I
I
IllumiDesk
Search…
Security and Compliance
Powered By GitBook
SG.1.01 - Policy and Standard Review

Control Statement

IllumiDesk's security policies and standards are reviewed, updated if required, approved by management, and communicated to authorized personnel annually.

Context

The purpose of this control is to ensure IllumiDesk's policies and procedures are kept up-to-date and relevant, changes are appropriately reviewed and approved, and IllumiDesk team members have a way to track those changes.
Due to the nature of how IllumiDesk operates and it's value of being iterative, continual updates are made to the related security policies and standards (as deemed necessary) that have been listed as in-scope for this control. Changes made to these procedures are always reviewed prior to being updated in IllumiDesk's handbook. Evidence of changes can be identified via the related handbook page's markdown file by visiting the Handbook Changelog.

Scope

All policies and standards having a direct impact to how IllumiDesk carries out it's IT/Security practices are in-scope for this control. Policies and standards impacting the broader organization have been determined to be entity level policies which are considered as part of the Entity Level Controls (ELC) documented within the Sarbanes-Oxley (SOX) Compliance Handbook page.
The specific policies and standards described in the Policy Reference section below are subject to this control.

Ownership

Control Owner:
    Security Compliance
Process Owner:
    Security

Guidance

Create process to have policies and standards reviewed and updated on a recurring, annual basis.

Additional control information and project tracking

Non-public information relating to this security control as well as links to the work associated with various phases of project work can be found in the Policy and Standard Review control issue.

Policy Reference

    Engineering Department Policies and Standards
      Development Department
      Infrastructure Department
        Backup Policies and Backup Recovery Testing
        Change Management
        Disaster Recovery and Disaster Recovery - Databases
        Incident Management
        Production Architecture Page
      Quality Department
      Security Department
        Data Classification Policy
        Data Protection Impact Assessment (DPIA) Policy
        Incident Response Guide
        IllumiDesk Password Policy Guidelines
        Risk Management
        Security Incident Communications Plan
        Security Operations On-Call Guide for Major Incidents
        Third Party Vendor Security Review Procedures
        Vulnerability Management
      Support Team
        Incident Management for Self-Managed Customers
      IllumiDesk Security Practices
        Business Continuity Plan
        Data Team Policies and Standards
        IT Ops Policies and Standards
          Inventory Management
        IT Help Team Policies and Standards
    General Policies and Standards
      Off-boarding Procedures

Framework Mapping

    SOC2 CC
      CCC1.4
      CC2.1
      CC2.3
      CC3.1
      CC3.2
      CC5.1
      CC5.2
      CC5.3
Last modified 1yr ago