Controls

Strategic governance of organizational risk and cybersecurity.

Comprehensive management of legal, regulatory and contractual obligations.

Independent internal and external cybersecurity audits.

Systematic management of findings, incidents and improvement opportunities.

Identity management and registration.

Strong authentication mechanisms.

Permissions and access control.

Complete identity lifecycle.

Endpoint asset management.

Endpoint protection and hardening.

CSP management and selection.

Cloud asset management.

Cloud network and system security.

Cloud encryption.

Cryptographic key lifecycle management.

Integrated, automated security in the SDLC.

Protection and secure management of APIs.

Structured management of system changes.

Change testing and validation.

Rollback and reversal of failed changes.

Ongoing information security training for all staff.

Security for employees working remotely or in hybrid mode.

Identification, classification and management of vendors and third parties.

Definition and management of security responsibilities with vendors.

Registration and classification of the organization's data inventory.

Identification and management of all points where data is collected.

Management of the complete data cycle from collection to deletion.

Protection of data confidentiality, integrity and availability.

Management of retention periods and deletion of personal data.

Data residency and compliance with geographic location requirements.

Security across the AI/ML model lifecycle and protection of training data.

Protection against malware and malicious applications.

Continuous management of the vulnerability lifecycle.

Log management and security event monitoring.

Security incident response and management.