3.1
Logical access & user account management
Access provisioning and de-provisioning, generic and privileged accounts, segregation of duties, periodic access reviews, password and session controls at application, OS and database level, default password changes, network access and remote access security.
3.2
Change management & environment segregation
Whether changes are categorised, prioritised, authorised, tested and implemented per procedure; segregation between who develops, who approves and who moves code to production; separated development, test and production environments; emergency change handling and roll-back.
3.3
System acquisition, development & implementation
SDLC methodology and its alignment with business requirements; controls over acquisition, development, configuration and implementation; requirements definition, design approval and secure coding; user acceptance testing, data migration and formal go-live authorisation.
3.4
IT environment protection
Malware detection coverage, settings and updating; patch installation across systems, operating systems and databases, tested by sample; firewall and intrusion prevention effectiveness; bandwidth management and capacity alignment.
3.5
Threat & vulnerability management
Periodic vulnerability assessment of systems, databases and network devices; tracking and remediation within defined timelines; consumption of threat intelligence and advisories; security event logging, correlation and monitoring coverage; alert review and escalation.
3.6
Security incident management & response
Documented policy, procedures and playbooks; detection, classification, escalation, containment and resolution; regulatory and stakeholder breach notification within required timelines; forensic readiness and evidence preservation; post-incident review and prior incident records.
3.7
Data processing & application controls
Input, processing and output controls; interface and reconciliation controls with external parties; error identification and handling; logging that establishes who, when, where and what for critical transactions; automated controls over the business lifecycle; master and standing data changes.
3.8
Fraud & AML/CFT system controls
Fraud prevention and detection across the customer lifecycle including identity verification; transaction monitoring rules, alerting and alert disposition; sanctions, watch-list and PEP screening configuration and list currency; case management and record-keeping.
3.9
Database management
Policies and procedures; performance monitoring, tested by sample; logical access for administrative and non-named users; encryption over data and backup media and key management arrangements; data classification enforcement; data and media disposal.
3.10
Data privacy & personal data protection
Framework alignment with data protection law; lawful collection, use, retention and disposal; consent management and data minimisation; data subject rights handling; cross-border transfer, third-party sharing and contractual safeguards with processors.
3.11
Records management & audit logging
Backup of systems, applications and records; retention and restoration; controls preventing unauthorised administrator access to logs or unauthorised log changes; logging of user access and errors; periodic supervisory review of logs and user activity.
3.12
Backup and recovery
Backup and restoration procedures and their business alignment; verification that data is actually recoverable, with restoration test records; offsite storage adequacy; media management against the classification policy; configuration, source code and database backup; replication to the recovery site.
3.13
High availability
Redundancy policies for main processing units and networks; communication channel redundancy; and an environment layout review to identify single points of failure.
3.14
IT service management
Service desk operations and incident logging, categorisation, prioritisation and resolution within agreed service levels; problem management including root cause analysis of recurring incidents; IT operations and job scheduling, batch monitoring and processing failure handling.
3.15
IT asset & configuration management
Completeness and accuracy of hardware and software inventories; the asset lifecycle from acquisition to disposal; secure baseline and hardening standards for operating systems, databases and network devices, and compliance monitoring against them; end-of-life and unsupported technology.
3.16
Digital channel, API & endpoint security
Authentication, session management and secure communication on customer-facing web and mobile channels; API and integration security including authentication, authorisation and input validation; endpoint and mobile device controls including anti-malware, hardening, encryption and device management.
3.17
Data center & physical security
Physical and environmental security policies; datacenter and alternate site location and disaster exposure; measures against theft, fire, water, power loss and other hazards; environmental controls including monitoring, detection, cooling and power; physical access authorisation, visitor logging and periodic reviews.
