InfoSec Controls

We have documented and deployed a comprehensive set of controls. A summary is presented in the following seven control groups.

Control Groups

Organizational Controls

Name	Description
Administrative Access Controls	Users with administrative access are approved and logged per SaaS Service or application.
Audit & Compliance Management	An audit management process is defined and implemented to support audit planning, risk analysis, security control assessments, conclusions, remediation schedules and report generation.
Audit Remediation	A risk-based corrective action plan to remediate audit findings has been established, documented, and approved. Internal and External Audit findings and remediation actions are reported to the relevant stakeholders.
External Audit Policy	External Audit policies and procedures are in place for ISO 27001 compliance and reviewed at least annually. External Audits occur at least once per year.
External Audit Policy	Information Security & Data Management policies and procedures, sponsored by the CEO are established, documented, approved, communicated, and reviewed at least annually.
InfoSec Role Assignments	The roles and responsibilities for planning, implementing, operating, assessing, and improving Information Security and Data Management processes are assigned.
Internal Audit Policy	Internal Audit policies and procedures are in place and reviewed at least annually. Internal Audits occur once per year.
Regular Policy Maintenance	All relevant organizational policies and associated procedures are reviewed at least annually.
Regulation & Legal Clarity	All the relevant standards, regulations, legal/contractual, and statutory requirements have been identified and documented.
Risk Management Policy	A formal, documented company-wide risk management Policy and procedure has been established and proactively maintained to manage company risks. The Policy is sponsored by the CEO.

Operational Controls

Name	Description
Backup Testing	Backups are tested at least annually to ensure the confidentiality, integrity, and availability of data.
Backups	Data is backed up daily to a remote location physically and logically separate from the original cloud source.
Business Continuity Policies	Effective Business continuity management and operational resilience policies and procedures have been established, documented, and approved in line with risk profiles. The policies and procedures are reviewed, updated and tested at least annually.
Change Management - Process	The risks associated with changing organizational assets (including applications, systems, infrastructure, configuration, etc.) are proactively managed and controlled throughout the change process.
Change Management - Organizational	Risk management policies, procedures and guidance are updated and communicated when any significant organizational change occurs.
Cyber Insurance	Effective Cyber Insurance to mitigate the financial impact of a data breach.
Disaster Recovery Planning	A disaster response plan has been established, documented and approved to ensure recovery from natural and man-made disasters. The response plan is reviewed and tested at least annually.
Exception Policy	A procedure has been implemented to manage policy and process exceptions, including within emergencies.
Operational Resilience	Operational resilience strategies and capability results are incorporated to establish, document and maintain a business continuity plan.
Quality Management	An internal assessment process is conducted every year to confirm the conformance and effectiveness of standards, policies, and procedures.
Security Breach Notification	Processes are in place to inform the relevant authorities or impacted customers within 48 hour of a security breach.
Security Incident Management	Policies and procedures for security incident management have been established, documented, and approved. They are reviewed and updated at least annually. The security incident response plan is tested and updated annually or upon significant organizational change.
Shared Security Model	A shared security responsibility model has been defined, showing the separation of responsibilities between cloud provider, other third parties, Strategic Blue and the customer.
Supply Chain List	An inventory of all supply chain relationships, services and risks has been developed. It is reviewed and updated on at least an annual basis.
Supply Chain Management	Contractual and legal responsibilities for data / information handling and security within the supply chain are defined within the relevant contracts.
Supply Chain Policy	A risk-based process has been established and documented for introducing and assessing new suppliers into the supply chain.

