Answer
- If possible offerors should submit a government pricing catalog; however, if an offeror does not have a government pricing catalog then it can use its commercial price lists (AdJ122016 30037 PM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 299
#2..
- 343 -
Question 19

Many vendors do not have government price lists. Please confirm that we can use either commercial or government price lists to determine our discounts. (Submitted: Jan 12, 2016 6:10:05 AM MST) Answer
- If possible offerors should submit a government pricing catalog; however, if an offeror does not have a government pricing catalog then it can use its commercial price lists. (Answered: Jan 12, 2016 3:00:37 PM MST) Question 20

3. Attachment G-Cost Proposal and Score sheet-Please explain how you will use your cost formula shown in the Score sheet when comparing discounts from list. Would you look at who is giving the highest discount? If so, this may not be an accurate comparison as some price lists have much higher prices for similar services and can therefore provide a higher net discount which may not result in a true bottom line cost savings (Submitted: Jan 12, 2016 6:10:25 AM MST)
Answer
- Offerors that provide a price schedule with a minimum discount from its Cloud Solutions will receive 152.8 points. If an Offeror fails to provide a discount or a price schedule as required by Section 9.1 its proposal will be disqualified. (Answered: Jan 12, 2016 3:00:37 PM MST)
Question 21
Attachment A-5. Assignments/Subcontracts-Would the State Add the Language in italics so that approval/disapproval by the Lead State is timely and reasonable

5. Assignment/Subcontracts: Contractor shall not assign, sell, transfer, or sublet rights, or delegate responsibilities under this Master Agreement, in whole or in part, without the prior written approval of the Lead State , "which consent shall not be unreasonably withheld". (Submitted: Jan 12, 2016 6:13:15 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 22
Attachment A-7 Termination-Please allow language in italics to insure that Contractors have had 30 days written notice to cure prior to termination of the contract for cause.

Termination of the Master Agreement due to Contractor default may be immediate " if Contractor shall have failed to cure any such default within thirty (30) days of written notice thereof ." (Submitted: Jan 12, 2016 6:15:43 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 23
Attachment A 8. Confidentiality, Non-Disclosure and Injunctive Relieve b. Non-Disclosure. Please allow addition of language in italics and delete (industry standard of confidentiality) . Since there is no industry standard, Contractors should be bound to their own reasonable degree of care for confidential information Contractor shall hold Confidential Information in confidence, using at least the "same degree of care it applies to its own confidential information, but in no event less than a reasonable degree of care", and shall not copy, reproduce, sell, assign, license, market, transfer or otherwise dispose of, give, or disclose (Submitted: Jan 12, 2016 6:20:22 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 24
Attachment A, 8. Confidentiality, Non-Disclosure and Injunctive Relieve c. Injunctive Relief. Please delete the word (acknowledges) and add "has been advised"
Contractor (acknowledges) "has been advised" that breach of this section, including disclosure of any Confidential Information, will cause irreparable injury to Purchasing Entity that is inadequately compensable in damages (Submitted: Jan 12, 2016 6:24:25 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 25
Attachment A 10. Defaults and Remedies. Please allow the addition of "by either party" in italics below. Both parties should be held accountable for nonperformance or material breach, as either party's lack of performance or breach would impact the other party's performance
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 300
#2..
- 344 -
Offerorâ€s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 25
Attachment A 10. Defaults and Remedies. Please allow the addition of "by either party" in italics below. Both parties should be held accountable for nonperformance or material breach, as either party's lack of performance or breach would impact the other party's performance.
(1) Nonperformance "by either party" of contractual requirements; or (2) A material breach "by either party" of any term or condition of this Master Agreement; or (Submitted: Jan 12, 2016 6:34:46 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 26
Attachment A-12. Force Majeure. Please insert the language in parenthesis as entities should continue to pay for goods or services that have been delivered prior to the Force Majeure event.

12. Force Majeure : Neither party shall be in default by reason of any failure in performance of this Contract (except for a failure to pay for goods or services delivered prior to the occurrence of a force majeure event) in accordance with reasonable control and without fault or negligence on their part. (Submitted: Jan 12, 2016 6:43:24 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 27
Attachment A. 13. Indemnification, Paragraph B. Please add language in parenthesis as vendors cannot indemnify Intellectual property for other 3rd party manufacturers products if that third party manufacturer does not provide that level of indemnification.

