compliance controls are associated with this Policy definition 'Document personnel acceptance of privacy requirements' (271a3e58-1b38-933d-74c9-a580006b80aa)
| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| FedRAMP_High_R4 |
PL-4 |
FedRAMP_High_R4_PL-4 |
FedRAMP High PL-4 |
Planning |
Rules Of Behavior |
Shared |
n/a |
The organization:
a. Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage;
b. Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system;
c. Reviews and updates the rules of behavior [Assignment: organization-defined frequency]; and d. Requires individuals who have signed a previous version of the rules of behavior to read and
resign when the rules of behavior are revised/updated.
Supplemental Guidance: This control enhancement applies to organizational users. Organizations consider rules of behavior based on individual user roles and responsibilities, differentiating, for example, between rules that apply to privileged users and rules that apply to general users. Establishing rules of behavior for some types of non-organizational users including, for example, individuals who simply receive data/information from federal information systems, is often not feasible given the large number of such users and the limited nature of their interactions with the systems. Rules of behavior for both organizational and non-organizational users can also be established in AC-8, System Use Notification. PL-4 b. (the signed acknowledgment portion of this control) may be satisfied by the security awareness training and role-based security training programs conducted by organizations if such training includes rules of behavior. Organizations can use electronic signatures for acknowledging rules of behavior. Related controls: AC-2, AC-6, AC-8, AC-9, AC-17, AC-18, AC-19, AC-20, AT-2, AT-3, CM-11, IA-2, IA-4, IA-5, MP-7, PS-6, PS-8, SA-5.
References: NIST Special Publication 800-18. |
link |
9 |
| FedRAMP_Moderate_R4 |
PL-4 |
FedRAMP_Moderate_R4_PL-4 |
FedRAMP Moderate PL-4 |
Planning |
Rules Of Behavior |
Shared |
n/a |
The organization:
a. Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage;
b. Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system;
c. Reviews and updates the rules of behavior [Assignment: organization-defined frequency]; and d. Requires individuals who have signed a previous version of the rules of behavior to read and
resign when the rules of behavior are revised/updated.
Supplemental Guidance: This control enhancement applies to organizational users. Organizations consider rules of behavior based on individual user roles and responsibilities, differentiating, for example, between rules that apply to privileged users and rules that apply to general users. Establishing rules of behavior for some types of non-organizational users including, for example, individuals who simply receive data/information from federal information systems, is often not feasible given the large number of such users and the limited nature of their interactions with the systems. Rules of behavior for both organizational and non-organizational users can also be established in AC-8, System Use Notification. PL-4 b. (the signed acknowledgment portion of this control) may be satisfied by the security awareness training and role-based security training programs conducted by organizations if such training includes rules of behavior. Organizations can use electronic signatures for acknowledging rules of behavior. Related controls: AC-2, AC-6, AC-8, AC-9, AC-17, AC-18, AC-19, AC-20, AT-2, AT-3, CM-11, IA-2, IA-4, IA-5, MP-7, PS-6, PS-8, SA-5.
References: NIST Special Publication 800-18. |
link |
9 |
| hipaa |
0104.02a1Organizational.12-02.a |
hipaa-0104.02a1Organizational.12-02.a |
0104.02a1Organizational.12-02.a |
01 Information Protection Program |
0104.02a1Organizational.12-02.a 02.01 Prior to Employment |
Shared |
n/a |
User security roles and responsibilities are clearly defined and communicated. |
|
14 |
| hipaa |
0109.02d1Organizational.4-02.d |
hipaa-0109.02d1Organizational.4-02.d |
0109.02d1Organizational.4-02.d |
01 Information Protection Program |
0109.02d1Organizational.4-02.d 02.03 During Employment |
Shared |
n/a |
Management ensures users are (i) briefed on their security role(s)/responsibilities, conform with the terms and conditions of employment prior to obtaining access to the organization’s information systems; (ii) provided with guidelines regarding the security expectations of their roles; (iii) motivated to comply with security policies; and, (iv) continue to have the appropriate skills and qualifications for their role(s). |
|
20 |
| hipaa |
0901.09s1Organizational.1-09.s |
hipaa-0901.09s1Organizational.1-09.s |
0901.09s1Organizational.1-09.s |
09 Transmission Protection |
0901.09s1Organizational.1-09.s 09.08 Exchange of Information |
Shared |
n/a |
The organization formally addresses multiple safeguards before allowing the use of information systems for information exchange. |
|
31 |
| hipaa |