Application Controls

Name	Description
Access Reviews	User access reviews and re-validation for least privilege and separation of duties purposes is completed on at least an annual basis.
Administrative Authentication	Administrative authentication is controlled via an Authentication account, acting as a bastion authentication gateway.
Application Administrative Access	The processes and procedures for the segregation of privileged access roles has been defined and implemented to maintain the separation of duties for administrative users.
Application Log Alerts	A process has been established and implemented to review and take appropriate and timely actions on detected alerts and anomalies within log data.
Application Logging	A secure, separate log of all changes and data requests is kept for our applications, with appropriate authentication and date/time stamp information.
Application Patching	Application code is run on AWS serverless services which are automatically updated, patched and managed by AWS under their shared service model.
Application Security Baseline	Application baseline requirements are defined to secure different applications based on the sensitivity of the data they contain.
Application Security Policies	Application security policies and procedures are established, documented, and approved to guide appropriate delivery of our application security capabilities. Policies are reviewed at least annually.
Application Testing	Application and code testing is automated when applicable and possible.
Authentication Policies	Strong password policies and multi-factor authentication (MFA) has been established and deployed for all applications.
IAM Policies	Identity and access management policies and procedures have been established, documented, and approved. The policies and procedures are reviewed and updated at least annually.
Key Usage	Key lifecycle management events are logged and monitored to enable auditing and reporting on cryptographic keys' usage.
Key Management	Key are securely controlled and monitored within an AWS system mangere parameter store
Least Privilege Access	Least privilege principle has been employed when implementing information system access.
Password Management	Processes and procedures for the secure management of passwords have been defined and implemented.
Penetration Testing	Annual Penetration testing is used to review current Application & API security.
Roll-back	A process to proactively roll back changes to a previously known "good state" is defined and implemented in case of errors or security concerns.
Secure Application Deployment	Strategies and capabilities have been established and implemented to deploy application code in a secure, standardized, automated and compliant manner.
Secure Application Development	A secure software development lifecycle (SSDLC) process is defined and implemented.
Separation of Duties	The separation of duties principle has been employed when implementing information system access.
Unique User ID	Processes and procedures have been established and deployed to ensure that users are identifiable through unique identification within each application. Shared User IDs are not allowed.
User Provisioning & De-provisioning	A user access provisioning process has been defined and implemented which authorizes, records, and communicates data and assets access changes. The process to de-provision or modify access has also been defined and implemented.

Data Controls

Name	Description
Adopt Best Practice	Systems, products, and business practices based on security and privacy principles by design and according to industry best practices.
Data Classification	Policies and procedures have been established, documented and approved for the classification, protection, and handling of data throughout its lifecycle based on the data sensitivity and risk associated with the data.
Data Flow	Data flow documentation has been created to identify what data is processed and where it is stored and transmitted.
Data Inventory	A data inventory has been created and is maintained for sensitive and personal information.
Data Management Policies	Corporate Data Management Policies are established and deployed, enforced and endorsed by COO & CEO. Policies are reviewed on at least an annual basis.
Data Processing	Processes and procedures have been defined and implemented to ensure personal or sensitive data is processed in accordance with GDPR & applicable legislation.
Data Removal	Any Customer data ownership automatically reverts to the customer at the end of contract. Customer held data is held for the minimum required time for legal and regulatory compliance.
Data Security Review	Data security and privacy policies and procedures are reviewed and updated at least annually.
Encryption of Data	Customer-held data is encrypted. Data at-rest and in-transit are cryptographically protected using current standards (AES-256 & TLS 1.3).
Encryption Policies	Cryptography, encryption, and key management policies and procedures have been established, documented and approved. The Policies and procedures are reviewed and updated at least annually.
Environmental Control Policies	Production and non-production systems are maintained completely separately, with no copy of production data in non-production systems.
Key Deactivation	Processes and procedures to deactivate keys, where required, have been defined and implemented.
Key Rotation	All Cryptographic keys are rotated on a regular basis.
Non-production (Test) Data	No production data is used or held within non-production environments.