The Contractor shall defend, indemnify and hold harmless NASPO, NASPO ValuePoint, the Lead State, Participating Entities, Purchasing Entities, along with their officers, agents, and employees as well as any person or entity for which they may be liable ("Indemnified Party"), from and against claims, damages or causes of action including reasonable attorneysâ€™ fees and related costs arising out of the claim that the Product or its use, infringes Intellectual Property rights ("Intellectual Property Claim") of another person or entity" if and to the extent that the respective manufacturers of the Product provide such indemnification to end users thereof." (Submitted: Jan 12, 2016 6:45:56 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 28
Attachment A. 16-Insurance-Please allow claims based and allow additional language that if such policies were to be cancelled prior to the expiration of the contract, that tail coverage would be purchased and maintained for at least a three (3) year minimum. Contractor also agrees that it shall be solely responsible for any self-insured retention or deductibles maintained on any of the polices referenced in this section.

Section 1) Please allow Contractors to add that they agree that insurance limiters may be satisfied using any combination of underyling and excess/umbrella policies.

Regarding cancellation, please allow standard cancellation language that provides for the insurance broker to notify Purchasing of any changes in accordance with insurance provisions-not the Vendor. (Submitted: Jan 12, 2016 6:52:21 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 29
Attachment A- 22. Data Access Controls. Please add language in italics as vendors would have to share information without purchasing's express written consent if required to share the information by law. "Unless required by law", Contractor may not share a Purchasing Entityâ€™s Data with its parent corporation, other affiliates, or any other third party without the Purchasing Entityâ€™s express written consent. (Submitted: Jan 12, 2016 6:54:00 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, State of Utah Bid CH16012
3/22/2016 4:23 PM p. 301
#2..
- 345 -
information without purchasings express written consent if required to share the information by law. "Unless required by law", Contractor may not share a Purchasing Entityâ€™s Data with its parent corporation, other affiliates, or any other third party without the Purchasing Entityâ€™s express written consent. (Submitted: Jan 12, 2016 6:54:00 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 30
Attachment A. 25. Purchasing Entity Data Please add language in parenthesis as many corporations utilize third party legal counsel and accounting firms for which they would need to disclose information.

No information regarding Purchasing Entityâ€™s use of the Service may be disclosed, provided, rented or sold to any third party (with the exception of Contractorâ €™s legal counsel and accountants) for any reason unless required by law or regulation or by an order of a court of competent jurisdiction. The obligation shall extend beyond the term of this Master Agreement in perpetuity. (Submitted: Jan 12, 2016 7:00:47 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 31
Attachment A-26. Records and Administration and Audit. a.

Please allow vendors to provide "copies" of our books instead of our actual books, as vendors would need to keep their original files. In addition, please change the right to audit from six (6) years to two (2 ) years as we believe that this is sufficient time and more reasonable. (Submitted: Jan 12, 2016 7:03:12 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 32
Attachment A-26. Records and Administration and Audit. Would you allow the addition of a paragraph e. at the end of the audit section as it clarifies what a vendor may have examined during an audit , the time, costs, etc. e. Any audit or inspection authorized by this Master Agreement shall be limited to copies of records in the possession or control of Contractor in order to determine Contractorâ€™s compliance with the terms and conditions hereunder, and only to the extent such records solely and directly relate to Contractorâ€™s performance under this Master Agreement. The cost of any such audit or inspection shall be at the sole expense of the Lead State, Participating Entity, or Purchasing Entity, and shall be conducted at the Contractor location(s) where such records are maintained. All Contractor information shall be considered confidential. Audits may be conducted no more than once per year, upon reasonable written notice to Contractor, during Contractorâ€™s normal business hours, with minimal business disruption to Contractor. (Submitted: Jan 12, 2016 7:21:42 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 33
Attachment A. 28. System Failure and Damage- Please allow vendors to add language in italics below as efforts need to be defined.

28. System Failure or Damage: In the event of system failure or damage caused by Contractor or its Services, the Contractor agrees to use its "commercially reasonable" best efforts to restore or assist in restoring the system to operational capacity (Submitted: Jan 12, 2016 7:23:00 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 34
Attachment A-31-Warranty Please delete e and f and add the paragraph below as vendors may be utilizing third party software.
" Contractorâ€™s sole liability (and Lead Stateâ€™s, Purchasing Entityâ€™s and Participating Entityâ€™s exclusive remedy) for any warranty claim shall be for Contractor to re-perform the deficient Services, or, if Contractor fails to remedy such deficiency within thirty (30) days of notice of a claim, to void the invoice for the deficient Services. Contractor shall have no obligation with respect to a warranty claim (i) if notified of such claim more than thirty (30) days after the Services in question were first performed or (ii) if the claim is the result of thirdparty hardware or software failures, or the actions of Lead State, Purchasing Entity or Participating Entity, or a third State of Utah Bid CH16012
3/22/2016 4:23 PM p. 302
#2..
- 346 -
party software.
" Contractorâ€™s sole liability (and Lead Stateâ€™s, Purchasing Entityâ€™s and Participating Entityâ€™s exclusive remedy) for any warranty claim shall be for Contractor to re-perform the deficient Services, or, if Contractor fails to remedy such deficiency within thirty (30) days of notice of a claim, to void the invoice for the deficient Services. Contractor shall have no obligation with respect to a warranty claim (i) if notified of such claim more than thirty (30) days after the Services in question were first performed or (ii) if the claim is the result of thirdparty hardware or software failures, or the actions of Lead State, Purchasing Entity or Participating Entity, or a third party.
(b) THIS SECTION 31 SETS FORTH THE ONLY WARRANTIES MADE BY CONTRACTOR. CONTRACTOR