1008.01d2System.3-01.d |
hipaa-1008.01d2System.3-01.d |
1008.01d2System.3-01.d |
10 Password Management |
1008.01d2System.3-01.d 01.02 Authorized Access to Information Systems |
Shared |
n/a |
Users sign a statement acknowledging their responsibility to keep passwords confidential. |
|
15 |
| hipaa |
1109.01b1System.479-01.b |
hipaa-1109.01b1System.479-01.b |
1109.01b1System.479-01.b |
11 Access Control |
1109.01b1System.479-01.b 01.02 Authorized Access to Information Systems |
Shared |
n/a |
User registration and deregistration, at a minimum: (i) communicates relevant policies to users and require acknowledgement (e.g., signed or captured electronically); (ii) checks authorization and minimum level of access necessary prior to granting access; (iii) ensures access is appropriate to the business needs (consistent with sensitivity/risk and does not violate segregation of duties requirements); (iv) addresses termination and transfer; (v) ensures default accounts are removed and/or renamed; (vi) removes or blocks critical access rights of users who have changed roles or jobs; and, (vii) automatically removes or disables inactive accounts. |
|
24 |
| hipaa |
1110.01b1System.5-01.b |
hipaa-1110.01b1System.5-01.b |
1110.01b1System.5-01.b |
11 Access Control |
1110.01b1System.5-01.b 01.02 Authorized Access to Information Systems |
Shared |
n/a |
Users are given a written statement of their access rights, which they are required to sign stating they understand the conditions of access. Guest/anonymous, shared/group, emergency and temporary accounts are specifically authorized and use monitored. |
|
11 |
| hipaa |
1137.06e1Organizational.1-06.e |
hipaa-1137.06e1Organizational.1-06.e |
1137.06e1Organizational.1-06.e |
11 Access Control |
1137.06e1Organizational.1-06.e 06.01 Compliance with Legal Requirements |
Shared |
n/a |
Acceptable use agreements are signed by all employees before being allowed access to information assets. |
|
8 |
| hipaa |
1201.06e1Organizational.2-06.e |
hipaa-1201.06e1Organizational.2-06.e |
1201.06e1Organizational.2-06.e |
12 Audit Logging & Monitoring |
1201.06e1Organizational.2-06.e 06.01 Compliance with Legal Requirements |
Shared |
n/a |
The organization provides notice that the employee's actions may be monitored, and that the employee consents to such monitoring. |
|
12 |
| hipaa |
1301.02e1Organizational.12-02.e |
hipaa-1301.02e1Organizational.12-02.e |
1301.02e1Organizational.12-02.e |
13 Education, Training and Awareness |
1301.02e1Organizational.12-02.e 02.03 During Employment |
Shared |
n/a |
Employees and contractors receive documented initial (as part of their onboarding within 60 days of hire), annual, and ongoing training on their roles related to security and privacy. |
|
17 |
| hipaa |
1302.02e2Organizational.134-02.e |
hipaa-1302.02e2Organizational.134-02.e |
1302.02e2Organizational.134-02.e |
13 Education, Training and Awareness |
1302.02e2Organizational.134-02.e 02.03 During Employment |
Shared |
n/a |
Dedicated security and privacy awareness training is developed as part of the organization's onboarding program, is documented and tracked, and includes the recognition and reporting of potential indicators of an insider threat. |
|
19 |
| hipaa |
1303.02e2Organizational.2-02.e |
hipaa-1303.02e2Organizational.2-02.e |
1303.02e2Organizational.2-02.e |
13 Education, Training and Awareness |
1303.02e2Organizational.2-02.e 02.03 During Employment |
Shared |
n/a |
Employees sign acceptance/acknowledgement of their security and privacy responsibilities. |
|
8 |
| hipaa |
1306.06e1Organizational.5-06.e |
hipaa-1306.06e1Organizational.5-06.e |
1306.06e1Organizational.5-06.e |
13 Education, Training and Awareness |
1306.06e1Organizational.5-06.e 06.01 Compliance with Legal Requirements |
Shared |
n/a |
Employees and contractors are informed in writing that violations of the security policies will result in sanctions or disciplinary action. |
|
11 |
| hipaa |
1307.07c1Organizational.124-07.c |
hipaa-1307.07c1Organizational.124-07.c |
1307.07c1Organizational.124-07.c |
13 Education, Training and Awareness |
1307.07c1Organizational.124-07.c 07.01 Responsibility for Assets |
Shared |
n/a |
The organization defines rules to describe user responsibilities and acceptable behavior for information system usage, including at a minimum, rules for email, Internet, mobile devices, social media and facility usage. |
|
9 |
| hipaa |
1308.09j1Organizational.5-09.j |
hipaa-1308.09j1Organizational.5-09.j |
1308.09j1Organizational.5-09.j |
13 Education, Training and Awareness |
1308.09j1Organizational.5-09.j 09.04 Protection Against Malicious and Mobile Code |
Shared |
n/a |
The organization prohibits users from installing unauthorized software, including data and software from external networks, and ensures users are made aware and trained on these requirements. |
|
12 |
| hipaa |
1324.07c1Organizational.3-07.c |
hipaa-1324.07c1Organizational.3-07.c |
1324.07c1Organizational.3-07.c |