Technology Controls

Name	Description
Anti-malware	Anti-malware software is installed on end user devices to mitigate malware attacks. Signature updates are updated automatically.
Application Network Management	Virtual Private Clouds (VPC) and Access Control Lists (ACL) are used to secure information flows between virtually separate services.
Capacity Management	Cloud PaaS & SaaS platforms have an effectively unlimited capacity, so capacity planning is not required.
Default Passwords	All default passwords supplied with hardware or software are changed upon installation.
Device Encryption	Information is protected from unauthorized disclosure on managed endpoints via storage encryption.
Device Enforcement	Processes and procedures have been defined and implemented to enforce policies and controls for all endpoints permitted to access systems and/or store, transmit, or process organizational data.
Device Inventory	An inventory of all endpoints is used and maintained to store and to access company data.
Device Management	Universal endpoint management policies and procedures have been developed and enabled. MDM software is deployed. The policies are reviewed and updated at least annually.
Device Patching	Device endpoint operating systems and applications patch levels are set to auto-update.
Environment Management	There is no communication between the different environments.
Environment Policy	Production and non-production environments are fully separated and segregated.
EUC Policy	Policies and procedures to protect against malware on managed assets are established, documented, approved, and applied. Policies are reviewed at least annually.
Infrastructure Security	We use PaaS & SaaS platforms for our applications, transferring responsibility for network & server infrastructure and virtualization security to our cloud provider.
Insecure Applications Removed	Unsupported or insecure applications are removed from user devices.
Lock Screen	All relevant interactive-use endpoints are configured to require an automatic lock screen.
MDM Remote Wipe	Processes are defined and implemented to enable remote company data deletion on managed endpoint devices.
Software Firewalls	Software firewalls are installed and configured on managed endpoints.
Supply Chain Risk Management	Processes and procedures have been defined and implemented to identify and respond to third-party security threats or vulnerabilities, when informed by our supply chain.
Third-party Access	Processes, procedures and technical and/or contractual measures are defined and implemented to maintain proper security of third-party endpoints with access to organizational data & services.
Vulnerability Management	Policies and procedures have been established, documented and approved to identify, report, and prioritize the remediation of vulnerabilities to protect systems against vulnerability exploitation. Threat and vulnerability management policies and procedures are reviewed and updated at least annually.

Physical Controls

Name	Description
Data Centre Management	Physical management and security of data centres is managed by our cloud vendors, who hold the appropriate validated certification for this responsibility.
Office Security	Dedicated office space is leased from FORA, for meetings and joint working. No data is stored on-site. Physical and logical security is provided by FORA.
Physical Media	Policies and procedures for the secure use and transportation of physical media is established and documented. Physical media is to be used only in exceptional circumstances, via encrypted storage devices. Policies and procedures are reviewed at least annually.
Secure Disposal Laptops	Policies and procedures for the secure wipe and recycling of end user computing devices have been established, documented, approved, and applied.
Secure Disposal of DC Equipment	Secure disposal of data center equipment, including storage media, is managed by our cloud vendors, who hold the appropriate validated certification for this responsibility.

People Controls

Name	Description
Acceptable Use Policy	An Acceptable Use Policy (AUP) has been established, documented, approved and applied. All users sign the AUP. The AUP is reviewed and updated on at least an annual basis.
AI Acceptable Use Policy	A Generative AI Acceptable Use Policy has been established, documented, approved and applied. The AUP is reviewed and updated on at least an annual basis.
Background Checks	Background verification policies and procedures of all new employees have been established, documented, approved and applied. Verification is to UK Government baseline (BPSS) standard. Administrators are cleared to UK Government SC Clearance.
Controlled Change of Role	Policies and procedures for the changing of roles and responsibilities have been established, documented, approved, and applied. Staff are given appropriate system access for their role, authorised by the line manager and HR.
Controlled Offboarding	Policies and procedures for the secure return of company assets have been established, documented, approved, and applied. System access is promptly revoked once a member of staff leaves employment.
Controlled Onboarding	Policies and procedures for the secure deployment of company assets for new starters have been established, documented, approved, and applied. Staff are given appropriate system access for their role, authorised by the line manager and HR.
Remote Access & Storage	Policies and procedures to protect information accessed, processed, or stored at remote locations has been established, documented, approved, and applied. Data is primarily stored in cloud storage.
Security Awareness	A comprehensive security awareness training program for all employees has been established, documented, approved and applied. Regular security awareness updates are provided, at least once per year.
Staff Legal Provision	All employees are required to sign an employment agreement before gaining access to organizational information systems, resources, and assets. The contract includes adherence to established information and data governance policies, including a non-disclosure agreement.

Who it's for

How it works

Resources

About Strategic Blue

InfoSec Controls

Control Groups