HEREBY DISCLAIMS ALL OTHER OTHER WARRANTIES, CONDITIONS OR UNDERTAKINGS, EXPRESS OR

IMPLIED, STATUTORY OR OTHERWISE, INCLUDING, BUT NOT LIMITED TO, THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. ALL SOFTWARE

AND HARDWARE PROVIDED OR INSTALLED BY CONTRACTOR ARE SUBJECT EXCLUSIVELY TO THE RESPECTIVE MANUFACTURERS WARRANTY. " (Submitted: Jan 12, 2016 7:25:05 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 35
Attachment A-Terms and Conditions 43-Entire Agreement. Please allow deletion of language in parenthesis below as suppliers utilizing third party software cannot alter the terms and conditions of the software.

This Master Agreement, along with any attachment, contains the entire understanding of the parties hereto with respect to the Master Agreement unless a term is modified in a Participating Addendum with a Participating Entity. (Delete-No click-through, or other end user terms and conditions or agreements required by the Contractor (â€œAdditional Termsâ€ ) provided with any Services hereunder shall be binding on Participating Entities or Purchasing Entities, even if use of such Services requires an affirmative â€œacceptanceâ€ of those Additional Terms before access is permitted.) (Submitted: Jan 12, 2016 7:35:06 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 36
Attachment A-43. Entire agreement-Please allow the additional paragraph to this section in italics below as this defines the liability of the Contractor.
" ADD- LIMITATION OF LIABILITY. (A) CONTRACTOR SHALL NOT BE LIABLE TO THE LEAD STATE,

PURCHASING ENTITY OR PARTICIPATING ENTITY FOR ANY INDIRECT, INCIDENTAL, SPECIAL OR

CONSEQUENTIAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR INTERRUPTION OF

SERVICES, LOSS OF BUSINESS, LOSS OF PROFITS, LOSS OF REVENUE, LOSS OF DATA, OR LOSS OR

INCREASED EXPENSE OF USE), WHETHER IN AN ACTION IN CONTRACT, WARRANTY, TORT (INCLUDING,

WITHOUT LIMITATION, NEGLIGENCE), OR STRICT LIABILITY, EVEN IF CONTRACTOR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH LIABILITIES. CONTRACTOR SHALL NOT BE RESPONSIBLE FOR PROBLEMS THAT OCCUR AS A RESULT OF THE USE OF ANY THIRD-PARTY SOFTWARE OR HARDWARE. (B) EXCEPT FOR GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, CONTRACTORâ€™S TOTAL LIABILITY TO THE LEAD

STATE, PURCHASING ENTITY AND PARTICIPATING ENTITY ARISING OUT OF SERVICES PERFORMED

UNDER THIS MASTER AGREEMENT, REGARDLESS OF THE LEGAL THEORY UPON WHICH SUCH LIABILITY

MAY BE BASED, SHALL NOT EXCEED IN THE AGGREGATE THE TOTAL PAYMENTS MADE BY LEAD STATE,

PURCHASING ENTITY OR PARTICIPATING ENTITY TO CONTRACTOR FOR THE SERVICES IN QUESTION IN THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE FIRST OCCURRENCE OF THE EVENT GIVING RISE TO SUCH LIABILITY." (Submitted: Jan 12, 2016 7:36:51 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 37
Exhibit 1 (Saas) 7. Termination and Suspension of Service- Please clarify that "purchasing entity" should be capitalized in the section. (Submitted: Jan 12, 2016 8:51:57 AM MST) Answer
- Correct the purchasing entity should be capitalized in this section. (Answered: Jan 12, 2016 2:26:19 PM MST) Question 38
Exhibit 1 (SaaS) 18. Right to Remove Individuals-Please add language in quotation marks and delete language in parenthesis. Reasonable judgement and reasoning should be used in a request to remove an individual from a project, and any removal should be subject to applicable law.