13 Education, Training and Awareness |
1324.07c1Organizational.3-07.c 07.01 Responsibility for Assets |
Shared |
n/a |
Employees, contractors and third-party system users are aware of the limits existing for their use of the organization's information and assets associated with information processing facilities and resources; and they are responsible for their use of any information resource and of any use carried out under their responsibility. |
|
8 |
| hipaa |
1325.09s1Organizational.3-09.s |
hipaa-1325.09s1Organizational.3-09.s |
1325.09s1Organizational.3-09.s |
13 Education, Training and Awareness |
1325.09s1Organizational.3-09.s 09.08 Exchange of Information |
Shared |
n/a |
Personnel are appropriately trained on leading principles and practices for all types of information exchange (oral, paper and electronic). |
|
11 |
| ISO27001-2013 |
A.11.2.4 |
ISO27001-2013_A.11.2.4 |
ISO 27001:2013 A.11.2.4 |
Physical And Environmental Security |
Equipment maintenance |
Shared |
n/a |
Equipment shall be correctly maintained to ensure its continued availability and integrity. |
link |
9 |
| ISO27001-2013 |
A.13.2.2 |
ISO27001-2013_A.13.2.2 |
ISO 27001:2013 A.13.2.2 |
Communications Security |
Agreements on information transfer |
Shared |
n/a |
Agreements shall address the secure transfer of business information between the organization and external parties. |
link |
11 |
| ISO27001-2013 |
A.13.2.4 |
ISO27001-2013_A.13.2.4 |
ISO 27001:2013 A.13.2.4 |
Communications Security |
Confidentiality or non-disclosure agreements |
Shared |
n/a |
Requirements for confidentiality or non-disclosure agreements reflecting the organization's needs for the protection of information shall be identified, regularly reviewed and documented. |
link |
14 |
| ISO27001-2013 |
A.15.1.2 |
ISO27001-2013_A.15.1.2 |
ISO 27001:2013 A.15.1.2 |
Supplier Relationships |
Addressing security within supplier agreement |
Shared |
n/a |
All relevant information security requirements shall be established and agreed with each supplier that may access, process, store, communicate, or provide IT infrastructure components for, the organization's information. |
link |
24 |
| ISO27001-2013 |
A.7.1.2 |
ISO27001-2013_A.7.1.2 |
ISO 27001:2013 A.7.1.2 |
Human Resources Security |
Terms and conditions of employment |
Shared |
n/a |
The contractual agreements with employees and contractors shall state their and the organization's responsibilities for information security. |
link |
24 |
| ISO27001-2013 |
C.7.2.a |
ISO27001-2013_C.7.2.a |
ISO 27001:2013 C.7.2.a |
Support |
Competence |
Shared |
n/a |
The organization shall:
a) determine the necessary competence of person(s) doing work under its control that affects its
information security performance;
NOTE Applicable actions may include, for example: the provision of training to, the mentoring of, or the reassignment of current employees; or the hiring or contracting of competent persons. |
link |
3 |
|
mp.per.1 Job characterization |
mp.per.1 Job characterization |
404 not found |
|
|
|
n/a |
n/a |
|
41 |
|
mp.per.2 Duties and obligations |
mp.per.2 Duties and obligations |
404 not found |
|
|
|
n/a |
n/a |
|
40 |
|
mp.per.4 Training |
mp.per.4 Training |
404 not found |
|
|
|
n/a |
n/a |
|
14 |
|
mp.s.1 E-mail protection |
mp.s.1 E-mail protection |
404 not found |
|
|
|
n/a |
n/a |
|
48 |
| NIST_SP_800-53_R4 |
PL-4 |
NIST_SP_800-53_R4_PL-4 |
NIST SP 800-53 Rev. 4 PL-4 |
Planning |
Rules Of Behavior |
Shared |
n/a |
The organization:
a. Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage;
b. Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system;
c. Reviews and updates the rules of behavior [Assignment: organization-defined frequency]; and d. Requires individuals who have signed a previous version of the rules of behavior to read and
resign when the rules of behavior are revised/updated.
Supplemental Guidance: This control enhancement applies to organizational users. Organizations consider rules of behavior based on individual user roles and responsibilities, differentiating, for example, between rules that apply to privileged users and rules that apply to general users. Establishing rules of behavior for some types of non-organizational users including, for example, individuals who simply receive data/information from federal information systems, is often not feasible given the large number of such users and the limited nature of their interactions with the systems. Rules of behavior for both organizational and non-organizational users can also be established in AC-8, System Use Notification. PL-4 b. (the signed acknowledgment portion of this control) may be satisfied by the security awareness training and role-based security training programs conducted by organizations if such training includes rules of behavior. Organizations can use electronic signatures for acknowledging rules of behavior. Related controls: AC-2, AC-6, AC-8, AC-9, AC-17, AC-18, AC-19, AC-20, AT-2, AT-3, CM-11, IA-2, IA-4, IA-5, MP-7, PS-6, PS-8, SA-5.
