Security & Trust at The Leadership Circle

Controls governing user access, authentication, and identity lifecycle management to ensure only authorized individuals can access systems and data.

• Access control
• Access rights
• Access to source code
• Authentication information
• Identity management
• Privileged access rights
• Secure authentication
• Segregation of duties

Controls for identifying, classifying, and managing information assets throughout their lifecycle, including proper handling and return procedures.

• Acceptable use of information and other associated assets
• Classification of information
• Inventory of information and other associated assets
• Labelling of information
• Return of assets
• Storage media

Controls ensuring critical business functions can continue during and after disruptions, including backup, recovery, and redundancy measures.

• ICT readiness for business continuity
• Information backup
• Information security during disruption
• Redundancy of information processing facilities

Controls addressing legal, regulatory, and contractual obligations, including independent security reviews and protection of intellectual property.

• Compliance with policies, rules and standards for information security
• Independent review of information security
• Intellectual property rights
• Legal, statutory, regulatory and contractual requirements
• Protection of records

Controls safeguarding data confidentiality and integrity through encryption, masking, secure transfer, and deletion practices.

• Data leakage prevention
• Data masking
• Information deletion
• Information transfer
• Privacy and protection of PII
• Use of cryptography

Controls protecting end-user devices and workstations from malware, unauthorized access, and data exposure.

• Clear desk and clear screen
• Protection against malware
• Security of assets off-premises
• User endpoint devices
• Web filtering

Controls establishing the organizational framework for information security, including roles, responsibilities, policies, and external engagement.

• Contact with authorities
• Contact with special interest groups
• Documented operating procedures
• Information security in project management
• Information security roles and responsibilities
• Management responsibilities
• Policies for information security
• Threat intelligence

Controls managing security throughout the employee lifecycle, from hiring through termination, including training and disciplinary processes.

• Confidentiality or non-disclosure agreements
• Disciplinary process
• Information security awareness, education and training
• Remote working
• Responsibilities after termination or change of employment
• Screening
• Terms and conditions of employment

Controls for detecting, reporting, responding to, and learning from security incidents, including evidence collection for investigations.

• Assessment and decision on information security events
• Collection of evidence
• Information security event reporting
• Information security incident management planning and preparation
• Learning from information security incidents
• Response to information security incidents

Controls capturing and analyzing system activities to detect anomalies, support investigations, and maintain audit trails.

• Clock synchronization
• Logging
• Monitoring activities

Controls protecting network infrastructure through segmentation, secure configurations, and defense-in-depth strategies.

• Network security
• Security of network services
• Segregation of networks

Controls embedding security into the software development lifecycle, including secure coding practices, testing, and environment separation.

• Application security requirements
• Outsourced development
• Protection of information systems during audit testing
• Secure coding
• Secure development life cycle
• Secure system architecture and engineering principles
• Security testing in development and acceptance
• Separation of development, testing and production environments
• Test information

Controls managing day-to-day IT operations, including capacity planning, change management, and vulnerability remediation.

• Capacity management
• Change management
• Configuration management
• Installation of software on operational systems
• Management of technical vulnerabilities
• Use of utility programs

Controls ensuring vendors, suppliers, and cloud providers meet security requirements and are monitored throughout the relationship.

• Addressing information security within supplier agreements
• Information security for use of cloud services
• Information security in supplier relationships
• Managing information security in the ICT supply chain
• Monitoring, review and change management of supplier services

Foundational policies establishing the security governance framework, risk management approach, and organizational accountability.

• Code of Business Conduct
• Compliance & Regulatory Monitoring
• Information Security & Privacy Governance
• Policy Management & Exception Handling
• Risk Management
• Sanctions & Disciplinary

Policies defining requirements for user access provisioning, authentication standards, and secure remote connectivity.

• Access Control & Least Privilege
• Authentication & Password
• Remote Access & BYOD

Policies governing how data is classified, handled, protected, shared, and disposed of throughout its lifecycle.

• Data Classification & Handling
• Encryption & Crypto Controls
• Information Sharing & Transfer
• Privacy & Data-Subject Rights
• Retention & Secure Disposal

Policies addressing personnel security, including acceptable behavior, background checks, and ongoing security awareness.

• Acceptable Use & Workstation Security
• Background Screening & On/Off-boarding
• Security & Privacy Awareness Training

Policies governing IT operations, including system hardening, change management, monitoring, and business continuity.

• Backup, Business Continuity & Disaster Recovery
• Change & Release Management
• Logging, Monitoring & Audit
• Physical Security & Environmental
• Secure Configuration & Hardening
• Vulnerability & Patch Management

Policies covering secure software development practices, incident response procedures, and third-party risk management.

• Incident Response & Breach Notification
• Secure Software Development Lifecycle
• Vendor & Third-Party Risk