18. Right to Remove Individuals: "Add-Subject to Applicable Law the" (Delete-The ) Purchasing Entity shall have the right at any time to (delete require) "add- request" that the Contractor remove from interaction with Purchasing Entity any Contractor representative who the Purchasing Entity "add-reasonably" believes is detrimental to its working relationship with the Contractor. (Submitted: Jan 12, 2016 8:55:55 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 39
Exhibit 1, (SaaS) 20. Compliance with Accessibility Standards-Please add language in quotation marks as most accessibility standards would apply to the equipment being utilized such as the computer and not the software.

The Contractor shall comply, with and adhere to Accessibility Standards of Section 508 Amendment to the Rehabilitation Act of 1973, or any other state laws or administrative regulations identified by the Participating Entity" Add- if they are applicable to the software or material provided. " (Submitted: Jan 12, 2016 8:57:41 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 40
Exhibit 1 (SaaS) 23. Subscription Services-Please add language in quotation marks. The Click T&C's of software should govern. Vendors utilizing third party software do not have the right to waive click T&C's. (i) access and use the Service for its business purposes; (ii) for SaaS, use underlying software as embodied or used in the Service; and (iii) view, copy, upload and download (where applicable), and use Contractorâ€™s documentation. No Contractor terms, including standard click through license or website terms or use of privacy policy, shall apply to Purchasing Entities unless such terms are included in this Master Agreement. "AddSubscription terms are limited and governed by the terms of the manufacturerâ€™s software license as provide in the RFP response. " (Submitted: Jan 12, 2016 8:59:51 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 41
Exhibit 2-(PaaS) 5.c. Breach Responsibilities -Please add language in quotation marks and delete language in parenthesis. Costs should be limited to that which is reasonable to move than just the Purchasing Entity. c. Unless otherwise stipulated, if a Data Breach is a direct result of Contractorâ€™s breach of its contractual obligation to encrypt Personal Data or otherwise prevent its release (Delete- as reasonably determined by the Purchasing Entity) the Contractor shall bear the "add-reasonable" costs associated with (1) the investigation and resolution of the data breach; (Submitted: Jan 12, 2016 9:02:20 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 42
Exhibit 2 (PaaS) 19. Compliance with Accessibility Standards-Please add language in quotation marks as most accessibility standards would apply to the equipment being utilized, not the software.

No Contractor terms, including standard click through license or website terms or use of privacy policy, shall apply to Purchasing Entities unless such terms are included in this Master Agreement . "Add-Subscription terms are limited and governed by the terms of the manufacturerâ€™s software license as provide in the RFP response. " (Submitted: Jan 12, 2016 9:07:38 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 44
Exhibit 1 (Saas) and Exhibit 3 (IaaS) 4. Security Incident or Data Breach Notification b and c.

We believe that this should say "unreasonable" instead of "reasonable". Please confirm and correct. b. Security Incident Reporting Requirements: The Contractor shall report a security incident to the Purchasing Entity identified contact immediately as soon as possible or promptly without out "Add-un"reasonable delay, or as defined in the SLA. (Submitted: Jan 12, 2016 9:10:46 AM MST) Answer
- Correct. The should be "unreasonable delay". It will be changed in the final RFP document. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 45
Exhibit 1 (SaaS) and 3 (IaaS) 5. c. Breach Responsibilities-Please delete language in parenthesis and add language in quotation marks. Cost should be limited to that which is reasonable to more than just the Purchasing Entity.
c. Unless otherwise stipulated, if a Data Breach is a direct result of Contractorâ€™s breach of its contractual obligation to encrypt Personal Data or otherwise prevent its (Delete- release as reasonably determined by the Purchasing Entity) the Contractor shall bear the "Add-reasonable" costs associated with (1) the investigation and resolution of the data breach; (Submitted: Jan 12, 2016 9:31:38 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 46
Exhbiti 1 (Saas) and 3 (Iaas) 19-Subscription terms.

Please clarify that this paragraph allows vendors to submit the click terms and conditions of software, and that these terms will become a part of the Master Agreement.

Exhibit 1 and 3-to Master Agreement Item 19- No Contractor terms, including standard click through license or website terms or use of privacy policy, shall apply to Purchasing Entities unless such terms are included in this Master Agreement . (Submitted: Jan 12, 2016 9:36:13 AM MST) Answer
- If an offeror has click through agreements or additional terms and conditions then it must attach them to its proposal. The agreement or additional terms and conditions will be negotiated and , if awarded a contract, will become a part of the final Master Agreement for that offeror.