References: NIST Special Publication 800-18. |
link |
9 |
| NIST_SP_800-53_R5 |
PL-4 |
NIST_SP_800-53_R5_PL-4 |
NIST SP 800-53 Rev. 5 PL-4 |
Planning |
Rules of Behavior |
Shared |
n/a |
a. Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy;
b. Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system;
c. Review and update the rules of behavior [Assignment: organization-defined frequency]; and
d. Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge [Selection (OneOrMore): [Assignment: organization-defined frequency] ;when the rules are revised or updated] . |
link |
9 |
|
op.exp.4 Security maintenance and updates |
op.exp.4 Security maintenance and updates |
404 not found |
|
|
|
n/a |
n/a |
|
78 |
|
op.ext.1 Contracting and service level agreements |
op.ext.1 Contracting and service level agreements |
404 not found |
|
|
|
n/a |
n/a |
|
35 |
|
op.mon.1 Intrusion detection |
op.mon.1 Intrusion detection |
404 not found |
|
|
|
n/a |
n/a |
|
50 |
|
op.nub.1 Cloud service protection |
op.nub.1 Cloud service protection |
404 not found |
|
|
|
n/a |
n/a |
|
33 |
|
op.pl.5 Certified components |
op.pl.5 Certified components |
404 not found |
|
|
|
n/a |
n/a |
|
26 |
|
org.3 Security procedures |
org.3 Security procedures |
404 not found |
|
|
|
n/a |
n/a |
|
83 |
| PCI_DSS_v4.0 |
12.6.3 |
PCI_DSS_v4.0_12.6.3 |
PCI DSS v4.0 12.6.3 |
Requirement 12: Support Information Security with Organizational Policies and Programs |
Security awareness education is an ongoing activity |
Shared |
n/a |
Personnel receive security awareness training as follows:
• Upon hire and at least once every 12 months.
• Multiple methods of communication are used.
• Personnel acknowledge at least once every 12 months that they have read and understood the information security policy and procedures. |
link |
8 |
| SOC_2 |
CC1.1 |
SOC_2_CC1.1 |
SOC 2 Type 2 CC1.1 |
Control Environment |
COSO Principle 1 |
Shared |
The customer is responsible for implementing this recommendation. |
Sets the Tone at the Top — The board of directors and management, at all levels,
demonstrate through their directives, actions, and behavior the importance of integrity and ethical values to support the functioning of the system of internal control.
• Establishes Standards of Conduct — The expectations of the board of directors and
senior management concerning integrity and ethical values are defined in the entity’s standards of conduct and understood at all levels of the entity and by outsourced service providers and business partners.
• Evaluates Adherence to Standards of Conduct — Processes are in place to evaluate
the performance of individuals and teams against the entity’s expected standards of
conduct.
• Addresses Deviations in a Timely Manner — Deviations from the entity’s expected
standards of conduct are identified and remedied in a timely and consistent manner |
|
8 |
| SOC_2 |
P2.1 |
SOC_2_P2.1 |
SOC 2 Type 2 P2.1 |
Additional Criteria For Privacy |
Privacy consent |
Shared |
The customer is responsible for implementing this recommendation. |
• Communicates to Data Subjects — Data subjects are informed (a) about the choices
available to them with respect to the collection, use, and disclosure of personal information
and (b) that implicit or explicit consent is required to collect, use, and
disclose personal information, unless a law or regulation specifically requires or allows
otherwise.
• Communicates Consequences of Denying or Withdrawing Consent — When personal
information is collected, data subjects are informed of the consequences of refusing
to provide personal information or denying or withdrawing consent to use
personal information for purposes identified in the notice.
• Obtains Implicit or Explicit Consent — Implicit or explicit consent is obtained from
data subjects at or before the time personal information is collected or soon there-after. The individual’s preferences expressed in his or her consent are confirmed
and implemented.
• Documents and Obtains Consent for New Purposes and Uses — If information that
was previously collected is to be used for purposes not previously identified in the
privacy notice, the new purpose is documented, the data subject is notified, and implicit
or explicit consent is obtained prior to such new use or purpose.
• Obtains Explicit Consent for Sensitive Information — Explicit consent is obtained
directly from the data subject when sensitive personal information is collected,
used, or disclosed, unless a law or regulation specifically requires otherwise.
• Obtains Consent for Data Transfers — Consent is obtained before personal information
is transferred to or from an individual’s computer or other similar device. |
|
4 |