This term is to prevent offerors from requiring purchasing entities to agree to click through agreements before using an offeror's service even though a Master Agreement and Participating Addendum have been signed. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 47
Exhibit 1 (SaaS), 2 (PaaS) and 3 (IaaS) 2. Data Protection a. Please allow additional language in quotation marks as vendor can only maintain security measures within their own organization.

2. a. The Contractor shall implement and maintain appropriate administrative, technical and organizational security measures "Add- within its own organization" to safeguard against unauthorized access, ... (Submitted: Jan 12, 2016 9:38:14 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 48
Exhibit 1 (Saas), 2 (Paas) and 3 (Iaas) 2. Data Protection e and f.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 305
#2..
- 349 -
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 48
Exhibit 1 (Saas), 2 (Paas) and 3 (Iaas) 2. Data Protection e and f.

Add language in quotation marks as data should be limited to what is intended for the exclusive use of the Purchasing Entity and exclusively in connection with the Master Agreement e. At no time shall any data or processes â€” that either belong to or are intended for the "Add- exclusive" use of a Purchasing Entity or its officers, agents or employees â€” be copied, disclosed or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the Purchasing Entity. f. The Contractor shall not use any information collected "Add-exclusively" in connection with the Services issued from this Master Agreement for any purpose other than fulfilling the Services. (Submitted: Jan 12, 2016 9:40:04 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 49
Exhibit 1 (Saas), 2 ((Paas) and 3 (Iaas) 3. Background Checks Add language in quotation marks as background check should be subject to applicable law8. Background Checks : Upon the request of the Purchasing Entity "ADD-and subject to applicable law," the Contractor shall conduct criminal background checks and not utilize any staff, including subcontractors, (Submitted:

Jan 12, 2016 9:41:22 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 50
Exhbiti 1, (Saas) 2 (Paas) and 3 (Iaas) 10. Contract Audit Please add language in quotation marks as notice should be reasonable and be performed during a Contractors normal working hours. Delete language in parenthesis.

Add language in blue as notice should be reasonable and be performed during a contractors normal working hours. , delete language in red-10.

Contract Audit: (Delete-The) "ADD-Upon reasonable written notice to the" Contractor, the Contractor shall allow the Purchasing Entity to audit conformance to the Master Agreement terms. The Purchasing Entity may perform this audit or contract with a third party at its discretion and at the Purchasing Entityâ€™s expense "ADD- during Contractorâ€™s normal business hours with minimum business disruption to Contractor. All audits shall be limited to records in the possession or control of Contractor that solely and directly relate to Contractorâ€™s performance under the Master Agreement and shall be treated by Purchasing Entity as confidential." (Submitted:

Jan 12, 2016 9:45:32 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 51
Exhibits 1 (Saas) 2, (Paas) and 3 (Iaas) 15. Import and Export of Data-Please clarify that "Contractors" should not be capitalized. (Submitted: Jan 12, 2016 9:46:48 AM MST) Answer
- Yes contractors should not be capitalized. (Answered: Jan 12, 2016 2:26:19 PM MST) Question 52
RFP Section 5.5.14- Please clarify that click through agreements and terms of use of respective manufacturers of the hardware and software products that encompass the proposed Cloud solution may be attached to a vendor's offer, and will be made a part of the Master Agreement. (Submitted: Jan 12, 2016 9:48:23 AM MST) Answer
- If an offeror has click through agreements or additional terms and conditions then it must attach them to its proposal. The agreement or additional terms and conditions will be negotiated and , if awarded a contract, will become a part of the final Master Agreement for that offeror. (Answered: Jan 12, 2016 2:26:19 PM MST) Question 53
RFP Section 3.12, paragraph 1 and RFP Section 5.1 call for a completed and signed RFP page which is to be provided by the Lead State as an attachment in BidSync.

This document is currently provided as a .htm file and also appears in the Packet_for_Bid with significant white space splitting the pagesCan the Lead State provide this a a printfriendly PDF and/or as an official standard State of Utah Bid CH16012
3/22/2016 4:23 PM p. 306
#2..
- 350 -
proposal. The agreement or additional terms and conditions will be negotiated and , if awarded a contract, will become a part of the final Master Agreement for that offeror. (Answered: Jan 12, 2016 2:26:19 PM MST) Question 53
RFP Section 3.12, paragraph 1 and RFP Section 5.1 call for a completed and signed RFP page which is to be provided by the Lead State as an attachment in BidSync.

This document is currently provided as a .htm file and also appears in the Packet_for_Bid with significant white space splitting the pages. Can the Lead State provide this a a print-friendly PDF and/or as an official standard form for us to complete and sign? (Submitted: Jan 12, 2016 1:47:50 PM MST) Answer
- This file will be uploaded as a separate document by 1/13/2016. (Answered: Jan 12, 2016 3:00:37 PM MST) Question 54
Per RFP 5.2.8, we are to provide a statement of proposal validity for 180 days from the â€œproposal opening date.â€ Does this mean the date the RFP was released or the date the Government opens proposal packages for evaluation? (Submitted: Jan 13, 2016 9:40:53 AM MST) Answer
- It means the date the government opens the proposals, which will be the closing date of the solicitation. (Answered: Jan 13, 2016 12:28:55 PM MST)
Question 55
RFP Section 1.1.1
Can state confirm that OEMs can use resellers as fulfillment partners to issue quotes, receive orders, and take payments directly from the customer?
Also, in addition to OEMâ€™s own cloud service offerings, can an OEM also offer separate value-added cloud service offerings of its authorized resellers, which may not otherwise be available on the OEMâ€™s price list? (Submitted: Jan 13, 2016 2:04:33 PM MST)
Answer
- OEMs can use resellers as fulfillment partners.

OEMs may only provide value-added services that have been included in the contract. (Answered: Jan 21, 2016 4:24:21 PM MST)
Question 56
RFP Section 3.16 â€“ As an OEM, we plan to use resellers if we are awarded this contract. Therefore, could such resellers use their Service Provider Identification Number or â€œSPINâ€ numbers in processing E-Rate orders? (Submitted: Jan 13, 2016 2:07:11 PM MST)
Answer
- Yes. (Answered: Jan 14, 2016 12:39:31 PM MST)
Question 57
Section 5.5.8
Section states "Offeror must at a minimum complete, provide, and maintain a completed a Level 1 CSA STAR Registry Self-Assessment and submit a copy under this RFP. Offeror must represent and warrant that it will keep this CSA Star Self-Assessment current on an annual basis and must be provide it to a Purchasing Entity when requested. Offeror must also represent and warrant the accuracy and currency of the information on the completed CSA Star Self-Assessment Form."
This appears contradicted by 8.13.a: "Level 1 CSA STAR Registry Self-Assessment complete an available through CSA STAR, as required by Mandatory Minimum 4.1.9."
Must the self assessment be uploaded to CSA STAR?. 5.5.8 implies that that is not necessary. (Submitted: Jan 13, 2016 2:10:22 PM MST)
Answer
- No the assessment does not need to be uploaded to CSA Star. The completed document needs to be attached to an Offeror's proposal. (Answered: Jan 25, 2016 2:23:05 PM MST) Question 58
Section 5.5.12
States that "Offeror, as part of its proposal, must provide a sample of its Service Level Agreement (SLA) that contains at a minimum, the terms described in Section 8.13 of the RFP" Section 8.13 describes the CSA STAR Assessment not SLA terms. What section should be referenced? (Submitted: Jan 13, 2016 2:11:49 PM MST)
Answer
- The section that should be referenced is 8.12. This change will be made in the final RFP document. (Answered:

Jan 14, 2016 12:39:31 PM MST)
Question 59
Section 8.1.1
Offerors are instructed to "Keep responses brief and to the point of how the service meets the requirement, within the indicated page limit."
Where is the indicated page limit stated? (Submitted: Jan 13, 2016 2:12:40 PM MST) Answer
- There is no page limit to this solicitation; however, Offerors are strongly encouraged to keep responses concise. (Answered: Jan 14, 2016 12:39:31 PM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 307
#2..
- 351 -
Section 8.1.1
Offerors are instructed to "Keep responses brief and to the point of how the service meets the requirement, within the indicated page limit."
Where is the indicated page limit stated? (Submitted: Jan 13, 2016 2:12:40 PM MST) Answer
- There is no page limit to this solicitation; however, Offerors are strongly encouraged to keep responses concise. (Answered: Jan 14, 2016 12:39:31 PM MST)
Question 60
Section 8.1.3
States "Offeror must identify for each service category(ies) the areas that each service category. For example if an Offeror provides a SaaS offering then it should be divided into education SaaS offerings, e-procurement SaaS offerings, information SaaS offering, etc. "
Please clarify, especially the first sentence. (Submitted: Jan 13, 2016 2:13:53 PM MST) Answer
- It should state that "Offeror must identify for each service category(ies) the subcategories for each service category."
If an Offeror provides SaaS services then it should provide a list of the subcategories within the SaaS category so that participating entities are aware of an offeror's services. (Answered: Jan 25, 2016 2:23:05 PM MST) Question 61
Section 8.16.5
"Ability to apply participating entity defined administration polices in managing solution" Please define which policies are relevant to solution management. (Submitted: Jan 13, 2016 2:14:52 PM MST) Answer
- 8.16.5 is modified as follows: "8.16.5 Ability to apply a participating entity's defined administration polices in managing a solution." (Answered: Jan 14, 2016 12:39:31 PM MST) Question 62

1. RFP, The General Provisions, paragraph 10. SALES TAX ID NUMBER (page 8 of the published 301 page RFP) states that it â€œrequires anyone filing a proposal with the state for the sale of tangible personal property or any other taxable transaction under UCA 59-12-103(1) to include their Utah sales tax license number with their proposal.â€ We have spoken with the Utah Tax Commission and they are unable to advise whether or not Cloud Solutions sales require a Utah Sales Tax ID Number. They suggested we ask NASPO ValuePoint for clarification. Our question: Do all Offerors have to obtain a Utah Sales Tax ID Number in order to be eligible to submit a proposal?

2. RFP, Master Agreement Terms and Conditions, Section 16. Insurance:
â€¢ What is the minimum insurance coverage for Data Breach and Privacy/Cyber Liability? â€¢ What are the â€œlow,â€ â€œmedium,â€ and â€œhighâ€ designations for Crime Insurance. What is meant by Crime Insurance? Please clarify what the different limits are for. â€¢ Can our Professional Liability and Cyber/Tech E&O policy be written on a claims-made basis? (Submitted: Jan 13, 2016 9:02:31 PM MST)
Answer
- 1. No. Offerors do not need to submit a Utah Sales Tax ID number to be eligible to submit a proposal. (Answered:

Jan 21, 2016 4:24:21 PM MST)
- 2. Crime insurance has been removed from Attachment A. The minimum insurance requirements are listed in Section 16 of the Master Agreement Terms and Conditions.

If an Offeror requests that the insurance be made on a claims-made basis then it need to take exception to the Master Agreement Terms and Conditions as described in the RFP document.

Low, Moderate, and High are defined as:

Low Risk Data is as defined in FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems (â€œLow Impact Dataâ€ ).

Moderate Risk Data is as defined in FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems (â€œModerate Impact Dataâ€ ).

High Risk Data is as defined in FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems (â€œHigh Impact Dataâ€ ). (Answered: Jan 27, 2016 11:46:12 AM MST) Question 63

3. Cloud Service Types â€“ SaaS, IaaS, and PaaS. Is it permissible to bid on just one or two of these? Please confirm that Vendors are not required to submit all three?

4. RFP Section 4.3. Evaluation Process. Will each Cloud Service Type (SaaS, IaaS, and PaaS) be reviewed separately and graded on the 1375 point scale, or would all submittals combined be subject to a maximum technical proposal review of 1375 points?

5. RFP Section 3.1.1. Electronically Submitted Proposals â€“ Paragraph two states â€œAll attachments shall be submitted in a format acceptable to the Lead State. Acceptable formats include .doc (Microsoft Word Document), .xls (Microsoft excel spreadsheet), and .pdf (Adobe Acrobat portable document format). Will you also accept .docx format?

6. RFP Attachment B, Consensus Assessments Initiative Questionnaire (CAIQ), and Cloud Controls Matrix (CCM).

Please advise if Vendors should submit one or both of these for each Cloud Service Type (SaaS, IaaS, and PaaS) they are proposing. While we realize these are optional submittals, should one be prepared for each IaaS, Saas, PaaS that an Offeror submits?

7. Does the entire Q&A period end on January 29, 2016 at 12:00 p.m. MST? If so, please confirm that the deadline State of Utah Bid CH16012
3/22/2016 4:23 PM p. 308
#2..
- 352 -
submitted in a format acceptable to the Lead State. Acceptable formats include .doc (Microsoft Word Document), .xls (Microsoft excel spreadsheet), and .pdf (Adobe Acrobat portable document format). Will you also accept .docx format?

6. RFP Attachment B, Consensus Assessments Initiative Questionnaire (CAIQ), and Cloud Controls Matrix (CCM).

7. Does the entire Q&A period end on January 29, 2016 at 12:00 p.m. MST? If so, please confirm that the deadline for all questions to be answered is therefore also January 29, 2016 at 12:00 p.m. MST. If so, what is the last date/time that questions can be posted prior to the end of the Q&A Period? (Submitted: Jan 13, 2016 9:02:50 PM MST) Answer
- 7. The Q&A Period will end on January 29, 2016 at 12:00pm. However, the answering of questions may be posted after that deadline because some questions may be coming in on January 29, 2016 at 11:59. The State of Utah will to the best of its ability answer questions quickly. (Answered: Jan 14, 2016 12:39:31 PM MST) - 3. Offerors are not required to submit on all three. However, an Offerors proposal must be clear which Cloud Service Types it offers.

4. All submittals will be combined and be subject to a maximum technical proposal review of 1375.

5. Yes. .docx type is acceptable. (Answered: Jan 21, 2016 4:24:21 PM MST) - 6. The final RFP documents request that both documents be completed. And that only one be completed for both, but that it has enough detail to cover all of an Offeror's proposed services. (Answered: Jan 25, 2016 2:23:05 PM MST)
Question 64
1) Financial Requirements:

Section 6.3 on Financial of the RFP states:

Offeror must provide audited financial statements to the State and should meet a minimum Dun and Bradstreet (D&B) credit rating of 4A2 or better, or a recognized equivalent rating. Please provide the Respondentâ€™s D&B Number and the composite credit rating. The State reserves the right to verify this information. If a branch or wholly owned subsidiary is bidding on this RFP, please provide the D&B Number and score for the parent company that will be financially responsible for performance of the agreement.

Seeing as a credit rating 4A2 would require a minimum net worth of $10M, this does not seem applicable for a small business. The cloud community is comprised largely of small businesses in their infancy due to the newness of cloud technology. According to the State, what is an acceptable â€œrecognized equivalent ratingâ€ for a small business? (Submitted: Jan 14, 2016 8:23:14 AM MST) Answer
- The State has decided to modify the 4A2 to a 3A2 rating or the equivalent. (Answered: Jan 25, 2016 2:23:05 PM MST) Question 65
2) In your response to question #3 dated 12/31/2015, â€œIs it the intent of the State to exclude small businesses from this bid? The minimum D&B rating requirement is extremely exclusionary to small businesses and we would suggest that small businesses will offer the State the best opportunity for innovation in the fast moving cloud market.â€ the state wrote:
â€œThe participating states want some assurance that a vendor is financially stable and able to complete IT projects of this nature. States are putting significant amounts of tax payer dollars into a contractor to provide a solution. If a small business would like to participate on this effort and cannot qualify on their own, they may want to consider partnering with a larger firm in order to qualify.â€ However, section 5.7 of the RFP regarding the use of sub-contractors states that â€œAny Subcontractor that an Offeror chooses to use in fulfilling the requirements of the RFP must also meet all Administrative, Business and Technical Requirements of the RFP, as applicable to the Services provided.â€ Is it the intent of ValuePoint to remove the 4A2 requirement for subcontractors so that small businesses are able to qualify as stated in the answer above? (Submitted: Jan 14, 2016 8:23:30 AM MST)
Answer
- Yes. An Offerors' subcontractors do not need to comply with Section 4A2. (Answered: Jan 14, 2016 12:39:31 PM MST) Question 66
3) CSA â€“ As an authorized reseller and Advanced Consulting Partner, our company inherits the controls and security procedures from our IaaS provider. Are cloud brokers allowed to leverage the CSA from our cloud provider (ie, Amazon, Microsoft, Google, Softlayer, Virtustream) or do we need complete our own audit? (Submitted: Jan 14, 2016 8:23:46 AM MST)
Answer
- Yes. Cloud providers are able to leverage the CSA from their cloud providers. (Answered: Jan 14, 2016 12:39:31 PM MST)
Question 67
RFP Sections 8.12.4 and 8.12.5 appear to be unintentionally duplicated requirements. Please confirm. (Submitted: Jan 14, 2016 8:37:29 AM MST)
Answer
- RFP Section 8.12.5 has been deleted. It will be removed from the final version of the RFP. (Answered: Jan 14, 2016 12:39:31 PM MST)
Question 68
Question 62 and 63 are the upload of a total of 7 questions. Will these be answered separately? Do we need to State of Utah Bid CH16012
3/22/2016 4:23 PM p. 309
#2..
- 353 -
ppy pq
(Submitted: Jan 14, 2016 8:37:29 AM MST)
Answer
- RFP Section 8.12.5 has been deleted. It will be removed from the final version of the RFP. (Answered: Jan 14, 2016 12:39:31 PM MST)
Question 68
Question 62 and 63 are the upload of a total of 7 questions. Will these be answered separately? Do we need to re-upload each question as a separate upload in order to have each question answered? (Submitted: Jan 14, 2016 2:00:14 PM MST)
Answer
- The State will answer all of the questions in Questions 62 and 63 in the space provided for those questions.

Finance CommitteeApril 29, 2024

Finance Committee
April 29, 2024